Licence

  • Thread starter Thread starter billy
  • Start date Start date
B

billy

Since I've done this the PC shuts down every 10 mins with
a warning NT Authority\system Any ideas?
 
Since I've done this the PC shuts down every 10 mins with
a warning NT Authority\system Any ideas?
Click to expand...


Two ideas:
One, you need a second license for the second copy of XP on your main PC.
Most of the licenses for Office products allow an installation to the main
PC and a laptop but the operating system is one copy of Windows per
computer. Microsoft sells license only or you could purchase a second copy
at the store. Often the discounted prices in the store are less than the
slightly discounted 2nd license that MS sells.

Second, I believe that you have the w32.blaster.worm and that it is the
cause of the warning/shutdown message that you're seeing.

Microsoft has a page devoted to information on this worm:
http://www.microsoft.com/security/incident/blast.asp

Fix from MVP Jim Eshelman:
<quote>
Here are the final steps we have settled on here at work for "Blasting the
Blaster" on individual desktops.

TRIAGE PROTOCOL: BLASTING THE BLASTER

0. (Optional) Disconnect from the network first. For remote users, have
them offline.

1. Disable the running virus: In Task Manager > Processes, select
MSBLAST.exe and click End Process. (NOTE: If it won't disable, see Note at
end.)

2. Delete the virus itself: In Start > Search > For Files & Folders (or
Win+F), search the entire hard drive for MSBLAST.EXE. After the search is
over, delete all copies it finds.

3. Remove the Registry entry that allows it to run:
HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Run
In the right pane delete: "windows auto update" = MSBLAST.EXE

4. Reboot the computer. The virus has been removed. Emergency measures are
complete. Restore network connection if it was disabled.
Steps 5 and 6 below protect against contracting it again.

5. Microsoft patch. For Windows 2000:
http://microsoft.com/downloads/details.aspx?FamilyId=C8B8A846-F541-4C15-8C9
F-220354449117&displaylang=en
For other NT-based Windows versions, select from list here:
http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/M
S03-026.asp
Click "Download" at left. Save to Desktop. When downloaded, click on it to
install. (Must have local admin rights.)

[direct link for WinXP download:
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-953
2-3DE40F69C074&displaylang=en ]

6. Update and run your antivirus program.


IF MSBLAST.EXE WON'T DISABLE IN TASK MANAGER
You have to stop it from launching at startup, and then reboot.
Specifically, apply step 3, then reboot.

More info available available at website of your antivirus vendor and/or
see this article from MVP Ron Martell:
http://www.bigblackglasses.com/Article.aspx?Article=342

</end quote>
 
1>you need to purchase a license for your second machine,but that isn't
causing your present problem.

2>You are infected with the blaster worm or one of it's variants

http://www.kellys-korner-xp.com/xp_qr.htm#rpc

There are 2 more variants out now.
The exes for the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


You may also be infected with the W32 Spybot worm.
Info on removing Spybot at:
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -
Sharon F said:
Since I've done this the PC shuts down every 10 mins with
a warning NT Authority\system Any ideas?
Click to expand...


Two ideas:
One, you need a second license for the second copy of XP on your main PC.
Most of the licenses for Office products allow an installation to the main
PC and a laptop but the operating system is one copy of Windows per
computer. Microsoft sells license only or you could purchase a second copy
at the store. Often the discounted prices in the store are less than the
slightly discounted 2nd license that MS sells.

Second, I believe that you have the w32.blaster.worm and that it is the
cause of the warning/shutdown message that you're seeing.

Microsoft has a page devoted to information on this worm:
http://www.microsoft.com/security/incident/blast.asp

Fix from MVP Jim Eshelman:
<quote>
Here are the final steps we have settled on here at work for "Blasting the
Blaster" on individual desktops.

TRIAGE PROTOCOL: BLASTING THE BLASTER

0. (Optional) Disconnect from the network first. For remote users, have
them offline.

1. Disable the running virus: In Task Manager > Processes, select
MSBLAST.exe and click End Process. (NOTE: If it won't disable, see Note at
end.)

2. Delete the virus itself: In Start > Search > For Files & Folders (or
Win+F), search the entire hard drive for MSBLAST.EXE. After the search is
over, delete all copies it finds.

3. Remove the Registry entry that allows it to run:
HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Run
In the right pane delete: "windows auto update" = MSBLAST.EXE

4. Reboot the computer. The virus has been removed. Emergency measures are
complete. Restore network connection if it was disabled.
Steps 5 and 6 below protect against contracting it again.

5. Microsoft patch. For Windows 2000:
http://microsoft.com/downloads/details.aspx?FamilyId=C8B8A846-F541-4C15-8C9
F-220354449117&displaylang=en
For other NT-based Windows versions, select from list here:
http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/M
S03-026.asp
Click "Download" at left. Save to Desktop. When downloaded, click on it to
install. (Must have local admin rights.)

[direct link for WinXP download:
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-953
2-3DE40F69C074&displaylang=en ]

6. Update and run your antivirus program.


IF MSBLAST.EXE WON'T DISABLE IN TASK MANAGER
You have to stop it from launching at startup, and then reboot.
Specifically, apply step 3, then reboot.

More info available available at website of your antivirus vendor and/or
see this article from MVP Ron Martell:
http://www.bigblackglasses.com/Article.aspx?Article=342

</end quote>
Click to expand...
 
Back
Top