NT AUTHORITY\SECURITY SHUTDOWN

[Guy Daniel]

Xref: kermit microsoft.public.windowsxp.security_admin:102122

I realised that when I log on to the internet ONLY, and
after 5 to 10 minutes, a count down message pops up on my
screen saying that the computer will auto-shut down for NT
AUTHORITY\SECURITY reason.

What does that mean? and why is that happening ?

Regards

[Carey Frisch [MVP]]

Apparently, your computer has an unwelcome visitor (VIRUS) known=20
as the WM32 Blaster/Lovsan WORM.

It entered the computer through the internet connection because the =
"firewall"
was not properly enabled and essential critical updates were not =
installed from
the Windows Update website. For instructions on fixing the problem, =
visit:

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp=20

Remove W32.MSBlast.Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Blaster Worm: Critical Security Patch for Windows XP (32-bit version)
http://microsoft.com/downloads/details.aspx?FamilyId=3D2354406C-C5B6-44AC=
-9532-3DE40F69C074&displaylang=3Den

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:

How do I turn on the Firewall?
http://www.andyrathbone.com/tips/firewall.html


**** IMPORTANT ****

Visit this web site if you experience difficulty installing=20
Windows XP Security Patch 823980:

How To Fix The Cryptographic Service Error
http://www.updatexp.com/cryptographic-service.html=20


--=20
Carey Frisch=20
Microsoft MVP
Windows XP - Shell/User

-------------------------------------------------------------------------=


"Guy Daniel" > wrote in message:
...

| I realised that when I log on to the internet ONLY, and=20
| after 5 to 10 minutes, a count down message pops up on my=20
| screen saying that the computer will auto-shut down for NT=20
| AUTHORITY\SECURITY reason.
|=20
| What does that mean? and why is that happening ?
|=20
| Regards

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Guy Daniel" > wrote in message
...
> I realised that when I log on to the internet ONLY, and
> after 5 to 10 minutes, a count down message pops up on my
> screen saying that the computer will auto-shut down for NT
> AUTHORITY\SECURITY reason.
>
> What does that mean? and why is that happening ?
>
> Regards