RPC error

[jruss]

What is this and how do I correct it?

SYSTEM SHUTDOWN
NT Authority\System

Remote Procedure call (RPC)

The system shuts down in 60 seconds.

Thanks
Jruss

 

[Doug Knox MS-MVP]

You have a virus, specifically the W32.Blaster.Worm. See
www.kellys-korner-xp.com/xp_tweaks.htm, Line 257, Left column, for a small
utility to help remove it, and all its known variants. Then download the
patch from Microsoft to help prevent this type of infection in the future.

More info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
Note: there are B and C variants as well. One of these two variants also
downloads another virus. A new version of either Nimda or Spybot, that the
AV scanners don't seem to be catching.

http://www.microsoft.com/security/incident/blast.asp
What You Should Know About the Blaster Worm and Its Variants

Two utilities that will help you disinfect your system:

http://www.dougknox.com/xp/utils/xp_emerutils.htm
http://www.dougknox.com/xp/utils/xp_starttrack.htm

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

You are infected with the blaster worm or one of it's variants.
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -