Re: Shutdown from NT-AUTHORITY\... = virus/attack?

Ansgar -59cobalt- Wiechers to me:

> > _How_ will he stay connected to WindowsUpdate, etc long enough to
> > download the necessary patches if his machine is connected to a LAN, or
> > straight to the Internet, where LSASS-exploiting malware is running
> > rife?
>
> http://www.ntsvcfg.de/ntsvcfg_eng.html

Brilliant -- most useful link I've seen ages.

I always liked (and still do!) the technical description of resolving 
most of this stuff at:

   http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.en

But for those who don't care about such details (or don't have the time 
to deal with each system service-by-service and port-by-port, this 
"canned" approach is great.

Of course, getting back to the my question, the original victim here 
would still be no better off if he were on a badly infested network and 
did not know the precise location of that URL...    8-)


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854