WinXP forcing itself to shutdown

JohnCleary

I know i've seen this problem before, and almost certain i've been able to troubleshoot it..

Mate of mine from college rang there saying that when they boot up their win XP machine, after a few minutes they get a pop-up saying that the PC is going to shut down in 90 seconds... Obviously he doesn't have enough time to Google to try and solve the problem.

He's not too sure if it's a virus or what, but i'm almost certain i've seen this problem before, and a say to disable it.. Anygot got any ideas?

Ruu_Old

Sounds like the Blaster (worm virus) or whatever it was called. This should help in its removal.

feylya

It sounds like the sasser virus. When the window pops up, run this command:

shutdown -a

then update and run your virus scanner.

Karoma

Start -> Run -> shutdown -a
^ to abort the shutdown

Update virus scanner & Windows Updates, reboot to safe mode and scan.

Are you sure it's "90 seconds" and not 60? Does it mention lsass.exe?

Zapho

Before the machine shuts down:
open the run command and type
"shutdown -a"
without the quotes.


This will abort the shutdown and allow you to investigate why it happens. You'll have to type that everytime you restart until you find the problem.

The 90 second shutdown dialog is acutally a windows program, and you can run it yourself if you want (just type shutdown in cmd and it'll give you the instructions on how to use it)

Old viruses like MSBLAST or SASSER and their variations used to do that as part of the infection.
Plenty of removal tools for those exist, just google em.

I haven't heard of any virus to do that in a while though.

JohnCleary

Cheers lads, gonna pop up tomorrow and try to get him sorted.

Should AVG find it?

Thanks for the quick replies

ActorSeeksJob

AVG might get rid of it, but hard to tell since you will have to run in normal mode. IMO try HijackThis first.

Please download the self-extracting version of HijackThis from here:

HijackThis_sfx download

Save HijackThis_sfx to your desktop.

Double-click the file then click the Unzip button. Then close the Self-Extractor window.

Using My Computer/Windows Explorer, navigate to C:\Program Files\HijackThis and double click on HijackThis.exe to run it. If you would like to make a shortcut for your Desktop so it's more easily accessable, right click HijackThis.exe and choose Send To > Desktop (create shortcut).

Please run the extracted HijackThis.exe from now on. Delete any copies of HijackThis.zip that you have saved.

Open HijackThis and click Do a system scan and save a log file. Copy the entire contents of that log and post it here

JohnCleary

Cheers, will also give that a try