lsass 128 rpc probs!!!

From: Nick (anonymous_at_discussions.microsoft.com)
Date: 05/25/04 

Date: Tue, 25 May 2004 03:41:59 -0700

Alrite,

I think I have a worm on a computer. I am getting the pop-
up that says that Remote Procedure Call has terminated
unexpectedly and was authorised by NT blah,blah,blah...

This usually happens when u have a worm, but the thing
that is confusing me is that it is not happening when
online, it is doing it offline!!! Also, when that RPC pop-
up pops up the usual countdown from 60 to turn off the
computer occurs and it says something about lsass and 128
(think it said port 128).

I thought it was Sasser, but I have run the Symantec
removal tool for Sasser and Blaster with no luck.

Does anyone know what worm it is, or is it a new one.

Thanks

Nick

Relevant Pages

  • Re: What is connected to which?
    ... remove it, or remove symantec, as they conflict with one another. ... firewall, and have found that sometimes the firewall is broken, and ... I've not ever caught sasser so I don't know it well. ... not come back as possitive for the sasser worm. ...
    (microsoft.public.windowsxp.newusers)
  • RE: XP rebooting
    ... sasser virus as sasser is more prevalent these days. ... take these steps to update your software, remove the worm, and help ... To avoid further problems, disconnect from the Internet: ... Step 5: Enable a Firewall ...
    (microsoft.public.security.virus)
  • Re: Sasser - unable to login - shutdown in 5 seconds
    ... It has obviously been infected with the Sasser ... >> worm but I can not keep the system running long enough ... >> to install any patches or clean anything. ... The same thing happens in safe mode ...
    (microsoft.public.windowsxp.security_admin)
  • Re: [Full-Disclosure] Scandal: IT Security firm hires the author of Sasser worm
    ... I don't know about the names of the company and the alleged Sasser worm ... > and seek damages. ... has helped the worm development or spreading. ...
    (Full-Disclosure)
  • Re: Win 2000 error message on Win XP computer
    ... I have had similar problems, but neither Stinger nor FXSasser ... I find this odd as I have signed up for automatic updates (on ... > You've apparently contracted the latest worm, W32.Sasser.Worm, ... > What You should Know about the Sasser Worm and its Variants ...
    (microsoft.public.windowsxp.general)