auto shutdown (nt authority/system)

[chloe]

I AM RUNNING WINDOWS XP AND WHEN I CONNECT TO THE NET A
ERROR MESSAGE COME UP AND SAYS THAT THE SYSTEM IS
SHUTTIND DOWN.

 

[Torgeir Bakken (MVP)]

I AM RUNNING WINDOWS XP AND WHEN I CONNECT TO THE NET A
ERROR MESSAGE COME UP AND SAYS THAT THE SYSTEM IS
SHUTTIND DOWN.

Hi

This could be the caused by a worm (Welchia/Blaster)...

Download and install this one:

MS03-039: Buffer Overrun In RPCSS Service Could Allow Code Execution
http://support.microsoft.com/?kbid=824146

at the same time, you should install the following updates as well:
http://www.microsoft.com/technet/security/bulletin/MS03-043.asp


After you have patched your computer and rebooted, to cleanup the worm that
might already has infected you:

I would recommend that you run a cleanup tool, e.g. Stinger.exe from McAfee,
it removes 30+ virus/worms in one sweep, including all MSBlaster variants
(McAfee name W32/Lovsan.worm), Welchia (McAfee name W32/Nachi.worm)
and Sobig.f

McAfee AVERT Stinger
http://vil.nai.com/vil/stinger/


More here as well
http://www.microsoft.com/security/incident/blast.asp

After this, if you haven't got it already, you should install an antivirus
program and keep the virus signature files updated at all times.

 

[Bruce Chambers]

Greetings --

First of all, please unstick your CapsLock key. Posting in all
caps, as you have done, is the Usenet equivalent of shouting, and is
considered very rude. More importantly, posting in all caps makes the
post very hard to read, further reducing your chances of getting help.

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH