Friend PC keeps Shutting down - whats the fix for this virus?

[doober]

My friend is in hysterics cause her Pc keeps shutting down and giving her all kinds of errors. Explorer wont load, ran norton and everything came up clean, Liveupdate is acting very weird also.

I remember a while back there was a virus that would shut down the users pc in 5 min or less from log in. anyone know what i need to fix this stupid BS?

thx

[stevecore]

http://www.cnn.com/2004/TECH/interne...eut/index.html

[angeleyes]

Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

[Ice]

Originally posted by angeleyes
Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

http://us.mcafee.com/virusInfo/defau...virus_k=125008

download the stinger tool ...

[doober]

fucking lame, whats the solution even if it doest work 100%?
I need to be able to boot the pc into hahahahahahas at the very least

[Theo]

There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

[More Booze]

And tell her to protect her computer.
There is alot of good free programs to use.

AVG - Free Antivirus Software

Sygate Personal Firewall - Also free

[TheLegacy]

my fiancee had the same problem but instead it was a matter of either motherboard fan - power supply - or worse, the hard drive has an error... it may not be a virus at all

[wdsguy]

its probably that new sassar worm.

symantec had a fix tool on their site for it.

[Ice]

I use a Linksys firewall router, Zone Alarm Pro and Norton antivirus Professional and never have a problem

[stev0]

sounds like the blaster worm...

Maybe it's just time for a format?

[doober]

Originally posted by Soul_Rebel
There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

been trying to do the shutdown/a thing but it gives me an error.
So i tired chnaging the clock to a few hours back but it still shut down.
worst part is Pc keeps shutting down quicker and quicker, what a nightmare

Thax for all the responses so far guys, much appreciated

[KMR Stitch]

If it shuts down?

Or does it Restart. ?


If it just restarts It was the same problem I was having my Motherboard was shorting out. and I had to buy a new one.

[Theo]

Originally posted by doober
been trying to do the shutdown/a thing but it gives me an error.
So i tired chnaging the clock to a few hours back but it still shut down.
worst part is Pc keeps shutting down quicker and quicker, what a nightmare

Thax for all the responses so far guys, much appreciated

whats your OS?

[WarChild]

Real pain in the ass. Quickest fix is this:

Go in to yoru internet connections. Select properties on the network card.

Tab on the far right of the properties tab is marked "ADVANCED"

Turn on "Internet Connection Firewall".

Run the auto update.

The Blaster broadcast to shutdown won't reach your computer.

Please note, your computer does not need to be infected. Other infected computers are broadcasting this shutdown instruction.

Daymon

[VideoJ]

Finally got rid of the little fucker.

Norton wouldn't get it, Mccaffe didn't find it, finally had to dig in a do it myself. I even tried the hand removal method and that didn't work, it kept coming back.

Simplest way to test wheather it's this virus, do a search on virus at google, if the win-dow closes right away you got it. Getting rid of the fucker is a two step process.

You want two pieces of software

KillProcess at http://home.swipnet.se/killprocess/
.hijack this (from download.com

First you have to kill the copy running. Use KillProcess for this as ctrl-alt-del doesn't work (the virus hides the process manager)

You look for wininit32.exe and kill it. might be called something else but that is what is what it was called in my machine. You can do the virus search test to see if that killed it.

Now run HijackThis. It will give you a list of possible problems in you computer. Look in the HKLM\..Run section, this is all stuff run when your computer starts up. Most are probalby ok, but look for the things that don't show a full directory path (c:\Program Files\...) The wininit32 ones and there is one that is named something weird (like [xlaq] fqe.exe). Click on those and click Fix checked.

Be careful here, if you're not very comfortable working on your computer, you may want to get a techie friend to do this.

[doober]

Originally posted by Soul_Rebel
whats your OS?

XP

[doober]

problem is i dont have the PC in front of me and am trying to get her to do these processes over the phone and her internet keeps cutting out + shutting down also which isnt a great help trying to download any of the removal tools listed here.

I will go see her tonite and check back on this thread cause there is a ton of good info here, keep posting if theres more info cause im sure in the next few days tons of people will be fucked again...pretty sad this virus shit

[Shoehorn!]

Originally posted by angeleyes
Welcome to hell........ nothing will get rid of the SOB. It's prob one or a few of the sassar virus variants. Nortons, SARC, housecall, AVG, etc........ Nothing removes it properly so far.

http://www.apple.com/

[cayne]

get hahahahahahasupdate.com
norton.com - it's the sasser.a virus.

[Theo]

download the p.atch here

http://www.microsoft.com/downloads/d...displaylang=en

probably will help to prevent reboots

[JFK]

Originally posted by TheLegacy
my fiancee had the same problem but instead it was a matter of either motherboard fan - power supply - or worse, the hard drive has an error... it may not be a virus at all

Absolutely, the same thing happened to us and it was a matter of overheating, try popping the cover off and seeing if there is anything loose.Our Porb was the fan and one of the parts became loose because of the heat

[WarChild]

Is it reporting RPC service as the shutdown error?

If that's the case, it's probably not HER computer that's infested.

Read my post above, it's easy to fix this you just need to update hahahahahahas.

Turn on the internet firewall built in to XP, and you will not be shut down by broadcasting Blaster variants.

[doober]

Originally posted by iceicebaby
http://us.mcafee.com/virusInfo/defau...virus_k=125008

download the stinger tool ...

the stinger tool is the only one that would remove this damn virus. Symantecs tool ran and ran froever and didnt find shit.
Also this http://home.swipnet.se/killprocess/ is very good also to see whats running in the background and to kill the process that some virus usually hide upon verifying the ctrl+alt +del on the process tab.

Thanks for all the help guys, my friend was really appreciative

[crockett]

1st off with the Blaster virus if you unhook the computer from the internet it will stay on... Least with my experance it did..

But as soon as the machine boots to hahahahahahas ctrl+alt+del and shut down msblaster.exe that will keep the PC from shuting down while you apply the fix..

[Goose]

you better hurry!

[svenski]

If it is a recent thing sounds like Sasser

http://www.microsoft.com/security/incident/sasser.asp

Use the above link for a checker/removal tool.

[cluck]

www.suse.com

[alexg]

Originally posted by Soul_Rebel
There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

DOWNLOAD THE ANTIVIRUS FOR BLASTER HERE

http://securityresponse.symantec.com...r/FixBlast.exe

i think its "shutdown -a"

[doober]

Originally posted by alexg
i think its "shutdown -a"

That doesnt work for me either on XP, im curious whats this command supposed to do?

[Jace]

hahahahahahas update before it happens