NT AUTHORITY shutting down my PC

Status
Not open for further replies.
Originally posted by suger and spice
Well I've read the Reuters post and it looks like MSBLAST is quite likely to be the culprit. As I said in one of my previouse posts I noticed that msblast was making around 10 outgoing connections to ip addresses that were changing every second.

Now I dont know if Killerbytes problem is the same, I could reboot my machine fine but as soon as i went online thats when i would get the reboot by NT AUthority. I would check these machines to see if they have msblast or one of its varients.
Click to expand...

They do seem to be related, but I do not trust that one fix gets rid of the other, if that makes sense. I just have this feeling that wile they may be related, I think they are seperate entities.
 
error? C:\DOCUME~1\Owner\LOCALS~1\Temp\WER18.tmp.dir00\svchost.exe.mdmp
C:\DOCUME~1\Owner\LOCALS~1\Temp\WER18.tmp.dir00\appcompat.txt the patch is not helping... its still happening.... once in awhile
 
Any of u guys have SVCHOST.exe Running? i think this is causing problems. read my aboive post for more details.

Oh and also my PC has just switched to classic view (sever 2000 taskbar/start menu) at this point i disconnected my modem bnad rebooted its still in classic mode....anyone else have this happen?
 
First of all i want to say thanks for helping me sort out this problem

secondly i want to offer some advice to anyone else suffering from this.

before you do anything else, make sure that the microsoft firewall is turned on, because believe it or not, this actually does stop the problem, to give you enough time to update your system :)

Maskaler
 
theres a lot of things to be done and they dot even seem to solve evrything tright now my pC is messed and i have tryed everything oh and now i have 5 svchost.exe's running.

read though this thread new user right from beginning and u should at leats be able to get ur pc to boot and not shutdown thanks to peoples help
 
Apparently Symantec doesn't even have virus definitions for this virus yet - so all you can do is disable it manually until there is a fix for it.

I'm probably going to end up having to reformat and reinstall the system anyway to get rid of all the garbage. Might be the best thing to do for everyone since nobody actually knows what all this thing is doing so far.

Think about it guys - we were all dealing with and investigating this problem before Symantec even knew about it. Kind of blows the mind! :)
 
I was having the exact same problem. I was using Norton but it wasn't coming up with anything, so I tried www.grisoft.com AVG. It came up with a worm. I updated and got rid of the worm. Not sure if it was related or coincidental, but thought I might throw in my 2 cents.
 
I'm still getting incomming connection attempts to msblast even though I#ve updated the patch.????

I do think your right Killerbyte. I would go as far as saying that their are two problems here one related to msblast causing the Nt AUTHORITY shutdown, (by the way I too have 3 instances of svchosts running). And the other problem which you have and others here which is causing the system to constantly reboot. As I said before mine only seemed to reboot when i went online every 10 min or so., the article does mention varients of msblast but no mention of NT AUTHORITY.

I went to www.astalavista.com and their are RPC exploits described their please have a look.
 
is nt authority something to do with svchost? that was what also pointed me to my temp directory, it keeps changing aswell a few mins ago i had 4 svchosts running now its 5 again now 4 again, 2 are system 1 is local service and one is network service the memory usgae also changed slightly on a couple of them when i just leave my pc...as if they r being accessed
 
anyone else having problems of continuous rebooting?

what are you doing for that

astalavista.com says that as long the other person is online, you will not be able to connect


any expert comments???
 
They are both the same problem.

The MSBLAST worm is taking advantage of the Flaw in MS that is causing the computer to reboot.

DO THIS:
go to START, CONTROL PANEL,ADMINISTRATIVE TOOLS,COMPONENT SERVICES

then select SERVICES (local) from the left hand window. Find "REMOTE PROCEDUE CALL (RPC)" from the right hand window, right click, porperties. You can then use the RECOVERY tab to set it so windows won't reboot each time.

Then you can go about patching, regediting and virus checking.



I'm not sure what to suggest for you guys who can't even get into windows.
 
thanx for the help people seems fine now,

has any one else noticed that svchost SYSTEM's kb is rising very slowly

what should i do to stop these
 
thankie

I stumbled accross this thread through google as many others did and would like to pay respects for being able to fix this highly annoying problem, so thanks people.

It was rebooting at random (the NT Authority message), often immediately at startup or within a few minutes of uptime. Interestingly, it was not doing the shut down immediately at startup whenever I actually turned off the computer at the wall before starting up.

I'm running XP Home so used the XP 32bit patch, followed by deleting the msblast.exe and the registry entry.

All is good now =)... I hope

that stuff in the temp folder (WER) was also appearing in my computer before I sorted it - seems to be a by-product of the problem in some way. I tried deleting the folder with the mentioned files within only to find a slightly different folder spawned a few restarts later...
 
Originally posted by suger and spice
Thanks for that post killerbyte im now installing f-secure to get rid of the blasted msblast.
Click to expand...

I was sure that they where united, but seperate. Let me know haw that works. I am hoping others can be as precise in their findings as you. Keep monitering it for a wile after the fix to see if there is more than these 2 parts.
 
You people are life savers i got my problem fixed and now im helping my girl friend ill deffintly come back to this site ure all awsome thanks again
 
Originally posted by spenj2k
Any of u guys have SVCHOST.exe Running? i think this is causing problems. read my aboive post for more details.

Oh and also my PC has just switched to classic view (sever 2000 taskbar/start menu) at this point i disconnected my modem bnad rebooted its still in classic mode....anyone else have this happen?
Click to expand...
Thats not directly the cause, if related at all. I have 4 of them running, sometimes more, thats normal.
 
well i've downloaded and istalled fsecure with the latest update and gues what it hasnt picked up on msblast...mthfckr. The next update is at 3.54am i think although im in germany so i dont know if the time is local to me or to were fsecure servers are. i will let u know.

however since installing the patch i have not had a problem. apparently msblast was created at 9.37pm today...yesterday i mean, **** its late.
 
yeah the patch works.......but it doesnt FIX the majority of the wandering crap on my computer.......

btw, this site is the best :)
stumbled upon it via Google.......ive been encountering this POS for about 2 weeks now.........

anyway, i installed the patch, installed and updated norton firewall but i still have all the msblast/nt authority stuff on my comp in my registry.......*sigh*
norton anti-virus doesnt detect it......
i am now installing AVG to see if i can get rid of everything since its a much smaller d/l than F-Secure (im on 56k, ugh).

i notice that now in my registry (hkey...microsoft...run) there are no more instances of msblast or nt authority.....hrmmmmmmm
 
Status
Not open for further replies.

Similar threads

A
Windows 10 Enterprise and Education editions will soon enter end of life status
Replies
12
Views
232
Lounds
L
D
Microsoft BitLocker encryption cracked in just 43 seconds with a $4 Raspberry Pi Pico
Replies
18
Views
452
bviktor
B
A
Google proposes ChromeOS Flex as an alternative for soon-to-be e-wasted Windows 10 machines
Replies
19
Views
412
ZedRM
ZedRM

Latest posts

Back