VIRUS ATTACK

last SG · 2005-12-16T15:57:36+00:00

thks guys. will try out all the methods n let u knw which workd!!!! really appreciate all the advice! thks!

fudgester SG

Hmm.... I got the exact same symptoms when I was hit by the blaster worm. If you say that it's neither blaster or sasser, then I'm not sure how I can help you.

I guess the only thing you can really do is to call in the pros. You may very well have to reformat your hard disk in the worst case scenario.

ndmmxiaomayi SG

Have you update your virus signatures? If not update it first before scanning. Scan your computer for viruses. Nowadays, not only Blaster and Sasser virus will cause auto shutdown.

Have you patched up your computer?

After scanning if the results show that your computer have no viruses, then answer these questions:

1) Is a firewall installed for your computer? If no firewall is installed, one reason why your computer auto shuts down because someone is controlling your computer, especially if you are using Windows XP. Windows XP allows someone to remotely control your PC, with or without your permission.

2) Have you opened any files send by your friends and your antivirus says virus detected?

yuko-ogura SG

i kana b4 too…tried all the various spywares progams but no use sia..in the end reformat com..all the music files gone lor..sian

chanff8 SG

If it appears again, try either one of the following methods:

1. Disconnect the LAN cable (If your using broadband). If this can't work, refer to 2.
2. Go to Start --> All Programs --> Accessories --> Command Prompt and type "shutdown -a" without the quotes and press enter. The shutdown process should be cancelled.

Now to check whether you have Blaster, which is rather unlikely, see if the process msblast.exe is in your Task Manager (Ctrl+Alt+Del).

If so, report back here...

Oh, and are you using Internet Explorer? You said it appears when you log on to the net. Can state internet connection?

Watch out also for these processes:
rpc.exe
rpctest.exe
dcomx.exe
lolx.exe
worm.exe

ndmmxiaomayi SG

Another question: Does it open an window and says you have xx seconds (xx is a number like 20) left before it shutdown?

If so, go to Start --> Run. Type in shutdown -a

This will abort shutdown.

dragg SG

i tried all the methods recommended by the symantec website. it doesnt work.

i did a recovery and lost all my data.

ndmmxiaomayi SG

All these can be easily by applying the Microsoft patch.

Patch

For more information on these processes, go to:

http://www.f-secure.com/v-descs/rpc.shtml

http://www.avp.ch/avpve/worms/win32/autorooter.stm

http://www.dbforums.com/t873450.html

Although lolx.exe cannot spread by itself, it is an IRC backdoor. It can be used by intruders to control your computer, resulting in the auto shutdowns.

ceecookie SG

eh?

last time my computer also kenna virus and keep shutting down....scan virus but norton anti virus say no virus....then after shutting itself down 2 times, the computer never shutdown on its own again...wierd.dunno where's the virus gone to...

ndmmxiaomayi SG

Got update your antivirus? Never update cannot tell.

Weird case though, auto shutdown for 2 times and then never happen again.

chanff8 SG

Its always important to update both Windows and Anti-virus. Must never be lazy about it Wink

ceecookie SG

the antivirus is always auto-updated and install definitions if avail....
then it's also up to date....

then my computer was also kenna by other virus like Funner...
it cre8 havoc on my computer and i had to use system restore to revert some of the damage...then i did a full system scan in safe mode...never detect any virus but after that also no more attack......

ndmmxiaomayi SG

Probably auto update a bit slow, that's why happened for two times and never happen again.

GSL SG

Does it match this Screenshot ?

ceecookie SG

something like this in my case

chanff8 SG

yup, it should look like that

GSL SG

Does it said something like C:\WINDOWS\SYSTEM32\ terminated ?

ceecookie SG

yes.....

GSL SG

ok. What's the file name Question

ceecookie SG

i think also lsass.exe

ndmmxiaomayi SG

lsass.exe cannot be terminated. Terminate it and your computer will be shut down. Aborting the shut down will cause instability to your computer.