From: "Phisherman" <
[email protected]>
|
| Interesting. Well this week I got the message
|
| Isass.exe - System Error
| Security Accounts Manager initialization failed because of the
| following error: The security ID structure is invalid. Error status:
| 0xC0000078. Please click OK to shutdown this system and reboot to
| Safe Mode , check the event log for more information.
|
| When I tried to reboot to safe mode the machine continued to reboot
| itself. This was on a machine that was recently loaded. Norton
| Antivirus 2003 was also loaded onto it with updated definitions. After
| searching at
www.microsoft.com a page suggested the likely cause is
| the sasser virus. If it is indeed the sasser virus, this proves NAV
| is lame.
The Sasser woem is long since gone. Indeed if it were around it would exploit TCP port 445
and a buffer overflow in the LSASS module. That's LSASS not ISASS and it makes a big
difference !
Now when I say the Sasser is dead, that doesn't mean the exploitation of the LSASS buffer
overflow is as well. The Sasser worm was replaced by numerous other worms that exploit the
vulnerability such as; AGOBot, SDBot, RBot, etc.
Now IF/F it was such an exploit it would generate the following message...
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819
or
NT AUTHORITY\SYSTEM
'c:\winnt\system32\lsass.exe' terminated unexpectedly with status code -1073741819
Even still, the above NT AUTHORITY shutdown in 60 sec. message can be auto-generated by the
OS and have nothing to do with an attempt at exploiting TCP port 445 and the associated
buffer verflow exploitation condition.
