NT AUTHORITY shutting down my PC

By acidosmosis
Aug 2, 2003
Topic Status:
Not open for further replies.
  1. Killerbyte

    Killerbyte Newcomer, in training

    They do seem to be related, but I do not trust that one fix gets rid of the other, if that makes sense. I just have this feeling that wile they may be related, I think they are seperate entities.
  2. newuser100

    newuser100 Newcomer, in training

    i am unable to open anything in my pc. it keeps resetting in a cycle.

    what to do??
  3. agsswanson1981

    agsswanson1981 Newcomer, in training

    error? C:\DOCUME~1\Owner\LOCALS~1\Temp\WER18.tmp.dir00\svchost.exe.mdmp
    C:\DOCUME~1\Owner\LOCALS~1\Temp\WER18.tmp.dir00\appcompat.txt the patch is not helping... its still happening.... once in awhile
  4. spenj2k

    spenj2k Newcomer, in training

    Any of u guys have SVCHOST.exe Running? i think this is causing problems. read my aboive post for more details.

    Oh and also my PC has just switched to classic view (sever 2000 taskbar/start menu) at this point i disconnected my modem bnad rebooted its still in classic mode....anyone else have this happen?
  5. Maskaler

    Maskaler Newcomer, in training

    First of all i want to say thanks for helping me sort out this problem

    secondly i want to offer some advice to anyone else suffering from this.

    before you do anything else, make sure that the microsoft firewall is turned on, because believe it or not, this actually does stop the problem, to give you enough time to update your system :)

    Maskaler
  6. newuser100

    newuser100 Newcomer, in training

    i am not able to even start windows, it restarts even before startup screen

    what ot do?
  7. spenj2k

    spenj2k Newcomer, in training

    theres a lot of things to be done and they dot even seem to solve evrything tright now my pC is messed and i have tryed everything oh and now i have 5 svchost.exe's running.

    read though this thread new user right from beginning and u should at leats be able to get ur pc to boot and not shutdown thanks to peoples help
  8. b2bomber81

    b2bomber81 Newcomer, in training Posts: 59

    Apparently Symantec doesn't even have virus definitions for this virus yet - so all you can do is disable it manually until there is a fix for it.

    I'm probably going to end up having to reformat and reinstall the system anyway to get rid of all the garbage. Might be the best thing to do for everyone since nobody actually knows what all this thing is doing so far.

    Think about it guys - we were all dealing with and investigating this problem before Symantec even knew about it. Kind of blows the mind! :)
  9. Sanchez

    Sanchez Newcomer, in training

    I was having the exact same problem. I was using Norton but it wasn't coming up with anything, so I tried www.grisoft.com AVG. It came up with a worm. I updated and got rid of the worm. Not sure if it was related or coincidental, but thought I might throw in my 2 cents.
  10. suger and spice

    suger and spice Newcomer, in training

    I'm still getting incomming connection attempts to msblast even though I#ve updated the patch.????

    I do think your right Killerbyte. I would go as far as saying that their are two problems here one related to msblast causing the Nt AUTHORITY shutdown, (by the way I too have 3 instances of svchosts running). And the other problem which you have and others here which is causing the system to constantly reboot. As I said before mine only seemed to reboot when i went online every 10 min or so., the article does mention varients of msblast but no mention of NT AUTHORITY.

    I went to www.astalavista.com and their are RPC exploits described their please have a look.
  11. spenj2k

    spenj2k Newcomer, in training

    is nt authority something to do with svchost? that was what also pointed me to my temp directory, it keeps changing aswell a few mins ago i had 4 svchosts running now its 5 again now 4 again, 2 are system 1 is local service and one is network service the memory usgae also changed slightly on a couple of them when i just leave my pc...as if they r being accessed
     
  12. newuser100

    newuser100 Newcomer, in training

    anyone else having problems of continuous rebooting?

    what are you doing for that

    astalavista.com says that as long the other person is online, you will not be able to connect


    any expert comments???
  13. Killerbyte

    Killerbyte Newcomer, in training

  14. defuzz

    defuzz Newcomer, in training

    They are both the same problem.

    The MSBLAST worm is taking advantage of the Flaw in MS that is causing the computer to reboot.

    DO THIS:
    go to START, CONTROL PANEL,ADMINISTRATIVE TOOLS,COMPONENT SERVICES

    then select SERVICES (local) from the left hand window. Find "REMOTE PROCEDUE CALL (RPC)" from the right hand window, right click, porperties. You can then use the RECOVERY tab to set it so windows won't reboot each time.

    Then you can go about patching, regediting and virus checking.



    I'm not sure what to suggest for you guys who can't even get into windows.
  15. Strife121

    Strife121 Newcomer, in training Posts: 17

    thanx for the help people seems fine now,

    has any one else noticed that svchost SYSTEM's kb is rising very slowly

    what should i do to stop these
  16. suger and spice

    suger and spice Newcomer, in training

    Thanks for that post killerbyte im now installing f-secure to get rid of the blasted msblast.
  17. MattyS54

    MattyS54 Newcomer, in training

    thankie

    I stumbled accross this thread through google as many others did and would like to pay respects for being able to fix this highly annoying problem, so thanks people.

    It was rebooting at random (the NT Authority message), often immediately at startup or within a few minutes of uptime. Interestingly, it was not doing the shut down immediately at startup whenever I actually turned off the computer at the wall before starting up.

    I'm running XP Home so used the XP 32bit patch, followed by deleting the msblast.exe and the registry entry.

    All is good now =)... I hope

    that stuff in the temp folder (WER) was also appearing in my computer before I sorted it - seems to be a by-product of the problem in some way. I tried deleting the folder with the mentioned files within only to find a slightly different folder spawned a few restarts later...
  18. Killerbyte

    Killerbyte Newcomer, in training

    I was sure that they where united, but seperate. Let me know haw that works. I am hoping others can be as precise in their findings as you. Keep monitering it for a wile after the fix to see if there is more than these 2 parts.
  19. ORC-MASTER

    ORC-MASTER Newcomer, in training

    You people are life savers i got my problem fixed and now im helping my girl friend ill deffintly come back to this site ure all awsome thanks again
  20. Strife121

    Strife121 Newcomer, in training Posts: 17

    ok the patch works, but this thing is still in our PC's do u think we should still be worried
  21. SNGX1275

    SNGX1275 TS Forces Special Posts: 12,425   +281

    Thats not directly the cause, if related at all. I have 4 of them running, sometimes more, thats normal.
  22. suger and spice

    suger and spice Newcomer, in training

    well i've downloaded and istalled fsecure with the latest update and gues what it hasnt picked up on msblast...mthfckr. The next update is at 3.54am i think although im in germany so i dont know if the time is local to me or to were fsecure servers are. i will let u know.

    however since installing the patch i have not had a problem. apparently msblast was created at 9.37pm today...yesterday i mean, **** its late.
  23. Strife121

    Strife121 Newcomer, in training Posts: 17

    is it normal for the memory usage to rise slowly???

    it doesnt seem right
  24. slowEJ6

    slowEJ6 Newcomer, in training Posts: 21

    yeah the patch works.......but it doesnt FIX the majority of the wandering crap on my computer.......

    btw, this site is the best :)
    stumbled upon it via Google.......ive been encountering this POS for about 2 weeks now.........

    anyway, i installed the patch, installed and updated norton firewall but i still have all the msblast/nt authority stuff on my comp in my registry.......*sigh*
    norton anti-virus doesnt detect it......
    i am now installing AVG to see if i can get rid of everything since its a much smaller d/l than F-Secure (im on 56k, ugh).

    i notice that now in my registry (hkey...microsoft...run) there are no more instances of msblast or nt authority.....hrmmmmmmm
  25. slowEJ6

    slowEJ6 Newcomer, in training Posts: 21

    According to this:
    http://www.f-secure.com/v-descs/rpc.shtml

    it should have made these:
    rpc.exe
    rpctest.exe
    tftpd.exe
    dcomx.exe
    lolx.exe
    worm.exe

    i searched......in my registry - negative.
    on my comp - negative.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.