Shutdown initiated by NT AUTHORITY\SYSTEM

[Dimandja]

I am looking at a computer left over from another user. I am trying to clean it up.

Each time I run Ad-Aware, a message shows with among other stuff: "Shutdown initiated by NT AUTHORITY\SYSTEM". There is a 60 second ticking countdown clock on it too. At zero, the computer is shutdown (in restart mode).

I'm gathering that this is done by a Blaster virus.

How do I fix this problem?

I have already tried to placate the forced shutdown with "shutdown -a", to no effect.

 

[carrr]

Get the tool, follow the intructions here;

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[Tusk]

You could also try and stop the blaster process from running, then you can run the necessary tools to kill the virus. Also, if you boot into safe mode this should stop the blaster process from starting and lets you run the tools.

 

[GlenJohnson]

Here's some good info to help follow up.

http://www.pcanswers.co.uk/tips/default.asp?pagetypeid=2&articleid=29024&subsectionid=616

Glen A. Johnson
To get the best answers to your questions, check out faq950-5848
If you're from the Chicago land area, check out Tek-Tips in Chicago IL

 

[Dimandja]

I tried many suggestions that used to apparently work, but to no avail.

I then went back to basics. Ran HijackThis, removed most "Nasty" elements, then tried to run Ad-Aware, and it was successful -- a hefty 108 entries were rustled up, and deleted.

I am not sure which of the entries, that HijackThis removed, were culpable.