NT AUTHORITY QUESTION

[billy woodard]

I RECENTLY RE-INSTALLED WINDOWS ON A CLOANED PC THAT WAS
PURCHASED WITH WINDOWS XP. WINDOWS WILL RUN AND AT
DIFFERENT INTERVALS IN TIME I WILL GET THE FOLLOWING
MESSAGE:

THIS SYSTEM IS SHUTTING DOWN. PLEASE SAVE ALL WORK IN
PROGRESS AND SHUT DOWN. ANY UNSAVED CHANGES WILL BE
LOST. THE SHUT DOWN WAS EVITIATED BY NT AUTHORITY SYSTEM.

 

[Carey Frisch [MVP]]

There are thousands of nasty viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds
the moment an internet connection is established.

Apparently, your computer is infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-------------------------------------------------------------------------------------------------


| I RECENTLY RE-INSTALLED WINDOWS ON A CLOANED PC THAT WAS
| PURCHASED WITH WINDOWS XP. WINDOWS WILL RUN AND AT
| DIFFERENT INTERVALS IN TIME I WILL GET THE FOLLOWING
| MESSAGE:
|
| THIS SYSTEM IS SHUTTING DOWN. PLEASE SAVE ALL WORK IN
| PROGRESS AND SHUT DOWN. ANY UNSAVED CHANGES WILL BE
| LOST. THE SHUT DOWN WAS EVITIATED BY NT AUTHORITY SYSTEM.

 

[Larry Samuels]

You are infected with the blaster worm or one of it's variants.
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.
Kelly's script kills all known variants.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.

--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -