Services Problem

[belhifet]

Hi, I have Windows 2000 Pro SP4 and I'm facing a problem.

I'm using Norton Ghost to restore the system to a good state when I have a problem.

So I just restored to a clean install of Windows 2000 and decided to do some locking-down before I start anything else.

I created two more user accounts, one as a backup to the Administrator account (member of Admins group) and one power user (member of Power Users group).

Then I connected to the internet and I got this lsass.exe "your computer will be shutdown in ...".

The computer restarted and when it asked me to login, I did login as Administrator, but the strange thing was that it took like 1 minute to load the desktop. It just showed a blue screen (the wallpaper, not the BSOD) and the CPU led didn't blink.

I tried with the other accounts as well but I got the same thing.

Then some application needed RPC to run and I went to services.msc to enable it back.

But when I clicked on properties, it was not responding, so I tried to close the services window and then it said something like "Please close the properties tab first". Which I couldn't because I did not see any open properties tab...

So my questions are:

1. What are the limitations of a Power User (the group)?

2. Which service is responsible for this lsass virus? I think it's RPC, but there are 2 RPC there. Which one?

3. Why does it take so long to load?

4. What's that weird problem with not letting me change the status of services and not showing the properties tab?

5. Can you point me to some hardening/locking down win2k tutorial?

[-pops-]

Stinger is the tool to remove the sasser worm (which you have) Download from http://vil.nai.com/vil/stinger/

More details from http://us.mcafee.com/virusInfo/default.asp...;virus_k=125007