LSASS_EXPLOIT

[Guest]

Hi There

I have just purchased and installed the latest PC-cillin Internet Security
for my PC.

It keeps telling me it has blocked a virus titled MS04_LSASS_EXPLOIT. It
suggests I run a scan and activate the emergancy lock. I don't know how to
fix this. I have all the current MS updates and my internet security is
running on the most current version.

ANy suggestions?

 

[TaurArian [MVP]]

http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VName=MS04-011_LSASS_EXPLOIT
Have a look at the above article

http://www.google.com.au/search?hl=...SASS+exploit&as_q=PC-cillin+Internet+Security

 

[David H. Lipman]

From: "Penny C" <[email protected]>

| Hi There
|
| I have just purchased and installed the latest PC-cillin Internet Security
| for my PC.
|
| It keeps telling me it has blocked a virus titled MS04_LSASS_EXPLOIT. It
| suggests I run a scan and activate the emergancy lock. I don't know how to
| fix this. I have all the current MS updates and my internet security is
| running on the most current version.
|
| ANy suggestions?

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

What you are experiencing is exploit code trying to infect your PC via TCP port 445 which is
how the various LSASS exploit infectors "worm" their way into a system via exploiting a
buffer overflow vulnerability in the OS.

If you are connected to Broadband there in Australia such as cable or DSL then I suggest
getting a Cable/DSL Router such as the Linksys BEFSR41. Then these exploitations will be
stopped at the Router and you will not be bothered by these annoying messages on the PC.

The thing to focus on is that Trend Micro blocked the Internet worm exploit code from
infecting the PC.