Sasser worm spreading 2

[ChrisHirst]

This has been raised as a medium alert today.

http://vil.nai.com/vil/content/v_125007.htm

It uses the LSASS vunerability;

http://xforce.iss.net/xforce/alerts/id/169

Patch and MS Security Bulletin MSO4-011

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Chris.

Indifference will be the downfall of mankind, but who cares?

 

[BionicJohn]

Hi, Chris,

Many thanks for your posting.

I've been able to clear what ever it was which was closing win2K down after about ten minutes. It gave a warning about C:\winnt\system32\lsasse.exe error and status code 128, and then counted down 60 secs to a reboot.

It wasn't the w32.sasser worm as Norton AV, Stinger and the Symantec removal tool all reported the system as clean.

However the MS Patch and MS Security Bulletin MSO4-011 seemed to do the trick - which I managed to download and run before the system re-booted.

Many thanks/diolch yn fawr.

Iechyd da! John
Glannau Mersi, Lloegr.

 

[nlm9802]

kind of related.. at least to the lsass.exe

if you get the status code 128, check to see what file it can't access (mine was samsvr.dll), use some sort of system recovery tool, and copy the missing dll from a good machine.

this happened to me today.. the port this worm is using is blocked, no infections on the network, just coincidental I guess.. the computer is now working fine, no sign of infection.

 

[GlenJohnson]

Was just notified about this 2 days later.

http://www.microsoft.com/security/incident/sasser.asp

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin check out Tek-Tips in Chicago, Illinois Forum.

TTinChicago

http://www.johnsoncomputers.us