NT AUTHORITY shutting down my PC

i am not able to even start windows, it restarts even before startup screen

what ot do?

theres a lot of things to be done and they dot even seem to solve evrything tright now my pC is messed and i have tryed everything oh and now i have 5 svchost.exe's running.

read though this thread new user right from beginning and u should at leats be able to get ur pc to boot and not shutdown thanks to peoples help

Apparently Symantec doesn't even have virus definitions for this virus yet - so all you can do is disable it manually until there is a fix for it.

I'm probably going to end up having to reformat and reinstall the system anyway to get rid of all the garbage. Might be the best thing to do for everyone since nobody actually knows what all this thing is doing so far.

Think about it guys - we were all dealing with and investigating this problem before Symantec even knew about it. Kind of blows the mind!

I was having the exact same problem. I was using Norton but it wasn't coming up with anything, so I tried www.grisoft.com AVG. It came up with a worm. I updated and got rid of the worm. Not sure if it was related or coincidental, but thought I might throw in my 2 cents.

I'm still getting incomming connection attempts to msblast even though I#ve updated the patch.????

I do think your right Killerbyte. I would go as far as saying that their are two problems here one related to msblast causing the Nt AUTHORITY shutdown, (by the way I too have 3 instances of svchosts running). And the other problem which you have and others here which is causing the system to constantly reboot. As I said before mine only seemed to reboot when i went online every 10 min or so., the article does mention varients of msblast but no mention of NT AUTHORITY.

I went to www.astalavista.com and their are RPC exploits described their please have a look.

is nt authority something to do with svchost? that was what also pointed me to my temp directory, it keeps changing aswell a few mins ago i had 4 svchosts running now its 5 again now 4 again, 2 are system 1 is local service and one is network service the memory usgae also changed slightly on a couple of them when i just leave my pc...as if they r being accessed

anyone else having problems of continuous rebooting?

what are you doing for that

astalavista.com says that as long the other person is online, you will not be able to connect


any expert comments???

http://www.f-secure.com/v-descs/msblast.shtml

http://story.news.yahoo.com/news?tmpl=story&u=/techtarget/20030811/tc_techtarget/918727

I found more on msblast, but am realy finding nothing on the connection to NT Authority in any way. The first link seems to be the most info yet.

They are both the same problem.

The MSBLAST worm is taking advantage of the Flaw in MS that is causing the computer to reboot.

DO THIS:
go to START, CONTROL PANEL,ADMINISTRATIVE TOOLS,COMPONENT SERVICES

then select SERVICES (local) from the left hand window. Find "REMOTE PROCEDUE CALL (RPC)" from the right hand window, right click, porperties. You can then use the RECOVERY tab to set it so windows won't reboot each time.

Then you can go about patching, regediting and virus checking.



I'm not sure what to suggest for you guys who can't even get into windows.

thanx for the help people seems fine now,

has any one else noticed that svchost SYSTEM's kb is rising very slowly

what should i do to stop these

Thanks for that post killerbyte im now installing f-secure to get rid of the blasted msblast.

thankie

I stumbled accross this thread through google as many others did and would like to pay respects for being able to fix this highly annoying problem, so thanks people.

It was rebooting at random (the NT Authority message), often immediately at startup or within a few minutes of uptime. Interestingly, it was not doing the shut down immediately at startup whenever I actually turned off the computer at the wall before starting up.

I'm running XP Home so used the XP 32bit patch, followed by deleting the msblast.exe and the registry entry.

All is good now =)... I hope

that stuff in the temp folder (WER) was also appearing in my computer before I sorted it - seems to be a by-product of the problem in some way. I tried deleting the folder with the mentioned files within only to find a slightly different folder spawned a few restarts later...

I was sure that they where united, but seperate. Let me know haw that works. I am hoping others can be as precise in their findings as you. Keep monitering it for a wile after the fix to see if there is more than these 2 parts.

You people are life savers i got my problem fixed and now im helping my girl friend ill deffintly come back to this site ure all awsome thanks again

ok the patch works, but this thing is still in our PC's do u think we should still be worried

well i've downloaded and istalled fsecure with the latest update and gues what it hasnt picked up on msblast...mthfckr. The next update is at 3.54am i think although im in germany so i dont know if the time is local to me or to were fsecure servers are. i will let u know.

however since installing the patch i have not had a problem. apparently msblast was created at 9.37pm today...yesterday i mean, **** its late.

is it normal for the memory usage to rise slowly???

it doesnt seem right

yeah the patch works.......but it doesnt FIX the majority of the wandering crap on my computer.......

btw, this site is the best
stumbled upon it via Google.......ive been encountering this POS for about 2 weeks now.........

anyway, i installed the patch, installed and updated norton firewall but i still have all the msblast/nt authority stuff on my comp in my registry.......*sigh*
norton anti-virus doesnt detect it......
i am now installing AVG to see if i can get rid of everything since its a much smaller d/l than F-Secure (im on 56k, ugh).

i notice that now in my registry (hkey...microsoft...run) there are no more instances of msblast or nt authority.....hrmmmmmmm

According to this:
http://www.f-secure.com/v-descs/rpc.shtml

it should have made these:
rpc.exe
rpctest.exe
tftpd.exe
dcomx.exe
lolx.exe
worm.exe

i searched......in my registry - negative.
on my comp - negative.