NT AUTHORITY shutting down my PC

[ajb924]

I was having the same problem
now i had downloaded the Patch thanks to this site
and its seem its working since i havent got that annoying warning anymore so far

Thanks

 

[acidosmosis]

Originally posted by kewlness
For me...

The NT AUTH/SYS restart only popped up after an Internet connection was made.

That will be the only time that it occurs. If I am correct, you must be connected to the Internet for this to happen. Out of everyone I've spoken with (at least 10) about this problem none have had their computer shut down while offline.

Unless the w32.blaster worm is capable of causing this to happen while offline. Though I believe this problem 100% relies on the person being connected to the Internet, same as the Windows Messenger service issue.

Glad you got it working guys.

 

[Dillon_the_rabb]

Hi Guys.

First, thatnks for the info on the MS Blast worm. I very nearly lost my sanity because of it! Secondly, I would like to try and help. If you are trying to D/L the patch/fix for the worm, and you machine keeps rebooting, making a few changes to what the RPC does when it fails may buy you a few precious minutes. As soon as windows has finished booting, open the control panel, and select administrative tools and then services. Find Remote Procedure Call (RPC) and double click. In the dialogue that pops up, select recovery, and in the first, second and subsequent failures boxes, select restart the service. Your PC will do all sorts of funny things, but it wont shut down. This should give you enough time to get the patches. When you have them, set all of them back to restart the computer, reboot, and then run the fix, and then install the patch.

It worked for me.

Good luck all!

 

[Dillon_the_rabb]

Sorry Fella's I should have read a previous post, as it says nearly word for word what I have just posted.

Sorry, I should have read ALL posts first before submitting.

Anyways, cheers for the help!

 

[iss]

one thing that people who are constantly being pinged on port 135 can do is make sure that file and printer sharing is disabled. ( as long as you are not networked and need to share files and printer on a network. as long as file and printer sharing is enabled your machine is actively announcing its presence and availibility on the net thru port 135

go to network neighborhood and choose properties and uncheck the box that says share fileand printer.

 

[akshay]

You guys ROCK
I had the same problem since last evening, so this morning searched for the problem on Google, found this forum. You guys have saved my computer.
I have installed a firewall now, updated XP with the Patch and updated my Virus definations.
It seems to be working fine now. While we are at it, should I stick with the OUTPOST firewall that I have installed, or should get the router with built in firewall?
I again thak you all for the valuable advice.

 

[EKUcolonel]

This site is great...glad we all could help.

 

[cobrabird]

godbless you all!!!

fellas! thanks for the tips about that freakin' NT AUTHORITY/SYSTEM
problem. it really made me frustrated this past few days, good thing i found you guys and that firewall thing really worked! thanks magician!:grinthumb but i still have a problem that i think you guys can figure out, see, my system restore doesnt work, every time i run it it. says incomplete everytime. what's up with that? hope you can aid me in this! thanks again!! you rock!!!

 

[Carrot]

the file may be corrupted, but to completely remove this virus you MUST disable and re-enable system restore.

This will wipe it in the process. If you don't, the virus will be restored.

 

[acidosmosis]

Cobrabird; Welcome to the TS Forums! For the best results I would recommend posting a new thread in the Windows forum about your problem. That should attract more attention to your question.

Sorry I'm not able to help though. I did a quick search on google about your problem and didn't really come up with anything that seemed relevant. You might want to search for yourself at www.google.com though. I'm at work so I dont have a lot of time to search.

Happy TS'ing!

 

[cobrabird]

thanks for the tips guys! ill try it later am i glad i stumbled on you guys! thanks again

 

[agsswanson1981]

i dont know if this has been said yet but the msblast worm contains code to go through or block the windows patch..

 

[CarolW]

THANK YOU!

I just wanted to say thank you SO much! I've downloaded the patch on both of my computers and am headed to help a friend fix his. I've been back connected with my TCP/IP connection for a good half an hour and no pop up! :grinthumb

Thanks so much for the help, now when my friends ask me to fix their computer I can!!!

If I need anything else I'll be sure to come back here!

 

[eDg]

hello

hello ppl
a friend of mine is having a prob..
it seems that his comp got a worm or something now he cant enter windows.
this is the error that it sends

<windows root> system32/ntoskrnel.exe

hes using win xp pro

 

[eDg]

he can get on msdos, but cant get on windwos itself, it freezes on a black screen and stays there.
also he cant enter Safe mode (none of the 2)

 

[Ebay.God]

Wow, looks like a lot of people are getting this, i hope i find the guy that did it to my comp so i can kick his nuts and let them fall out of his mouth! Ugh, that is getting a little visiul, anyways, i was working all day yesterday on this andi couldnt get it, work up this mournin, thought of going to microsoft.com and go it in 10 minutes of work compared to 16 hours of work, ugh, how sad.


Tell your friend to reformat. Thats what i would do. Also if he has another computer he could take the hd out of the first one and put it in the working one, back up all of the software he wants on his other comp, format the first hd, then put all of the software back on it,, Good Luck.


`~_GoD_~`

Edited by Mictlantecuhtli

 

[acidosmosis]

Please watch your language. I know it is frustrating but that kind of language can get you in trouble here.

And, btw welcome to TS.

 

[Laser558]

First post on this forum and let me start by saying one big thanks for all the help offered on this "lovesan" virus. Been getting same NT Authority shutdown errors since Sunday night and found you all as the top hit on Google.
Managed to beat the shutdown and download the patch along with AV updates (just changed IE6 privacy settings to max....seemed to do the trick, or was I just lucky?). AV found the virus and allowed me to delete it (had to use safemode for a couple of awkward files) and cleaned out associated entries in registry as suggested.
All seemed OK on reboot, HOWEVER started to see message appear on screen at random when not connected to the internet (56K modem) saying "YOU OR A PROGRAM IS TRYING TO CONTACT MICROSOFT.COM....WHICH CONNECTION DO YOU WISH TO USE?"
This would reappear every 10 mins or so and made me wonder whether something has been left behind on my pc, with regards to this possible DDOS attack on MicroSoft on Aug 16th!!
Ran a basic search for this interesting SVCHOST.exe file and found one somewhat similar lurking in the Windows Prefetch folder. It was called SVCHOST.exe******.pf or very close and was a real swine to delete, even in safe mode. After three/four attempts causing pc to crash whilst deleting, it has finally gone and no more messages re an attempt to contact MicroSoft!! All in all a very interesting experience BUT I am not sure it's all over yet.

 

[Phantasm66]

Originally posted by acidosmosis
Please watch your language. I know it is frustrating but that kind of language can get you in trouble here.

And, btw welcome to TS.

I'll let him off, since it made me laugh.

Next time, however, I may not be so forgiving... :darth:




I have had NONE of the problems faced by many people who posted here.

The reason why is simple: I keep my machines up to date with security fixes and patches, and I have up to date anti-virus programs....

All you Windows clueless luzers have to do is go to windowsupdate.microsoft.com and click some buttons.

You can even download a program for the system tray that does it automatically for you. I know this is a broadband-centric kind of thing to do, but its people with broadband, or at work LANs, who really have to worry about this kind of security glitch getting turned into an attack program.

Also, download a free virus killer software (there are MANY!) and keep it up to date with regular updates. Out of date anti virus software is worse than none at all.

Computers are constantly evolving, and how these kinds of annoyances and exploits happen is because people fail to keep up with the times.

 

[ajb924]

Originally posted by Ebay.God
Wow, looks like a **** load of people are getting this, i hope i find the little bastard that did it to my comp so i can kick his nuts and let them fall out of his mouth! Ugh, that is getting a little visiul, anyways, i was working all day yesterday on this andi couldnt get it, work up this mournin, thought of going to microsoft.com and go it in 10 minutes of work compared to 16 hours of work, ugh, how sad.


Tell your friend to reformat. Thats what i would do. Also if he has another computer he could take the hd out of the first one and put it in the working one, back up all of the software he wants on his other comp, format the first hd, then put all of the software back on it,, Good Luck.


`~_GoD_~`

The only person to blame is the person who had created the virus. No other person would send you the virus on purpose unless its ur enemy, viruses spread automatically from one pc to another without the user intention. i got the virus from Kazaa while downloading music

 

[waiyeh]

the patch didn't work for me.
but i managed to get rid of the nt authority shut by going to admistration tools and services.
thanks all you guys for that.
one more thing is that i tried to update windows at their web page it suppose to scan for any updates and it tells me it could take a few minutes but its bee way more than that, is it slow or crashed due to big influx of people trying to download updates?

 

[J_Bone]

I had msblast.exe also....I deleted it along with its prefetch file.
I have it after I installed the patch.
Find them here:
C:\WINDOWS\SYSTEM32 for "msblast.exe"
C:\WINDOWS|Prefetch for "MSBLAST.EXE-09FF84F2.pf"

I deleted both and now there is no traffic thru my connection.

 

[spenj2k]

At work today some PCs were getting the authority shutdown thing but the virus (mcblaster.exe) is no where to be found! which would indicate nt authority being something different, our/and another companys exchange sever/website host server stopped working and required a reboot but nothing can be found on them in the form of a virus

I still believe something else is running (possibly in svchost.exe)



Has anyone experienced problems even after removing the virus? i have norton anti virus at home telling me its unable to start up its messenger scanner, my old msn messenger doesn't work anymore but msn 6.0 does. Sygate personal firewall won't install it says "Error loading support files Error loading support type library/DLL (svchost is related to dlls running in the background). Also when trying to install a different version of norton anti virus i get an error where it says it was interupted and can't continue the install.


or maybe i'm just paranoid!!?? only time will tell...all i know is my pc hasn't been the same since

 

[Phantasm66]

Originally posted by waiyeh
i tried to update windows at their web page it suppose to scan for any updates and it tells me it could take a few minutes but its bee way more than that, is it slow or crashed due to big influx of people trying to download updates?

If that happens, try again after a few minutes, or at least shut down browser window and then open a new Internet Explorer window and try again....

 

[SaTaNzBish]

Hm im on Xp Pro and i havnt gotten the virus thing yet i also have Zonealarm.... hopefully i dont get it another thing is wit msn messnager im on 5.0 and not 6.0 maybe its msn messanger who knows..