VIRUS ATTACK
-
Originally posted by skeujin:my laptop kena virus...
when i log onto the net... sometimes a window will appear n it says shutdown by nt authority.....
system will shut down in 1:00.... thn countdown begins
i tght it was the msblaster worm bt using various anti virus programmes dont detect anythg...
ive also tried against sasser...
any suggestions? -
Hmm.... I got the exact same symptoms when I was hit by the blaster worm. If you say that it's neither blaster or sasser, then I'm not sure how I can help you.
I guess the only thing you can really do is to call in the pros. You may very well have to reformat your hard disk in the worst case scenario. -
Have you update your virus signatures? If not update it first before scanning. Scan your computer for viruses. Nowadays, not only Blaster and Sasser virus will cause auto shutdown.
Have you patched up your computer?
After scanning if the results show that your computer have no viruses, then answer these questions:
1) Is a firewall installed for your computer? If no firewall is installed, one reason why your computer auto shuts down because someone is controlling your computer, especially if you are using Windows XP. Windows XP allows someone to remotely control your PC, with or without your permission.
2) Have you opened any files send by your friends and your antivirus says virus detected? -
i kana b4 too...tried all the various spywares progams but no use sia..in the end reformat com..all the music files gone lor..sian
-
If it appears again, try either one of the following methods:
1. Disconnect the LAN cable (If your using broadband). If this can't work, refer to 2.
2. Go to Start --> All Programs --> Accessories --> Command Prompt and type "shutdown -a" without the quotes and press enter. The shutdown process should be cancelled.
Now to check whether you have Blaster, which is rather unlikely, see if the process msblast.exe is in your Task Manager (Ctrl+Alt+Del).
If so, report back here...
Oh, and are you using Internet Explorer? You said it appears when you log on to the net. Can state internet connection?
Watch out also for these processes:
rpc.exe
rpctest.exe
dcomx.exe
lolx.exe
worm.exe -
Another question: Does it open an window and says you have xx seconds (xx is a number like 20) left before it shutdown?
If so, go to Start --> Run. Type in shutdown -a
This will abort shutdown. -
i tried all the methods recommended by the symantec website. it doesnt work.
i did a recovery and lost all my data. -
All these can be easily by applying the Microsoft patch.Originally posted by chanff8:Watch out also for these processes:
rpc.exe
rpctest.exe
dcomx.exe
lolx.exe
worm.exe
Patch
For more information on these processes, go to:
http://www.f-secure.com/v-descs/rpc.shtml
http://www.avp.ch/avpve/worms/win32/autorooter.stm
http://www.dbforums.com/t873450.html
Although lolx.exe cannot spread by itself, it is an IRC backdoor. It can be used by intruders to control your computer, resulting in the auto shutdowns. -
eh?
last time my computer also kenna virus and keep shutting down....scan virus but norton anti virus say no virus....then after shutting itself down 2 times, the computer never shutdown on its own again...wierd.dunno where's the virus gone to... -
Got update your antivirus? Never update cannot tell.Originally posted by ceecookie:eh?
last time my computer also kenna virus and keep shutting down....scan virus but norton anti virus say no virus....then after shutting itself down 2 times, the computer never shutdown on its own again...wierd.dunno where's the virus gone to...
Weird case though, auto shutdown for 2 times and then never happen again. -
Its always important to update both Windows and Anti-virus. Must never be lazy about it
-
the antivirus is always auto-updated and install definitions if avail....Originally posted by ndmmxiaomayi:Got update your antivirus? Never update cannot tell.
Weird case though, auto shutdown for 2 times and then never happen again.
then it's also up to date....
then my computer was also kenna by other virus like Funner...
it cre8 havoc on my computer and i had to use system restore to revert some of the damage...then i did a full system scan in safe mode...never detect any virus but after that also no more attack...... -
Probably auto update a bit slow, that's why happened for two times and never happen again.Originally posted by ceecookie:the antivirus is always auto-updated and install definitions if avail....
then it's also up to date....
then my computer was also kenna by other virus like Funner...
it cre8 havoc on my computer and i had to use system restore to revert some of the damage...then i did a full system scan in safe mode...never detect any virus but after that also no more attack...... -
Does it match this Screenshot ?Originally posted by FireIce:
-
something like this in my caseOriginally posted by GSL:Does it match this Screenshot ? -
yup, it should look like thatOriginally posted by GSL:Does it match this Screenshot ? -
Does it said something like C:\WINDOWS\SYSTEM32\ terminated ?Originally posted by ceecookie:something like this in my case -
yes.....Originally posted by GSL:Does it said something like C:\WINDOWS\SYSTEM32\ ternimated ? -
ok. What's the file nameOriginally posted by ceecookie:yes.....
-
i think also lsass.exeOriginally posted by GSL:ok. What's the file name -
lsass.exe cannot be terminated. Terminate it and your computer will be shut down. Aborting the shut down will cause instability to your computer.
-
hmm..... strange never see before this kind of shutdown on Windows XP Service Pack 2 ,then it must kanna virus, possible is Sasser.Originally posted by ceecookie:i think also lsass.exe -
might b registry error
-
by the way, i know how to stop the shutdown when it appear again.
-
http://www.sysinfo.org/startuplist.php?letter=&filter=lsass&count=50&offset=0
If theres 2 lsass.exes in yr task manager... Congrats, you strike toto