LSASS buffer overflow

ive done some research, determined that this is the problem that has been raping my computer. Although I dont think the attacker has done anything mailicious (besides causing a system reboot every ten minutes ) im getting the patches, following all the reccomendations that i read on various websites, but i cant help but think if the attacker received any kind of personal or sensitive information. can anyone help? and not surprisingly, the microsoft firewall didnt pick it up :mad: so i put zone alarm on. ill give a couple links if you all want a good read. im using win xp pro.

link
http://www.eeye.com/html/Research/Ad...20040413C.html
http://securityresponse.symantec.com...ent/10108.html
http://vil.nai.com/vil/content/v_125007.htm

Hi

Thanks to NeuTron I had today a real good read[1]
about the your topic.

The Microsoft Firewall does log what you tell him to log.
A log reader can be found here [2].
Zone Alarm does not just give you better information.
Especially you should use windump[3] (or similar stuff) to
check in detail what the attacker has received - however,
now it is too late anyway :D

But maybe for next time, you will be well prepared
(sorry, should not be sarcastic ;) )


[1] http://www.giac.org/practical/GCIH/S...nnedy_GCIH.pdf
[2] http://www.winxpcentral.com/windowsxp/fwlog.php
[3] http://windump.polito.it/install/default.htm

Er...... Patching might help..... This was addressed in 04-11.....

Quote:

---

Issued: April 13, 2004
Updated: August 10, 2004
Version: 2.1

---

Then again a firewall would have prevented it..... Actually, it would have stopped it dead.....

thanks for the replies. actually tiger shark, im using my laptop and it had never been connected to the internet before. so i plugged it in, dialed away, and not fifteen minutes later the buffer overflow occured. now i do have zone alarm and closed just about every port i dont need. i also patched up my laptop. ill just have to add this to my lessons learned the hard way list :)

Wow, does this sound familiar. A few months ago I had a similar problem. I re-installed xp on my laptop and took a quick trip to the library (I was offline at the time). While there i deceided to slip in my wireless card (i didn't know if the library had wireless at that time), and it instantly put me online. So I was just pissing around online and within 5 minutes of being online I was infected by blaster.

So after this I picked up zone alarm and NAV2k4. This made it possible for me to actually patch my laptop before getting infected.

Now, I have official microsoft update CDs (sp1a and sp2). But more importantly I have slip streamed sp2 into an XP install CD, and it also installs a bunch of drivers and programs. If you want to also setup an xp cd like this, here's a great guide:
http://unattended.msfn.org/