Shutdown initiated by NT Authority

This is a problem that I have seen in relation to the
blaster virus. If you go into your running processes
look to see if there is a blaster process running, End it
and run a virus scanner or virus cleaning program.
Something like Mcafee's Stinger.

>-----Original Message-----
>When I am using Outlook Express or Internet Explorer I

get a window that

>says, "Shutdown initiated by NT Authority System" Then

it says, "Remote

>Procedure Call Service Terminated Unexpectedly" The

computer then reboots.

>
>I think this has something to do with The Authenticated

Users whish I think

>has the words "NT Authority"
>
>Anyone know how to fix this? I have looked at the

Microsoft Knowledge Base

>article #300067 but this article does not mention

theis "Shutdown" problem.

>
>
>.
>

get the patch for the msblast virus (blaster)

>-----Original Message-----
>When I am using Outlook Express or Internet Explorer I get

a window that

>says, "Shutdown initiated by NT Authority System" Then it

says, "Remote

>Procedure Call Service Terminated Unexpectedly" The

computer then reboots.

>
>I think this has something to do with The Authenticated

Users whish I think

>has the words "NT Authority"
>
>Anyone know how to fix this? I have looked at the

Microsoft Knowledge Base

>article #300067 but this article does not mention theis

"Shutdown" problem.

>
>
>.
>

On Thu, 11 Dec 2003 10:33:40 -0800, "Harny" <harrykay@dslextreme.com>
wrote:

>When I am using Outlook Express or Internet Explorer I get a window that
>says, "Shutdown initiated by NT Authority System" Then it says, "Remote
>Procedure Call Service Terminated Unexpectedly" The computer then reboots.
>
>I think this has something to do with The Authenticated Users whish I think
>has the words "NT Authority"
>
>Anyone know how to fix this? I have looked at the Microsoft Knowledge Base
>article #300067 but this article does not mention theis "Shutdown" problem.

Harry,

You are infected by the Blaster worm or its variant. The following
articles should help:

http://www.microsoft.com/security/incident/blast.asp
http://www.newtechhelp.com/virus/bla...chia/index.htm

Cheers,

Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/ven...ster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com...chia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Harny" <harrykay@dslextreme.com> wrote in message
news:vthe03ha7dcfa1@corp.supernews.com...

> When I am using Outlook Express or Internet Explorer I get a window

that

> says, "Shutdown initiated by NT Authority System" Then it says,

"Remote

> Procedure Call Service Terminated Unexpectedly" The computer then

reboots.

>
> I think this has something to do with The Authenticated Users whish

I think

> has the words "NT Authority"
>
> Anyone know how to fix this? I have looked at the Microsoft

Knowledge Base

> article #300067 but this article does not mention theis "Shutdown"

problem.

>
>