.NET update and virus-like symptoms?

[John]

Installing Microsoft .NET Framework update on 6th August produced virus-like
symptoms: 'This system is shutting down. Please save all work in progress and
log off. Any unsaved changes will be lost. This shutdown was initiated by NT
Authority\ System'; The 60 second countdown notice also showed: 'status code
1073741819' and Lsass.exe.
Rebooting Windows XP home produced a shutdown repitition. Antivirus
programmes did not detect anything - uninstalling the update seems to be the
answer to this problem.

 

[TaurArian]

Sounds like the old "sasser" virus back again
Run this tool: http://support.microsoft.com/?kbid=890830
http://www.microsoft.com/downloads/...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

From memory to stop the shutdown:
Click run and type shutdown -a
then enter
--

TaurArian [MVP] 2005-2010 - Update Services
http://taurarian.mvps.org
======================================
Disclaimer: The information has been posted "as is" with no warranties or
guarantees and doesn't give any rights.

 

[Ken Blake, MVP]

Installing Microsoft .NET Framework update on 6th August produced virus-like
symptoms: 'This system is shutting down. Please save all work in progress and
log off. Any unsaved changes will be lost. This shutdown was initiated by NT
Authority\ System'; The 60 second countdown notice also showed: 'status code
1073741819' and Lsass.exe.

Where did you get this update? It sound very much a non-Microsoft fake
update containing the old Blaster worm.

Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
Processes tab, click msblast.exe and then "End process." Reply "Yes"
to the warning message that comes up.

This stops the worm from running, so your system will not shutdown.
However, it doesn't remove it, and if that's all you do, it will start
up again the next time you boot.

Do a google search on Blaster to find out how to get rid of it.

 

[John]

I think this was a normal system update which was added after seeing the
yellow shield, just .NET Framework - I noticed the problem soon after; I
prevented the shutdowns with the 'shutdown -a' command and found this was
probably a Sasser or Blaster infection as it also disabled sound and turned
the taskbar grey; downloading programmes from Symantec and AVG - I even
installed the AVG suite, as my own PC Tools Antivirus was disabled and
unusable - did not detect any viruses; I also tried an anti-spyware
programme; this led to my thinking it was the Microsoft .Net update; after
uninstalling these updates of 6th August things were back to normal - very
odd.

 

[Ken Blake, MVP]

I think this was a normal system update which was added after seeing the
yellow shield, just .NET Framework - I noticed the problem soon after; I
prevented the shutdowns with the 'shutdown -a' command and found this was
probably a Sasser or Blaster infection

Yes, that's what it sounded like to me, as I said. But if that's the
case, it didn't come with a Microsoft update. Either the update didn't
come from Microsoft as you thought it did, or else the infection had
nothing to do with the update, but was just around the same time.

as it also disabled sound and turned
the taskbar grey; downloading programmes from Symantec and AVG - I even
installed the AVG suite, as my own PC Tools Antivirus was disabled and
unusable - did not detect any viruses; I also tried an anti-spyware
programme; this led to my thinking it was the Microsoft .Net update; after
uninstalling these updates of 6th August things were back to normal - very
odd.

Very odd indeed. But if that's the case, the update that you thought
was a normal Microsoft update can not have been.

 

[John]

Well, thanks for your response. Before removing the updates, I was stumped by
this for hours. I did wonder whether a genuine update might have activated
something dormant on my computer - like most users, I don't have much of an
idea as to how the thing works!

 

[John]

You were right: the PC Tools Antivirus was initially disabled by the
Blaster-like charachteristics, so I replaced this with AVG; thinking the
removal of the .NET updates had done the trick, I re-installed the PC Tools
antivirus - the programme was nolonger disabled, but the problem immediately
returned; I tried an online Trend Micro scan and then installed Avira
antivirus. Replacing PC Tools Antivirus with anything appears to be the
solution - although none detect the Blaster infection.