shutting down

My roommate is gone for the week and one night her
computer logged off and now every time we try to log in
again after about a minute this message pops up. This
system is shutting down. Please save all work in progress
and log off. Any unsaved changes will be lost. This
shutdown was initiated by NT AUTHORITY\SYSTEM. Time before
shutdown: (then it gives 60 seconds on the clock). Also-
Message
Windows must now reset because the Remote Procedure Call
(PPC) service terminated unexpectedly.
What is causing this and how can I fix it? Thank you
Erin Williams

Erin Williams wrote:
> My roommate is gone for the week and one night her
> computer logged off and now every time we try to log in
> again after about a minute this message pops up. This
> system is shutting down. Please save all work in progress
> and log off. Any unsaved changes will be lost. This
> shutdown was initiated by NT AUTHORITY\SYSTEM. Time before
> shutdown: (then it gives 60 seconds on the clock). Also-
> Message
> Windows must now reset because the Remote Procedure Call
> (PPC) service terminated unexpectedly.
> What is causing this and how can I fix it? Thank you
> Erin Williams

There's a new major worm hitting the Internet currently. You can get more
info about the worm here:

http://securityresponse.symantec.co...laster.worm.htm
l



The following "fix" procedure is courtesy of Ron Martell





'This is caused by a new and rapidly spreading virus.



To clear up the "NT Authority\System" and RPC call errors:



1. Go to http://support.microsoft.com/?kbid=823980 and download the
security patch. If at all possible do this on a clean machine and copy the
patch to a 3.5 inch diskette.



2. Boot the infected machine into Safe Mode (use the F8 key multiple times
before and during the boot menu). Insert the 3.5 inch diskette with the
patch on it and run it. Do not reboot yet.



3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the entry
for MSBLAST.EXE and clear the checkbox for it.



4. Use Start - Search and check all your hard drives for the file
MSBLAST.EXE and delete all copies of it.



5. Shut down and restart the computer normally.



6. Immediately do an update of your antivirus software and when the updates
are installed do a complete virus scan of your hard drive. So far
Symantec/Norton, Trend Micro (PC-Cillin) and Sophos seems to be the only
major companies with an update for this specific virus (4:30 p.m. PDT 11 Aug

2003) but the others will undoubtedly follow within 24 hours.




--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/