R
Robert J. Rando
David,
I'm running in SAFE MODE. I'm trying to execute Start, Run, Shutdown -a
precisely at the time I get the error message but I'm getting locked out of
the start/run command line once the error message comes up. I can't get the
system to stay running for me for more than 10 minutes. This is getting very
frustrating as I can't get any of the MULTI_AV exe files to run for more
than 10 minutes. You have been extremely helpful and I am computer savvy but
I just can't seem to get past 1st base with this one.
Also, how do I specifically block the UDP and TCP ports you reference? I do
have an Etherfast Cable/DSL Router.
Bob
----- Original Message -----
From: David H. Lipman
To: (e-mail address removed)
Sent: Sunday, December 25, 2005 8:12 PM
Subject: Fw: LSASS.EXE Terminated Unexpectedely Code 1073741819
From: David H. Lipman
Newsgroups:
microsoft.public.windowsxp.device_driver.dev,microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.security.virus
Sent: Sunday, December 25, 2005 10:05 PM
Subject: Re: LSASS.EXE Terminated Unexpectedly Code 1073741819
From: "Robert J. Rando" <[email protected]>
| HELP!! System Shutting down after 10 min with "LSASS.EXE Terminated
| Unexpectedly with status Code 1073741819". I've run the Microsoft
Malicious
| Software tool and it doesn't detect the W32.Sasser.E.Worm. I've tried the
| Symantec tool as well but the system shuts down before it is complete.
I've
| compared this to my other system and the Registry entries for LSASS.EXE
are
| exactly the same. My other system is fine. I have tried virtually every
| suggestion I have found on the Web and still no resolution.
|
| Any suggestions? Bob
|
Way too many News Groups !
There are anti virus News Groups specifically for this type of discussion.
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus
One of the above and microsoft.public.windowsxp.general is all that this
should have been
posted too ! Theefore I have set Follow-ups to those two News Groups.
The following are certainly symptoms of a LSASS buffer overflow exploit via
TCP port 445.
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status
code -1073741819
or
NT AUTHORITY\SYSTEM
'c:\winnt\system32\lsass.exe' terminated unexpectedly with status
code -1073741819
However, one can NOT assume Sasser. There are several Internet worms now
actively taking
advantage of this vulnerability. Most notable are the SDBot/RBot worms
W32/Sasser.worm.a -- http://vil.nai.com/vil/content/v_125007.htm
W32/Reatle.f@MM -- http://vil.nai.com/vil/content/v_135722.htm
W32/Gaobot.worm.gen -- http://vil.nai.com/vil/content/v_100785.htm
Qhosts.apd -- http://vil.nai.com/vil/content/v_124880.htm
W32/Plexus.b@MM -- http://vil.nai.com/vil/content/v_126167.htm
W32/Sdbot.worm!ftp -- http://vil.nai.com/vil/content/v_128082.htm
W32/Mytob.gen@MM -- http://vil.nai.com/vil/content/v_132158.htm
W32/Radebot.worm -- http://vil.nai.com/vil/content/v_132018.htm
{ W32/Radebot.worm, W32/Mytob.gen@MM & W32/Sdbot.worm!ftp will all exploit
both LSASS and
the RPC/RPCSS DCOM vulnerabilities }
To mitigate the LSASS module buffer overflow vulnerability one needs to
install the
following Microsoft LSASS for WinXP KB835732 --
http://www.microsoft.com/downloads/...9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en
One can execute the 'shutdown -a' command line to stop the 60 second
countdown and effect
the installation of the patch. Additionally disconnecting the PC from the
Internet will
keep such an attack from happening and allow the installation of the patch.
When you get the (attached) NT Shutdown message with the 60 sec.
countdown...
Go to; Start --> Run
enter; shutdown -a
It should also be noted that just becuase one gets the (attched) LSASS
shutdown message, it
does NOT mean that one is infected. It means that TCP port 445 is under
attack by
attempting to exploit the buffer overflow vulnerability. A non-vulnerable
system will not
exhibit the (attached) NT Shutdown message.
One *must* use a FireWall and patch their systems to prevent such an
exploitation.
If one is on Broadband a Cable/DSL Router such as the Linksys BEFSR41 can
greatly mitigate
such a threat even if LAN nodes are not fully patched. Specifically
blocking both TCP and
UDP ports 135 ~ 139 and 445 will completely mitigate and of the worms or
hackers trying to
take advantage of MS Networking ports using TCP/IP.
The following tool can be used to find and remove any of the known Internet
worms that will
exploit the vulnerability and should be used ASAP.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in
Normal Mode.
This way all the components can be downloaded from each AV vendor's web
site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot
the PC.
You can choose to go to each menu item and just download the needed files or
you can
download the files and perform a scan in Normal Mode. Once you have
downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe
Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to
run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm
* * * Please report back your results * * *
I'm running in SAFE MODE. I'm trying to execute Start, Run, Shutdown -a
precisely at the time I get the error message but I'm getting locked out of
the start/run command line once the error message comes up. I can't get the
system to stay running for me for more than 10 minutes. This is getting very
frustrating as I can't get any of the MULTI_AV exe files to run for more
than 10 minutes. You have been extremely helpful and I am computer savvy but
I just can't seem to get past 1st base with this one.
Also, how do I specifically block the UDP and TCP ports you reference? I do
have an Etherfast Cable/DSL Router.
Bob
----- Original Message -----
From: David H. Lipman
To: (e-mail address removed)
Sent: Sunday, December 25, 2005 8:12 PM
Subject: Fw: LSASS.EXE Terminated Unexpectedely Code 1073741819
From: David H. Lipman
Newsgroups:
microsoft.public.windowsxp.device_driver.dev,microsoft.public.windowsxp.general,microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.perform_maintain,microsoft.public.security.virus
Sent: Sunday, December 25, 2005 10:05 PM
Subject: Re: LSASS.EXE Terminated Unexpectedly Code 1073741819
From: "Robert J. Rando" <[email protected]>
| HELP!! System Shutting down after 10 min with "LSASS.EXE Terminated
| Unexpectedly with status Code 1073741819". I've run the Microsoft
Malicious
| Software tool and it doesn't detect the W32.Sasser.E.Worm. I've tried the
| Symantec tool as well but the system shuts down before it is complete.
I've
| compared this to my other system and the Registry entries for LSASS.EXE
are
| exactly the same. My other system is fine. I have tried virtually every
| suggestion I have found on the Web and still no resolution.
|
| Any suggestions? Bob
|
Way too many News Groups !
There are anti virus News Groups specifically for this type of discussion.
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus
One of the above and microsoft.public.windowsxp.general is all that this
should have been
posted too ! Theefore I have set Follow-ups to those two News Groups.
The following are certainly symptoms of a LSASS buffer overflow exploit via
TCP port 445.
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status
code -1073741819
or
NT AUTHORITY\SYSTEM
'c:\winnt\system32\lsass.exe' terminated unexpectedly with status
code -1073741819
However, one can NOT assume Sasser. There are several Internet worms now
actively taking
advantage of this vulnerability. Most notable are the SDBot/RBot worms
W32/Sasser.worm.a -- http://vil.nai.com/vil/content/v_125007.htm
W32/Reatle.f@MM -- http://vil.nai.com/vil/content/v_135722.htm
W32/Gaobot.worm.gen -- http://vil.nai.com/vil/content/v_100785.htm
Qhosts.apd -- http://vil.nai.com/vil/content/v_124880.htm
W32/Plexus.b@MM -- http://vil.nai.com/vil/content/v_126167.htm
W32/Sdbot.worm!ftp -- http://vil.nai.com/vil/content/v_128082.htm
W32/Mytob.gen@MM -- http://vil.nai.com/vil/content/v_132158.htm
W32/Radebot.worm -- http://vil.nai.com/vil/content/v_132018.htm
{ W32/Radebot.worm, W32/Mytob.gen@MM & W32/Sdbot.worm!ftp will all exploit
both LSASS and
the RPC/RPCSS DCOM vulnerabilities }
To mitigate the LSASS module buffer overflow vulnerability one needs to
install the
following Microsoft LSASS for WinXP KB835732 --
http://www.microsoft.com/downloads/...9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en
One can execute the 'shutdown -a' command line to stop the 60 second
countdown and effect
the installation of the patch. Additionally disconnecting the PC from the
Internet will
keep such an attack from happening and allow the installation of the patch.
When you get the (attached) NT Shutdown message with the 60 sec.
countdown...
Go to; Start --> Run
enter; shutdown -a
It should also be noted that just becuase one gets the (attched) LSASS
shutdown message, it
does NOT mean that one is infected. It means that TCP port 445 is under
attack by
attempting to exploit the buffer overflow vulnerability. A non-vulnerable
system will not
exhibit the (attached) NT Shutdown message.
One *must* use a FireWall and patch their systems to prevent such an
exploitation.
If one is on Broadband a Cable/DSL Router such as the Linksys BEFSR41 can
greatly mitigate
such a threat even if LAN nodes are not fully patched. Specifically
blocking both TCP and
UDP ports 135 ~ 139 and 445 will completely mitigate and of the worms or
hackers trying to
take advantage of MS Networking ports using TCP/IP.
The following tool can be used to find and remove any of the known Internet
worms that will
exploit the vulnerability and should be used ASAP.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in
Normal Mode.
This way all the components can be downloaded from each AV vendor's web
site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot
the PC.
You can choose to go to each menu item and just download the needed files or
you can
download the files and perform a scan in Normal Mode. Once you have
downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe
Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to
run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm
* * * Please report back your results * * *