Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Microsoft
[Top] [All Lists]

New Sasser variant on the loose? Anyone else?

Subject: New Sasser variant on the loose? Anyone else?
Date: Mon, 13 Mar 2006 14:14:37 -0500
Has anyone seen a sasser variant that effects Windows 2k3 SP1?

    We have started seeing servers exhibiting the exact same effects that 
sasser had back when it was "all the rage" that are completely patched to 
the latest "Windows Update" spec before ever touching the non firewalled 
internet. Our firewall is about as restrictive as possible.

There are two errors which are similar which evoke the "reboot of death" I 
have been seeing these again since Saturday.

"Shutdown was initiated by NT AUTHORITY\SYSTEM
C:\Windows\SYSTEM32\services.exe Status Code -1073741819"

I shortened the above error message, but the perinent parts are there, I 
also noticed that sometimes it is lsass and sometimes it is services.exe.

Also, we use ghost to install our operating system, and our ghost image is 
current up to the last windows update patch, and I have verified that sasser 
is not on our ghost image.

Has anyone seen anything similar?

Thanks,
Andrew

---------------------------------------------------------------------------
---------------------------------------------------------------------------


<Prev in Thread] Current Thread [Next in Thread>