NT Authority/System error message

For anyone running Windows XP and is getting an error regarding NT Authority you can get a patch here

<a href="http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp" target="_blank">http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp</a>

yeah the same shit happened to me. good thing i did downloaded it. Thanks man. Anyways, any idea why this happened?

This is how I got ruined by some faggot.
Had to format my C: Drive.

Great times.

whoa whoa...i just turned my cpu on and i got this 'system will shutdown in 50 seconds' message. obviously i just yanked the power cord out and rebooted, seems to be fine so far...what the fuck is it?

yeah that shit wont go away no other remedy than to download the patch.

i just got back from seeing T3 for the second time, and that shit freaked me out proper, with all these self-aware computers. fucking ironic or what? so, how long has this shit been happening? just started todasy or what? i got norton antivirus running and still no sign of the bastardio.

Wow, it's really cool that the Neo Geo can apparently run Windows XP. Great news.

Seriously though, EVERYONE needs to go download this patch ASAP. This is a bigger security hole than normal for Microsoft (if that's possible) and it doesn't take long at all to download and install.

I guess its been going on for at least a few weeks...big time that is.

Seems as soon as I noticed it...tons of people started noticing it on forums. But I was too late. VIRUS VIRUS VIRUS.

Oh well. It's just a computer.

Sorry for posting it so late and that a few had to reload their computers.

Anyway I am a supervisor for Gateway tech support and we received about 30 of these in a row before we realized something serious was happening.

We all believe it was a virus that exploits a known vulnerability in any NT based system. The patch was released over 8 months ago but Microsoft has not made it available on Windows update. So far we estimated that over 35,000 Gateway users have the same issue and it appears to be growing in larger numbers.

Today I spent my entire shift searching the web for any possible fixes and once I found it this was the second place I went.

At first we all thought it was an error in XP for everyone but now that I am home I see that isnt the case as my computer is having no issues whatsoever.

For those of you that havent gotten any error download the patch immediately and for those that had to reload I suggest you get it as well as the virus is going to contiue.

As far as why Norton isnt detecting it, my best guess is that Norton looks for known virus and this one wasnt known until today.

Firewall... Firewall... Firewall... I think that should do it. As for Norton not detecting it, it makes sense, this is probably not a virus that executes "Virus Like Activities" Heuristics are used to determine malicious files, but if the application is exploiting something Windows does automatically, then it shouldn't really see it as a virus. However, the second it starts renaming certain files, or starts editing the registry... alarms would be set off. If anyone has contained this virus please submit it to Symantec, as they test it and release a patch for it ASAP... Security Response is there all the time for things like this...

-Nick

nruva:
Firewall... Firewall... Firewall... I think that should do it. As for Norton not detecting it, it makes sense, this is probably not a virus that executes "Virus Like Activities" Heuristics are used to determine malicious files, but if the application is exploiting something Windows does automatically, then it shouldn't really see it as a virus. However, the second it starts renaming certain files, or starts editing the registry... alarms would be set off. If anyone has contained this virus please submit it to Symantec, as they test it and release a patch for it ASAP... Security Response is there all the time for things like this...

-Nick

Click to expand...

I firewall wont help. There was another computer on my network at home that was hit and we are all using the same firewall.

I believe it was more or less just a script that was set to execute today....not necessarily a virus but just a batch file or something similar.

Decepticon:

nruva:
Firewall... Firewall... Firewall... I think that should do it. As for Norton not detecting it, it makes sense, this is probably not a virus that executes "Virus Like Activities" Heuristics are used to determine malicious files, but if the application is exploiting something Windows does automatically, then it shouldn't really see it as a virus. However, the second it starts renaming certain files, or starts editing the registry... alarms would be set off. If anyone has contained this virus please submit it to Symantec, as they test it and release a patch for it ASAP... Security Response is there all the time for things like this...

-Nick

Click to expand...

I firewall wont help. There was another computer on my network at home that was hit and we are all using the same firewall.

I believe it was more or less just a script that was set to execute today....not necessarily a virus but just a batch file or something similar.

Click to expand...

If you find a file or anything that you think is causing it please send it to Symantec, or if you would like you can send it to me and I will hand it to someone in Security Response... let them know what is going on, etc.

-Nick

Anyone know if you can apply the patch if a system has already been compromised?

Just for kicks, search for the file "w32.pinfi"

Man,it happened to me too!


i was so pissed...i just bought a new computer...

man thanks for the patch^__^

i downloaded the Xp 32 Bit one...but i'm not sure if my xp is 32 or 64,i'm not an expert..

so how can i see it?

Sorry for going OT...

and thanks again for the patch

You can apply the patch to any system that has been infected already but the virus is still there, it just fixes the error so you can do more.

As far as determining what version of XP.....unless you dropped about $8,000 for your computer you are using the 32 bit edition. Also when you boot up your machine it would say 64-Bit edition on the splash screen.

damn i got too! i applied the patch but it still keeps happening! wtf???? what do i do? 36 seconds top shut down nooooooooooooooooooooooooooooooooo

damn, u got the same shit as i did. it sucked ass. i was so pissed off, i thought i caused, cause thats when it happened, while i was on my compy 386, this shit happened. i had to call comcast but was on hold for an hour(some worm, huh). Finally i got the information, put on my firewall, downloade the microsoft.40 patch, shut down, then put bachk the firewall off. scary as hell.

then my GBA got the virus. buttrock

alright i found the fix by symantec.
heres the link

<a href="http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html" target="_blank">http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html</a>

follow the instructions then install the patch it should be fine after that.

I had those messages WAY back, but due to a badly installed windows. It was kinda of fun... imagine talking with msn and then the "Your system will shutdown in 60 seconds"

Oh my god! Somebody set us up the bomb lol

Ironically now it's provoqed by a virus I have no warnings

I see^__^ thanks Decepticon

I had a hell of a time with this yesterday and once before about a week ago. Yesterday it happened multipule times then I did a windows update and everything was fine. What odd though is that every application on my system would run EXCEPT Outlook Express...after I did the update it works fine. I'll dl the patch though, thanx!

mlloyds Removal Steps for RPC virus
(W32.Blaster.Worm)The 60 second shut down thing!
1) Enter Safe mode
• Power on the computer, tapping F8 once a second, until the Windows startup menu appears
• Select SAFE MODE and press ENTER ENTER
• Login as normal when prompted.
• If a message saying you are running in safe mode appears with a YES / NO button click YES.
• Wait for the desktop to load.
2) disable DCOM.
• Click Start
• Click Run
• Type DCOMCNFG.EXE
• Under CONSOLE ROOT, Click the + next to COMPONENT SERVICES
• Under this (takes a few seconds to appear) click COMPUTERS
• In the righthand pane, right-click MY COMPUTER
• Click PROPERTIES
• Select the DEFAULT PROPERTIES tab
• Remove the tick from ENABLE DISTRIBUTED COM ON THIS COMPUTER
• Click OK and apply the changes.
• Close DCOMCNFG.EXE
3) Disable System Restore (on Windows XP)
• Click START
• Right Click MY COMPUTER
• Click PROPERTIES
• Select the SYSTEM RESTORE tab
• Tick TURN OFF SYSTEM RESTORE ON ALL DRIVES
• Click OK to apply changes.
4) Connect to the internet and download the virus removal tool
• Shutdown and restart the computer, allowing it to boot up as normal
• Login as normal
• Connect to the internet and open this page:
<a href="http://securityresponse.symantec.com/avcenter/FixBlast.exe" target="_blank">http://securityresponse.symantec.com/avcenter/FixBlast.exe</a>
• Save this file to the desktop.
• A) Open/run the file once downloaded
• Click the START button.
• Wait a few minutes while the program scans the computer for the virus.
• When finished click OK.
• A reminder pops up to download the Patch from Microsoft.
• First time run through Click NO, restart Windows, then repeat from step 4 A). Second time
follow the next step.
• Click YES and it connects to this page automatically:
<a href="http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026." target="_blank">http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.</a>
asp
• Select Windows 2000 or Windows XP 32 bit as appropriate
• Click the DOWNLOAD on the right.
• Run this program. Following the prompts.
5) Repeat 2 then 3 but replacing the tick for ENABLE DISTRIBUTED COM ON THIS
COMPUTER and removing the tick from TURN OFF SYSTEM RESTORE ON ALL DRIVES.

Decepticon:
For anyone running Windows XP and is getting an error regarding NT Authority you can get a patch here

<a href="http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp" target="_blank">http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp</a>

Click to expand...

OMG thanks Decepticon for posting this info. It is strange... I just got this error message yesterday on my home PC after coming back from vacation. It seems to only do this message if I go online, and usually happens within 5 minutes of logging in.

Thanks again!

Thanks ^^... I didn't get hit with that yesterday, but I had a lot of friends (even my Girlfriend) who had it...I posted the links for them and they all say thank you wink