NT AUTHORITY/SYSTEM

[Morteza Ranjbar]

Hello,
I use Windows XP home edition SP1, I have a problem about
NT AUTHORITY/SYSTEM
It apears most time when I use internet.
The programs which install in my computer are in below:

ACD FotoCanvas 3.0
ACD FotoSlate 3.0
ACDSee 6.0
Adobe Reader 6.0
ACDSee Device Detector 2.0
Nero Enterprise Edition 5.5.10.42
AquaMark3
AVIcodec 1.1.0.4
BitZipper 3.5.1
Cabinet Manager 4.1.0.217
CDCheck 3.0.1.43
FlashGet 1.40
Ghostscript 7.06
Microsoft Office XP
Morgan JPEG2000 ToolBox
MUSICMATCH Jukebox 8.10.0169
Nero 6 Ultra Edition
NeroVision Express 2
Nero Media Player
NiceMC Player
Panda Antivirus Titanium 2.04.04
PowerDVD 5.0
QuickTime Player 6.4
System Mechanic 4.0c Professional
THOMSON mp3PRO Audio Player 1.1.0
Total Commander 5.10
VCDCutter 4.11
WinRAR 3.20
XingMPEG Player 3.30
XingMPEG Encoder 2.20

and Microsoft Programs are:
Windows Media Player 9.00.00.2980
Internet Explorer 6.0 update version Q828750
Windows Movie Maker 2.0.3312.0

and all of my device drivers and the BIOS version and
firmware of all devices were updated.

most time when I use the Internet(DialUp Connetion
33.6kbps) I have this problem
and The message which is shown at below occured:
"This system is shutting down please save all works in
progress and logoff. any unsaved changes will be lost
this shutdown was initiated by NT AUTHORITY/SYSTEM"
and it says that shut down your computer in one minute.
(Problem1)


and my other problem is in use of "XingMPEG Player version
3.30" when I install this
program in Windows XP Home Edition Sp1, the thumbnails of
File of type
supproted by this program isn`t shown from Windows in its
folder and the icon of
file type is shown in thumbnails. for Example "MPG" is
the extension of Supported
"XingMPEG Player version 3.30" File types and This MPG
video File thumbnail
isn`t shown from Windows in its folder.(Problem2)

thank you for support.
Morteza Ranjbar

 

[dev]

Morteza Ranjbar said:

I use Windows XP home edition SP1, I have a problem about
NT AUTHORITY/SYSTEM
Most time when I use the Internet(DialUp Connection
33.6kbps) I have this problem
and The message which is shown at below occured:
"This system is shutting down please save all works in
progress and logoff. any unsaved changes will be lost
this shutdown was initiated by NT AUTHORITY/SYSTEM"
and it says that shut down your computer in one minute.

Before posting it's always wise to search this group. "NT Authority" or
"remote" reveals dozens of tips and links that will eradicate this worm.
Or search for "blaster" at http://google.com

 

[Kevin]

You are most likely infected with the blaster.exe virus or one of the
variants. As to your second problem, I can't help you.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH