xp nt authority shut down

[colleen]

everytime we log onto the internet about 5 min later we
get the message nt authority system has encountered a
problem and will shut down system. have tried windows
downloads etc, cannot fix problem. any ideas email @
(e-mail address removed) thanx alot

 

[David H. Lipman]

Go to; Start --> Run
enter; shutdown -a

This will halt the shutdown and give you a chance to Download the McAfee worm removal tool,
Stinger: http://vil.nai.com/vil/stinger/ or the Microsoft Lovsan/Blaster and Nachi/Welchia
Removal Tool
http://www.microsoft.com/downloads/...8B-FE98-493F-AD76-BF673A38B4CF&displaylang=en
and install the following patch for the RPC/RPCSS Buffer Overflow Vulnerability that is
addressed by Microsoft Security Bulletin MS03-39 http://support.microsoft.com/?kbid=824146

Please read: http://www.microsoft.com/security/incident/blast.asp

You also need a FireWall. If you don't patch the PC and not use a FireWall then you will
just be re-infected.

I also suggest the installation of *ALL* MS Critical Updates ASAP.

In addition:
If you post to UseNet with your TRUE, not a munged, email address then you have invited the
Swen Internet worm [aka; W32/Gibe-F] to visit you.

The Swen is news spelled backwards. The reason it is called this is because the Swen worm
harvests email addresses from UseNet News Groups. It has an engine that allows it to post
itself to UseNet News Groups as well as it has its own email engine. From the list of
email addresses that it has harvested, it will then email itself to those addresses.

Dave



| everytime we log onto the internet about 5 min later we
| get the message nt authority system has encountered a
| problem and will shut down system. have tried windows
| downloads etc, cannot fix problem. any ideas email @
| (e-mail address removed) thanx alot

 

[Guest]

-----Original Message-----
everytime we log onto the internet about 5 min later we
get the message nt authority system has encountered a
problem and will shut down system. have tried windows
downloads etc, cannot fix problem. any ideas email @
(e-mail address removed) thanx alot
.

i have the same problem, did you get a fix yet ?

 

[John Stockdyk]

It looks like you have a very old virus called Blaster. Read what M$
says here:

http://www.microsoft.com/security/incident/blast.asp

There is a section called "How to Tell If the Worm Is Affecting Your
Computer" and your PC shows the typical symptoms!

HTH

 

[David H. Lipman]

Try reading my reply to the OP !

Dave



|
| >-----Original Message-----
| >everytime we log onto the internet about 5 min later we
| >get the message nt authority system has encountered a
| >problem and will shut down system. have tried windows
| >downloads etc, cannot fix problem. any ideas email @
| >[email protected] thanx alot
| >.
| >
|
| i have the same problem, did you get a fix yet ?

 

[David H. Lipman]

Very Old ?

NYB, Monkey and Jerusalem.B are old. The Lovsan/Blaster hit around Aug '03.

But, Hey, what do you know, you are posting with your true email address so the Swen
Internet worm can visit you.

Dave



| It looks like you have a very old virus called Blaster. Read what M$
| says here:
|
| http://www.microsoft.com/security/incident/blast.asp
|
| There is a section called "How to Tell If the Worm Is Affecting Your
| Computer" and your PC shows the typical symptoms!
|
| HTH
|
| (e-mail address removed) wrote:
|
| > >-----Original Message-----
| > >everytime we log onto the internet about 5 min later we
| > >get the message nt authority system has encountered a
| > >problem and will shut down system. have tried windows
| > >downloads etc, cannot fix problem. any ideas email @
| > >[email protected] thanx alot
| > >.
| > >
| >
| > i have the same problem, did you get a fix yet ?
|
|

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH