system shutting down when online!

[Ashis Banerjee]

dear friends,
i have been using windows xp for the past
two years. but recently i am facing a problem whenever i
am connected to the net a aplash up screen comes up
displaying the message that the system will shut down
within 60 seconds and urging to save all my documents.
something related to rpc services is also displayed.
after 60 seconds the system automatically shuts down. I
have also installed windows 98 in my machine but there is
no such problem.
can anyone suggest any remedy?
ashis!!!!!

 

[Lanwench [MVP - Exchange]]

Could be sasser, blaster, or a variant. Means, you don't have your firewall
enabled (tsk tsk tsk) and haven't run Windows Update regularly to get all
critical patches. Never connect to the Internet without a firewall in place
to protect you - not even for a second. Win9x, for all its faults, isn't
susceptible to these particular viruses.

For WinXP: If you can't stop your computer from restarting:

As soon as your computer reboots and Windows loads, click Start, then Run.
In the box, type the following:

shutdown -a (then click OK)

Enable your firewall ASAP!

Then see http://www.microsoft.com/security/incident/sasser.asp and
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

McAfee's Stinger tool to remove Sasser: http://vil.nai.com/vil/stinger/

Note that even if this isn't Sasser, Stinger should be able to get rid of
it.

MS removal tool for Windows 2000 SP2 and up, or Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

Enable your XP firewall (or get a third party one if not on XP or even if
so - www.zonealarm.com has a free one) and run Windows Update regularly to
keep your OS patched to the gills. You also need good antivirus software and
need to keep it updated regularly. As mentioned, the patch for this exploit
was released April 13th...but there are plenty you do need. Perhaps want to
enable the autoupdate feature of Windows Update and subscribe to the
security bulletin announcements at www.microsoft.com/security.

 

[NoNoBadDog!]

Congratulations!



Your system is infected with the much publicized Sasser worm. You have
allowed
yourself to become infected because of ALL of the following;


1. You have not updated your version of Windows.

2. You are not using an UP TO DATE antivirus program.

3. You connected to the internet without a firewall on your computer.

Until you correct ALL of the above situations, you will remain vulnerable to
infection not only by SASSER, but also by the thousands of other worms,
viruses, trojans, keyloggers, spyware, malware, etc.

Because you do not practice even the most basic level of computer security,
you are not only a threat to yourself but to the entire internet community.
When your machine is infected, it looks for other machines, owned by persons
like yourself who have poor computer security practices, to infect.

First, disconnect from the network.


When the shutdown message appears, go START > Run and type in "shutdown -a"
(without the quotes), and hit the enter key.

Download the Windows critical update and the SASSER removal tool.here are
the

links..



Security Update:



http://www.microsoft.com/downloads/...9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en





and the SASSER removal Tool:



http://www.microsoft.com/downloads/...7E-1B6B-4FC3-90D4-9FA42D14CC17&displaylang=en


After rebooting, go to the website of the company that makes your antivirus
program and download all the updates that are available. If your antivirus
has expired, you must
purchase a new one.
Third, go to www.zonealarm.com and download the FREE firewall.
Keep your version of Windows updated. Always install any critical patches
that are posted to the Microsoft update website.

Keep you antivirus program up to date. New virus detection signatures are
released nearly on a daily basis, so this is something you should do every
day. Not once a month, or "when I have time", or "when I remember".

Once you have done these things, you will find your internet experience to
be much safer and happier.


Bobby

 

[Ovidiu Popa]

Sasser worm or anything similar, acting on your machine's RPC.

Disinfection required - tools at www.symantec.org or
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

Ovidiu Popa
MVP