NT AUTHORITY shutting down my PC

Just wanted to say..thankyou Techspot. I've spent most of the afternoon reading this thread and printing it off ...and my computer is now fine! I followed the instructions provided by Carrot - thanks.

Good point about keeping ontop of updates Phantasm...

Once again, you rock!

I would once again like to thank the wonderful people with TONS more information than myself on this board. I was able to sucessfully repair/delete the worm from not one, or two but 4 computers! lol (My personal 2 plus 2 of my friends)
You guys are once again wonderfull and get two thumbs up! :grinthumb :grinthumb

Guys, I don't know if it's a problem on my end, but I was trying to download the latest AV definitions for Grisoft AV Free Edition and the web update feature would not work; the file would not download. I downloaded the file manually and it updated fine after I placed it in the update subdirectory and ran Grisoft.

Just a heads up in case.

problem with the patch??

I just realized I had this worm, so I downloaded the patch of off Microsoft's website, but as I'm trying to install it, it says, Extraction Failure because "xpsp1hfm.exe is not a valid Win32 application" And then it stops. What is going on, and how can I fix this??? Please please help!! :-(

hmm, that did not happen to me at all.

Bluemagic,

if you are allready infected then you need to run the removal tool befroe installing the patch.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

NT Authority

This has been happening to me for a couple of days before I found y'all, but it only happens when I go online. The longest it lets me stay online for is maybe 5 minutes which is definitely not long enough to get the patch because (I hate to admit) I am still using dial up. would it be possible to get the patch oon my pc at work and save it to disk?

lil_lars80; Yea, you will only be affected when your online. Setting Remote Procedure Call to take no action will stop that from happening and you can get the patch from Microsoft in the meantime.

svchost.exe

Hey guys thanks for all the help with the NT AUTHORITY issue.
I was wondering if any of you guys found out what the file:
svchost.exe

is and if I should or how can I delete.
I have 4 of them running under task manager and when I tried to stop the processes I got the old NT AUTHORITY msg back.
Does anyone have the same problem?
Please help!
Thanks

Hello!

After reading more posts...I'm growing more and more paranoid...

I never found any msblast.exe files on my computer nor did my updated A/V find any virus or infected files. Should I be concerned???

recap: When the NT AUTH/SYST hit...I downloaded all available Windows updates for security. Everything worked fine...updated anti virus and all scans were fine.

Thanks

BRPlayer, as far as I am aware, svchost is a legit file that controls and runs several Win2K and XP functions. So it's not unusual to find several copies running when you check with TasK Manager. It's not a file you should delete.

I can't tell you exactly which functions are being loaded by svchost, you can try searching for it using a search engine and there will be sites with articles on what the file does.

More importantly, from your description, it's not so much svchost that is your problem right now, it's the fact that the NT Authority thingie is still plaguing you, which means you have contracted and yet to remove the worm?

Checking the earlier pages of this thread should help. Or try Cnet News or eweek for their reports as well, which should contain links to info.

Thanks for the help guys. I will look into it.

kewlness, given that your system has been scanned and proclaimed clean, then you're probably safe as long as you keep up to date with patches and AV/firewall updates.

In the end, the larger issue is not about this particular worm alone; it's about what the end user and Microsoft should do respectively to ensure secure computing.

I have been thinking about this: I bought a computer years ago just to play games. Back then it was still MS-DOS, and I had to learn config.sys and autoexec.bat tweaks in order to maximize the amount of higher memory available (extended and expanded memory, himem.sys and em386.exe if I recall correctly?).

Soon, for school projects, I slowly learnt word processing. But after all these years, I never learnt to program, unless you include HTML and some statistical package stuff.

But I have found myself increasing visits to sites like Techspot for their tweak guides, etc. It seems to me that in order to really use a computer optimally and securely, one almost has to become a "techie" by default and necessity. I mean, now I even assemble my own systems instead of buying from Dell and the like...

I don't know if this is asking a bit too much of end users, most of whom would just simply like to run their everyday productivity programs, games, surf and that's about it. What do you guys think?

tkteo...tks for the response

I think as time goes by, end users (such as myself...lol) will have to become more knowledgeable or else their computers won't last 24 hrs.

2:24 a.m. here...zzz....g/nite

SVCHost is a normal task. I have about 4-5 running on my system at once all the time. No cause for alarm

hmm........i see a few of you saying that cmd.exe is a virus? yet according to this......

http://www.uksecurityonline.com/husdg/windowsxp/shutdownports.htm

its a necessary file to find out what ports are open on your computer......

Thank goodness for this site. I am a relative novice on my machine and am just learning the ropes really. I feared the worst when I couldn't shift the shut down messages. Used my office pc to search google and found this.

Great community spirit , thanks for all the tips.

By the way, my computer seems ok now after using the removal tool and then downloading the patch (fingers crossed, touch wood, etc, etc...)

RPC Call

what do you make of this Has anyone experienced problems even after removing the virus? i have norton anti virus at home telling me its unable to start up its messenger scanner, my old msn messenger doesn't work anymore but msn 6.0 does. Sygate personal firewall won't install it says "Error loading support files Error loading support type library/DLL (svchost is related to dlls running in the background). Also when trying to install a different version of norton anti virus i get an error where it says it was interupted and can't continue the install.