Automatic System Shutdown After Installing XP

  • Thread starter Thread starter Scott
  • Start date Start date
S

Scott

I recently had to reinstall XP on my system, and now
every time I get on the internet, if I am on for more
than a few minutes, I get a message saying my sytem is
going to shut down in 60 seconds...and there is no way
around it. I get a message referring to the NT
AUTHORITY...and then something about a lsass.exe error
when I restart the system.

My first thought was a virus...and I ran a full scan
using a current version of Norton, and it came up clean.

I remember having this same problem when I initially
installed XP...and someone talked me through changing the
recover options on a service from RESTART COMPUTER to
TAKE NO ACTION, but I can't seem to find the right one
now. I thought it was something to do with an RPC
service, but changing that is not doing the trick.

Anyone know what I need to do?

Thanks.
 
Scott,

Regardless of what Norton told you, you have either the Sasser or Blaster
virus, most likely Sasser. Go to symantec.com for removal directions! More
than liely, someone will reply to your post with links and info. Good luck!

p.s. Next time have a firewall installed on your pc BEFORE connecting to
the internet, such as Zone Alarm.
 
Thanks...I "assumed" norton was going to find it if it
was there. Guess thats what happens when you "assume"!
 
Well, if your Norton Pre-Dates the arrival of Sasser or Blaster, then it
won't catch it until you update the Virus Def's - this would be the case
using NAV 2003 or earlier.
 
Scott said:
I recently had to reinstall XP on my system, and now
every time I get on the internet, if I am on for more
than a few minutes, I get a message saying my sytem is
going to shut down in 60 seconds...and there is no way
around it. I get a message referring to the NT
AUTHORITY...and then something about a lsass.exe error
when I restart the system.

My first thought was a virus...and I ran a full scan
using a current version of Norton, and it came up clean.

I remember having this same problem when I initially
installed XP...and someone talked me through changing the
recover options on a service from RESTART COMPUTER to
TAKE NO ACTION, but I can't seem to find the right one
now. I thought it was something to do with an RPC
service, but changing that is not doing the trick.

Anyone know what I need to do?

Thanks.
Click to expand...

This is caused by a worm W32.msblaster it has similar names it wa
created by Jeffrey Lee Parson..in brief it creates a backdoor progra
hich allows hackers.

W32.Blaster.Worm exploits the DCOM RPC vulnerability. This is describe
in Microsoft Security Bulletin MS03-02
<http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx>, an
a patch is available there. You must download and install the patch. I
many cases, you will need to do this before continuing with the remova
instructions. If you are not able to remove the infection or preven
re-infection using the following instructions, first download an
install the patch.
Additional information, and an alternate site from which to downloa
the Microsoft patch is available in the Microsoft article "What Yo
Should Know About the Blaster Worm and Its Variants.
www.microsoft.com/security/incident/blast.mspx>."
Because of the way the worm works, it may be difficult to connect t
the Internet to obtain the patch, definitions, or removal tool befor
the worm shuts down the computer. It has been reported that, for user
of Windows XP, activating the Windows XP firewall may allow you t
download and install the patch, obtain virus definitions, and run th
removal tool. This may also work with other firewalls, although thi
has not been confirmed.

Live Long and Prosper

Darkhaw
 
Back
Top