lsass/rpc shutdown but not sasser ?!?

[dnice]

hi, hopefully someone can help with this, our network has just bombed
pretty bad with lots of machines coming up with and LSA shell message
followed by an lsass, RPC shutdown.

We're scanning the machines in question for Sasser etc and they're
coming up clean. Latest patches from microsoft are applied but
machines still error and shut down.

any ideas ?

thanks in advance.

 

[muttly]

I have had the same error everyone tells you its a virus
or a worm but it isn't

the error i got was lsass.exe nt authorty 1073741819

ended up re installing the server after about 3 days

please let me know if you get it fixed

thx

phil

 

[dnice]

wasn't sasser in the end - another worm called korgo which behaves in
a similar way.

our antivirus wasn't picking it up to start with, despite being up to
date - we're sorting it out now tho.

cheers,

D.