TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Andrew on August 25, 2004, 11:05:36 PM

Title: MS_Windows_LSASS_RPC_DS_Request
Post by: Andrew on August 25, 2004, 11:05:36 PM

Hello,

I have Norton Internet Security 2003 installed. I run Windows XP Home Edition SP1.  I repeatedly get a msecurity alert from Norton that it has detected and blocked an intrusion attempt. The intruder is my computer and my IP address.  The Intrusion is a MS_Windows_LSASS_RPC_DS_Request. It attacks the microsoft-ds(445) port.

I have ran a virus scan and nothing comes up.  I have also patched the pc from the links provded on Symantec's site at: http://securityresponse.symantec.com/avcen...DS_Request.html (http://\"http://securityresponse.symantec.com/avcenter/attack_sigs/sigs/MS_Windows_LSASS_RPC_DS_Request.html\")

I have also ran Ad-Aware to get rid of any data mioners and other such junk.  I have a program a2 (A-Squared) to look for Malware, but nothing comes up.  Yet I still get the intrusion alert.  

Several questions:
1.  Could these programs be missing something?  (NOrton and the anti-malware software all missed another .exe on my pc called dickface8932.exe once which I had to delete from the systems folder and a registry entry.)

1a.  If so does any one have any info on what this problem is and how to fix it?

2.  If this is not a malware or some sort of virus, what is it and how can I fix the thing so the alert does not come up every few seconds?

Thanks for any help or info.

Title: MS_Windows_LSASS_RPC_DS_Request
Post by: Guest on September 26, 2004, 03:24:24 AM

that is not a virus
a hacker is trying to acces your computer
that is an exploit
try to download the patch from ms

Title: MS_Windows_LSASS_RPC_DS_Request
Post by: Jam Handy on January 27, 2005, 10:06:33 AM

You'll find a lot of info on this on the Symantec site.  They also give a link to the Microsoft page where you can download the patch to prevent this intrusion.

The Symantec site is here:
http://securityresponse.symantec.com/avcen...DS_Request.html (http://\"http://securityresponse.symantec.com/avcenter/nis_ids/sigs/MS_Windows_LSASS_RPC_DS_Request.html\")

They have listed the vulnerable operating systems on this page, and have given links to each one by OS and by service pack number.

Jam Handy

Title: MS_Windows_LSASS_RPC_DS_Request
Post by: dave on January 28, 2005, 04:55:52 PM

hi there im having the same security threat from this ms_windows_lsass_rpc_ds_request
the problem is im using windows xp sp2 and on the link to the symantec website doesnt seem to have a patch for xp service pack2,could anyone advise where i could get a patch for sp2,thanks

Title: MS_Windows_LSASS_RPC_DS_Request
Post by: silvana on February 02, 2005, 03:22:08 AM

I am also having the same problem with the windows xp sp2. I had 58 attacks from MS_Windows_LSASS_RPC_DS_Request and the MS_RPC_DCOM_Buffer_Overflow on Jan 31st. I haven't been able to locate a patch for the MS_RPC_DCOM_Buffer_Overflow at all and there wasn't a patch for the other one for Windows sp2. Please let me know of anything if you find it. Thanks.