NT Authority

[mack]

Before you jump to conclusions, I know that there are
worms that cause NT Authority to shutdown the computer. I
have removed them using SARC's tool and applied
microsoft's patch to protect future exploits of this
flaw. The only problem that I have is, there are several
instanceses of SVCHOST running on the computer. If I end
each one of these I get the NT Authority is shutting down
message. I assume the only two worms are Blaster and
Welchia. If that is the case then I don't (according to
the tools) have the worm anywhere on my computer. So
basically my question is, "Is the action of ending SVCHOST
supposed to bring the system down via NT Authority?"

Thanks

 

[Chris Lanier]

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/?kbid=314056

Why are there so many copies of svchost.exe on my machine?
http://www.ntfaq.com/Articles/Index.cfm?ArticleID=20609

 

[NoNoBadDog!]

You still have a variant of the worm on your computer. SARC's tool only
removes the original variant. You should visit the symantec page and use
their removal tool, as it removes all variants. You will need to turn off
system restore and reboot before doing this, as it can reinfect from a
restore point.

Bobby