Remote Procedure Call creates shutdown

[CJ]

Last weekend I cleaned off my hard drive and reinstalled
everything. I have Windows XP and the only update I did
was the service pak. I only did that one because the last
time I tried this I discovered a conflict in the updates
that continually makes my computer freeze up. Everything
was working beautifully for a few days, but then I
started getting a "system shutdown" box that gives me 60
seconds to close everything before it restarts the
computer. It says the shutdown was initiated by NT
AUTHORITY\SYSTEM and the message says "Windows must now
restart because the Remote Procedure Call (RPC) service
terminated unexpectedly.

Any idea what is causing this and how to fix it?

Thanks,
CJ

 

[Doug Knox MS-MVP]

First, before connecting to the internet, enable your firewall (See Help and Support) Then visit http://www.kellys-korner-xp.com/xp_qr.htm#rpc for information on removing the MSBlast virus and the Microsoft patch for this issue.

 

[dev]

/CJ/ said:

Last weekend I cleaned off my hard drive and reinstalled
everything. I have Windows XP and the only update I did
was the service pak. I only did that one because the last
time I tried this I discovered a conflict in the updates
that continually makes my computer freeze up. Everything
was working beautifully for a few days, but then I
started getting a "system shutdown" box that gives me 60
seconds to close everything before it restarts the
computer. It says the shutdown was initiated by NT
AUTHORITY\SYSTEM and the message says "Windows must now
restart because the Remote Procedure Call (RPC) service
terminated unexpectedly.

Answered hourly here. A search of the group, if possible is a time saver.
Here's but one reply that you might have come across...

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


(posted originally by Bruce Chambers)

 

[CWatters]

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix.

Is it actually possible to do this?

 

[Guest]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -

 

[Bruce Chambers]

Greetings --

I downloaded and saved it to a floppy disk long ago. I never
connect a PC to a LAN or the Internet without having installed this
particular patch first. Of course, it does require SP1, but I always
used slipstreamed installation CDs, so that's not an issue for me.
For those people who do not prepare for an OS installation in advance,
the key precaution would be to enable the firewall _before_ connecting
and downloading the SP or other updates.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH