problems system restart when I turn computer On..

aacm · Nov 16, 2004

HI everyone ! Hi techs!!!
I haven a problem with my laptop. Everytime I turn on and go to desktop right away restart again said: "Your computer will restart in 60 seconds, NT authority|System, and c:\windows\system32\services.exe"
and give errors with IE and others programs that start when computer is up..
I was able to get in the Safe Mode with no problems and I run antivirus, spyware, and no success after rebooting. So any one has experience this problems please need help to resolve without formating the hard drive.
I running Windows 2000 pro in a Pentium 4 machine. Toshiba laptop..

Thanks guys...

Al

Andreas1 · Nov 16, 2004

do you have access to another machine?

first, try to check out these:
http://www.microsoft.com/security/incident/blast.mspx
http://www.microsoft.com/security/incident/sasser.mspx
(two MS bulletins about the blaster and sasser worms - which can cause similar behaviour.)
http://vil.nai.com/vil/stinger/
(a removal tool for those two and a couple of other baddies.)

if it is Sasser:

http://www.microsoft.com/technet/Security/alerts/sasser.mspx said:

On Windows 2000 systems, to prevent LSASS.EXE from crashing (thereby restarting the operating system) unplug the network cable (or disable the network adapter before LSASS.EXE crashes) and then perform any one of the following steps to prevent the worm from crashing LSASS.EXE:
1.
Create a file called %systemroot%\debug\dcpromo.log and make the file read-only. To do this, type the following command:

echo dcpromo >%systemroot%\debug\dcpromo.log & attrib +r %systemroot%\debug\dcpromo.log

[...]

If the machine is currently infected with the Sasser worm it may start flooding the local network connection as soon as the cable is plugged back in making it impossible to download updates. To temporarily disable the worm use Task Manager to kill the following processes:

End any process beginning with 4 or more numbers and “_up.exe” (for example, 12345_up.exe)
End any process starting with avserve (for example, avserve.exe, avserve2.exe)
End any process named skynetave.exe
End any process named hkey.exe
End any process named msiwin84.exe
End any process named wmiprvsw.exe

NOTE: Do not end the process named wmiprvse.exe it is a legitimate system process.

After stopping the worm processes you should be able to download the security update and a Sasser removal tool.
Click to expand...

so much for a first attempt to get the critical possibilities ruled out.

HTH,
Andreas

Pilli · Nov 17, 2004

Almost certainly Sasser -

I have moved this thread to a more appropriate forum

Pilli

Blackspear · Nov 17, 2004

To stop the shutdown process do the following:

Click on Start

Click on Run

Type in the following:

shutdown –a

Click “Ok”

This will abort the shutdown process.

I would then suggest following the instructions found here: https://www.wilderssecurity.com/showthread.php?t=50662

Hope this helps...

Let us know how you go...

Cheers

aacm · Nov 17, 2004

Hi everybody thanks for all info you get me however this laptop is totally uncontrolable in other words I can even sign in.. so I save some files that I need from safe mode and try to fix it the way you guys tell me. so far no success because no way to get it going. Only in save mode is the way I can get it run with difficultes. Yes I have another computer in the house so thats why I put my threads .... however thanks a lot I will let you know if i can fixied thru Safe Mode...
Al

Log in or Sign up

problems system restart when I turn computer On..

aacm Registered Member

Andreas1 Security Expert

Pilli Registered Member

Blackspear Global Moderator

aacm Registered Member

Log in or Sign up

problems system restart when I turn computer On..

aacm Registered Member

Andreas1 Security Expert

Pilli Registered Member

Blackspear Global Moderator

aacm Registered Member

Useful Searches