Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

Geek Culture / Weird error

Author
Message
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 10th Apr 2004 15:49
Link
OK, im unable to use my regular computer at the moment because of a strange problem with it. Whenever I boot it up, about a minute after boot up a box appears saying 'this system is shutting down, please save any work and log off' while it counts down from 1 minute. It gives the reason that 'lsass.exe' in the WINDOWS\SYSTEM32 directory terminated unexpectedly with the status code 128. It also says the shutdown was authorised by NT AUTHORITY\SYSTEM. It means I cant do anything, plus it couldnt have happened at a worse time, as I have a load of graphics projects and an IT project to finish in a week.

If I didnt know Id say it sounds something like the msblast virus, but I installed the prevention patch when my system as originally set up.

Does anyone know whatit is or even better how to get rid of it? If I cant im going to have to spend a day re setting my computer up.

Any help is appreciated.

Back to top
Profile PM
CattleRustler
Retired Moderator
21
Years of Service
User Offline
Joined: 8th Aug 2003
Location: case modding at overclock.net
Posted: 10th Apr 2004 16:21 Edited at: 10th Apr 2004 16:21
Link
well I'd use the pc youre on now and search this occurance to see if it something valid like a stupid M$ problem or if it is the symptom of some worm or virus. It almost sounds like a virus/worm of some sort that is corrupted and executes its reboot scheme but isn't finalizing it's payload. See what you can find. Usually good info at

symantec
computer associates
nortons


Home of the VB.NET Class Builder Utility - Demo and FULL versions now available!!
Back to top
Profile PM
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 10th Apr 2004 16:27
Link
OK cheers, I'll give it a bash

Back to top
Profile PM
Mentor
22
Years of Service
User Offline
Joined: 27th Aug 2002
Location: United Kingdom
Posted: 10th Apr 2004 16:51
Link
do you have an up to date antivirus and a firewall enabled?...nope! thought not!, if you had you would have had your PC protected against this worm/virus and your life would be so much more stress free for the cost of a little system slowdown, you can get something like Antivir if you don`t have a network, free for home users, updates 2 to 5 times a week and pretty solid, then install a firewall and take the time to set it up correctly and run adaware to clean out any trojan/spyware/keyloggers you may have had added to your system, if aids spread across the planet at the speed of light you would take precautions yes?, so why do so many people stick their unprotected PC onto the net and expect to get away with it?, consider yourself told off

Mentor.

PC1: P4 hyperthreading 3ghz, 1gig mem, 2x160gig hd`s, ATI radeon 9800 pro gfx, 6 way surround sound, PC2: AMD 1.2ghz, 512mb ram, FX5200 ultra gfx, stereo 16 bit soundblaster, ups.
Back to top
Profile PM
Dave J
Retired Moderator
21
Years of Service
User Offline
Joined: 11th Feb 2003
Location: Secret Military Pub, Down Under
Posted: 10th Apr 2004 17:01
Link
Sounds exactly like the blaster worm. See if disabling it manually works.

1. Open the Run Dialog in the start menu
2. Type in "services.msc" and click OK
3. Double click the 'Remote Procedure Call (RPC)' Option
4. Click the 'Recovery' tab
5. Change the 3 options from 'Restart the computer' to 'Take no action'
6. Click OK

If that doesn't work then it mustn't have anything to do with the blaster worm as it exploited the RPC flaw. The fact that you have the patch means it shouldn't be the worm but who knows, it's worth a try.


"Computers are useless they can only give you answers."
Back to top
Profile PM Email
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 10th Apr 2004 21:44
Link
OK... couldnt find anything about it anywhere

Mentor: I do have a virus checker, it was updated about a hour before the problem occured, in fact the problem first started during a virus scan. As for a firewall, I was going to install one but was actually due to reset my system up soon anyway, just didnt expect this to fall on me all of a sudden before my priority work was done.

Exeat, I'll give that a try cheers...

Back to top
Profile PM
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 10th Apr 2004 21:53
Link
I gave it a try Exeat, but its still the same. If anything, it seemed that the shutdown initiated much faster, a matter of seconds after bootup. Strange.

Back to top
Profile PM
Lord Ozzum
20
Years of Service
User Offline
Joined: 29th Oct 2003
Location: Beyond the Realms of Death
Posted: 10th Apr 2004 22:12
Link
what virus software is it?

You're just jealous cuz the voices don't talk to you!!!
Back to top
Profile PM Email
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 10th Apr 2004 22:15
Link
AVG 6

Back to top
Profile PM
Lord Ozzum
20
Years of Service
User Offline
Joined: 29th Oct 2003
Location: Beyond the Realms of Death
Posted: 10th Apr 2004 22:19 Edited at: 10th Apr 2004 22:20
Link
can't help you there then
well, maybe you were one of the few "lucky" to get a new one

well, try this
enter safe mode
I suggest doing a search for it
then press control alt delete and end it
then quickly delete it before it turns back on

-OR-

reformat
which, if it takes that, that would suck

You're just jealous cuz the voices don't talk to you!!!
Back to top
Profile PM Email
Wik
21
Years of Service
User Offline
Joined: 21st May 2003
Location: CT, United States
Posted: 11th Apr 2004 03:53
Link
Make sure "shutdown" isnt in your autoexec.bat file


Back to top
Profile PM
Dave J
Retired Moderator
21
Years of Service
User Offline
Joined: 11th Feb 2003
Location: Secret Military Pub, Down Under
Posted: 11th Apr 2004 04:13
Link
http://www.k-otik.com/exploits/02.14.MS04-007-dos.c.php

Turns out it's a DoS attack, unfortunately that page doesn't give a solution because it's imforming us how to exploit the flaw.


"Computers are useless they can only give you answers."
Back to top
Profile PM Email
the_winch
21
Years of Service
User Offline
Joined: 1st Feb 2003
Location: Oxford, UK
Posted: 11th Apr 2004 05:09
Link
Well if it is that which sounds unlikley to me just disconnect the comp from the internet.

you ain't the cops
Back to top
Profile PM Website
M00NSHiNE
21
Years of Service
User Offline
Joined: 4th Aug 2003
Location: England, UK
Posted: 11th Apr 2004 15:39
Link
Its not on the net which makes it sound to me like a pointless attack to random computers to stop them getting access to data etc. My computer isnt connected to the net and doesnt have time to probably.

Back to top
Profile PM
Back to top

Login to post a reply

Server time is: 2024-09-21 15:49:32
Your offset time is: 2024-09-21 15:49:32