NT Authority System---system will shutdown in 60 Seconds

[rollinginownfilth]

I just got this error message and my system did indeed reboot. I've
scanned for viruses and found none. I've also used MS malicious
software removal tool and it found nothing. My question is: Is this
type of error ever not the result of a virus or worm (e.g. Sasser,
Blaster)? Is it ever "normal" to get the error? So far, it's only
happened once, but I'm concerned that I may have a new trojan making
its home in my PC.

Any suggestions?

 

[Haggis]

I just got this error message and my system did indeed reboot. I've
scanned for viruses and found none. I've also used MS malicious
software removal tool and it found nothing. My question is: Is this
type of error ever not the result of a virus or worm (e.g. Sasser,
Blaster)? Is it ever "normal" to get the error? So far, it's only
happened once, but I'm concerned that I may have a new trojan making
its home in my PC.

Any suggestions?

well...it doesn't sound good :>

was that the complete message ? do you have at least SP1 installed ?


read here:

http://www.pchell.com/virus/sasser.shtml

 

[rollinginownfilth]

Unfortunately, I didn't have time to write down the entire message
before my PC rebooted--but it was very similar to what was reported for
Sasser and Blaster worms. I have SP2 installed and did an update less
than a week ago. Windows Firewall is also enabled. Hasn't happened
again--weird.

 

[David H. Lipman]

From: <[email protected]>

| I just got this error message and my system did indeed reboot. I've
| scanned for viruses and found none. I've also used MS malicious
| software removal tool and it found nothing. My question is: Is this
| type of error ever not the result of a virus or worm (e.g. Sasser,
| Blaster)? Is it ever "normal" to get the error? So far, it's only
| happened once, but I'm concerned that I may have a new trojan making
| its home in my PC.
|
| Any suggestions?

To know hat it is you NEED the entire message posted in your reply.

Theere are many NON-viral reasons fior a NT System shutdown.

 

[rollinginownfilth]

Is there a log created when this message appears? When I saw it, my
reaction was "WTF?" and I didn't think to write down the exact message
before my system rebooted. If I can retrieve the message, I will, but
I don't know how to do that (or if it is even possible).

Thanks for any tips!

 

[David H. Lipman]

From: <[email protected]>

| Is there a log created when this message appears? When I saw it, my
| reaction was "WTF?" and I didn't think to write down the exact message
| before my system rebooted. If I can retrieve the message, I will, but
| I don't know how to do that (or if it is even possible).
|
| Thanks for any tips!

No.

We need to see something like...

NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

or

NT AUTHORITY\SYSTEM
Windows must now restart because the Remote Procedure Call(RPC) Service terminated
unexpectedly

You have 60 secs to record the message. It has been done by others, so I think you can do
it too.

 

[rollinginownfilth]

It's not that I'm incapable of recording the message--it's that the
problem has only occurred once and I didn't record the message at the
time. If it happens again, I'll record it. In the meantime, I guess I
can just assume that my system is "okay" for now.

 

[David H. Lipman]

From: <[email protected]>

| It's not that I'm incapable of recording the message--it's that the
| problem has only occurred once and I didn't record the message at the
| time. If it happens again, I'll record it. In the meantime, I guess I
| can just assume that my system is "okay" for now.

Yes.

 

[Steve N.]

From: <[email protected]>

| It's not that I'm incapable of recording the message--it's that the
| problem has only occurred once and I didn't record the message at the
| time. If it happens again, I'll record it. In the meantime, I guess I
| can just assume that my system is "okay" for now.

Yes.

Windows File Protection possibly automatically replaced a corrupted
system file and corrected the problem. I'd still do a thorough virus
scan as I've seen rbot worm varients cause this sort of problem
intermittently lately.

Steve N.

 

[David H. Lipman]

From: "Steve N." <[email protected]>

| Windows File Protection possibly automatically replaced a corrupted
| system file and corrected the problem. I'd still do a thorough virus
| scan as I've seen rbot worm varients cause this sort of problem
| intermittently lately.
|
| Steve N.

The reason I posred...
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

and

NT AUTHORITY\SYSTEM
Windows must now restart because the Remote Procedure Call(RPC) Service terminated
unexpectedly

Is that they are the two types of messages that Internet worms will generate. Since it did
not jar the memory of the OP, I don't think it stems from worm activity.

I may be wrong... The following can be used to determine it..


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.htm#Step_3_%96_Getting_Help


* * * Please report back your results * * *

 

[Steve N.]

From: "Steve N." <[email protected]>

| Windows File Protection possibly automatically replaced a corrupted
| system file and corrected the problem. I'd still do a thorough virus
| scan as I've seen rbot worm varients cause this sort of problem
| intermittently lately.
|
| Steve N.

The reason I posred...
NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

and

NT AUTHORITY\SYSTEM
Windows must now restart because the Remote Procedure Call(RPC) Service terminated
unexpectedly

Is that they are the two types of messages that Internet worms will generate. Since it did
not jar the memory of the OP, I don't think it stems from worm activity.

I may be wrong... The following can be used to determine it..

No argument there at all. I wasn't questioning what you said.

Steve N.