«

> "Kathy" <> wrote in message
news:...
> Hi everyone,
>
> Within the past week my son got this message on his computer about three
times so far saying that the computer is shutting down within 40 seconds and
to close everything before it shuts >down and it was authorized by NT
administration, then it goes through and shuts down the computer. I asked
him what exactly does it say and that is what he told me that it says. He
uses a >broadband connection and constantly has the computer on along with
his IM program. I am thinking he needs to update his security updates
through MS. I don't think he has any firewall >program such as Black Ice or
anything like that. He used to have it but I don't know why he doesn't have
it anymore. The OS he is using is WinXP. Has anyone else had this problem
before?
>
>Thanks,
>Kathy
>A+

Hi Kathy,

What is the pop-up message he's getting?. The most common pop-ups are spam
using the 'messenger' service it's just a matter of blocking certain ports.
If he's on broadband then he really should have a firewall. The build-in XP
doesn't cut it. I personally switched from ZoneAlarm to Kerio which is very
small and light on resources. But I consider it more of a 'techy' firewall
since you really need to understand TCP/IP & ports and it take more set-up
to run efficient. For the average user Zone Alarm is probably one of the
better ones.

If you could post the message that would help a lot. Also advise him to get
a firewall if he doesn't have one already Z.A has there free version which
does a decent job. You'd be amazed how much traffic trying probing your
computer on broadband!.

Rick
--
A+, Network+

Hey Kathy

I think it may be a virus. I do remember hearing something similar late
last year but have not come across it myself.
Rus your sons virus checker and perhaps an anti trojan scanner
http://download.com.com/3000-2239-10...ml?tag=lst-0-1 and a spyware
scanner http://download.com.com/3000-2144-10...ml?tag=lst-0-1 .
As some virus actually disable antivirus software when I have something I
can not explain I also go to http://housecall.trendmicro.com/ and run their
free online scan just to check.

I agree with Rick - Kerio is a great firewall and if you are able to set it
up for your son would I think be a safer option than Zonealarm.
http://download.com.com/3000-2092-90...ml?tag=lst-0-3

I also forgot to mention that there are a couple virus out there that can
disable certain firewalls so it is worthwhile checking if your sons firewall
was uninstalled by him or somehow disabled.


Russ

"Kathy" <> wrote in
news::

> ...It is an
> actual windows pop-up box and the message actually counts down the
> numbers from 40 to 0, as for seconds. There is nothing in this box to
> click either, no OK, no Cancel, no X to x-out of it, nothing. It just
> randomly pops-up and actually shuts the computer down. When this first
> started I told him to get a firewall program, but he's a kid and he
> thinks he knows it all, so what good it was to tell him. I will keep
> after him about getting ZA though. I'm sure he'll get sick of it doing
> this and maybe come to his senses. I just thought I would ask about
> this to make sure I was on the right track about solving the problem.
>
> Thanks
> Kathy
> A+
>
Hi Kathy,

It sounds like the XP commandline shutdown command has been issued. The
next time this happens go to the command line and type in shutdown -a.
This will abort the shutdown sequence. The dialog box you are seeing is
activated when the shutdown command is given on the command line. Your
son's system may be compromised. After you abort the process you may
want to examine the system event logs to see if you can determine when
the command was issued and by what application or user and for what
reason. You son's system may have a back door application running. With
all the stuff that is going on out here in the digital wild's it's
probably going to be a good worm hunt for you.

Let me know how it works out.

Jed