New Sasser variant on the loose? Anyone else?

Has anyone seen a sasser variant that effects Windows 2k3 SP1?

    We have started seeing servers exhibiting the exact same effects that
sasser had back when it was "all the rage" that are completely patched to
the latest "Windows Update" spec before ever touching the non firewalled
internet. Our firewall is about as restrictive as possible.

There are two errors which are similar which evoke the "reboot of death" I
have been seeing these again since Saturday.

"Shutdown was initiated by NT AUTHORITY\SYSTEM
C:\Windows\SYSTEM32\services.exe Status Code -1073741819"

I shortened the above error message, but the perinent parts are there, I
also noticed that sometimes it is lsass and sometimes it is services.exe.

Also, we use ghost to install our operating system, and our ghost image is
current up to the last windows update patch, and I have verified that sasser
is not on our ghost image.

Has anyone seen anything similar?

Thanks,
Andrew

---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Sasser variant that effects 2k3 SP1 completely updated?
    ... Has anyone seen a sasser variant that effects Windows 2k3 SP1? ... We have started seeing servers exhibiting the exact same effects that sasser had back when it was "all the rage" that are completely patched to the latest "Windows Update" spec before ever touching the non firewalled internet. ...
    (Bugtraq)
  • Re: Sasser Worm - Please Help!!
    ... however--I'll re-post Microsoft's recipe for Sasser removal. ... Microsoft has learned about a worm identified as "W32.Sasser.worm" that is ... Windows XP Professional ... sluggish or your Internet connection is slow ...
    (microsoft.public.scripting.virus.discussion)
  • Re: Sasser - unable to login - shutdown in 5 seconds
    ... > Working with a Toshiba notebook - running Windows XP ... It has obviously been infected with the Sasser ... > to install any patches or clean anything. ... When cleaning a machine that is vulnerable to the Sasser worm it is ...
    (microsoft.public.windowsxp.security_admin)
  • Re: XP wont install...hardware or software problem
    ... Then select install and select to delete the current ... How to install Windows XP ... About Sasser and Blaster, from Google ...
    (microsoft.public.windowsxp.hardware)
  • Re: SASSOR WORM
    ... > HOW DO I GET RID OF THE SASSER WORM IN WINDOWS XP ... the Microsoft provided information on the matter can be ... After enabling the Internet Connection Firewall or creating the read-only ...
    (microsoft.public.windowsxp.help_and_support)