"Automatic Shutdown..." WHY???

[Stephen]

Hi, I wonder if there's anybody out there that can help
me.

Recently I've been connecting to the Internet and
sometimes it's been fine but other times I get a message
about 2-3 minutes in saying...

"This system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost.
This shutdown was initiated by NT AUTHORITY\SYSTEM.

Message: Windows must now restart because the Remote
Procedure Call (RPC) service terminated unexpectedly"

At first I thought I'd been infected by the Sasser virus
but I've run the check on the Microsoft site and I appear
to be clean. Does anyone out there have an idea what is
happening here and know how to prevent it?

Thanks,

Stephen

 

[Carey Frisch [MVP]]

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

--------------------------------------------------------------------------------------


| Hi, I wonder if there's anybody out there that can help
| me.
|
| Recently I've been connecting to the Internet and
| sometimes it's been fine but other times I get a message
| about 2-3 minutes in saying...
|
| "This system is shutting down. Please save all work in
| progress and log off. Any unsaved changes will be lost.
| This shutdown was initiated by NT AUTHORITY\SYSTEM.
|
| Message: Windows must now restart because the Remote
| Procedure Call (RPC) service terminated unexpectedly"
|
| At first I thought I'd been infected by the Sasser virus
| but I've run the check on the Microsoft site and I appear
| to be clean. Does anyone out there have an idea what is
| happening here and know how to prevent it?
|
| Thanks,
|
| Stephen
|

 

[Guest]

Have you checked for the Blaster virus? That was one of the problems with systems infected with blaster. Microsoft has a program you can run that takes care of it.

 

[Guest]

I think you windows box is infected some worm

1. Go-> run > regedit [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
If you see some value what have name avserve.exe or avserve2.ese that mean you computer is infected sasser. just check
security update and deleite aveserve.exe and/ or aveserve2.exe. Allso use sasser removeble tool example symateck sasser removeble tool.

2. Press Cntrl + alt +del and ceck out protcesses if protcesses what have name cvhost.exe use cpu critical high like 100 % or litlebit less that mean perhaps you computerinfected worm blaste. Just ceck critical update and use worm blaster removeble tool

3. Advanced Windows user can shutdown you computer in fix lan so changed you adminitrator (built in acount ) password and renamed build in administrator acount. Better way is disable administrator acount and create you own admin acont name is admin or computerevil or hacker or something else

4. Check you Scheduled Tasks. It is simple write some *.bat file and add new Shedules Task what shutdown or restart you computer.

 

[Stephen]

Thanks to all. Blaster worm has been located and
successfully removed!!

Stephen

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB828471 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

MS04-012 Cumulative Update for Microsoft RPC-DCOM
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH