NT authority /system

[Guest]

I am getting this error message NT authority/systems remote procedure call
rpc service. My computer will then shut down. What is this?

 

[Doug Knox MS-MVP]

A trojan that's trying to infect your system. Turn your FIREWALL ON!

Disconnect from the internet (whether you're on dial or broadband) and see Help and Support for "Firewall".

Then reconnect to the internet, ensure that your antivirus software is up to date and scan your system.

 

[Carey Frisch [MVP]]

How to remove the "Blaster Worm" from your computer:
http://www3.telus.net/dandemar/blaster.htm

[Courtesy of MS-MVP Jupiter Jones]

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

-------------------------------------------------------------------------------------

:

| I am getting this error message NT authority/systems remote procedure call
| rpc service. My computer will then shut down. What is this?

 

[David H. Lipman]

When you get the shutdown message...

Go to; Start --> Run
enter; shutdown -a

This will halt the shutdown and give you a chance to Download the McAfee worm removal tool,
Stinger: http://vil.nai.com/vil/stinger/ or the Microsoft Lovsan/Blaster and Nachi/Welchia
Removal Tool
http://www.microsoft.com/downloads/...8B-FE98-493F-AD76-BF673A38B4CF&displaylang=en
and install the following patch for the RPC/RPCSS and DCOM Vulnerabilities that are
addressed by Microsoft Security Bulletin MS04-012 - KB828741
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741 and finally
http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

Please read: http://www.microsoft.com/security/incident/blast.asp

You also need your WinXP FireWall enabled. If you don't patch the PC and not use a FireWall
then you will
just be re-infected.

I also suggest the installation WinXP SP2 ASAP which actually contains the patch expressed
in KB828741.

Dave





| I am getting this error message NT authority/systems remote procedure call
| rpc service. My computer will then shut down. What is this?

 

[Bruce Chambers]

I am getting this error message NT authority/systems remote procedure call
rpc service. My computer will then shut down. What is this?

It's a well-known worm that has been widely publicized for the past 2½
years.

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB828471 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

MS04-012 Cumulative Update for Microsoft RPC-DCOM
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH