LsaSrv Error message maybe Sasser

[reinhard]

hello,

One of our machine got some errors with Event ID 5000 and
Event source LsaSrv. Microsoft describes this error in
KB328948. I am not sure if the error comes directly from
Lsass.exe or from Maybe Sasser worm.
A test with the Microsoft tool shows me, that the machine
is not infected with sasser.

I think its an attack from sasser but i am not sure.
Does anyone know, which error messages Sasser produces or
how i can identify it?

Thanks in advance

 

[alex]

Hi there

I am also having the same problem with one of our
servers. However, this has been going on since end of
April, therefore cannot be the Sasser worm (as this
appeared after May 1).
Still no closer to a resolution this end tho. You ?

Alex

 

[Reinhard]

Hi Alex,

I only know that there is a fix for a Lsass.exe Problem
and you only get this hotfix through Microsoft support.
But i am not sure if this is the solution.

The KB was 328948.

Reinhard