NT AUTHORITY shutting down my PC

By acidosmosis ยท 344 replies
Aug 2, 2003
  1. Rick

    Rick TechSpot Staff Posts: 4,572   +65

    Re: nt authority

    Then don't get online! :p Blasterworm only shuts down your computer if you get online. If you disconnect your network (DSL or cable), then you should not get shut down.

    If you DO see the shutdown message, you'll have about 40 seconds to do this:

    Start / Run

    Type in shutdown -a

    Press the enter key and the message should disappear.
  2. luisramirez

    luisramirez TS Rookie

    NT Authority

    So how do I load a patch if the computer just keeps rebooting every 60 seconds?
  3. jshields13

    jshields13 TS Rookie Posts: 109

    I too had the blaster worm, but after I activated the firewall that comes with XP as per the instructions from Microsoft, my computer no longer shut down. I was able to download the fix and follow all the instructions to remove the worm. Have not had a problem since.
  4. BloodRaven

    BloodRaven TS Rookie Posts: 89

    wow that reallyhelped me out... im starting to like techspot more and more every minute!!!
  5. davey

    davey TS Rookie

    what patch are we talking about hear
  6. poertner_1274

    poertner_1274 secroF laicepS topShceT Posts: 4,172

    Please be patient and don't double post.
    The patch they are talking about is the RPC problem in Windows
    Or the NT Authority/shutdown problem.
  7. Hodsocks

    Hodsocks TS Guru Posts: 382

    I know this is an old thread but does anyone one know if there is a new variant of the MSblaster worm.
    I ask because I thought I had fixed this problem 5 months ago by installing the patch from Microsoft site and running the removal tool from Symantec.
    This week it has reared its ugly head again on the same machine, so I loaded the latest patch for it from the MS site and also ran the removal tool from the MS site. Thinking this was the last of it I went online and after about an hour or so, would you believe it the "NT Authority" box appeared and the machine proceeded to close down.
    I have also seen this happen on another machine that had had the patch installed a few months ago,
    WHat's going on here???
  8. chillum

    chillum TS Rookie

    I think that there may well be a new variation.
    I have been asked to check out a co-workers desk top after they had recieved the "NT Authority......" in 60 secs this desktop will self destruct message lol.
    I started xp in safe mode. this bought me a little more time, but doh! i didn't select "safemode w/ networking" and the comp shut down before I could make any changes. There were no internet connections running, infact I disconnected the comp from the router about 35 shutdowns prior to starting in safe mode.
    When i tried to reboot windows I got "strike F1 to retry reboot, F2 for setup"
    F1 resulted in a repeat of the above message.
    F2 resulted in the discovery that the maxtor "5T020H2" that was installed up to this point, now appears not to be installed???????????????

    How did that happen? well i'm a little lost.....

    I have the updates, patches, removal tools and some other goodies port blockers etc... to lock down this comp, but can no longer get the hard disk drive to boot up, also the CD-ROM device appears to no longer be installed?????

    Anyone have any ideas why this may have happened?
  9. flyrgrl12

    flyrgrl12 TS Rookie

    Looks like this thing is attacking again. I thought I got rid of the problem a couple of months ago when it reared it's ugly head. Back then, there was a message before the 60 second shut down that specifically said the RPC function/thing. Now it says winnt/system32/lsass.exe
    I know nothing about this stuff and would just rather get a new computer but ya know how that goes. I tried the whole shutting down the RPC but that doesn't do anything, I still get the 60 shut down. I've downloaded the patch (again) and it doesn't work. Anyone know how to fix this???!!!
  10. Hodsocks

    Hodsocks TS Guru Posts: 382

    Funny you should say that because it is exactly the same message I had before it shutdown.
    I have just checked it out and it is not on my machine but must have been on the laptop having the problem.
    A quick search tells me that Isass.exe is a trojan that opens port 3410 which is presumably how the worm got onto the machine...hence bypassing the patch to fix the RPCproblem.
    Check out http://www.liutilities.com/products/wintaskspro/processlibrary/isass/
  11. rachie

    rachie TS Rookie

    I too have the same problem with the NT Authority shutting down my computer after being on for a few mins or so. I had the original virus a few months ago and I downloaded the patch and it was fixed just peachy. DO I do the same thing? Is this a different virus??

    *sigh* this is so annoying. Any help would be appreciated

  12. flyrgrl12

    flyrgrl12 TS Rookie

    Woohoo! I figured it out with a lot of help from everyone on here! Go to http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx and download the newest security update-whichever works for your system, mine was the Microsoft Windows XP and Microsoft Windows XP Service Pack 1. I wouldn't recommend halting the RPC function, since it didn't have any effect on the computer shutting down anyway (or at least for me). Once you get the update installed everything should be peachy. There looks to be some info about the virus out on the web now, I know yahoo had something about it on their main page. Hope this helps!
  13. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,345   +11

    Download the patch mentioned by flyrgrl12 and apply it (before it reboots again :p)
    Yes, it's called Sasser.
  14. rachie

    rachie TS Rookie

    ok so is there a way where i can stop my computer from rebooting every two secs! lol. I tried to do the RPC thing and that didn't work. Any suggestions?
  15. SNGX1275

    SNGX1275 TS Forces Special Posts: 10,742   +421

  16. rachie

    rachie TS Rookie

    ok i fixed it... i just put the patch on a cd and then installed it onto my laptop. :). thanks for everyone's help.. i'm always completely useless with computers...

    until the next virus lol...
  17. Matter

    Matter TS Rookie

    sorry to bring this subject back up again but i am at risk, my firewall/anti-vrirus is stoopping it getting into my PC. I have the Exploit/LSASS Exploit/RPC-DCOM and Exploit/Upnp

    i don't know if its on my pc and its stopping it doing anything but i'm not sure, is there a patch or anything to remove this?
  18. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,345   +11

    At least for the last one there's a simple fix: Disable upnp service.

    Go to Control Panel -> Administrative Tools -> Services -> Universal Plug and Play Device Host service. Right-click, select Properties. Stop it and set Startup Type field option to "Disabled".
  19. supermoo

    supermoo TS Rookie

    Can't get on internet

    Hi I am having this problem on a different machine. I am using my laptop. I can't get on the internet at ALL on the infected machine.
    Can i download something on my laptop and then install it on the regular PC?
    I'm a novice so I don't follow all of the threads and posts on this board.
  20. Hodsocks

    Hodsocks TS Guru Posts: 382

Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...