Notices
Computer/Internet Issues & Troubleshooting Anyone with questions about the terribly complex world of computers or the internet should try here. NOT FOR REPORTING ISSUES WITH PPRuNe FORUMS! Please use the subforum "PPRuNe Problems or Queries."

Windows is shutting down!

Old 3rd May 2004 | 20:26
  #1 (permalink)  
Thread Starter
20 Anniversary
 
Joined: Apr 2003
Posts: 488
Likes: 9
From: UK
Windows is shutting down!

Have just changed ISP on son's computer. Everything straightforward until I removed the old ISP (using the remove mechanism) after which the warning 'Windows is shutting down' (in ONE minute) came on the screen. Not possible to stop this and so close down it did! From then on whatever command was made, the above warning came on screen and activated.....despite the fact that the selected command dialogue box always opened in the background. Your thoughts please!!
Laptop running XP

H49
Helen49 is offline  
Old 3rd May 2004 | 20:49
  #2 (permalink)  

Jolly Green Giant
 
Joined: May 1999
Posts: 586
Likes: 0
From: Dublin, Ireland
Could be the the sasser virus. I had ot two days ago and it shut everything down..

Use the fix from symantec listed here removal tool

It will remove the virus from your system and also read the details as well. You can check it manually as well to see if its completely gone.

Make sure you then update your virus definitions.
OneWorld22 is offline  
Old 4th May 2004 | 14:56
  #3 (permalink)  
The Oracle
 
Joined: Aug 2001
Posts: 2,902
Likes: 0
From: Naples, Florida U.S.A.
Helen49,

Your Son has MSBlaster worm:

WORM_MSBLAST.GEN

(As a note: If Windows is going to crash, it just crashes. It is not going to give you 60 seconds to do your work before shutting down.)

Take Care,

Richard
Naples Air Center, Inc. is offline  
Old 4th May 2004 | 15:09
  #4 (permalink)  
Thread Starter
20 Anniversary
 
Joined: Apr 2003
Posts: 488
Likes: 9
From: UK
One World 22 & Richard.....thank you for the advice. It did take the 60seconds to shut down, counting down before it commenced.

H49
Helen49 is offline  
Old 4th May 2004 | 15:35
  #5 (permalink)  
The Oracle
 
Joined: Aug 2001
Posts: 2,902
Likes: 0
From: Naples, Florida U.S.A.
Helen49,

Follow the directions from the link I gave you above. Then run Trend Micro's Housecall to make sure his system is clean.

I would also run Lavaoft's Ad-Aware to make sure you have any Spyware your system.

Once that has completed, download every patch Microsoft has for the OS.

Take Care,

Richard
Naples Air Center, Inc. is offline  
Old 4th May 2004 | 16:31
  #6 (permalink)  
25 Anniversary
 
Joined: Mar 2000
Posts: 406
Likes: 0
From: Winchester.Hants.England
Just cleaned the "Sasser" virus from someone's machine. It behaves almost the same as "Blaster" . In the closing down message it mentions "lsass.exe" which indicates you've got it.
Regards
FBW
Flybywyre is offline  
Old 4th May 2004 | 20:04
  #7 (permalink)  
Thread Starter
20 Anniversary
 
Joined: Apr 2003
Posts: 488
Likes: 9
From: UK
all help appreciated guys. Many thanks.

H49
Helen49 is offline  
Old 4th May 2004 | 20:13
  #8 (permalink)  

'nough said
 
Joined: Sep 2002
Posts: 1,025
Likes: 0
From: Raynes Park
Flybywyre, lsass.exe is a windows application which is required and will always be present - the worm infects it causing the problem. The real clue is that you can see avserver.exe running when you do a ctrl-alt-del.

Charles
amanoffewwords is offline  
Old 4th May 2004 | 22:34
  #9 (permalink)  
 
Joined: Jan 2004
Posts: 357
Likes: 0
From: Bracknell UK
Hi Helen,

Please download 'Hijack This!' from here, unzip, and place it in it’s own folder, (not in the temp folder, or on the desktop) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a PM to me.

This will give me a rundown of what’s going on in your PC. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required.

(You may have all now guessed that this is a C&P)..

Cheers

Liam
E-Liam is offline  
Old 5th May 2004 | 21:17
  #10 (permalink)  
25 Anniversary
 
Joined: Mar 2000
Posts: 406
Likes: 0
From: Winchester.Hants.England
Thanks AMOW's.............

As I said it shows up in the RPC message

Regards
FBW
Flybywyre is offline  
Old 6th May 2004 | 20:05
  #11 (permalink)  

Official PPRuNe Chaplain
 
Joined: Apr 2001
Posts: 3,498
Likes: 0
From: Witnesham, Suffolk
Odd one here. I tried to run Trend Micro Housecall (I've done so before but not for a couple of years). It wanted to download and install a plugin for Netscape.

But I don't use Netscape. I use Mozilla (v 1.7RC1 at the moment), and it couldn't find the Netscape Plugins folder so refused to go any further. I showed it the Mozilla one, but that didn't satisfy it.

Sounds like Mozilla is even more secure than I thought!
Keef is offline  

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.