NT AUTHORITY/SYSTEM ERROR Code #1073741819

[Ian]

My computer displays an error message that says the NT
AUTHORITY/SYSTEM has terminated and then gives a
countdown until it shuts down. It won't stay on long
enough to download any updates from Windows Update to get
it working right. What should I do?

 

[Carey Frisch [MVP]]

How to remove the "Blaster Worm" from your computer:
http://www3.telus.net/dandemar/blaster.htm

[Courtesy of MS-MVP Jupiter Jones]

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

--------------------------------------------------------------------

:

| My computer displays an error message that says the NT
| AUTHORITY/SYSTEM has terminated and then gives a
| countdown until it shuts down. It won't stay on long
| enough to download any updates from Windows Update to get
| it working right. What should I do?

 

[Patti MacLeod]

Hi Ian,

That might be due to a Sasser worm infection. Have a look here:
http://www.microsoft.com/security/incident/sasser_printxp.mspx



Regards,

 

[NoNoBadDog!]

Lets see....



1. You connected to the internet without enabling the Windows firewall.



2. You also have no antivirus software installed.



3. You did not update your version of windows...if you had, the patch to

prevent infection from the SASSER worm would have been on your system (it's

been available for months).



The reason that your machine is infected is because of all of the above.

You must educate yourself on basic computer security.



Here's what you need to do now, in this exact order...



1. Disconnect the computer from the internet...If you have broadband,

physically disconnect the cable from the back of the computer.





2. Turn the computer on. When the message appears, START>Run>'Shutdown -a"



3. Enable the windows firewall. It is very rudimentary as firewalls go,

but it is better than nothing.



4. Install a reputable Antivirus program. You will have to update it after

re-connecting to the internet, and thereafter you MUST KEEP IT UPDATED.



5. Connect to the internet.



6. Update your antivirus software.



7. Run a scan and let the antivirus software will clean your system.



8. Connect to Windows Update and download ALL Critical downloads. Install

them. You may have to repeat this more than once in order to download and

install all Critical Updates.



9. Never, ever connect to the internet, even briefly, without having met

all of the above requirements.



You not only allowed you machine to be infected, but you turned it into a

tool that is/was looking for other unprotected computers to connect. It has

been recently announced that an unprotected computer can be infected in as

little as 40 seconds.



I would venture a bet that your computer has more than just the latest

variant of the SASSER worm.



Once you begin to practice basic computer security, you can become a

responsible "netizen"



Bobby

 

[Bruce Chambers]

Greetings --

You've apparently contracted the latest worm, W32.Sasser.Worm,
specifically designed to attack people who do not update their
computers promptly and who do not practice "safe hex." In other
words, like Blaster, this worm was developed and distributed _after_ a
patch for the vulnerability was announced and made publicly available.
Further, and also like Blaster, this worm could not affect any
computer whose user had taken the basic precaution of using a properly
configured firewall.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next Shutdown countdown begins. This will abort the shut down. Also,
make sure you've enabled a firewall before starting, to preclude any
more intrusions while getting the updates/patches/tools.

What You should Know about the Sasser Worm and its Variants
http://www.microsoft.com/security/incident/sasser.asp

Microsoft Security Bulletin MS04-011
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

W32.Sasser.Worm
http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html

A tool is available to remove the Sasser worm variants
http://support.microsoft.com/default.aspx?scid=kb;EN-US;841720

W32.Sasser.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

McAfee AVert Stinger Virus Removal Tool
http://vil.nai.com/vil/stinger/


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH