system shutting down inexplicably!

[royjacob]

i'm on a home network running xp pro on my laptop. every so often the system issues a message "... system shutdown initiated by NT AUTHORITY\SYSTEM ...shutdown after --- secs.".

any ideas?

the other computer on the network runs xp home. both are connected thru a dell broadband router.

 

[jaffy]

Search this board for msblaster virus or new W32.Welchia.Worm
or go to

http://www.microsoft.com

Install patches and follow removal
get a virus scanner
you have a virus

 

[clayton74]

Its the Blaster virus/worm. You need to download

http://www.sophos.com/support/disinfection/blastera.html

the blaster disinfector

2. How do I remove W32/Blaster-A automatically?
W32/Blaster-A can be removed from Windows 95/98/Me/NT/2000/XP computers automatically with RESOLVE
either download the RESOLVE W32/Blaster-A self-extractor and double-click it (the contents will extract to C:\SOPHTEMP)
or send an email to the autoresponder at blaster-request@sophos.com then create a C:\Sophtemp folder and unzip the BLASTER.ZIP file you are sent into this folder
select Start|Run then type cmd (on Windows 95/98/Me type command) to open a command prompt
click OK
to remove the worm non-interactively type
C:\SOPHTEMP\RESOLVE.COM -DF=BLASTERA.DAT -NOC
and press the Enter key.

Then turn off your system restore control panel/system/system restore uncheck turn off system restore on all drives and apply. Download Microsoft patch

http://www.microsoft.com/security/incident/blast.asp

and install reboot and tyhings should be back to normal

 

[Turkbear]

Hi, In general it is better to stay with the Microsoft detailed methods -
Look here:

http://www.microsoft.com/security/incident/blast.asp

 

[clayton74]

Exactly what I said in my earlier post but explained it in easy steps, rather than going from web page to web page on the microsoft site.

 

[Turkbear]

Hi,
It does not appear to be the same, since you directed him to the Sophos site for removal of the virus, but I see no indication he is running their anti-Virus..


PS..Lots of pages there as well...

 

[paparazi]

You may not be able to download the destroy tool and patch because of the shutting down.
It you have access to another uneffected PC use that.
The free downloads are available from:
Symantec (Nortons) destroy tool for W32.blaster.worm
And security patch for the afore mentioned worm off Microsofts download website.
Both will easily fit on a floppy each

Couple of tips before using the search and destroy tool:
You must disable system restore.
run tool
re activate restore
run patch from Microsoft
enable XP's built in firewall
update you OS and Virus software with the latest critical updates and definitions.

This particular worm does not effect OS 95/98/98SE/98ME and as far as I remember not NT as earlier stated.
Only W2000/XP/XPpro as far as I am aware.
Martin





Replying helps further our knowledge, without comment leaves us wondering.

 

[pixelq]

To bypass the shutdown process. Go to a command prompt or start-->run and type:

shutdown /a