Lsass.exe and Lssas.exe

[ndavies]

Found both of these in our WINNT/System32 folder. The Alerter service on our DC appears to be pointed to Lssas.exe. The Alerter service on our replica points to SCVHost.

A bit of research looks like the Lssas.exe is a nasty piece of work and shouldn't be there. A trojan variant of GrayBird.

Should Alerter be using SCVHost as opposed to the proper Lsass.exe?

We're also completely unable to ping our DC. It tells us it's connected to the switch fine, the switch says its fine yet we can't reach it?! Any suggestions. It has a fixed IP and being the DC has all the DNS and DHCP stuff on it.

Ta

Nick "head scratching" Davies

[Geoff]

On W2k3 SP2:

C:\WINDOWS\system32\svchost.exe -k LocalService

[ndavies]

turns out someone has loaded several services onto our dc to do with the counterstrike game. we've actually this morning just caught a remote user on it, trying to install more services and transferring stuff via an open ftp connectoin......first thing..pull the plug!

dear oh dear.

[Geoff]

So your network has been compromised?

[ndavies]

Looks like it. We're working through cleaning it up offline. But how can we ever be sure...there's so many processes running!

[Geoff]

You can't. You must rebuild your systems from known good backups and/or scratch. Also, contact your LEAs audit department. They have people for helping you with this.