NT AUTHORITY shutting down my PC

[Rick]

Re: nt authority

Originally posted by stingernator
i'm having that nt authority problem but computer keeps shutting down before i get a chance to run patch... help!!

Then don't get online! Blasterworm only shuts down your computer if you get online. If you disconnect your network (DSL or cable), then you should not get shut down.

If you DO see the shutdown message, you'll have about 40 seconds to do this:

Start / Run

Type in shutdown -a

Press the enter key and the message should disappear.

 

[luisramirez]

NT Authority

So how do I load a patch if the computer just keeps rebooting every 60 seconds?

 

[jshields13]

I too had the blaster worm, but after I activated the firewall that comes with XP as per the instructions from Microsoft, my computer no longer shut down. I was able to download the fix and follow all the instructions to remove the worm. Have not had a problem since.

 

[BloodRaven]

wow that reallyhelped me out... im starting to like techspot more and more every minute!!!

 

[davey]

what patch are we talking about hear

 

[poertner_1274]

Please be patient and don't double post.
The patch they are talking about is the RPC problem in Windows
Or the NT Authority/shutdown problem.

 

[Hodsocks]

I know this is an old thread but does anyone one know if there is a new variant of the MSblaster worm.
I ask because I thought I had fixed this problem 5 months ago by installing the patch from Microsoft site and running the removal tool from Symantec.
This week it has reared its ugly head again on the same machine, so I loaded the latest patch for it from the MS site and also ran the removal tool from the MS site. Thinking this was the last of it I went online and after about an hour or so, would you believe it the "NT Authority" box appeared and the machine proceeded to close down.
I have also seen this happen on another machine that had had the patch installed a few months ago,
WHat's going on here???

 

[chillum]

I think that there may well be a new variation.
I have been asked to check out a co-workers desk top after they had recieved the "NT Authority......" in 60 secs this desktop will self destruct message lol.
I started xp in safe mode. this bought me a little more time, but doh! i didn't select "safemode w/ networking" and the comp shut down before I could make any changes. There were no internet connections running, infact I disconnected the comp from the router about 35 shutdowns prior to starting in safe mode.
When i tried to reboot windows I got "strike F1 to retry reboot, F2 for setup"
F1 resulted in a repeat of the above message.
F2 resulted in the discovery that the maxtor "5T020H2" that was installed up to this point, now appears not to be installed???????????????

How did that happen? well i'm a little lost.....

I have the updates, patches, removal tools and some other goodies port blockers etc... to lock down this comp, but can no longer get the hard disk drive to boot up, also the CD-ROM device appears to no longer be installed?????

Anyone have any ideas why this may have happened?

 

[flyrgrl12]

Looks like this thing is attacking again. I thought I got rid of the problem a couple of months ago when it reared it's ugly head. Back then, there was a message before the 60 second shut down that specifically said the RPC function/thing. Now it says winnt/system32/lsass.exe
I know nothing about this stuff and would just rather get a new computer but ya know how that goes. I tried the whole shutting down the RPC but that doesn't do anything, I still get the 60 shut down. I've downloaded the patch (again) and it doesn't work. Anyone know how to fix this???!!!

 

[Hodsocks]

Funny you should say that because it is exactly the same message I had before it shutdown.
I have just checked it out and it is not on my machine but must have been on the laptop having the problem.
A quick search tells me that Isass.exe is a trojan that opens port 3410 which is presumably how the worm got onto the machine...hence bypassing the patch to fix the RPCproblem.
Check out http://www.liutilities.com/products/wintaskspro/processlibrary/isass/

 

[rachie]

I too have the same problem with the NT Authority shutting down my computer after being on for a few mins or so. I had the original virus a few months ago and I downloaded the patch and it was fixed just peachy. DO I do the same thing? Is this a different virus??

*sigh* this is so annoying. Any help would be appreciated

 

[flyrgrl12]

Woohoo! I figured it out with a lot of help from everyone on here! Go to http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx and download the newest security update-whichever works for your system, mine was the Microsoft Windows XP and Microsoft Windows XP Service Pack 1. I wouldn't recommend halting the RPC function, since it didn't have any effect on the computer shutting down anyway (or at least for me). Once you get the update installed everything should be peachy. There looks to be some info about the virus out on the web now, I know yahoo had something about it on their main page. Hope this helps!

 

[Mictlantecuhtli]

Originally posted by rachie
DO I do the same thing?

Download the patch mentioned by flyrgrl12 and apply it (before it reboots again )

Is this a different virus??

Yes, it's called Sasser.

 

[rachie]

ok so is there a way where i can stop my computer from rebooting every two secs! lol. I tried to do the RPC thing and that didn't work. Any suggestions?

 

[SNGX1275]

Also go here to see if you are infected:
http://www.microsoft.com/security/incident/sasser.asp

 

[rachie]

ok i fixed it... i just put the patch on a cd and then installed it onto my laptop. . thanks for everyone's help.. i'm always completely useless with computers...

until the next virus lol...

 

[Matter]

sorry to bring this subject back up again but i am at risk, my firewall/anti-vrirus is stoopping it getting into my PC. I have the Exploit/LSASS Exploit/RPC-DCOM and Exploit/Upnp

i don't know if its on my pc and its stopping it doing anything but i'm not sure, is there a patch or anything to remove this?

 

[Mictlantecuhtli]

At least for the last one there's a simple fix: Disable upnp service.

Go to Control Panel -> Administrative Tools -> Services -> Universal Plug and Play Device Host service. Right-click, select Properties. Stop it and set Startup Type field option to "Disabled".

 

[supermoo]

Can't get on internet

Hi I am having this problem on a different machine. I am using my laptop. I can't get on the internet at ALL on the infected machine.
Can i download something on my laptop and then install it on the regular PC?
I'm a novice so I don't follow all of the threads and posts on this board.

 

[Hodsocks]

Check out http://www.microsoft.com/security/incident/sasser.mspx and download on your laptop, copy to your desktop and install.