win xp shuts off after 5 .authority nt/system message

  • theking1971
  • Born
  • Born
  • theking1971
  • Posts: 1

Post 3+ Months Ago

the message authority nt/system somes on and starts process of shutoff after beeing on the web about 5 minutes any suggestions
  • Anonymous
  • Bot
  • No Avatar
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post 3+ Months Ago

  • whosonthedexs
  • Student
  • Student
  • User avatar
  • Posts: 72
  • Loc: UK

Post 3+ Months Ago

Do you have Broadband or dialup?

Which ever you have make sure that before you start your machine you disconnect either the modem, cat 5 or usb router cable from your PC, this is purley a precaution.

1. Once this is done start your machine.

2. Once started, click start -> Run -> and type "services.msc" without the quotes, locate the [i]Remote Procedure Call (RPC)[/i] service,

3.plug your modem, cat 5 or usb router cable back in and monitor the service.

4. When you the recieve the error your getting check that the service is still running.

If the service has ceased to run your PC is infected by the a virus that expoilts a vunerability in the RPC service.

A patch can be downloaded from the microsoft web site.

If the service is still running then you should check your event log by accessing computer management or by running eventvwr.msc from Start -> run.

hope this helps.
  • ModernDestroyer
  • Professor
  • Professor
  • User avatar
  • Posts: 794
  • Loc: California

Post 3+ Months Ago

You could hit alt + crtl + Del, go into the task manager then to the processes tab and scroll thru till you see msblaster.exe and tell it to end that process. Then you can go to the symantec web site and look for security alert. On that page of the web site there will be a removal tool and a link to the Microsoft update page with the appropriate update so the virus can't come back into your machine. While you are downloading the removal tool and the patch, keep the task manager open and running in the backround and watch to make sure the msblaster.exe doesn't start again. If it does just end the process like before till you get the patch and tool downloaded. Enjoy :D

// Here is the link to the removal tool and update http://securityresponse.symantec.com/av ... .tool.html
  • whosonthedexs
  • Student
  • Student
  • User avatar
  • Posts: 72
  • Loc: UK

Post 3+ Months Ago

As soon as the msblaster.exe file is launch the RPC service is stopped.

Instant shut down!
  • ModernDestroyer
  • Professor
  • Professor
  • User avatar
  • Posts: 794
  • Loc: California

Post 3+ Months Ago

actually the msblaster.exe virus would give you a minute shutdown warning :D I disinfected about 5 PC's that had it, the time it took to affect varied but once the NT authority message came on you had 59 secs and the computer would reboot :D
  • whosonthedexs
  • Student
  • Student
  • User avatar
  • Posts: 72
  • Loc: UK

Post 3+ Months Ago

I stand corrected.

Just got annoyed when friends and family were phoning me every other day.

Just sent em a CD in the end with removal tool and MS patch.

A minute's not a long time but the again the removal tool is onlly a couple of K.
  • mitch
  • Born
  • Born
  • mitch
  • Posts: 2
  • Loc: abilene tx

Post 3+ Months Ago

having the same yet completly diffrent problems. I'm getting the same prompt that says blah blah blah will shut down in 50sec due to RPC etc etc the diffrence is that I've downloaded the patch and the symantec cleaner it says I dont have the virus but it still gives me the prompt and it still shuts down. also when i try install the patch it does the extracting files routine then goes to the agreement screen in which I agree then it goes to the inspecting files screen then just dissapers i try it again it may get 1/4 inch bar of the inpecting files then it just goes away anyone have any ideas whats going on it would be great I know I have the virus becuase i went to my task manager and thier is a USER32 source under the RPC deal for everytime it restarted.thanks alot
mitch
  • ModernDestroyer
  • Professor
  • Professor
  • User avatar
  • Posts: 794
  • Loc: California

Post 3+ Months Ago

Here is a link to help you on the USER32 RPC shutdown

http://www.overclockers.com/tips00445/index02.asp

I hope it helps :D
  • mitch
  • Born
  • Born
  • mitch
  • Posts: 2
  • Loc: abilene tx

Post 3+ Months Ago

thanks for the help. I went to the link and it just gave me info on the problem and the same fix as the rest of the sites. I attempted to re apply the patch and still just disappers after I attempt to appy the patch I have been searcing for 2 days for a fix with now luck at all.any step in the right direction will be great.thanks again.
mitch
  • christian
  • Born
  • Born
  • christian
  • Posts: 3

Post 3+ Months Ago

i'm getting this exact same shutdown message, but when i open task manager i cannot find the msblaster.exe running. when i try to install any virus scanner it immediately closes. also when trying to install the windows patch, that closes. i turned off the remote process call as well. do i have a known variant of this virus? is there any??? please help!
  • Borrow -A- Geek
  • Professor
  • Professor
  • User avatar
  • Posts: 763
  • Loc: Dallas/Ft Worth, Texas

Post 3+ Months Ago

check to see if you have loader.exe running
  • christian
  • Born
  • Born
  • christian
  • Posts: 3

Post 3+ Months Ago

i don't see a program called loader.exe running..[/img]
  • Borrow -A- Geek
  • Professor
  • Professor
  • User avatar
  • Posts: 763
  • Loc: Dallas/Ft Worth, Texas

Post 3+ Months Ago

if you do, then end task on it, it is a part of the MSblaster team of variants... in fact the original variant of the msblaster self destructed on January 10th 2004 but unfortunatly the variants have not...
  • Borrow -A- Geek
  • Professor
  • Professor
  • User avatar
  • Posts: 763
  • Loc: Dallas/Ft Worth, Texas

Post 3+ Months Ago

ok do you have the remover tool from S.A.R.C. ? located at http://www.sarc.com/ they have a removal tool there that removes all variants... as said before you may need to boot into safe mode to run that tool effectively. additionally if your not connected to the internet, you computer wont try to reboot itself... so keep that in mind as well... if you ned some time to fix it then get off the net... as in remove your connection whether it is dial up or cable modem ... unplug it! :-) good luck
  • christian
  • Born
  • Born
  • christian
  • Posts: 3

Post 3+ Months Ago

here is a picture of what is currently running...


Image
  • Borrow -A- Geek
  • Professor
  • Professor
  • User avatar
  • Posts: 763
  • Loc: Dallas/Ft Worth, Texas

Post 3+ Months Ago

you image didnt show up Christian... but it just dawned on me that another program running is the blaster virus call user32.exe end task on that too.

also on the shut down thing.. it CAN BE STOPPED...You can actually stop this shutdown if you want, executing the command “shutdown /a” will abort the countdown and return control to you (the command may also be parsed "shutdown -a.") However, you may or may not want to do this… because about half the apps you run will probably not work without RPC. However, if your network is so hammered by worm traffic that you’re having trouble staying up long enough to download and apply the patch, a good “shutdown /a” can give you more time to work. Also, once USER32.EXE has scheduled one shutdown for RPC crashing, it won’t schedule another until you reboot (or manually restart RPC, which is not advisable) – so you don’t have to sit there aborting countdowns over and over again.
  • kickum
  • Born
  • Born
  • kickum
  • Posts: 1
  • Loc: Iowa

Post 3+ Months Ago

I am having the same problem. I have had the blaster worm before, but this time it's different. I don't have msblast.exe in my task manager & my Norton says I have it, but The fixblast tool from symantec can't find it. Really weird. Somone may have already posted this, but if you are having this problem & you get the "NT Shutdown" countdown, before the timer runs out, go to : Start menu, Run & type in "shutdown -a" without the quotes. It will stop the shutdown process.it really works. If I figure out how to get rid of this I will let everyone know....
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Posts: 23456
  • Loc: Woodbridge VA

Post 3+ Months Ago

Nice little tip kickum. That'll be a good one to remember.
  • zilos
  • Born
  • Born
  • zilos
  • Posts: 3

Post 3+ Months Ago

im getting this same error (NT shutwond in 59 secs...) but i get it before windows even starts. (right before it shows me the users login screen...
Please, I need some help...
  • Alkatr0z
  • Mastermind
  • Mastermind
  • Alkatr0z
  • Posts: 1883
  • Loc: Adelaide, Australia

Post 3+ Months Ago

mmmm Can you get into Safe Mode?
Do you use 'always on' broadband?

Post Information

  • Total Posts in this topic: 20 posts
  • Users browsing this forum: No registered users and 51 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 1998-2014. Ozzu® is a registered trademark of Unmelted, LLC.