Re: NT2K systems dying, LsaSrv EventID 5000

From: David Soussan (das_at_DASCOMPUTERCONSULTANTS.COM)
Date: 06/16/05 

Date:         Thu, 16 Jun 2005 09:00:29 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

I didn't send an update to the listserver -- I thought this message was
filtered out by our moderator since I didn't see my original message on the
list until this morning.

Seeing activity on this thread, here is the information from Microsoft... (I
grafted two messages together)

It sounds like some folks hit with this are seeing more damage than we saw.

-----Original Message-----
From: Microsoft Security Response Center
Sent: Monday, June 06, 2005 2:14 PM
To: Microsoft Security Response Center; 'das@dascomputerconsultants.com'
Cc: Microsoft Security Response Center
Subject: RE: New exploit being tested? [sr]

David,

I have the final answer. Your trace captures code using public PoC from
http://www.metasploit.com/projects/Framework/modules/exploits/msasn1_ms04_00
7_killbill.pm but that has been put into the Rbot engine.

Here is the best link to use for the reused exploit code (instead of the
link below): http://www.phreedom.org/solar/exploits/msasn1-bitstring/

[This link was from the original message] Your trace matches other traces we
have on this issue. Our data at this point matches the June 5 entry here:
http://www.viruslist.com/en/weblog.

Let me know if I can be of any other help. We can confirm that the MS04-007
and MS04-011 security updates protect systems from all known ASN and LSASS
based issues, including your report.

Thanks
Scott 

--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--

Relevant Pages

  • Re: kernel crashes inside MV643xx driver
    ... Call trace: ... I searched the webs and found the similar problems: ... MontaVista pays me. ... I never received the original message on netdev or linux-kernel. ...
    (Linux-Kernel)
  • Re: Domain hijacked
    ... includes the headers from the original message you could trace them... ... but in some cases the returning mail server doesn't ...
    (microsoft.public.security)
  • Re: SQL.LOG too big
    ... Since Iam unable to see the original message, Iam not sure what trace you ... check out if ODBC trace is running (run ... ODBC Tracing to SQL.LOG Can Slow SQL Server or Consume All Disk Space ...
    (microsoft.public.sqlserver.server)