nt authority\system

[mike]

After being on the internet for a few minutes i get a
system shutdown message < initiated by nt
authority\system' . Can anyone help.

 

[Will Denny]

Hi

Your system has been infected by the Blaster Worm. Have a look at the
following links:

www.kellys-korner-xp.com/xp_qr.htm#rpc

Courtesy of MVP Kelly Theriot.

"Virus Alert About the Blaster Worm and Its Variants"
http://support.microsoft.com/?id=826955

"What You Should Know About the Blaster Worm and Its Variants"
http://www.microsoft.com/security/incident/blast.asp

--

Will Denny
MS-MVP Windows - Shell/User


| After being on the internet for a few minutes i get a
| system shutdown message < initiated by nt
| authority\system' . Can anyone help.

 

[Lanwench [MVP - Exchange]]

Sounds like you have the Blaster worm or a variant - which indicates that
you a) didn't enable your firewall (do so ASAP) and b) haven't been running
windows update to get all critical updates (do this regularly). Also, make
sure you have good antivirus software running on your PC and keep it updated
regularly.

See http://www.newtechhelp.com/content/view/10/25/ for info on how to remove
Blaster/Welchia.

 

[Malke]

After being on the internet for a few minutes i get a
system shutdown message < initiated by nt
authority\system' . Can anyone help.

You have the MSBlaster worm or variants. Take the infected machine off
the Internet and any lans immediately. From a different, uninfected
computer go to:

http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.html

and read all about how to fix this. After your computer is clean, buy a
current antivirus, install it, and keep it up to date. Be sure to go to
Windows Update regularly to keep your system patched.

Malke

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Guest]

http://securityresponse.symantec.com/avcenter/FixBlast.exe

That's all you need to do...