Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Lsass.exe causing shutdown in IE.

  • From: Jeff Workman
  • Date: Sat May 01 17:08:40 2004


--On Saturday, May 01, 2004 4:18 PM -0400 Henry Yen <henry@AegisInfoSys.com> wrote:

On Sat, May 01, 2004 at 03:09:12AM -0500, Ejay Hire wrote:
We're starting to take calls from users about an LSASS.EXE error causing
XP to do the 60 seconds till forced reboot, and the normal blaster
mitigation and turning on the ICF isn't fixing it.  I've been able to
reproduce it on one machine locally.  Is anyone else seeing it?
Sasser (windows) worm.

   http://isc.sans.org/diary.php?date=2004-04-30
This affects Win2k too. I had to deal with it earlier today. It was my experience that after the machine rebooted a few times it would stay up and allow you to remove the offending files and processes, and apply the appropriate patches.

What I like about this worm is that it's extremely easy to identify hosts on your network that are infected. Just run an nmap scan of your network and look for hosts with TCP port 5554 open.

-J

--
Jeff Workman | jworkman@pimpworks.org | http://www.pimpworks.org




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.