win xp restarting... not that new virus, is it?

[dfarrales]

about 2 mins into starting up XP, a window pops up w/ the following:

windows shutting down. this process was initiated by nt auth\system. the RCP terminated unexpectedly.

background: just did a full format and install of XP. i was just installing a few normal applications and i get this.

any ideas?

 

[EeyoreX]

Blaster.

\Dan

 

[dfarrales]

i ended up just doing a system restore... cleared it up.

still, would like to find out if anyone's experienced similar?

 

[LTC8K6]

Yeah, it was the very popular blaster worm from a while back.

 

[John]

Originally posted by: dfarrales
about 2 mins into starting up XP, a window pops up w/ the following:

windows shutting down. this process was initiated by nt auth\system. the RCP terminated unexpectedly.

The RPC shutdown is the MSBlaster worm.

background: just did a full format and install of XP. i was just installing a few normal applications and i get this.

any ideas?

Yes, be sure you install SP1 first, then run windows update and download/install all of the criticals. I'd also recommend enabling the firewall on your network adapter (or use a hardware solution) and install a quality antivirus product. You can then install the rest of your applications.

i ended up just doing a system restore... cleared it up.

still, would like to find out if anyone's experienced similar?

Keep in mind that viruses hide in the "system restore" folder. Please follow the recommendations above.

 

[CTho9305]

Originally posted by: John

i ended up just doing a system restore... cleared it up.

still, would like to find out if anyone's experienced similar?

Keep in mind that viruses hide in the "system restore" folder. Please follow the recommendations above.

I dont think blaster/sasser do... but if you don't install the critical update, you're likely to be reinfected in minutes.

 

[EeyoreX]

The simple solution: Make sure the Windows firewall is activated before connecting to the internet to update everything. Blaster will be stopped by the simple XP firewall.

\Dan

 

[gmcttr]

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

A couple of links with Blaster removal instructions.