General discussion

Locked

PC Shutsdown automatically

By pcmaster ·
Today My Windows 2000 PC started shutting down automatically. After a few minutes a window pops up and says windows is restarting. The window says something like NTAUTHORITY/Shutdown

Counts of about 30 seconds and does a reboot. Anyone know what causes it and how to fix it?

Thanks

This conversation is currently closed to new comments.

11 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by parton15 In reply to PC Shutsdown automaticall ...

Check out the link below for the answer and fix

http://support.microsoft.com/default.aspx?scid=kb;en-us;q318650

Collapse -

by pcmaster In reply to

Poster rated this answer.

Collapse -

by sgt_shultz In reply to PC Shutsdown automaticall ...

...and get a firewall (e.g. ZoneAlarm)...

Collapse -

by pcmaster In reply to

Poster rated this answer.

Collapse -

by Ebk1025 In reply to PC Shutsdown automaticall ...

yeah we used to do that all the time in class
shutdown "IP/hostname" at the command line
im not sure how to sut it off but if you type
"shutdown /a" at command line/run menu it will abort the shutdown

Collapse -

by pcmaster In reply to

Poster rated this answer.

Collapse -

by Joseph Moore In reply to PC Shutsdown automaticall ...

Actually, this is probably the Sasser worm. It just came out late Friday night. This worm exploits Windows 2K and XP machines that don't have the MS04-011 patch. It triggers a problem in LSASS.EXE, which causes the 60 second shutdown you are seeing.
Go here to read up on this:
http://www.microsoft.com/security/incident/sasser.asp
(link also at: http://tinyurl.com/39hae)
And get the patch to stop this.
Then run an updates antivirus scan.

Collapse -

by pcmaster In reply to

Poster rated this answer.

Collapse -

by RCOM In reply to PC Shutsdown automaticall ...

This is related to a couple of viruses but the most recent is as mentioned, "W32/Sasser.worm.a". This attacks systems that have not been patched with a Microsoft security update for an Exploit in LASASS. Get the patch from the following link.

http://tinyurl.com/37grk

To manually remove this virus follow these steps:

1. Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.

2. Delete the file AVSERVE.EXE from your WINDOWS directory (typically c:\windows or c:\winnt)

3. Run "Regedit" to Delete the "avserve" value from:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run

4. Reboot the system into Default Mode

To automatically remove the files download and run Stinger.exe from Network Associates:

http://vil.nai.com/vil/stinger/

Go to the following Microsoft link to learn how to protect your system.

http://tinyurl.com/n9fy

Collapse -

by pcmaster In reply to

Poster rated this answer.

Back to Windows Forum
11 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums