Friend PC keeps Shutting down - whats the fix for this virus? - GoFuckYourself.com

doober · 05-03-2004, 10:41 AM

My friend is in hysterics cause her Pc keeps shutting down and giving her all kinds of errors. Explorer wont load, ran norton and everything came up clean, Liveupdate is acting very weird also.

I remember a while back there was a virus that would shut down the users pc in 5 min or less from log in. anyone know what i need to fix this stupid BS?

thx

stevecore · 05-03-2004, 10:43 AM

http://www.cnn.com/2004/TECH/interne...eut/index.html

angeleyes · 05-03-2004, 10:44 AM

Welcome to hell........ nothing will get rid of the SOB.

It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

Ice · 05-03-2004, 10:47 AM

Quote:

Originally posted by angeleyes
Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

http://us.mcafee.com/virusInfo/defau...virus_k=125008

download the stinger tool ...

doober · 05-03-2004, 10:48 AM

fucking lame, whats the solution even if it doest work 100%?
I need to be able to boot the pc into hahahahahahas at the very least

Theo · 05-03-2004, 10:48 AM

There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

More Booze · 05-03-2004, 10:52 AM

And tell her to protect her computer.
There is alot of good free programs to use.

AVG - Free Antivirus Software

Sygate Personal Firewall - Also free

TheLegacy · 05-03-2004, 10:54 AM

my fiancee had the same problem but instead it was a matter of either motherboard fan - power supply - or worse, the hard drive has an error... it may not be a virus at all

wdsguy · 05-03-2004, 10:55 AM

its probably that new sassar worm.

symantec had a fix tool on their site for it.

Ice · 05-03-2004, 10:55 AM

I use a Linksys firewall router, Zone Alarm Pro and Norton antivirus Professional and never have a problem

stev0 · 05-03-2004, 10:55 AM

sounds like the blaster worm...

Maybe it's just time for a format?

doober · 05-03-2004, 11:14 AM

Quote:

Originally posted by Soul_Rebel
There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

been trying to do the shutdown/a thing but it gives me an error.
So i tired chnaging the clock to a few hours back but it still shut down.
worst part is Pc keeps shutting down quicker and quicker, what a nightmare

Thax for all the responses so far guys, much appreciated

KMR Stitch · 05-03-2004, 11:16 AM

If it shuts down?

Or does it Restart. ?

If it just restarts It was the same problem I was having my Motherboard was shorting out. and I had to buy a new one.

Theo · 05-03-2004, 11:23 AM

Quote:

Originally posted by doober
been trying to do the shutdown/a thing but it gives me an error.
So i tired chnaging the clock to a few hours back but it still shut down.
worst part is Pc keeps shutting down quicker and quicker, what a nightmare

Thax for all the responses so far guys, much appreciated

whats your OS?

WarChild · 05-03-2004, 11:24 AM

Real pain in the ass. Quickest fix is this:

Go in to yoru internet connections. Select properties on the network card.

Tab on the far right of the properties tab is marked "ADVANCED"

Turn on "Internet Connection Firewall".

Run the auto update.

The Blaster broadcast to shutdown won't reach your computer.

Please note, your computer does not need to be infected. Other infected computers are broadcasting this shutdown instruction.

Daymon

VideoJ · 05-03-2004, 11:53 AM

Finally got rid of the little fucker.

Norton wouldn't get it, Mccaffe didn't find it, finally had to dig in a do it myself. I even tried the hand removal method and that didn't work, it kept coming back.

Simplest way to test wheather it's this virus, do a search on virus at google, if the win-dow closes right away you got it. Getting rid of the fucker is a two step process.

You want two pieces of software

KillProcess at http://home.swipnet.se/killprocess/
.hijack this (from download.com

First you have to kill the copy running. Use KillProcess for this as ctrl-alt-del doesn't work (the virus hides the process manager)

You look for wininit32.exe and kill it. might be called something else but that is what is what it was called in my machine. You can do the virus search test to see if that killed it.

Now run HijackThis. It will give you a list of possible problems in you computer. Look in the HKLM\..Run section, this is all stuff run when your computer starts up. Most are probalby ok, but look for the things that don't show a full directory path (c:\Program Files\...) The wininit32 ones and there is one that is named something weird (like [xlaq] fqe.exe). Click on those and click Fix checked.

Be careful here, if you're not very comfortable working on your computer, you may want to get a techie friend to do this.

doober · 05-03-2004, 11:58 AM

Quote:

Originally posted by Soul_Rebel
whats your OS?

XP

doober · 05-03-2004, 12:04 PM

problem is i dont have the PC in front of me and am trying to get her to do these processes over the phone and her internet keeps cutting out + shutting down also which isnt a great help trying to download any of the removal tools listed here.

I will go see her tonite and check back on this thread cause there is a ton of good info here, keep posting if theres more info cause im sure in the next few days tons of people will be fucked again...pretty sad this virus shit

Shoehorn! · 05-03-2004, 12:07 PM

Quote:

Originally posted by angeleyes
Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

http://www.apple.com/

cayne · 05-03-2004, 12:07 PM

get hahahahahahasupdate.com
norton.com - it's the sasser.a virus.

Theo · 05-03-2004, 12:08 PM

download the p.atch here

http://www.microsoft.com/downloads/d...displaylang=en

probably will help to prevent reboots

JFK · 05-03-2004, 12:15 PM

Quote:

Originally posted by TheLegacy
my fiancee had the same problem but instead it was a matter of either motherboard fan - power supply - or worse, the hard drive has an error... it may not be a virus at all

Absolutely, the same thing happened to us and it was a matter of overheating, try popping the cover off and seeing if there is anything loose.Our Porb was the fan and one of the parts became loose because of the heat

WarChild · 05-03-2004, 12:25 PM

Is it reporting RPC service as the shutdown error?

If that's the case, it's probably not HER computer that's infested.

Read my post above, it's easy to fix this you just need to update hahahahahahas.

Turn on the internet firewall built in to XP, and you will not be shut down by broadcasting Blaster variants.

doober · 05-04-2004, 08:41 AM

Quote:

Originally posted by iceicebaby
http://us.mcafee.com/virusInfo/defau...virus_k=125008

download the stinger tool ...

the stinger tool is the only one that would remove this damn virus. Symantecs tool ran and ran froever and didnt find shit.
Also this http://home.swipnet.se/killprocess/ is very good also to see whats running in the background and to kill the process that some virus usually hide upon verifying the ctrl+alt +del on the process tab.

Thanks for all the help guys, my friend was really appreciative

crockett · 05-04-2004, 09:13 AM

1st off with the Blaster virus if you unhook the computer from the internet it will stay on... Least with my experance it did..

But as soon as the machine boots to hahahahahahas ctrl+alt+del and shut down msblaster.exe that will keep the PC from shuting down while you apply the fix..

Goose · 05-04-2004, 09:15 AM

you better hurry!

svenski · 05-04-2004, 09:19 AM

If it is a recent thing sounds like Sasser

http://www.microsoft.com/security/incident/sasser.asp

Use the above link for a checker/removal tool.

cluck · 05-04-2004, 09:21 AM

www.suse.com

alexg · 05-04-2004, 09:22 AM

Quote:

Originally posted by Soul_Rebel
There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

i think its "shutdown -a"

doober · 05-04-2004, 09:24 AM

Quote:

Originally posted by alexg
i think its "shutdown -a"

That doesnt work for me either on XP, im curious whats this command supposed to do?

Jace · 05-04-2004, 09:24 AM

hahahahahahas update before it happens

05-03-2004, 10:41 AM	#1
doober Confirmed User Join Date: Jul 2003 Location: in yoOoo kitchen Posts: 6,984	Friend PC keeps Shutting down - whats the fix for this virus? My friend is in hysterics cause her Pc keeps shutting down and giving her all kinds of errors. Explorer wont load, ran norton and everything came up clean, Liveupdate is acting very weird also. I remember a while back there was a virus that would shut down the users pc in 5 min or less from log in. anyone know what i need to fix this stupid BS? thx

05-03-2004, 10:44 AM	#3
angeleyes Confirmed User Join Date: Feb 2003 Location: Wandering around FL using random Wireless Connections Posts: 3,584	Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far. __________________ Need a Writer? Contact Me. I write quality descriptions, short erotic stories, quality one-liners.. whatever you need.

05-03-2004, 10:54 AM	#8
TheLegacy SEO Connoisseur Industry Role: Join Date: Apr 2003 Location: Brantford, Ontario Posts: 17,120	my fiancee had the same problem but instead it was a matter of either motherboard fan - power supply - or worse, the hard drive has an error... it may not be a virus at all __________________ SEO Connoisseur Microsoft Teams: Robert Warren SEO Telegram: @TheLegacy54 RobertWarrenSEO.com

05-03-2004, 10:55 AM	#10
Ice Confirmed User Join Date: Nov 2002 Location: Sunny California Posts: 26,053	I use a Linksys firewall router, Zone Alarm Pro and Norton antivirus Professional and never have a problem __________________ icq 1904905

05-03-2004, 12:07 PM	#20
cayne My time is coming... Join Date: Jan 2004 Location: Europe --- eMail: service(at)badasscompany.com --- ICQ: 60288510 Posts: 7,476	get hahahahahahasupdate.com norton.com - it's the sasser.a virus. __________________ If lesbian anal is wrong, I don't want to be right.

05-03-2004, 10:43 AM	#2
stevecore Confirmed User Join Date: May 2003 Posts: 6,130	http://www.cnn.com/2004/TECH/interne...eut/index.html

05-03-2004, 10:48 AM	#5
doober Confirmed User Join Date: Jul 2003 Location: in yoOoo kitchen Posts: 6,984	fucking lame, whats the solution even if it doest work 100%? I need to be able to boot the pc into hahahahahahas at the very least

05-03-2004, 10:48 AM	#6
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	There are several options to avoid the system shutdown: Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices. Go to Start->Run, type in shutdown/a, and press Enter. Change the system time back by several hours. Disconnect from the Internet. DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE http://securityresponse.symantec.com...r/FixBlast.exe

05-03-2004, 10:52 AM	#7
More Booze Confirmed User Join Date: Mar 2004 Posts: 5,116	And tell her to protect her computer. There is alot of good free programs to use. AVG - Free Antivirus Software Sygate Personal Firewall - Also free

05-03-2004, 10:55 AM	#9
wdsguy Ryde or Die Industry Role: Join Date: Dec 2002 Location: California-Shanghai Posts: 19,568	its probably that new sassar worm. symantec had a fix tool on their site for it.

05-03-2004, 10:55 AM	#11
stev0 Confirmed User Join Date: Aug 2003 Location: Calgary, Alberta Posts: 6,801	sounds like the blaster worm... Maybe it's just time for a format?

05-03-2004, 11:16 AM	#13
KMR Stitch I am cool Join Date: Jul 2003 Posts: 14,494	If it shuts down? Or does it Restart. ? If it just restarts It was the same problem I was having my Motherboard was shorting out. and I had to buy a new one.

05-03-2004, 11:24 AM	#15
WarChild Let slip the dogs of war. Industry Role: Join Date: Jan 2003 Location: Bermuda Posts: 17,263	Real pain in the ass. Quickest fix is this: Go in to yoru internet connections. Select properties on the network card. Tab on the far right of the properties tab is marked "ADVANCED" Turn on "Internet Connection Firewall". Run the auto update. The Blaster broadcast to shutdown won't reach your computer. Please note, your computer does not need to be infected. Other infected computers are broadcasting this shutdown instruction. Daymon

05-03-2004, 11:53 AM	#16
VideoJ Confirmed User Join Date: Aug 2002 Location: S. Florida Posts: 750	Finally got rid of the little fucker. Norton wouldn't get it, Mccaffe didn't find it, finally had to dig in a do it myself. I even tried the hand removal method and that didn't work, it kept coming back. Simplest way to test wheather it's this virus, do a search on virus at google, if the win-dow closes right away you got it. Getting rid of the fucker is a two step process. You want two pieces of software KillProcess at http://home.swipnet.se/killprocess/ .hijack this (from download.com First you have to kill the copy running. Use KillProcess for this as ctrl-alt-del doesn't work (the virus hides the process manager) You look for wininit32.exe and kill it. might be called something else but that is what is what it was called in my machine. You can do the virus search test to see if that killed it. Now run HijackThis. It will give you a list of possible problems in you computer. Look in the HKLM\..Run section, this is all stuff run when your computer starts up. Most are probalby ok, but look for the things that don't show a full directory path (c:\Program Files\...) The wininit32 ones and there is one that is named something weird (like [xlaq] fqe.exe). Click on those and click Fix checked. Be careful here, if you're not very comfortable working on your computer, you may want to get a techie friend to do this.

05-03-2004, 12:04 PM	#18
doober Confirmed User Join Date: Jul 2003 Location: in yoOoo kitchen Posts: 6,984	problem is i dont have the PC in front of me and am trying to get her to do these processes over the phone and her internet keeps cutting out + shutting down also which isnt a great help trying to download any of the removal tools listed here. I will go see her tonite and check back on this thread cause there is a ton of good info here, keep posting if theres more info cause im sure in the next few days tons of people will be fucked again...pretty sad this virus shit

05-03-2004, 12:08 PM	#21
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	download the p.atch here http://www.microsoft.com/downloads/d...displaylang=en probably will help to prevent reboots

05-03-2004, 12:25 PM	#23
WarChild Let slip the dogs of war. Industry Role: Join Date: Jan 2003 Location: Bermuda Posts: 17,263	Is it reporting RPC service as the shutdown error? If that's the case, it's probably not HER computer that's infested. Read my post above, it's easy to fix this you just need to update hahahahahahas. Turn on the internet firewall built in to XP, and you will not be shut down by broadcasting Blaster variants.

05-04-2004, 09:13 AM	#25
crockett in a van by the river Industry Role: Join Date: May 2003 Posts: 76,806	1st off with the Blaster virus if you unhook the computer from the internet it will stay on... Least with my experance it did.. But as soon as the machine boots to hahahahahahas ctrl+alt+del and shut down msblaster.exe that will keep the PC from shuting down while you apply the fix.. __________________ In November, you can vote for America's next president or its first dictator.

05-04-2004, 09:15 AM	#26
Goose Confirmed User Join Date: Mar 2004 Location: --------Europe------- Posts: 5,725	you better hurry! __________________ ICQ: 52410619

05-04-2004, 09:19 AM	#27
svenski Confirmed User Join Date: Mar 2004 Location: Behind you Posts: 227	If it is a recent thing sounds like Sasser http://www.microsoft.com/security/incident/sasser.asp Use the above link for a checker/removal tool.

05-04-2004, 09:21 AM	#28
cluck Confirmed User Join Date: Dec 2002 Location: New Jersey Posts: 5,248	www.suse.com __________________ icq 279990726 www.mcdonalds.com <- great money making opportunity

05-04-2004, 09:24 AM	#31
Jace FBOP Class Of 2013 Industry Role: Join Date: Jan 2004 Location: bumfuck, ky Posts: 35,562	hahahahahahas update before it happens