Help! WinXP shutting itself down! (1 Viewer)

[Jeremy Allin]

Hope someone has a quick and easy answer.

OS: Windows XP Professional
Internet Explorer 6.0
Cable Internet

I managed a screengrab before the counter reached zero. Any thoughts? It seems to be doing this every 15 minutes or so. If I provide any other useful information, just let me know.

Thanks!

 

[SethH]

I'm pretty sure that is the calling card of a virus that has come around in the past year. Update your virus software and scan your entire system. I'm pretty sure that is the culprit, but not 100% sure.

 

[Glenn Overholt]

Probably right. I think there is a way to turn RPC off. I wouldn't want anyone calling me.

Glenn

 

[Jeremy Allin]

I was in the middle of a virus scan and the message came up again (about 10 mins. in).


Whoa.....40 seconds left til restart. It's a WORM!!! :-O

EDIT: Sorry for my frantic post, the computer can go down at any second. It picked up on a Blaster Worm I believe.

...Trying to exorcise the demon...

EDIT2: I think I've got it! There was a virus called Welchia.B.Worm that was a pain to get rid of. Downloaded a special utility from Symantec that killed it. Just did another full system scan...no viruses.

Thank you Seth and Glenn.

 

[SethH]

No problem at all. I thought that looked familiar. I got that last time I reformatted and I plugged into the internet before reinstalling my firewall. Suggestion: turn on the XP firewall. Many worms do not require an e-mail for transport. The XP firewall will stop it from getting in. Better yet, download the free version of ZoneAlarm as it will block everything from coming in, and if you happen to get a worm it will stop you from spreading it to others (the XP firewall will not do this).

 

[nolesrule]

http://us.mcafee.com/virusInfo/defau...virus_k=100499

The simple prevention is to close port 135 using a firewall. Also install the WinXP patch that has ben available to fixthis for several months.

 

[Rob Gillespie]

Blaster or Nachi (Welchia) virus. You need patch KB824146 (MS03-039).

 

[Jeremy Allin]

THanks again, guys. I got the computer about three months ago but I hadn't hooked it up to the Internet until last night.

Got everything working fine and left it sitting at the desktop for an hour. I returned to find I was infected.

I will install the patch.