System Shutdowns

[Dean Wencl]

I am experiencing numerous regular shutdowns with the
following. "This shutdown was initiated by NT
AUTHORITY\SYSTEM" Time before shutdown: 00:00:59

Message
Windows must now restart because the Remote Procedure
Call (RPC) service terminated unexpectedly

What is wrong with my system, We have never had this
trouble before I used windows updates and McAfee updates.
What did I do wrong.

Dean

 

[Bruce Chambers]

Greetings --

Just returning from vacation? Haven't seen any news reports these
past two weeks? Can't see the replies to the hundreds of other posts
asking the same question?

W32.Blaster.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Microsoft Security Bulletin MS03-26
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Nicholas]

Dean --

Apparently, your computer has an unwelcome visitor (VIRUS) known
as the WM32 Blaster/Lovsan WORM.

It entered the computer through your internet connection because the "firewall"
was not properly enabled and essential critical updates were not installed from
the Windows Update website. For instructions on fixing the problem, visit:

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Remove W32.MSBlast.Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Blaster Worm: Critical Security Patch for Windows XP (32-bit version)
http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:

How do I turn on the Firewall?
http://www.andyrathbone.com/tips/firewall.html


**** IMPORTANT ****

Visit this web site if you experience difficulty installing
Windows XP Security Patch 823980:

How To Fix The Cryptographic Service Error
http://www.updatexp.com/cryptographic-service.html


--
Nicholas

--------------------------------------------------------------------------


| I am experiencing numerous regular shutdowns with the
| following. "This shutdown was initiated by NT
| AUTHORITY\SYSTEM" Time before shutdown: 00:00:59
|
| Message
| Windows must now restart because the Remote Procedure
| Call (RPC) service terminated unexpectedly
|
| What is wrong with my system, We have never had this
| trouble before I used windows updates and McAfee updates.
| What did I do wrong.
|
| Dean

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -