System shutting down in 60 Seconds again!

Soldato
Joined
18 Oct 2002
Posts
10,445
Location
Behind you... Naked!
I am getting this again on some of my PCs.

Last time I had it, it was due to the blaster worm IIRC, and I still have that symantec proggie just for it, and it probably does clear it out, but it says its gone.

Well, by the time I wait for it anyway.

I am getting it this time however, ONLY when ADAWARE comes accross it!

The next time I run ADAWARE, its gone, even though ADAWARE has not had the chance to do anythign cos it sort of hangs and everythign except ADAWARE gets killed off, and only ADAWARE is left, but it wotn do anything?

Anyone else getting this?

I had though it could be my copy of ADAWARE but I have downloaded it fresh on a clean system and it still does it.

Its done it now about 4 times in the last week on my main PC and its done it 7 or 8 times on a few of my LAN PCs.

I am running NOD32 AntiVirus, and I have both NOADWARE, and SPYWARE DOCTOR in the BG and I also use SpyBot S&D and ADAWARE every day... I have doen a couple of fresh installs in the last week ( for other reasons than this issue ) and I get hit basically as soon as I get the chance to run Adaware!!!

I have gone through everythign in the last few days and I can guarantee that there is nothing wrong with my installation files / Disks and it is DEFINITELY coming through the internet.

Anyone?
 
Sorry, I can't help. But I think you would get better assistance if this thread was in the "Windows" section of the OCUK forums. So if a don is passing you know what to do. Good luck. ;)
 
Phil99 said:
Install Service Pack 2 and make sure Windows Firewall is enabled before plugging in the LAN cable.

also as soon as the messege appears type shutdown -A in the "run" dialog from the start menu.

did you run the balster worm proggie in safe mode ;)
 
Last edited:
mctiny said:
also as soon as the messege appears type shutdown -r in the "run" dialog from the start menu.

-r Shutdown and restart the computer
-a Abort a system shutdown

Sure you don't mean -a? ;)
 
Phil99 said:
Install Service Pack 2 and make sure Windows Firewall is enabled before plugging in the LAN cable.

SP2 intergrated into CD and yes, Firewall is on BEFORE anything


mctiny said:
also as soon as the messege appears type shutdown -A in the "run" dialog from the start menu.

did you run the balster worm proggie in safe mode ;)

shutdown -a...

No, I cannot.

As soon as that dialog comes up, everything, including the taskbar disappears. The only thing thats left is the background picture and ADAWARE.

Yes, the blaster killer runs in SAFEMODE too.

At this time, it seems to be gone.

It seemed to have gone previously too, but it will be back within a day or two! - It has done for the last week or so, and I just cannot shift it, or well, at least I just cannot stop being hit by it.?
 
crashuk said:
http://safety.live.com/site/en-gb/default.htm?s_cid=sah

use this its found things that other stuff hasnt.

Ok, every little helps, but then I use a Mixture of AdAware, Spybot S&D, NoAdware, Spyware Doctor, and The MS one ( Although its pretty much failed to find anythign so far that the others miss ), so thats 5, this one will be No6

I wonder if it will ever happen, that there is an all-in-one killer that will actually get rid of everything... Oh, and not be a hogger like Norton of course!

Energize said:
Some viruses can stay on the hard drive after it has been formatted, just because you formatted it doesnt means its ok.

Of couse, thats so true.

But on several different PCs, at 2 different locations, using different installation media?
 
If the viruses spread to the other pcs on the network its possible its just hiding on the hard drives on all of them. I don't know if that particular virus can remain after formatting though. Possibly everytime you format one of the pcs and add it to the network the virus jumps to it from another pc on the network, you could try formatting all of them at the same time.
 
Go over to sysinternals.com and get their programs "TCP view" and "Process Explorer". Then run TCP view and see what processes are listening on what ports and look for anything "dodgy" with process explorer.

Report back with what you find.
 
There is no doubt thats possible, but on 2 completely unrealated systems that are nowhere near the same network ( About 2 miles away )

So, there MUST be something that is absolutely invisible to me???

Yet, I have even tried the original CDs to install stuff and its still coming up, oh, and just for you to know... On the other PC ( 2 Miles away where it also appeared ) I have used a new HD.

Ok sysinternals PEXP shows up...

Nothign suspicious, but then...


WMIPRVSE.EXE under oneof the SVCHOST.EXE's

Having a closer look shows up the NT AUTHORITY thing... Part of the message that coems up when it shuts down.

Ok, I will have a play and get back to you on how this affects things...

I may not update till after brazil v croatia.

I really want Croatia to win cos Brazil, cos England will never do that.

Coooommmmeeee oooooonnnnn Enguuuuurluuuuund!!!

And Im welsh!
 
Are these computers connected to the net via the same ISP? Could it be possible that they are in the same IP address block and both got hit by a worm at roughly the same time (before you configured the firewall), it sounds very reasonable to me.

Keep Process explorer running and when the window pops up saying that Windows is going to reboot, look for a process that is in green. If there is one, let me know...
 
Actually its running right now, and opening up FireFox ( coming from the link in Thunderbird ) and I saw a couple of RED and a couple of GREENS

Footie is about to start now, so I will update you later on.

Only time I get my kids to actually sit down and be quiet, so its vital for me to watch the game....Purely in an educational perspective of course!!! lol
 
Should this happen again, try pressing CTRL-SHIFT-ESC

that'll give you task manager and then as said earlier you can use file > run 'shutdown -a' to abort the shutdown and then run explorer.exe to bring back the start menu, from there you could load process explorer and look for anything new/dodgy rather than keeping it running all the time
 
Back
Top Bottom