Re: Continued shutdown, move iniciated by NT Authority System

From: Dave Patrick (mail_at_Nospam.DSPatrick.com)
Date: 09/07/04 

Date: Tue, 7 Sep 2004 03:36:16 -0600

"rocio" wrote:
| Thanks Dave, for responding.
|
| And while I save the downloads to a disk and read the
| information, I have a couple of questions to ask you.
|
| Related to the virus:
| - Do you think that the problem is that a virus still in my
| computer? Even after running a full scan and finding
| nothing?...
* Yes msblast and or sasser or variants.

| - The files that were deleted by Norton (TFTP1344 and
| TFTP1392)... do they need to be replaced in the system?
* Most likely just part of the virus.

| Norton has kept these files as a 'backup' [having deleted
| the infected ones -I think]. And if that is the case, can
| I reinstall those files from my 'backup' ERD disk?
|
| Related to the patches:
| - Installing these patches in the system should solve the
| problem? Or would I need to reinstall from ERD date data
| and then run the patches before re-installing again
| utilities and Norten antivirus. At this time I have not
| data or major programs installed.
* These may help.
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.d.html
Windows 2000 Users: What to Do If Your Computer Has Been Infected by Sasser
http://www.microsoft.com/security/incident/sasser_print2000.mspx
 But then I would just start a new install.

| - Also, is there a special method for installing patches?
| or it is kind of 'wizard' follow-me-through kind of install?
* The articles spell it out pretty well. 

-- 
Regards,
Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

Relevant Pages

  • Re: Continued shutdown, move iniciated by NT Authority System
    ... Do you think that the problem is that a virus still in my ... Norton has kept these files as a 'backup' [having deleted ... Installing these patches in the system should solve the ...
    (microsoft.public.win2000.setup)
  • Remote Procedure Call Service RPC error
    ... You have a virus. ... try installing recent patches ... >when I connect to the internet I get connected then in ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Slow boot after installing SP2
    ... >>tons of disk space. ... the time it takes his PC to get to the desktop *after* installing SP2. ... If the only change in his system was the installation of SP2, ... > Have you gone through the startup listand disabled the ones you do not ...
    (microsoft.public.windowsxp.newusers)
  • Re: Linux and security
    ... as a trojan backdoor. ... > potential from virus' it does severely limit the ability a virus has to ... if you catch a virus by installing software then you gotta sift through ... > opposed to a large portion of the global open source community. ...
    (comp.os.linux.security)
  • Dual G5 Leopard freeze/hang
    ... And the flakiness continues in Leopard even after I ... It turned out to be my Sonnet SATA 4+4 controller ... I then went through a long sequence of installing and uninstalling ... Eventually I realized that any disk (well, ...
    (comp.sys.mac.system)