When trying to boot up computer, windows 2000 loads, then when desktop loads, it is normal for two seconds, then goes to internet explorer homepage as background, and then all the shortcuts come on screen also. (occasionally, instead of explorer homepage it will have background saying restore active desktop, but won't let me do that). Then after fully booting up, a window comes on the screen with the following: System Shutdown by NT Authority\system
C:WinnT\system32\lsass.exe
Status code 128

At the bottom of this window it has a one minute timer. As soon as it counts down to zero, the system shuts down, and automatically tries to restart.

Specs

Windows 2000 Professional
768 mb RAM
amd athlon 1587mhz processor overclocked to 2100
400w power supply
maxtor 160gb hard drive

Hello cominatcha,

Welcome to pchf.

Sound like you have two problems here. The shutting down is likely to be the Korgo virus, similar to Sassar. Please download the following fix here:

W32.Korgo Removal Tool - Symantec.com
W32.Sasser Removal Tool - Symantec.com

If the shutdown message appears during this time, you can stop it:

- Go to Start, Run, and type in shutdown -a

This will abort the 1 minute shutdown.

After this, you will need to reset you background:

- Right click on your desktop, go to Properties
- Click on Desktop and choose a new background.

Hey Madmonkey. Finally got a chance to try your suggested repairs to my pc. Successfully downloaded & ran both Korgo and Sasser removal tools, and neither virus was detected. I did have to run the virus scans in safe mode, because when I attempted to run the shutdown abort, I got the message window that the shutdown could not be run. Extremely frustrating to say the least! Would attempting to destroy the viruses in safe mode have possibly hidden the viruses?

Hey cominatcha!

I had this problem so i had to reformat but i wouldnt have had i been able to get online and recieve help before it shutdown. I wish i knew what madmonkey just said about aborting the shutdown.

But have a look at my thread i posted after i reformatted. Maybe some of the posts in there will help.

http://www.pchelpforum.com/windows-x...-recovery.html

Thanks upgrader, I was sure it was Korgo! Blaster was another one, but this one shut down after 30 seconds instead of a minute, and I'll be very suprised if this one is still around. If upgraders link doesn't help, can you click on "pchf prework" on my signature, and submit a hijackthis and avg log. One of the security team (probably joe) will get back to you with a fix.