Re: NT2K systems dying, LsaSrv EventID 5000

I didn't send an update to the listserver -- I thought this message was
filtered out by our moderator since I didn't see my original message on the
list until this morning.

Seeing activity on this thread, here is the information from Microsoft... (I
grafted two messages together)

It sounds like some folks hit with this are seeing more damage than we saw.

-----Original Message-----
From: Microsoft Security Response Center 
Sent: Monday, June 06, 2005 2:14 PM
To: Microsoft Security Response Center; '[email protected]'
Cc: Microsoft Security Response Center
Subject: RE: New exploit being tested? [sr]

David,

I have the final answer. Your trace captures code using public PoC from
http://www.metasploit.com/projects/Framework/modules/exploits/msasn1_ms04_00
7_killbill.pm but that has been put into the Rbot engine.

Here is the best link to use for the reused exploit code (instead of the
link below): http://www.phreedom.org/solar/exploits/msasn1-bitstring/

[This link was from the original message] Your trace matches other traces we
have on this issue.  Our data at this point matches the June 5 entry here:
http://www.viruslist.com/en/weblog.

Let me know if I can be of any other help. We can confirm that the MS04-007
and MS04-011 security updates protect systems from all known ASN and LSASS
based issues, including your report.

Thanks
Scott

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--