DIGIT-ARC read-only archive · snapshot: July 23, 2026

DIGIT-ARC / Software / Software Q&A

patch 4 autoshutdown worm in win 2003 server

10 posts · originally from https://geek.digit.in/community/threads/patch-4-autoshutdown-worm-in-win-2003-server.8534/

T
taken Original post #1
Apr 18, 2005 at 5:30 PM
hi,

i have recently loaded windows 2003 standerd edition on my server machine and it has been affected by this

"... will shutdown in 60 seconds... win NT/Authority .." XXX worm.

i got a fix only for win XP pro and windows 2000 server. i have tried with windows 2000 server patch on this OS but it say that the OS is not of proper version. pls suggest me the patch URL. i desperately need it.

reg
taken
D
digen #2
Apr 18, 2005 at 7:49 PM
Afaik Win2003 is one amonst the few OS's which doesnt get infected by sasser/blaster worm.But I maybe wrong.

Can you please post the exact error message you are recieving? A screenshot would be of great help.
R
rajas #3
Apr 19, 2005 at 2:08 AM
Sasser Worm will affect WinNT, 2000, XP, Windows Server 2003, Microsoft NetMeeting. (All Versions).


@taken: Check the link for the download patch for WIN Server 2003. Also, it includes the update for all versions of Windows.

*www.microsoft.com/technet/security/bulletin/MS04-011.mspx
D
digen #4
Apr 19, 2005 at 2:15 AM
Oh yeah my bad.
Thanks for the info rajas.
R
rajas #5
Apr 19, 2005 at 5:01 AM
ur welcome digen.
T
taken #6
Apr 19, 2005 at 10:01 AM
thnks 4 the Re

i am downloading it. hope that it works out.

taken
T
taken #7
Apr 19, 2005 at 5:01 PM
well well,

i have downloaded the patch but it still exists. is there any remedy or other ways to get this problem out???

regs
R
rajas #8
Apr 19, 2005 at 6:21 PM
Try scanning with Stinger
Stinger is a stand-alone utility used to detect and remove specific viruses
*vil.nai.com/vil/stinger/

OR
Microsoft® Windows® Malicious Software Removal Tool
*www.microsoft.com/downloads/detail...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Both the utilities can clean the computer for Sasser or Blaster Worm/Virus. Try both and post the result.
T
taken #9
Apr 20, 2005 at 5:44 PM
so thnsk of ur prompt re:

well, i have downloaded the S/w both stinger and Microsoft one. Ran both of them and could just get nothing:

here is the report of stinger:
----------------
McAfee AVERT Stinger Version 2.5.3 built on Mar 1 2005

Copyright (C) 2005 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Mar 1 2005.

Ready to scan for 53 viruses, trojans and variants.



Scan initiated on Wed Apr 20 17:23:41 2005

Number of clean files: 17916



Scan initiated on Wed Apr 20 17:27:42 2005

Number of clean files: 17918
--------------------

to say, i have first just intititated the scan and in it, repair was on. later again i scanned with "report" option enabled.

so, i dont find anything sugesting here.

well, reg the other, it just ran and showed that nothing is corrupted or infected.

so, i think when the scan was on progress, it might have cured the virus. i will have to test the system now again as such.

well, is it that at any point of time this worm reenters the system after the scan??? if then i think i will have to scan each and every time i start the PC. isn't it

pls suggest the feedback
taken
R
rajas #10
Apr 22, 2005 at 4:19 AM
@taken:

The worm hits the RPC services. so, when u clean the traces of the infection and apply the patch, there is no point that it would come back.
If you still get the error of "NT Authority...", its better to reformat. Apply the patch of Sasser/Blaster immediatly B4 u do anything. may be Worm messed-up the RPC Services.