Random Shutdown - NT authority\system?

[George Gosbee]

Hello all,

Another problem,

I keep getting a random shutdown caused by NT
authority\system and or svchost.exe, anyone out there have any ideas what's
causing this. It can occur whilst its booting up the desktop or it can say
quiet for 10's of minuets.

TIA George.

 

[S.Sengupta]

Hi!George!
Download the MS03-026 patch from Microsoft.

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

http://www.bigblackglasses.com/Article.aspx?Article=342
http://www.microsoft.com/security/incident/blast.asp

Worm Removal:
************
From Symantec: W32.Baster.Worm is exploiting the vulnerabilities of the
RPC interface.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

From McAfee:
http://vil.nai.com/vil/content/v_100547.htm
http://vil.nai.com/vil/content/v_100516.htm

Sophos:
http://www.sophos.com/virusinfo/analyses/w32blastera.html

regards/
ssg MS-MVP
pronetworks.org

 

[R. C. White]

Hi, George.

Sorry! Sounds like you have the Blaster worm. :>(

Here are the official instructions for what to do now:

Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955

RC

 

[Bruce Chambers]

Greetings --

If you've connected the PC to the Internet without having first
enabling a firewall, without having first installed an antivirus
application with current virus definition files, and/or before
installing the KB824146 Hotfix, you're very likely to have been
infected from any of the thousands of PCs on the Internet that are
constantly broadcasting the Blaster and/or Welchia worms. It only
takes a few seconds of exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[P Diddy]

Hi,

If you've connected the computer to the net without having first
enabling a firewall, without having first installed an antivirus
application with current virus definition files, and/or before
installing the KB824146 Hotfix, you might be infected from any
of the thousands of PCs on the Internet that are
constantly broadcasting the Blaster and/or Welchia worms...doesn't take long
to get it..

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Here are some links:

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger