LSASS.exe dataed 12/31/1979?

[Guest]

We recently cleared a sasser infection from our PDC.

I have run every detection and removal tool I could find (McAffee, Norton,
Microsoft) and I am running anti-virus.

IIS is locking up several times a day and I have to run an iisreset to fix
the problem.

I compared a the file LSASS.exe on my PDC to the same file on my BDC (I know
these are NT terms but you get the point) and found the create date to be
from 1979 while on the BDC it is from 2003. I also checked a BDC out in the
field and it is also dated 1979.

What should be the correct date?

Can I replace these files?

How?

Please help

 

[David H. Lipman]

From: "SkiOne" <[email protected]>

| We recently cleared a sasser infection from our PDC.
|
| I have run every detection and removal tool I could find (McAffee, Norton,
| Microsoft) and I am running anti-virus.
|
| IIS is locking up several times a day and I have to run an iisreset to fix
| the problem.
|
| I compared a the file LSASS.exe on my PDC to the same file on my BDC (I know
| these are NT terms but you get the point) and found the create date to be
| from 1979 while on the BDC it is from 2003. I also checked a BDC out in the
| field and it is also dated 1979.
|
| What should be the correct date?
|
| Can I replace these files?
|
| How?
|
| Please help

MS04-011: Security Update for Microsoft Windows
http://support.microsoft.com/default.aspx?scid=kb;en-us;835732

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

 

[Guest]

Thank you very much.

Can you then assume that with the information I have provided that I am
definately being affected by this vulnerability?

 

[David H. Lipman]

From: "SkiOne" <[email protected]>

| Thank you very much.
|
| Can you then assume that with the information I have provided that I am
| definately being affected by this vulnerability?
|

Yes. If LSASS was patched properly then you would not have been infected by the Sasser
Internet worm.