RE: Shutdown from NT-AUTHORITY\... = virus/attack?

Hello Peter,

you can stop W2K from shutting down with shutdown -a (this option aborts a
system shutdown) at the "RUN" dialog or
at cmd.exe.
Your system could be infected with the Sasser or Blaster Virus....
Did you already check your System, maybe with an OnlineScanner, like
TrendMicro Housecall
or something like that?

rgrds,

/benjamin

-----Original Message-----
From: news [mailto:news@sea.gmane.org] On Behalf Of Peter Nabbefeld
Sent: Thursday, 02 September, 2004 05:24 PM
To: focus-virus@securityfocus.com
Subject: Shutdown from NT-AUTHORITY\... = virus/attack?


Hello,

could anybody here tell me, if a "Shutdown from NT-AUTHORITY\..." (can't
remember the full name) is caused by a virus or an attack? How can I stop
W2k from shutting down? I've tried to close the shutdown task and to open
notebook and fill in some text, but both didn't work. I fear, that some
virus might have been installed into my startup files (probably a backdoor).

I've installed a firewall (maybe outdated) and a virus scanner (last update
about one week ago, maybe also some days more), so if it's been caused by a
virus, it should be a relatively recent one.

Kind regards

Peter Nabbefeld