AOH :: HP Unsorted S :: B06-1030.HTM

Sasser variant that effects 2k3 sp1 completely updated?



Sasser variant that effects 2k3 SP1 completely updated?
Sasser variant that effects 2k3 SP1 completely updated?



    Has anyone seen a sasser variant that effects Windows 2k3 SP1?

    We have started seeing servers exhibiting the exact same effects that 
sasser had back when it was "all the rage" that are completely patched to 
the latest "Windows Update" spec before ever touching the non firewalled 
internet. Our firewall is about as restrictive as possible.

There are two errors which are similar which evoke the "reboot of death" I 
have been seeing these again since Saturday.

"Shutdown was initiated by NT AUTHORITY\SYSTEM
C:\Windows\SYSTEM32\services.exe Status Code -1073741819"

I shortened the above error message, but the perinent parts are there, I 
also noticed that sometimes it is lsass and sometimes it is services.exe.

Also, we use ghost to install our operating system, and our ghost image is 
current up to the last windows update patch, and I have verified that sasser 
is not on our ghost image.

Has anyone seen anything similar?

Thanks,
Andrew 


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.