Tim,
Today a user brought in his personal laptop and one of our techs ran multiple Sasser removal tools on the laptop to no avail. After looking over it some I noticed what was going on. The laptop had been compromised using a newer version of Gaobot/Phatbot worm which can exploit the LSASS vulnerability. The Sasser removal tools would get rid of the running version of the Sasser worm, but upon reboot it would be back again. This is because at least two additional services had been installed, in my case they were
c:\windows\system32\system.exe
c:\windows\system32\ntmsdata\windows\svchost.exe (This folder held the original files from the attack)
When the system rebooted one of these two services seem to start up Sasser again by pulling a copy from "c:\windows\system32\ntmsdata\windows". The reason this original version wasn't getting snagged by the Sasser removal tool was because the permissions to the folder had been removed.
After restoring the permissions for SYSTEM and Administrators, I was able to remove Sasser and the users A/V was able to get rid of everything else. I then removed the folder that was added by the attack. Sorry for the long email, but I hope it's useful.
________________________________________________
Stephen Bogdanski Network Support, MSU-CVM
Michigan State University [log in to unmask]
A227 VetMed Center Phone: (517) 353-5551
East Lansing, MI 48824 Fax: (517) 432-2937
>>> Tim Potter <[log in to unmask]> 05/05/04 11:10AM >>>
Has anyone had any Win 2000 machines become EXTREMELY sluggish due to one
of these worms (taking 10 min. or so for every single process, mouse click,
etc)? I've run the latest/ greatest removal tools from Symantec for
W32.Sasser.D and done a full scan from a good machine w/ the latest NAV
definitions (5/4) & come up with nothing. An ACNS help desk tech. was
confident that the Sasser worm was causing this sort of problem on other
PCs around campus, but I've only seen others here describe random reboots
so far.
Any thoughts or advice would be appreciated,
Tim
**********************
Tim Potter <><
Information Officer
MSU Alumni Association
E. Lansing, MI 48824
Toll-free: 877/ MSU-ALUM (678-2586)
Ph: 517/432-1160
Fax: 517/432-7769
Stay Connected! www.msualum.com
|
