Re: New Virus released, can anyone help identify it?
From: Jeff Cochran (jeff.nospam_at_zina.com)
Date: 09/29/04
- Next message: Steven L Umbach: "Re: New Virus released, can anyone help identify it?"
- Previous message: Craig N.: "New Virus released, can anyone help identify it?"
- In reply to: Craig N.: "New Virus released, can anyone help identify it?"
- Next in thread: Steven L Umbach: "Re: New Virus released, can anyone help identify it?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 29 Sep 2004 02:13:00 GMT
First guess is it's actually malware/spyware/etc. Have you looked at
the RUN and RUNONCE keys and removed any reference? Checked the
Startup group?
Jeff
On Tue, 28 Sep 2004 18:08:27 -0700, "Craig N."
<anonymous@discussions.microsoft.com> wrote:
>I am a consultant, and I have had 3 corporate netowrks,
>plus 20 servera t my colo facility nailed with a new
>virus. Virus sacns are not picking it up, and I have the
>latest definitions.
>
>I have identified the culprit service to be LSESS.EXE, not
>LSASS.exe, ans the sasser patch and removal tool does not
>work. ALso, in the system32 folder, I locate the file.
>
>It appears as though this virus just comes right in, not
>through e-mail or surfing. Since some of the machines
>affected are pure gaming servers, and dont have anyone
>accessing the net or receiving e-mail.
>
>Anyways, as far as effects, the first noticeable sign is
>that once you log into 2000, you do not get a desktop, it
>just sits with a blue screen for hours. Then the machine
>starts rebooting constantly.
>
>I performed a format and reinstall of 2000, and got my
>desktop back, but within 2 minutes, I started getting
>svchost errors, and Windows would rebbot after 10 seconds.
>
>I finally did a clean 2003 install, and once again got the
>virus, but it was attacking the RPC,causing a reboot in 10
>seconds. I went into services, and disabled the action
>from reboot machine to take no action for RPC.
>
>I have noticed that if I restrict access to the file
>LSESS.EXE the machines apper to run fine. I have also
>encountered multiple instances of it inthe registry.
>
>It looks like blaster or maybe Sasser, but not exact. It
>also appears t be a widespread infection. I originally
>caught it two days ago, and assumed it was blaster, but
>then it nailed everypne today, and these are all seperate
>corporations, and nothing on the security sites regarding
>it.
>
>Anyways, anyone have any idea what it is?
>
- Next message: Steven L Umbach: "Re: New Virus released, can anyone help identify it?"
- Previous message: Craig N.: "New Virus released, can anyone help identify it?"
- In reply to: Craig N.: "New Virus released, can anyone help identify it?"
- Next in thread: Steven L Umbach: "Re: New Virus released, can anyone help identify it?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
