Re: 100% cpu usage for LSASS.EXE on DC intermittently, consistent

"Phillip Windell" wrote:
> You don't. You must scan for them with decent AV Software. If you are not
> runnig with that kind of protection in a school environment already to begin
> with you are being suicidal. School networks are the worst networks on
> Earth for being a virus haven, a spyware haven, and about everything else
> that is bad on a network.
>

Phillip, an important comment, but you missed the point. We ARE running AV
software on our clients. However, it only takes one client (mis-configured,
un-configured, never configured) to be a source for a WORM as you well know.

You may be hinting that I need to install AV software on my DC's, however, I
don't know that Microsoft supports DC's with AV installed. Also, I'm not
sure AV software would detect a WORM intrusion attempt. That seems more like
the work of Firewall or IDS software.

Again, I don't believe the DC's themselves are contaminated, one of them is
just being attacked (or at least unusually accessed). I'd love to believe
that if the source was one of the campus (or remote campus) PCs that it would
have AV installed and that the user was also competent to note the infection.
But since I don't maintain those thousands of desktops, their is no way I
can confirm they are all clean or the users are all competent.

What I do know is that something is sending something to one of my DCs. I'm
hoping that an MS representative reads this thread and leads me in the right
direction.

I'm sure DCs are susceptable to this in any large organization and the
Microsoft is aware of this. Otherwise they wouldn't have added the Firewall
option to SP1 in W2k3. - bill


.

Relevant Pages

  • Re: Boot virus & root kit?
    ... Overwrite track 0 on ALL drives installed in the computer. ... Physically disconnect the computer from any networks ... Install Windows XP with SP2. ...
    (microsoft.public.windowsxp.general)
  • Re: Setting Up a Network on W2000
    ... It appears that when you click install all drivers with their CD, it has something else in mind. ... Print Sharing and the Client for Microsoft Networks then ... Wayne Watson (Nevada City, CA) ...
    (microsoft.public.win2000.networking)
  • Re: OMEGAMON XE for Mainframe Networks
    ... don't install them. ... with IBM and pounding on them until they got the issues resolved. ... We have abandoned everything except the Mainframe for Networks ... If you have received this electronic mail message in error, ...
    (bit.listserv.ibm-main)
  • [SLE] My experience with 10.0/10.1 (long)
    ... I've been a SuSE fan since 9.0. ... have a Samba server activated, ... the inability to set up networks during the install, ... couldn't set up networks during the install. ...
    (SuSE)
  • Re: Should I just dump ISA and buy a PIX ??
    ... Routing & Remote Access and rely on just ISA routing instead? ... I may install ethereal tomorrow and see what packets are being dropped, ... in ISA2000) networks; it doesn't "announce" anything. ...
    (microsoft.public.isaserver)