System shuts down while online

anonymous_at_discussions.microsoft.com
Date: 02/03/04


Date: Tue, 3 Feb 2004 12:14:41 -0800

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 
***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -
Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32
.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
.removal.tool.html

>-----Original Message-----
>Prior to Feb 01 wasn't having any problems but heard
>about the MYDOOM problem. Went to Symantec and downloaded
>the removal tool. Ran the tool, said it didn't find
>anything. Feb 01 when I start the system Desktop Notepad
>starts with the following info:
>..shellclassinfo (in squared brackets) nextline read,
>localizedresourcename=@%systemroot%\system32\shell32.dll,-
>21787.
> Ran the removal tool again, said no problem. I did the
>destructive restore which formatted the hard drive and
>put the system back to it's original config. Now when I'm
>on line and try to download something a window pops up
>stating the system has to shut down initiated by
>NTAUTHORITY\SYSTEM. Something to do with the Remote
>Procedure Call (RPC).
>.
>



Relevant Pages

  • Re: Serious Security Issue in Windows XP SP2s Firewall
    ... Subject: AW: Serious Security Issue in Windows XP SP2's Firewall ... If you update a WinXP SP-1 with enabled Internet ... Connection Firewall ...
    (Focus-Microsoft)
  • Blaster
    ... been using an internet connection firewall and have ... Then immediately turn-on Windows XP's built-in Firewall: ... ***Install a good firewall. ...
    (microsoft.public.security.virus)
  • Remote proceedure call terminated unexpectedly
    ... been using an internet connection firewall and have ... Then immediately turn-on Windows XP's built-in Firewall: ... ***Install a good firewall. ...
    (microsoft.public.windowsxp.general)
  • Win xp shuts down
    ... been using an internet connection firewall and have ... Then immediately turn-on Windows XP's built-in Firewall: ... ***Install a good firewall. ...
    (microsoft.public.windowsxp.accessibility)
  • XP crashes when on-line
    ... been using an internet connection firewall and have ... Then immediately turn-on Windows XP's built-in Firewall: ... ***Install a good firewall. ...
    (microsoft.public.windowsxp.newusers)