Re: I have a Win 2000 Automatic shutdown problem

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 10/22/05 

Date: Fri, 21 Oct 2005 18:29:51 -0400

From: "Joshua" <Joshua@discussions.microsoft.com>

| I am running a WIN2000 PRO OS and everytime I boot up Windows it has the
| automatic shutdown timer to 1 minute, I can get in with safe mode, but cant
| with safe mode with network connections. It says this shutdown was initiated
| by NT AUTHORITY\SYSTEM. The system process 'C:\\WINNT\System32\system.exe
| terminated unexpectedly with a code 128. The system will now shut down and
| restart.
| I have checked with most newsgroups and they all say I have the MSBLAST
| virus, however I cannot find anything in regedit or windows search that says
| this. My Norton antivirus also cannot find any virus. This all started when I
| enabled my WiFi connection too, if that helps.

You don't have the Lovsan/Blaster or the Sasser worms.

There are *many* who falsely conclude that if you get a ... NT AUTHORITY\SYSTEM Shutdown
message in 60 secs. that is one of those two worms. However, they generate specific
shutdown messages such as...

NT AUTHORITY\SYSTEM
'c:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073741819

Which may be the Sasser or any worm that exploits the LSASS Vulnerability via TCP port 445.

The term "msblast" is associated with a Vulnerability with the RPC/RPCSS DCOM sub-system and
your message is not indicative of RPC and a TCP port 135 attack.

There is a problem on your system, however I don't know the exact cause but I can state that
I sincerely doubt it is viral in nature. . 

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Relevant Pages

  • RE: Remote restart of services
    ... This article describes how to use the Remote Shutdown tool ... to shut down and restart a local or remote Windows 2000-based or Microsoft ...
    (microsoft.public.win2000.general)
  • Re: GP errors
    ... Then later shutdown second one and start the first one. ... machine (MTCCSAPROUTER) to the domain and those errors are not coming. ... The policy for which it is giving access denied error is the Default ... Windows cannot query for the list of Group Policy objects. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Changing Password via Terminal Services causes Server Reboot (
    ... Unfortunately installing Windows 2003 SP1 didn't fix the problem that we are ... >> We are currently experiencing a problem with one of our Windows 2003 servers. ... Shutdown will begin in 58 seconds. ... The system will now shut down and restart. ...
    (microsoft.public.windows.server.general)
  • Blaster worm virus
    ... Whenever your computer attempts to shutdown or reboot, ... "Windows must restart because the Remote Procedure Call ... Turn on your Internet Connection Firewall ...
    (microsoft.public.windowsxp.security_admin)
  • Virus with RPC
    ... Whenever your computer attempts to shutdown or reboot, ... "Windows must restart because the Remote Procedure Call ... Turn on your Internet Connection Firewall ...
    (microsoft.public.windowsxp.security_admin)