Computer Shutdown

  • Thread starter Thread starter Reuben Sanguinet
  • Start date Start date
R

Reuben Sanguinet

I just loaded SBC Yahoo Dial on my laptop which has
Windows XP Home edition installed. When I connect to the
internet, after a few minutes I get a message stating that
the system is about to shutdown . . . Shutdown was
initiated by NT Authority\System. Windows must now
restart because RPC service terminated unexpectedly.

This happens every time I try to connect to the internet.
Any suggestions?
 
Hi Reuben,

When the shutdown warning appears, click start/run and enter "shutdown -a"
to halt the process. It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone
 
I just loaded SBC Yahoo Dial on my laptop which has
Windows XP Home edition installed. When I connect to the
internet, after a few minutes I get a message stating that
the system is about to shutdown . . . Shutdown was
initiated by NT Authority\System. Windows must now
restart because RPC service terminated unexpectedly.

This happens every time I try to connect to the internet.
Any suggestions?
Click to expand...

Sounds like your machine is infected with the Blaster worm.

See the following pages for more info:

http://www.microsoft.com/security/incident/blast.asp
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Good luck, and keep those virus definitions updated.
 
Back
Top