Neil Roberts said:
I have just installed BT Broadband Basic on my computer
and every so often (sometimes at 10 minute intervals I am
getting the message:
Windows must restart because the
Remote Procedure Call (RPC) service
terminated unexpectedly
Initiated by NT AUTHORITY/SYSTEM
Is the problem with BT, the telephone line or in the
computer?
Any suggestions?
Your computer is infected with one of the recent worms, usually either
Blaster or Sasser, or one of the variants.
If the shutdown box mentions RPC then it's Blaster,
but if the shutdown box mentions LSASS then it's Sasser.
What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp
What You Should Know About the Sasser Worm
http://www.microsoft.com/security/incident/sasser.mspx
IMPORTANT:
*First thing to do is to enable the Internet Connection Firewall.*
Go to the Network Connections folder;
Right-click your Internet connection | Properties | Advanced tab;
Enable the option "Protect my computer and network..."
Second, we need to install the critical updates which you are missing.
Attempt to go to the windows update site and choose all of the Critical
Updates which are offered.
If the machine begins a shutdown whilst you are trying to do this,
go to a command prompt, and issue this command to cancel the pending
shutdown:
shutdown -a
Let all the critical updates install.
This will install the patches necessary to stop Blaster and Sasser.
Thirdly, you must remove the infection:
A tool is available to remove Blaster worm and Nachi worm infections from
computers that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330
A tool is available to remove the Sasser worm variants
http://support.microsoft.com/?kbid=841720
Fourth, you should follow all the steps listed here to prevent future
problems like this:
Protect Your PC
http://www.microsoft.com/athome/security/protect/default.aspx
1) Always run a firewall, as we set up earlier.
2) Set up your machine for Automatic Updates.
3) Get an AV program installed, and keep it updated.
