Over 1 million tech questions and answers.

NT Authority\System Shutdown problem and helper.dll problem among others

Q: NT Authority\System Shutdown problem and helper.dll problem among others

Hello,

My mother was using my computer and she keeps going to this website that downloads malware (yeah, she not going to go on this website anymore... lol) on my computer. I have dealt with this several times and now I have a few things on my computer that I cannot seem to get rid of.

I had over 32 malware on my computer and managed to get rid of those. However, I am still having the NT Authority\System shutdown problem upon using my computer from hibernation. Also, whenever I reboot, I get the helper.dll in the common folder upon startup. I may or may not have other problems also.

I really appreciate anyone who can help me.
Thanks in advance.

DDS (Version 1.1.0) - NTFSx86
Run by Steffi at 14:04:04.37 on Sat 01/03/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.959.300 [GMT -5:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated)
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)
FW: Norton Internet Worm Protection *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\Steffi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Steffi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Steffi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Steffi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\Steffi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Steffi\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [Google Update] "c:\documents and settings\steffi\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
StartupFolder: c:\docume~1\steffi\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe
StartupFolder: c:\docume~1\steffi\startm~1\programs\startup\vongot~1.lnk - c:\program files\vongo\Tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
IE: Copy to Semagic - c:\program files\semagic\copy.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Semagic - c:\program files\semagic\link.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: microsoft.com\update
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SEH: {CB0A0B68-3F3C-61D2-A901-8381E131D211} - No File

============= SERVICES / DRIVERS ===============

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-7-1 34312]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-19 99376]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20080912.002\naveng.sys [2008-9-12 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20080912.002\navex15.sys [2008-9-12 873552]
R4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R4 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-7-1 468224]
R4 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S3 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
S3 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]

============== File Associations ===============

inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"

=============== Created Last 30 ================

2009-01-01 19:42 <DIR> --d----- c:\program files\ESET
2009-01-01 19:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-01 19:04 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-01 19:04 <DIR> --d----- c:\docume~1\steffi\applic~1\SUPERAntiSpyware.com
2009-01-01 18:28 <DIR> --d----- c:\temp\REX81
2009-01-01 18:28 <DIR> --d----- c:\windows\system32\xn
2009-01-01 18:28 <DIR> --d----- c:\windows\system32\p2
2009-01-01 18:28 <DIR> --d----- c:\temp\1cb
2009-01-01 18:28 <DIR> --d----- C:\Temp
2008-12-18 22:32 <DIR> --d----- c:\program files\iTunes
2008-12-18 22:32 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll

==================== Find3M ====================

2008-12-13 01:40 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll
2008-11-07 14:23 32,000 a------- c:\windows\system32\drivers\usbaapl.sys
2008-10-30 21:21 92,819 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-24 06:21 455,296 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-23 07:36 286,720 -------- c:\windows\system32\dllcache\gdi32.dll
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 08:11 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 08:11 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 11:34 337,408 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-15 02:06 633,632 -------- c:\windows\system32\dllcache\iexplore.exe
2008-10-15 02:04 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2007-10-29 21:36 836 a------- c:\docume~1\steffi\applic~1\wklnhst.dat
2007-09-06 12:28 1,097,728 a------- c:\documents and settings\steffi\iTunesMobileDevice.dll
2007-05-30 22:17 3,655,608 a------- c:\program files\FLV PlayerRCATSetup.exe
2007-05-30 22:17 25,990,392 a------- c:\program files\FLV PlayerRCSetup.exe
2006-12-09 01:34 22 a--sh--- c:\windows\sminst\HPCD.sys
2007-03-09 02:12 27,648 a--sh--- c:\windows\system32\AVSredirect.dll

============= FINISH: 14:04:47.60 ===============

RELEVANCY SCORE 200
Preferred Solution: NT Authority\System Shutdown problem and helper.dll problem among others

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: NT Authority\System Shutdown problem and helper.dll problem among others

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results, click no to the Optional_ScanFollow the instructions that pop up for posting the results.Close the program window, and delete the program from your desktop.Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERER,K

Read other 2 answers
RELEVANCY SCORE 94

I just turned on my computer and there was a pop up  message  : The system needs to shut down because of NT Authority/System due to the fact that C:\Windows\system32\services.exe has terminated unexpectedly
 
After the shutdown, I restarted the computer again, but now there's no "message" and the machine seems to be working fine. But I am not convinced, I am very apprehensive. Any advice, please?
 
OS  : Windows XP Professional  Version 2002 Service Pack 3
 
Thanks much

A:Nt Authority System Shutdown Problem!

Please download MiniToolBox  , save it to your desktop and run it.
 Checkmark the following checkboxes:  List last 10 Event Viewer log  List Installed Programs  List Users, Partitions and Memory size.
 Click Go and paste the content into your next post.
 Also...please Publish a Snapshot using Speccy - http://www.bleepingcomputer.com/forums/topic323892.html/page__p__1797792#entry1797792 , taking care to post the link of the snapshot in your next post. 
Louis

Read other 12 answers
RELEVANCY SCORE 94

it keeps giving me an error saying nt authority system must shut down and it says dcom server process and it has a countdown of a minute....the cd drive is also broke so i cant pop in the cd....Is there any other way 2 fix this....i even looked up these and none showed...
Msblast.exe, Nstask32.exe, bleep32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, and Yuetyutr.dll
can someone please help me!!!!!!!!!!!

A:Nt Authority System Shutdown Problem!

Well i dont know much of your problem but i can give you a little help, whenever the SYSTEM SHUTDOWN message appears, go to Start -> Run -> then type in "shutdown -a" without the quotes (Duh.) it will terminate the process..for now

Read other 3 answers
RELEVANCY SCORE 92

Hello,I'm new to this site but my problem seems to be similar to others posted here. My computer is shutting down after I go on the internet. I get a "Generic Host Process for Win32 services" message about a problem and then a NT/Authority System Shutdown (your computer needs to be shut down in 60 seconds). I'm managing around it with "shutdown -a" each time (only once per start-up and going on-line). I was also having issues with the google search in Firefox being re-directed. I've been working on this for days running Symantec, Spybot, and some other stuff. When I ran MalawareBytes it found a bunch of culprits (Trojans, back door, and malware traces) so I thought I was saved but it popped up again the next time I started the computer.Any help would be greatly appreciated but be prepared as I am not very good with computers. Here is the contents of the of the DDS.txt log DS (Ver_09-12-01.01) - NTFSx86 Run by Owner at 19:48:18.28 on Thu 02/04/2010Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Outdated) {FB06448E-52B8-493A-90F3-E43226D3305C}============== Running Processes ============================= Pseudo HJT Report ===============uStart Page = hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=7.0unattached&bm=ho_centraluSearch Page = hxxp://www.google.comuSearch Bar = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://ww... Read more

A:NT/Authority System Shutdown and Google Redirect Problem

Hello and welcome to Bleeping Computer! We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Fo... Read more

Read other 2 answers
RELEVANCY SCORE 90.4

Hello,I am new to this site and I was hoping you guys can be of assistance to me. I am experiencing a virus that is shutting down my computer usually around 12:30am every night with the message NT/Authority System Shutdown your computer needs to be shut down in 30 seconds. Last time I received this was back in 2004 when I had the same worm most people had on their computers. Another Issue I am having is my firefox and IE is extremely slow mainly due to this Google Redirect Bug/Virus whatever you want to call it. I have searched for days to try to resolve this matter. I downloaded numerous malaware programs such as Ant-Virus Plus, Pareto, Trojan Remover, Goored Fix, MalawareBytes I believe its called.. but nothing has worked. I scanned my system plenty of times but it never cleaned anything.I have a Sony Vaio Laptop PCG-V505BX running on XP. Please let me know what other information you need.

A:Virus/Malaware NT/Authority System Shutdown and Google Redirect Problem

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.Please describe the issues you are experiencing with your computer.

Read other 19 answers
RELEVANCY SCORE 80

NT Authority- system keeps shutting down my computer. I have scanned for the blaster worm but the reports say it isn't on my computer. I also changed the RPC service to "restart the service" and "take no action", but still keeps shutting down. One thing I'm wondering about is when I used McAfee's online fix, "Stinger", while scanning, it gets to this file, Win\drivercache\i386\driver.cab\evpnt50p.chm file hpv880al.dll, computer stops responding and makes ticking noises. I have to manually turn off my computer. This happens every time i use Stinger. Any advice would be GREATLY appreciated. Thanks and have a great day.

A:NT Authority shutdown problem

Hello and Welcome to TSF

The error you've encountered is a symptom of the MSBlast worm (also known as the W32.Blaster.Worm), which has been around since August 2003. To resolve this error, you first need to use the command

shutdown -a

to stop the system from shutting down so that you can patch the computer and remove the virus. Next, download and install the patch, which is available on Microsoft's Web site.

To remove running versions of the virus from your PC, open Task Manager, select the Processes tab, then click End Process for all of the following processes:

* MSBLAST.EXE
* *****32.EXE
* TEEKIDS.EXE
* MSPATCH.EXE
* MSLAUGH.EXE
* ENBIEI.EXE

To prevent the virus from starting again, perform the following steps:

1. Start a registry editor (e.g., regedit.exe).
2. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry subkey.
3. Remove any value that mentions any of the executables listed above.
4. Close the registry editor.
5. Open Windows Explorer, search your Windows folder for any of the executables listed above, then remove those files.
6. If you're running Windows XP, enable the Internet Connection Firewall (ICF) and use Windows Update to keep your system up-to-date.

An automated virus removal tool that replaces the steps above is available at the Symantec Web site. (If you use this tool, you'll still need to download and install the patch from the Microsoft We... Read more

Read other 1 answers
RELEVANCY SCORE 72.8

I would like to apologise in case this problem has come up before, I've searched extensively and found out that it is a variation of a Blaster Worm thats been about for quite some time.
My problem seems to be different from the cases I've seen elsewhere because it persists even if I re-start my PC in safe mode and after windows repair (via the original disk).
The message that pops up is that the system needs to shut down because of NT Authority/System due to the fact that C:\Windows\system32\services.exe has terminated unexpectedly with status code -1073741819.
As I have mentioned, I've attempted to re-boot in Safe Mode to edit the registry in order to render it inactive, but the message still popped up. Repair with the original disks failed to remove it to. I'm runnin Windows XP SP2 and it seems that my Avast! antivirus did nothing.
I am quite baffled by the problem and am wondering if anyone can point me towards a solution. Any help would be greatly appreciated. Thank You for Your time.

Read other answers
RELEVANCY SCORE 72.4

Hi everyone,

Joined the forum recently. I have a serious problem. My system keeps shutting down after a popup appears saying "nt authoriy/system has authorised this shutdown" with a count down timer starting from 58 seconds. I searched this forum if there was any hijack this log posted about this and i found one. I tried downloading trend micro and running it. but it gave some error message and finally didnt work. And there is some zlip which got installed in the c drive. As soon as I start my computer a window pops up in which i can only see a cross mark in red and an OK button. Cant see the message. Even after pressing ok button it keeps popping up. This stops only when I end the process in the task manager. I tried running stinger. It found 4 infected files and cleaned them (or so it said). But the problem still persists.

Pls help!!

Thanks

A:NT authority/system shutdown

First thing, if you get that countdown window again, quickly either click start -> run or press Windows + R and type "shutdown -a" and hit enter (without the quotes of course). This will abort the auto shutdown, and although it may restart the timer, it will give you a few more valuable seconds.

Secondly, this sounds much like the Blaster worm. Here is more information about this virus and instructions for disinfection.

Afterwards, I would suggest going to GreyKnight's anti-spyware page here and following the instructions to keep yourself protected and remove any other malicious code you have on your system.

Read other 1 answers
RELEVANCY SCORE 72.4

Hello, I've been having a problem with my Windows XP computer, similar to the one described on this thread: http://www.bleepingcomputer.com/forums/lof...hp/t239409.htmlI get a pop-up that says: "System is shutting down, initiated by NT AUTHORITY/SYSTEM." It comes up regardless of whether or not I'm on the Internet. And it gives me a countdown of 60 seconds and then forces the shut down and restart of my computer. There are no buttons/options to click, and I can't close the popup.I followed the instructions on the thread above. I used ATF Cleaner and downloaded and installed Super Anti Spyware Free. I couldn't reboot the computer in Safe Mode (got a blue screen), and I can't even finish scanning the computer with Super Anti Spyware Free, because the popup always comes up at some point in the scan and shuts everything down. I also tried to do the Windows File Checker as suggested in the above thread, but again, the popup always comes up and shuts everything down before it finishes. Plus, I don't have any recovery discs or anything with me.After the computer restarts, I get a message that says, "Data Execution Prevention: To help protect your computer, Windows has closed this program: Generic Host Process for Win32 Services"I have McAfee Antivirus through my school, which I ran earlier today and nothing came up. I also ran Malwarebytes and nothing come up either.

A:"NT Authority/System" Shutdown

When you get a message that the system is shutting down, follow these steps to stop the cycle:Press the Windows Key + R keys on your keyboard or go to > Run..., and in the Open dialog box, type: cmdPress Ok.At the command prompt C:\>, type: shutdown -aPress Enter.-- Vista users can refer to these instructions:How to Enable Run Command in Vista - How to Run a command prompt as an AdministratorPlease download Malwarebytes Anti-Malware (v1.44) and save it to your desktop.alternate download link 1alternate download link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan.If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mba... Read more

Read other 3 answers
RELEVANCY SCORE 72.4

Hi

My parents computer has recently been getting this window appear within a couple of minutes of logging into the computer which says some message about NT Authority/System Shutdown and a 60 second timer. When the timer reaches 0 the computer will restart and it will just continue to do so.

So I done some google searches and heard about 2 viruses called Blaster and Sasser I believe. I ran both the fixes for both of these viruses in safe mode, and neither or them said the machine was infected. I am now clueless as to what to do next.

Can't really reformat the machine either as they haven't backed it up. Any advice?

Cheers

A:NT Authority/System Shutdown

Hi mikasaka


Your parent's computer is very likely to still be malware infested: even though you ran Blaster & Sasser cleaners. There are several versions of each of those worms, and there are still other exploits that can cause similiar symptoms.

See if you can make an up-to-date UBCD4Win DVD (when making the DVD, be sure to update the antimalware programs on it with the latest malware definitions). All the instructions on what tools are included and on how to build the DVD are on the UBCD4Win website. It's a free tool, but you need to have a WinXP CD or installation files folder to create the disk. Once the DVD is created, boot your parents computer with it -- and use the antimalware tools on the UBCD4Win disk to clean the PC. I recommend using the IMGBurn program (included in their download) to burn the .iso onto DVD. When all the latest definitions and tools are added, a DVD is necessary for all the file to fit. [You can build a CD version too, but you have to carefully remove many programs for things to fit - if you want all the latest malware removal tools]. --- http://www.ubcd4win.com ---

Once it's malware-free, if Windows is too damaged to fix without reinstalling -- backup your parents documents, music, photos, videos, email, etc. onto removable media first --- and then perform the reinstall. They need a backup anyway.

Best of luck
. . . Gary

P.S. ... if you want to most thorough advice on cleaning their PC -- visit the Security Foru... Read more

Read other 1 answers
RELEVANCY SCORE 72.4

When I go to Task manager the SVChost.exe file that uses about 5k memory is the one that initiante the shtdown I know how to kill the shutdown process with the shutdown -a in the run, I have ran the following full system scans Malware bytes, Ad-Aware Se, Spy Bot Search and Destroy, as well as my Virus protection Eset Nod32, after all of those scans I still have the stupid virus here are all the required log files.
Hijack this
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:50:06 PM, on 9/1/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\xampp\apache\bin\httpd.exe
C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eH... Read more

A:Nt Authority System Shutdown

Bump
 

Read other 1 answers
RELEVANCY SCORE 72.4

A friend has a fairly new Compaq laptop (Presario 2100). After first logging onto the Internet it works fine for several minutes. Then a window appears which reads, as follows:

"This system is shutting down. Please save all work in progress and log off. This shutdown was initiated by NT AUTHORITY\SYSTEM.
Time before shutdown (starts at 1 min. and winds down to 0).

Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly."
 

A:Shutdown due to NT AUTHORITY\SYSTEM

Try reading this .
 

Read other 3 answers
RELEVANCY SCORE 72.4

Hi, I was instructed by my moderator to post here for further help. My previous thread was http://www.bleepingcomputer.com/forums/topic400312.html/page__gopid__2276285

I've followed the Prep Guide, but my computer won't allow me to run any new programs. Everytime I try to execute one, I get a pop-up with a black screen and white writing that says "Program too big to fit in memory". So I don't have any logs I'm able to produce and send you. Please help! Thank you!

Here's my original post with the problem:
My computer keeps getting a popup that says, "System Shutdown This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM Message: Window must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly."
It then counts down 60 seconds and restarts. When it restarts, I often get a black screen with the cursor still visible. I have to push the power button to completely shut it down and then turn it back on. I've pulled the internet cable out, and that hasn't helped. I type in "shutdown -a" and that helps until the screen pops up again. I tried putting the DDS program and DeFogger onto a flash drive and installing it on the computer, but it won't allow me to. I was able to run Ad-Aware, and that come up clean. I can't run my normal Anti-Virus (CA Internet Security Suite). Th... Read more

A:NT AUTHORITY\SYSTEM shutdown

Hi,Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

Please reply to this post so I know you are there.The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.Once I receive a reply then I will return with your first instructions.Thanks

Read other 10 answers
RELEVANCY SCORE 72.4

I keep getting an error on my computer that states "this computer is shutting down. Please save all work and log off. Any unsaved changes will be lost. This shutdown was initiated by NT Authority/System. System will shutdown in 1:00. Message- Windows must now restart because the Remote Procedure Center (RPC) call service terminated unexpectedly." The counter on the error counts downs from one minute and then restarts the computer. I have tried running Mcafee virus scan and it will not even open. I tried to run Malwarebytes' Anti-Malware and I get a run time error. I have made attempts to look up a solution on the web from my iPad but everything says either run current antivirus scans, run malware scans or download something. I can not get on the Internet either. I have read the instructions for posting here and that I should download and run DDS and GMAC and then post the reports but I can not get on the Internet to download anything. It will not let me even open Internet Explorer and Firefox opens but does not connect to the Internet.

A:NT Authority/System Shutdown

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Whenever your machine prompts to shutdown, go Start > Run and type shutdown -a then press 'Enter'(note the space) and it will abort the shutdown.

------------------------------------------------------

Download the tools(dds and gmer) to USB drive on another computer and transfer them to your desktop. Transfer the logs back here via the USB drive.

------------------------------------------------------

Read other 19 answers
RELEVANCY SCORE 72.4

Okay I have a darned bug or something. I am running Windows XP Professional.
I have gone over all the possible ways to find the issue. I find NONE of the mblast.exe nor any of the other things associated with the blaster worm.

This link shows the exact popup that is coming up on my computer.
Gateway Support - NT Authority\System Error Message: "This system is shutting down. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly."

Yet all the fixes don't work. I disconnected it from my internet and it still shuts down. I also did the regedit and it doesn't show any of the items that might be there. mblast.exe isn't running.

I have tried to run w32blaster.worm removal tool and it just keeps popping up while I am trying to run it.

Right now I am on my laptop trying to find a fix. I have had to do
"shutdown -a" in the run line to keep it up and running.

I tried to run stinger but with it stopping me from even being able to pull up firefox, chrome, or IE I can't get it where I want it. It is on my external hard drive and isn't giving me the option of checking which hard drive I want to check and I can't get it to my main hard drive. I can't move pictures I can't do anything.
Please someone direct me to a fix that I can maybe get working.

Thanks
Teddie

A:NT Authority\System Shutdown

I would suggest starting here:
NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help - Tech Support Forum

Another option would be to run a scanner outside of Windows using one of the scanners available from AVG, AVIRA, BitDefender or Microsoft.

Read other 6 answers
RELEVANCY SCORE 72.4

I found a thread started last February (Confused: NT Authority\System shutdown because DCOM Server) that mirrored my experience, but it was closed without resolution. I start my computer and as long as I do not have my wireless antenna plugged into my usb port nothing goes wrong. However, when I plug my wireless into the usb port ussually with in a minute I get a message that pops up "The system is shutting down please save all work in progress and log off. Any unsaved changes will be lost. Shutdown initiated by NT Authority\System. Countdown 60...Windows must now restart because ... Service terminated unexpectedly." I don't recall which service terminates unexpectedly, although I think there may have been several different ones. In my internet search tonight, I have seen several mentioned, but nothing reminded me of the messages I have seen.

I run Windows XP Home, SP3 and use Mozilla Firefox as my primary internet browser. We have AVG security which has not found any problems. I have also run Malwarebytes, and while it found some things, it did not resolve this problem. Tonight I follwed the instructions posted by Gateway and ran the Symantec W32.Blaster.Worm Fix Tool, which reported that the worm was not found on the computer. Thankfully, I found the instructions on stopping the shut down (run: shutdown -a), so I was able to continue my quest to solve this problem. I have found some fixes that suggest downloading patches/fixes from Microsoft, but am told tha... Read more

Read other answers
RELEVANCY SCORE 72.4

Every time I plug in my printer( USB plug) HP deskjet 2345 I get this error message that my computer will shutdown in 56 seconds. I can't use the printer. The error says it is a problem with system32/services.exe I can use the USB ports for my Ipod and camera with no problems so it is not the USB port. This only happen when I plug in the printer. Please help thanks

A:N T Authority System Shutdown

Check the last poster's info in this link: http://forums.techarena.in/showthread.php?t=43030

Read other 6 answers
RELEVANCY SCORE 72.4

ok so i had a computer before and i was doing some upgrades and i fried the motherboard sent it back and got a new one same model and now someone told me i need to reinstall xp and whatnot because before it wouldent let me in so how do i go about reinstalling it?

ok so i was doing some upgrades to my motherboard and i fried it sent it to manufacturer and got a new one and yesterday i put it all togther and it started up fine and then a popup came up at the login screen saying NT\AUTHORITY SYSTEM blah blah then it says C://windows/system32/lsass.exe terminated unexpectedly and has to shut down and then it gives me 50 seconds and it restarts and does the same thing over and over.


should i use a kill disk and just start over? cause i have nothing important on my drive.
 

A:Nt Authority/system Shutdown

Yes, reformat and reinstall from scratch. Hopefully, that`ll solve your problem.

Regards Howard

You need to do the following.

Diconnect from the net and don`t reconnect, until you have your firewall software installed.

1 Restart your computer and go to setup usually by pressing the F2 or delete key.

2 Once you get into setup look for the boot menu and make sure you set it to boot from cd first followed by your hard drive.

3 Put the Windows xp disk into your cd drive.

4 Now save your settings and exit setup.

5 While your computer is booting you will see a message that says "press any key to boot from cd" press any key.

6 When the welcome to setup screen appears press enter and then press F8 to accept the Microsoft licence agreement.

7 You will be prompted to repair an installation press the escape key.

8 Now select the partition that you want to reformat and press the D key to delete it you will be asked to confirm that you want to delete the partition.

9 Now press C to create a brand new partition you will be asked what size you want the partition to be in mega bytes. If you just press enter then the partition will be the maximum size that you can have. This is perfectly ok if you don`t want to create multiple partitions.

10 You will now be asked to format the partition select the ntfs file sytem and do a full format.

11 Once the format is complete setup will continue.

Your computer will restart during the remaining setup again you will be asked to p... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

My computer keeps getting a popup that says, "System Shutdown This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM Message: Window must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly."
It then counts down 60 seconds and restarts. When it restarts, I often get a black screen with the cursor still visible. I have to push the power button to completely shut it down and then turn it back on. I've pulled the internet cable out, and that hasn't helped. I type in "shutdown -a" and that helps until the screen pops up again. I tried putting the DDS program and DeFogger onto a flash drive and installing it on the computer, but it won't allow me to. I was able to run Ad-Aware, and that come up clean. I can't run my normal Anti-Virus (CA Internet Security Suite). The whole strip at the bottom of the screen with the start button is and the running programs are has disappeared, so I have to Control-Alt-Delete to get to the Task Manager to attempt to open anything. I'm trying desperately to open and backup (it's been about a month since I've done so) my QuickBooks and photos. Any suggestions on how to get my computer back to normal?!

A:NT AUTHORITY\SYSTEM shutdown

Hello.

Can you boot in Safe Mode?

~Blade

Read other 12 answers
RELEVANCY SCORE 72.4

Greetings,When connected to the internet I receive a NT System Authority Shutdown from 5 mins to 15mins onlineAttached are the two files requested from the directions.Two notes: I ran the gmer without the internet connection as it would be still running when the NT System Authority error appearedI did NOT disable the CD emulation. I attempted the link and I received a 404 errorLooking forward to resolving this problem.I am grateful you provide this service.Regards SPencer

A:NT System Authority Shutdown

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL report,Please download OTL from this link.Save it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.Under the Custom Scan box paste this in:netsvcsmsconfigactivexdrivers32%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfiles%SYSTEM... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

When ever I try to open any web page on my pc I get this popup saying that This computer will be shut down by nt authority system....then it gives me 60 sec and it restarts. I've never seen anything like it.

Have you?

Thanks for any info.

A:nt authority system shutdown??

oops, same as below....sorry

Read other 12 answers
RELEVANCY SCORE 72.4

I have been fighting with my computer for a few weeks. I was infected with Virtumonde and Vundo which would not allow me to update antivirus programs. I used avast boot scan to get rid of that. Now, every time i boot up, i get a popup window that says NT authority System shutdown, the system will shut down in XX seconds. The only way i am accessing the internet is through Safe Mode with networking. I am unable to update through Windows Update in this mode apparently. I also tried the FixBlast scanner suggested when i googled the Shutdown problem which turned up nothing. The Windows Hotfix suggested only tells me that it can not be installed when
Windows Service Packs are present. All of my antispyware/antivirus turn up nothing when scanning, which again I can only access in Safe Mode. I downloaded Comodo Firewall. Any help would be greatly appreciated!! Thanks in advance.

DDS (Ver_09-01-07.01) - NTFSx86 NETWORK
Run by Administrator at 17:41:11.17 on Thu 01/08/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.157 [GMT -5:00]

AV: Norton Internet Security *On-access scanning enabled* (Updated)
AV: avast! antivirus 4.8.1296 [VPS 090106-1] *On-access scanning enabled* (Updated)
FW: Norton Internet Security *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsM... Read more

A:nt authority system shutdown

Howdy, my name is Hoov, and I will be helping you with your dilemma. I appologize for the delay in getting you help.Please make sure you watch this thread for responses. If you click the options tab at the top of your first post, you can select to track this thread. Here is what I am asking you to do during the repair of your computer*Tell me everything that you have done, if anything, to try and fix this problem.*Please only use 1 forum to help clear up your problem. Posting on more than 1 and following instructions from more than 1 forum will cause those helping you to pull out thier hair.*Follow my instructions - If you can't for some reason, or if you don't understand something, please tell me. If you deviate from my instructions, tell me, it may make a difference on where we go. Don't install anything, even other programs that have nothing to do with security or malware, it could cause things to change, and I would never know it. *Have faith. I will do all I can to get your computer working, and if I can't - someone else here will know something else to try. *Stick with me to the end. My aim is to fix your problems, and give you the tools and knowledge to keep this from happening again.Now onto trying to fix your computer.Please download Malwarebytes Anti-Malware and save it to your desktop.alternate download link 1alternate download link 2Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.When the installation begins, f... Read more

Read other 3 answers
RELEVANCY SCORE 72.4

I am having trouble diagnosing a problem with my XP Professional. I keep having an error message of NT Authority/System needs to close. What is this, why is it coming up, and what can I do about it?

A:NT Authority System shutdown

You have the blaster virus.Please post your hijack this log in the hijack this forum.Hijack this, is a handy little tool used to survey a system and tell what is currently running on the system. And if a threat is found you can check it and delete it. Althought hijack this doesnt tell you what a threat is or isnt, you can always post your log here and get help.If you want to download hijack this, it can be found herehttp://www.merijn.org/files/hijackthis.zip

Read other 1 answers
RELEVANCY SCORE 72.4

Keeps happening , along with Error sign saying hard error! I've been told my hard drive is failing, or my operating system. Which one could it be? sometimes my pc tower starts clicking and when this happens my desktop icons sometimes disappear and then I have to reboot from the tower and then I'm good for a couple of days. I have repaired the operating system just a few days ago, thats when the NT stuff started. This happens every time I use the dell operating system cd. I checked for viruses and spy ware with what I have installed and also online with trend micro. Please help I need to be able to get my pictures out of my computer I only have a DVD drive. Ordered a combo but dell messed up and I didn't even realize it til just recently.
 

A:NT Authority System Shutdown

I would suggest you get yourself a DVD burner. They are VERY cheap off of newegg these days and VERY easy to install. Clicking noises are probably coming from your hard drive and that is definitely not a good sign. Don't use your system anymore until you have means of backing up the data you need off of it. Flash drives are also pretty cheap these days. It might be worth your while to pick up a 2 gig flash drive and back up what you need. Get new hard drive and do a clean install.

The error that you are getting in full detail would be helpful. Aside from the normal hard drive read/write noises you should not hear any clicking coming from your pc.
 

Read other 2 answers
RELEVANCY SCORE 72.4

so im getting this automatic shutdown prompt that shuts my system down under the name of NT SYSTEM AUTHORITY SHUTDOWN. Also, it is affecting my typing and missing every third or fourth letter if i dont type like myfather!..here is my hijack this log. ( i have already run ewido, spybot, adaware, and norton)Logfile of HijackThis v1.99.1Scan saved at 11:19:55 PM, on 10/3/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Unable to get Internet Explorer version!Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Microsoft Windows OneCare Live\Antivirus\MSMPSVC.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\... Read more

A:Nt System Authority Shutdown..help!

Please help me! i have done everything i know how!

Read other 18 answers
RELEVANCY SCORE 72.4

Hi everyone,

Joined the forum recently. I have a serious problem. My system keeps shutting down after a popup appears saying "nt authoriy/system has authorised this shutdown" with a count down timer starting from 58 seconds.It also has the following message
" C:\Windows\System32\lsass.exe has terminated unexpectedly and the system needs to restart.
I searched this forum if there was any hijack this log posted about this and i found one. I tried downloading trend micro and running it. but it gave some error message and finally didnt work. And there is some zlip which got installed in the c drive. As soon as I start my computer a window pops up in which i can only see a cross mark in red and an OK button. Cant see the message. Even after pressing ok button it keeps popping up. This stops only when I end the process in the task manager. I tried running stinger. It found 4 infected files and cleaned them (or so it said). But the problem still persists.

Pls help!!

Thanks

A:nt authority/system shutdown

Download HiJackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install the newer version.
It will by default install to the directory - C:\Program Files\HiJackThis\
If it gives you an intro screen, just choose - Do a system scan and save a logfile.
If you don't get the intro screen, just hit [Scan] and then click on Save log.
Post the HiJackThis.log file here.

Read other 1 answers
RELEVANCY SCORE 72.4

Note: I apologize for originally posting this in the wrong forum. I was going too quickly, and I thought the notice said "HijackThis logs should be posted in this forum." What it really said was "No HijackThis logs should be posted in this forum." My bad.My first post is now filed under "Misplaced HJT Logs":http://www.bleepingcomputer.com/forums/t/185597/shutdown-by-nt-authority-system/Here is my second attempt...========================Thank you in advance for your help. I really appreciate it!I'm the IT support guy at a small high school in Detroit. Our office manager's computer is apparently infected. It will work fine for a long time (two hours or more) but then we'll see this message: "Services and Controller app has encountered a problem and needs to close." That's followed by a second window that says: "This shutdown was initiated by NT AUTHORITY \ SYSTEM." Then it reboots.I tried to clean it by running these tools:McAfeeFixBlastStingerThese attempts were unsuccessful.The computer is an HP Compaq nx7400 laptop,running Windows XP Professional.I will post my HiJackThis log below for your inspection,and I will watch the forum for a reply.Ed MorykwasConsortium College Preparatory High School\Detroit, Michigan========================HIJACKTHIS LOG========================Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:20:26 PM, on 12/10/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16735)Boot mode: NormalRunning processes... Read more

A:Shutdown by NT AUTHORITY \ SYSTEM

Dear Webmaster:
You can mark this topic "Closed." I read your Preparation Guide and followed the instructions very carefully, and that solved my problem. The Kaspersky Online Scanner was especially helpful.
Many thanks,
Ed Morykwas

Read other 2 answers
RELEVANCY SCORE 72

I am having trouble with xp home edition operating system. Everytime I go into window, I immediately get this message "XP SYSTEM SHUTDOWN NT AUTHORITY SYSTEM" and the pc shutdown within 60 seconds. Please help - Thanks

A:[moved from Other Operating systems]Xp System Shutdown Nt Authority System

it sounds like the blaster worm virus i will move you to security,ms have a patch for it
http://support.microsoft.com/kb/833330
follow the 5 steps here
http://www.techsupportforum.com/showthread.php?t=15968

Read other 2 answers
RELEVANCY SCORE 72

Hi everyone! My system is always being shut down by some NT authority (always while connected to the internet) and AVG Guard is always finding some virus. I always try to heal it but it doesn't seem to work. Also, I get loads of registry error popups while connected to the internet. Help! My HijackThis Log is as follows:

Logfile of HijackThis v1.99.1
Scan saved at 10:50:56 PM, on 9/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\Fast.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tp4mon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.exe
C:\Program Files\OpenOffice.org 1.9.113\program\soffice.BIN
C:\Program Files\Gaim\gaim.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\eeya\LOCALS~1\Temp\Rar$EX00.564\HijackThis.exe

R0 - HKCU\Software\Mic... Read more

A:system always being shutdown by NT Authority System; registry error popups

Please download Trend Micro? Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).Save it to your desktop.
Double-click the new icon on your desktop (tmas-web-scan.exe)
It will say "Loading TrendMicro definitions".
Once the definitions are loaded, the program will appear to close then re-open.
Click "Start Scan"
After it's done scanning, click "Scan Results"
Make sure all items found have a check next to them, then click "Clean Threats Now".
Click Exit.
Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them in your next post.

Perform an online scan in Internet Explorer with Panda ActiveScan
Click on the Scan your PC button & a 'pop up' window shall appear. * ensure that your pop up blocker doesn't block it
Click On 'Scan Now'
Enter your e-mail address & click 'Scan Now' ...begins downloading Panda's ActiveX controls.- 8MB
Begin the scan by selecting My Computer
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
If it finds any malware, it will offer you a report. Click on see report
Then click Save report
Post the contents of the report in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Read other 17 answers
RELEVANCY SCORE 71.6

I got this nt authority system shutdown error and ran several malware tools and the symantec blaster removal tool and everything came up clean, so as a last resort i ran windows repair and now it gets hung up in the login screen saying that windows is not activated and that i need to activate in order to login...i click yes and it just gets hung up

A:nt authority system shutdown error

Try this -> Windows XP Home Activation window fail to appear after running a - Microsoft Answers

Read other 3 answers
RELEVANCY SCORE 71.6

Help friends! I'm trying to fix my computer when it started to show a popup box NT Authority/System 60 second shutdown. After checking in various forums and downloading some good antivirus software, I decided to follow the advice on this forum: http://forums.techguy.org/windows-xp/560714-windows-xp-home-must-restart.html I turned on the computer and now I can't login to windows xp and the 60 second shutdown still happens. Tried logging in using safemode but still no password box. Is it time to get the windows xp cd to reformat again? Please help. Thanks
 

A:no password box and NT Authority/System 60 sec shutdown

I'm wondering if within safe mode, you can start the command prompt to run the "sfc /scannow" command (without the quotes.)
 

Read other 3 answers
RELEVANCY SCORE 71.6

Whenever i switch off or reboot my computer this comes up 
 
http://2-windowserrors.com/wp-content/uploads/2012/04/isass.exe.png
My internet is not working and cannot enable my firewall.
I did not download any malicious material from the internet.
I'am typing this from my laptop
My PC is affected with this
 
Please give me a solution for this problem.

A:This shutdown was initiated by NT Authority/System

I did a little poking around, reasonable chance you have picked up a worm.  Have you gone into safe mode and used Malwarebytes and Superantispyware?  There was also mention of going into safe mode and going to the Microsoft update page, I read where there is a patch for a hole.
 
Free: http://www.malwarebytes.org/lp/lp4/?gclid=CML2uf_JvLwCFaVQOgodOlEAIQ
Also free:  http://www.superantispyware.com/

Read other 1 answers
RELEVANCY SCORE 71.6

i posted already in the "Am I Infected?" subforum here so you can get an idea of what i've done and the moderator told me to post here now... here's a link to my previous post for your review: http://www.bleepingcomputer.com/forums/t/193201/not-sure-what-i-have/i have windows XP pro and basically, when i try to LAN a game with my brother (who lives in a different state than me) using Hamachi i get booted to my desktop in the middle of the game with a system prompt indicating that my system will need to shutdown and restart in 60 seconds. Hamachi is a program that creates a VPN, which makes it seem as if i'm directly connected with my brother's computer through a router so that we're able to LAN.if you read the link i've provided, i've done multiple scans for malware and viruses but i was told it doesn't seem like they're issues now. i seem to only get that NT AUTHORITY system shutdown message when i'm LANing with my brother and randomly during the middle of the game. i'm able to access and surf the web fine without any trouble and my computer doesn't have that shutdown message if it's left alone either... just when i'm LANing with my brother.the issue is that i've LANed with my brother with the same game for awhile using this Hamachi program and never had any issues like this before. i haven't gone to any weird questionable sites or installed any questionable programs either recently so i don't know what the problem is.some people were telling me that maybe the problem is... Read more

A:NT AUTHORITY System Shutdown Message

The automated shutdown message comes because something critical for Windows operations has terminated. As such, Windows can't keep running - so it shuts down on you.

The first step would be to check your Event Viewer for errors around the time that it shut down.
To do this, go to Start...Run...and type in "eventvwr.msc" (without the quotes) and press Enter.
Click on the System log in the left hand pane, then scroll down the right hand pane looking for errors around/just before the shutdown.
Then do the same thing for the Application log file.

Post back with the results and we'll move on from there.

Read other 10 answers
RELEVANCY SCORE 71.6

I have a dell and am using windows xp.My laptop is doing this, I do not have time to do anything because it shuts down in 60 seconds. What can I do, it does it when I am online or offline. I have symnantec antivirus on my system. I am running windows xp

A:Nt Authority System Will Shutdown In 60 Seconds

Sounds like it could be malware to me.First, when it starts to shut down - quickly press the Windows key and the R key. Then (quickly again) type in "shutdown -a" (without the quotes) and this should abort the shutdown.Try this forum for assistance with the malware: http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Read other 1 answers
RELEVANCY SCORE 71.6

Hi guys

I've googled searches trying to fix this problem. The pc shuts down a minute after windows open. I've tried run shutdown -a which works but then the pc freezes on me. I can't run updates because once i shutdown -a, the pc freezes. I ran in safe mode and ran fixblast fxsasser and mcafee stinger and found nothing. I know its the sasser virus but if someone can help i would greatly appreciate it. I'm not pc smart so please be detailed

many thanks
 

A:Help with NT Authority/System Shutdown 1073741819

Read other 7 answers
RELEVANCY SCORE 71.6

Hello,About a month ago I was infected with internet security 2010 and was able to use your help guide to remove it. Then, I was infected again with security essentials 2010. I tried using the help guide and it did not work. While trying to remove it, I think I might have gotten another virus, because then my computer started an automatic shutdown each time I turn it on. I get two messages:svchost.exe---application error the instruction at "0x71ac24c7" referenced memory at "0x00000000". The memory could not be "written".And also I get the message that I am infected with worm.win32.netskyI've looked at other posts to try and solve the problem and I do not get a "start" button where I am able to do anything at all before it shuts down in 60 seconds. It does the same thing in safe mode.

A:NT Authority system automatic shutdown

Hi, sylvesterkidd Welcome.Lets give this a try. You will need a flash drive to move information from the sick computer to a working computer, so we can see the progress of our actions. Save these instructions in your flash drive as a text file (use notepad) so you can have access to these while in an external environment (PE).Here is what you need to do.Two programs to downloadFirst Download ISOBurner. Click Here for ISOBurner Instructions. Install the program, and follow the next set of steps. SecondDownload OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7MB in size so it may take some time to download.When downloaded double click and this will then open ISOBurner to burn the file to CDBoot the Non working computer using the boot CD you just created.In order to do so, the computer must be set to boot from the CD firstNote : For information click hereYour system should now display a REATOGO-X-PE desktop.Double-click on the OTLPE icon.When asked "Do you wish to load the remote registry", select YesWhen asked "Do you wish to load remote user profile(s) for scanning", select YesEnsure the box "Automatically Load All Remaining Users" is checked and press OKOTL should now start. Change the following settingsChange Drivers to AllChange Registry to AllUnder the Custom Scan box paste this in/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dlliaStor.sysnvstor.sysatapi.sysIdeChnDr.sysviasraid.sy... Read more

Read other 35 answers
RELEVANCY SCORE 71.6

I have had this problem for some time. McAfee didn't catch it and now my Windows Installer is corrupted. I just ran "hijackthis" and have included the report below. Any help would be great. My computer is a Dell Inspiron 9100, XP (completely updated), IE8. Just about everyother start up I get the box pop up that says "NT Authority\System has had an error and will shut down in 60 seconds". I then go to Start, Run, Shutdown -a. This stops the shutdown. I should have done something before now but I haven't needed to install anything new until now. I just purchased a new printer/scanner and cannot install the software. ThanksTroyLogfile of Trend Micro HijackThis v2.0.2Scan saved at 12:15:00 PM, on 10/1/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\savedump.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\WLTRYSVC.EXEC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device ... Read more

A:NT Authority System Shutdown In 60 Seconds Help

Hi wildunc1,Welcome to BleepingComputer HijackThis Logs and Malware Removal, My name is sundavis, I will be helping you to deal with your Malware problems today.Uncheck Word Wrap under Format menu in the log before proceeding copy/paste logs into this thread. If you have shutdown problem, you may use Shutdown -a command or make a bat file while the system pops up system shutdown warning. Launch your Notepad and copy/paste the content of code box into [email protected] -aSave this as remove.bat. Choose to save as "All files" and place it on your desktop. It should look like this:Double click it while the system warning presents. It will stop the shutdown process and running the program as instructed as follows:Step1Please download GMER Rootkit Scanner from Here or Here.Extract the contents of the zipped file to desktop. Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent . If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO. In the right panel, you will see several boxes that have been checked. Uncheck the following ...Sections IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one)Then click the Scan button & wait for it to finish. For more info, go to Here for your reference.Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" , and copy and paste the contents in your next reply.**Caution**Rootkit scans oft... Read more

Read other 12 answers
RELEVANCY SCORE 71.6

Hi .. After re-installing windows and AVG SpybotS&D &AdAware2008 then updated all windows updates also updated AVG & Spybot & Adaware after doing this I then ran avg then spybot with no problems then ran adaware2008 after leaving it to run for 54 mins it found 1 threat and i took it had froze .. after canceling scan nothing happened so turned off my laptop (HP pavilion zt1141s 1.2ghz 256 ram) and restarted but then got the following message on the blue logon screen ..

System shutdown initiated by NT Authority/system System must restart because DCOM server process launcher terminated unexpectedly

.. And now Just stops on blue logon screen with windows logo/flag ..
wont boot into safe mode or anything !!

Please help Cheers Ivs
 

A:Solved: Nt authority\system shutdown

Read other 7 answers
RELEVANCY SCORE 71.6

When I launch Ad Aware (newest version). A dialogue opens that warns of a 60 sec shutdown from NT Authority/System. The following is the message that comes with...."DCOM Server Process Launcher Service terminated unexpectedly.

Any thoughts would be most appreciated.

AT
 

A:Solved: NT Authority/System 60 sec shutdown

Read other 12 answers
RELEVANCY SCORE 71.6

Hello,

My parents are having this problem with their system. Symptoms of the problem are it will bring this dialog box up about every 15 - 30 minutes. I see lots of posts about this but thought I should post my logs and see if anyone can help. I see the posts from the link below corrected the problem but I see that his logs were differant then mine.

http://forums.techguy.org/malware-r...292500-solved-solved-random-nt-authority.html

Below are my logs from Hijackthis, can anyone help??

Thank you for all the support

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:07:51 PM, on 1/30/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\System32\ASTSRV.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgfws9.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AV... Read more

Read other answers
RELEVANCY SCORE 71.6

Hello,I must have some type of trojan on my system. Every time I start up, I get the NT AUTHORITY SYSTEM SHUTDOWN in 60 seconds error. I was able to use the "shutdown -a" command in the Run box to stop the shutdown.I have run Ad-Aware, Spybot, Housecall AntiVirus and Avert Stinger and it is still popping up (even after cleaning up and deleting some files that were found). Here is my HJT log: (I appreciate ANY HELP!!!!!) thanksLogfile of Trend Micro HijackThis v2.0.2Scan saved at 10:42, on 2008-09-27Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exeC:... Read more

A:Nt Authority System Shutdown Error

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, please post a new HijackThis log. Please see Preparation Guide for use before posting about your potential Malware problem. Thank you for your patience.If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Read other 6 answers
RELEVANCY SCORE 71.6

Hey, I have a problem with my computer. Everytime I'm online the following message pops up:"System Shutdown: This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEMTime before shutdown: 00:00:59Message:Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly."The computer then shuts down by itself and restarts. I checked online to see what the problem was and I found that it was related to the Blaster or sasser worm. You might think "Problam Solved" right away but it wasnt the case because I used many different anti-virus,Firewall and worm removal programs which were:-AVG antivirus-Zonealarm Firewall-McaFee Stinger-Symantec Blaster Worm Removal-Symantec Sasser Worm Removal-Avira antivir-Microsoft Malicious Software Removal ToolI've used all of these programs to scan the worm but none were able to find any viruses or the cause of the problem. I even tried looking for the worm manually under the Windows directory and other folders were the worm might potentialy be in but no luck.The message still pops up after all this, not to mention my computer runs slower and this triggers only when I'm online. The only way I can stop the countdown to type in "shutdown -a" in the run program so it wont reboot, but the computer runs even more slower after doing this, sometimes crashing. The message will still appear... Read more

A:NT AUTHORITY/SYSTEM automatic shutdown

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 2 answers
RELEVANCY SCORE 71.6

Just recently i started getting a message on my computer saying,

"This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown initiated by NT Authority\System."
and also says below:
"Windows must now restart because the DCOM Server Process Launcher Service terminated unexpectedly."
"Generic host process for Win32 services."

It repeats this process about every 20 minutes or so. I'm also having some ad-ware and malware issues. When using Google Chrome and searching through a search engine, every time i click a link to a search it redirects me to a different site ( porn or a bunch of random sites) . I have ran malware and adware removal programs, Microsoft Windows Malicious Software Removal Tool, Spybot Search & Destroy and Mcafee with no success in solving these problems. Ever since these problems have been occurring, it seems like my computer has slowed down significantly.

I have attached my Hijack this log, hoping it will be to some help. Would appreciate some help with this, much obliged!

-Matt


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:37:19 PM, on 1/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WI... Read more

A:Windows Shutdown- NT AUTHORITY\SYSTEM, D COM

Read other 6 answers
RELEVANCY SCORE 71.6

Ok, I've been getting the pop up only on start up:
{This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM...Time before shutdown : 00:00:60...Message windows must now restart because the DCOM Server Process Launcher service terminated unexpectedly.}

I searched online and realized that could run "shutdown -a" to stop this. However the trouble doesn't stop here because my internet gets disconnected sometimes and my audio is gone. If I reinstall the IDT HD audio CODEC audio works but the problem starts again if my netbook is restarted. I scanned with malwarebytes but found nothing I have a lot of information on this netbook and cant wipe the system. PLEASE HELP!!!!!

A:nt authority system shutdown virus

Hello NYCGOONER and to BleepingComputer.This may or may not be a malware issue. Since you've posted in the Am I Infected forum, we will first try to eliminate malware as a possible cause.***************************************************Before we begin, let me say this. Your system, for whatever reason, appears to be rather seriously damaged. A critical Windows system process is failing; this is what is causing the popup you mention. I strongly suggest you immediately begin backing up all your important data. Depending on what we find, a reformat may be your only option assuming you would like your computer to be more than just a decoration.***************************************************Alright, let's see if we can turn up anything. If you are unable to download any of the programs directed, you may download them to another machine and transfer them to your malfunctioning machine via CD or flash drive.Please download ATF Cleaner by Atribune & save it to your desktop.Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox browser click Firefox at the top and choose: Select AllClick the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.If you use Opera browser click Opera at the top and choose: Select AllClick the Empty Selected button.
If you would like to keep your saved passwords, please click N... Read more

Read other 11 answers
RELEVANCY SCORE 71.2

Alright, Thank you guys for your help in advanced.

As soon as I start up my computer, it varries from 1-5 mins, but a message box just pops up and says...
This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: 00:00:60 ( edit - thats 60 secs )

Message
The system process
'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code - 1073741819. The system will now shut down and restart.

Well I figured out how to give me more time, I just set the date back a few days. Also, I read around and read that it might be the blaster worm, so I downloaded the fixer, and restarted my comp and ran it before that System Shutdown thing came up. But it said I was not infected.
Heres my HijackThis log -

Logfile of HijackThis v1.97.7
Scan saved at 10:03:00 AM, on 5/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Common Files\CMEII\CM... Read more

A:lsass.exe/NT AUTHORITY\SYSTEM problem. need help asap

Please don't post duplicate threads for the same issue.

Being addressed here:

http://forums.techguy.org/showthread.php?t=225870
 

Read other 1 answers
RELEVANCY SCORE 71.2

Alright, Thank you guys for your help in advanced.

As soon as I start up my computer, it varries from 1-5 mins, but a message box just pops up and says...
This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: 00:00:60 ( edit - thats 60 secs )

Message
The system process
'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code - 1073741819. The system will now shut down and restart.

Well I figured out how to give me more time, I just set the date back a few days. Also, I read around and read that it might be the blaster worm, so I downloaded the fixer, and restarted my comp and ran it before that System Shutdown thing came up. But it said I was not infected.
Heres my HijackThis log -

Logfile of HijackThis v1.97.7
Scan saved at 10:03:00 AM, on 5/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Common Files\CMEII\CM... Read more

A:lsass.exe/NT AUTHORITY\SYSTEM problem. need help asap

Read other 10 answers