60 sec shutdown RPC help

[Gary G]

All of a sudden 2 of my office machines come up with a RPC shutdown...Is
this a worm or what...Running XP pro fully patched and
updated...Help...Thanks in advance...GG

 

[Leythos]

All of a sudden 2 of my office machines come up with a RPC shutdown...Is
this a worm or what...Running XP pro fully patched and
updated...Help...Thanks in advance...GG

Yes, if your PC is doing an automatic shutdown in 60 seconds, then it's
almost certainly compromised. Use the tools below to repair the
compromise.

You will have to boot in safe mode, may have to issue a "shutdown /a" to
abort the shutdown, and then you can run multi-av (that you've
downloaded and updated on another/friends computer) on your computer.

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

No person of sound mind would download files from a hack site that
requires a password to access the unknown files when they are available
directly from the vendors.

Always remember - only download files from Trusted Sites.

The following links will take you to vendors sites for Spy Ware / Ad
ware removal tools and also for Antivirus tools. After you install any
of these applications and update them, run them in SAFE MODE to allow
them to properly clean your system.

First, make sure that your Java is updated to the latest version:
http://www.java.com/en/download/index.jsp

These sites are for downloading Anti-Malware and Anti-Spyware tools, in
order that I would use them myself:

Dave Lipman's tools:
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Secured2K's AntiPauper (download link/info at)
http://forums.mcafeehelp.com/viewtopic.php?t=65072

Rogue Fix - This removal tool is the property of Internet Inspiration
http://www.internetinspiration.co.uk/roguefix.htm

AdAwareSE can be found here:
http://www.lavasoft.com/download_and_buy/detection_database/

SpyBot Search and Destroy can be found here:
http://www.safer-networking.org/en/download/index.html

 

[Robert Moir]

All of a sudden 2 of my office machines come up with a RPC
shutdown...Is this a worm or what...Running XP pro fully patched and
updated...Help...Thanks in advance...GG

This can indicate a number of problems, including a worm as you say. It's
most famous as a symptom of some worms, but assuming it has to be a worm
causing this is like assuming a cut in your arm is caused by a bullet
because that's the most "famous" cause of bleeding arms according to
hollywood, while ignoring the fact you slipped and fell on broken glass just
before you noticed the cut.

Have you recently made changes to these systems (installed patches, new
software, etc?).
Does this happen constantly, e.g. are the machines essentially useless at
the moment because of this error because it appears as soon as you boot? Or
does it occur after you've been using them for a while? Does it occur on
both machines at the same time?

 

[Gary G]

I have recently switched to Nod 32 for virus...The error occurs after using
the system for a while...It occurs on both machines at random times...After
reboot all is well...Some days no problem...Then out of the blue the
error...GG

 

[Tx2]

I have recently switched to Nod 32 for virus...The error occurs after using
the system for a while...It occurs on both machines at random times...After
reboot all is well...Some days no problem...Then out of the blue the
error...

Not an office joker, per chance? One of my colleagues 'discovered' he
could run a commmand prompt and achieve this.

It might be worthwhile installing a free firewall such as Comodo (if you
are able) and see what pops up.

It caught my colleague out

I have no other suggestion if you can rule out the above.

 

[Robert Moir]

I have recently switched to Nod 32 for virus...The error occurs after
using the system for a while...It occurs on both machines at random
times...After reboot all is well...Some days no problem...Then out of
the blue the error...GG

Well I'm not convinced its malware on your system, that's for sure. Are
there any messages in the event log just before it all goes wrong?

I'd also agree with TX2's suggestions, by the way.

 

[Tx2]

(e-mail address removed) thought we might be interested in
the following...

Not an office joker, per chance? One of my colleagues 'discovered' he
could run a commmand prompt and achieve this.

That is of course a "command" prompt...
Long day yesterday.