Only happens when you connect to the net, eh? And it still happens after a full format and reinstall as well... odd.

How is your friend connecting to the net? What browser, conection type, etc.?

When the screen to reboot comes up, go to
start-run and type CMD
on the black screen type "shutdown -a" and hit enter that will prevent from restat and will give you enough time to fic the problem, it is a blaster worm, you can click on this link http://securityresponse.symantec.com...r/FixBlast.exe , you would have to save it in your desktop and run it..let us know what happen

Hello,

I would take a look at the Microsoft Logs and see if something is written in there describing why the computer may have shut off. If you are lucky, the logs might suggest something for you.

I have also heard of stolen registrations of XP shutting down, and in one case, locked up a person's hard drive that he could not access his files off.

Good Luck,

Christian

well hi everyone i tried this things the shutdown -a gives it about 2 minutes more and that's it he is connecting on dial-up connection i have been searching and no it's not the blaster worm i can't find the files msblast.exe on this files of sys32 or on the registry and i have gone to symantec.com and can't find anything i just found something about that whenever you format a pc infected with this blaster you have to enable a firewall so i'll just have to format the harddrive again and thanx guys but if there is nothing else with what you can help me i'll appreciate it.
another question does anybody know why a computer wont letyou download things such as virus removal tools and any other av system?

Yes- some of the malicious programs out there redirect requests to anti-virus/anti-spyware web sites by modifying your "hosts" file. Search for the hosts file and open it in Notepad. A basic hosts file will only contain a few lines of comments at the beginning, and the following single entry:

127.0.0.1 localhost

If you see any other 127.0.0.1 entries, they should be deleted.


As to your original problem- there's always the possibility that you've got a hardware problem. Things like bad RAM, a fault on the motherboard, or overheating could all cause unexpected shutdowns.

hello
i did found some hosts with the ip 127.0.0.1 so i erased them is there anything else i have to do have this fixed or just once you erase it it's ok and by the way can you give me a little help on how to fix the pc that is turning off by itself with a message saying shutdown initiated by nt authorized system i formatted the hard drive and installed xp back on it but once they connected there it was again my friend is connecting on a dial up i have no idea what kind of pc but it is but i even erased the partitions it had and made new ones if you could help me please.

Removing the hosts entries should at least allow you to reach the previously-blocked sites. I'd make sure to run the lastest version of your anti-virus, as well as Ad Aware, SpyBot, HijackThis, etc. to make sure you're clean; whatever altered your hosts file is probably still lurking in your system.

I'll have to get back to you on the shutdown problem later...

This is typical Sasser activity. It does not matter whether you format and reinstall or not. Until you turn on your firewall and patch the vulnerability you will be wide open to attack. The Sasser worm attacks by REMOTELY seeking out and infecting insecure computers (brand new builds without the patch are the most likely targets); the infected computer then becomes part of the problem.
To sort this out follow these steps
1. Format and reinstall but do NOT allow the computer to connect to the internet.
2. Download the patch to another secure computer. http://www.microsoft.com/technet/sec.../ms04-011.mspx
3. Apply the patch to the newly built computer.
4. Turn on the ICF (Internet connection firewall).
5. Only now is it safe to connect to the internet and update at the Windows update site.
Hope this helps. If you need any more assistance send me a private message.

hi silbylaw
i have also tried looking for info. on the sasser worm and what i found to fix the problem is this a manually removal but didn't work it might work for somebody else so i'll leave it here
You can also remove Sasser manually by following these steps.

1. Disconnect your computer from the Internet.
2. Boot in Safe Mode by pressing the F8 key during startup.
3. Navigate to your Windows directory (c:\WINDOWS or c:\WINNT) on your hard drive.
4. Look for a file named AVSERVE.EXE. Delete it.
5. Click on the Start menu and select Run.
6. Type "regedit" (without quotes).
7. Navigate to the following Registry key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
8. In the windows to the right, look for a value called avserve. Delete it.
9. Exit RegEdit.

Reboot.
Another question does any body knows how to enable the win xp firewall thanx for all your solutions but wont work. I am trying to think that is is a hardware problem but if there is any other solution for this i would thank you so much if you guys share it with me.