Error message and shutdown when connected to internet

[Tracie]

On my laptop, when I connect to the internet after I'm
connected for about 10 to 15 minutes I get and error
message that says windows shutdown initiated by NT
Authority\SYSTEM Remote Procedure Call (RPC) terminated
unexpectedly. I have never encoutered this before. I'm
using windows xp, I can't even stay on line long enough to
download any of the service packs, its a new install that
worked fine a couple days ago. It's running on a Toshiba
Laptop PC with 6 gig hard drive, 256 mhz and 256 ram, is
the pc just not big enough to run windows, I've already
reinstalled my modem drivers. Any ideas.

Thanks

 

[Nicholas]

Tracie --

Apparently, your computer has an unwelcome visitor known
as the WM32 Blaster/Lovsan worm.

It entered your computer through your internet connection because the "firewall"
was not properly enabled and essential critical updates were not installed from
the Windows Update website. For instructions on fixing the problem, visit:

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Remove W32.MSBlast.Worm
http://www.dougknox.com/xp/scripts_desc/xp_msblast.htm

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:

How do I turn on the Firewall?
http://www.andyrathbone.com/tips/firewall.html


**** IMPORTANT ****

Visit this web site if you experience difficulty installing
Windows XP Security Patch 823980:

How To Fix The Cryptographic Service Error
http://www.updatexp.com/cryptographic-service.html


--
Nicholas

--------------------------------------------------------------------------


| On my laptop, when I connect to the internet after I'm
| connected for about 10 to 15 minutes I get and error
| message that says windows shutdown initiated by NT
| Authority\SYSTEM Remote Procedure Call (RPC) terminated
| unexpectedly. I have never encoutered this before. I'm
| using windows xp, I can't even stay on line long enough to
| download any of the service packs, its a new install that
| worked fine a couple days ago. It's running on a Toshiba
| Laptop PC with 6 gig hard drive, 256 mhz and 256 ram, is
| the pc just not big enough to run windows, I've already
| reinstalled my modem drivers. Any ideas.
|
| Thanks

 

[Pavan \(MS\)]

Dear Tracie,

Thank you for contact Microsoft Online Support Service. My name is Pavan
Pediredla and I will be working with you on this service request.

As I understand, you have received the following error messages when using
your computer:

"This system is shutting down. Please save all work in progress and log off.
This shutdown was initiated by NT Authority/System."

"Windows must restart because the Remote Procedure Call (RPC) service
terminated unexpectedly."

If I have misunderstood, please feel free to let me know.

This is a known security issue which was first found on July 15. There is
currently an Internet Worm that is taking advantage of this security issue.
Microsoft published the patch to fix this issue on July 16 for all of the
affected systems on our web site. For more information, please refer to the
following page:

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

The resolution to this issue is to clean the worm from your system and
install the patch mentioned above. You can find a link below to install the
patch for Windows XP.

It is suggested that you first download the patch to your system so you can
install the patch immediately after cleaning the system and before you
reconnect to the Internet or network.

In some cases this Worm can cause your system to reboot and you may have
difficulties downloading the patch. In those cases you need to turn off
some ports that the virus uses by blocking them with Firewall software. The
ports that may need to be blocked are as follows:

TCP/UDP Port 135

TCP/UDP Port 139

TCP/UDP Port 445

*Note: Port 69 (TFTP) and TCP port 4444 are also in use by this worm and
should be blocked.

The Internet Connection Firewall that comes with Windows XP will block these
by default once it is enabled. To enable the Internet Connection Firewall
that comes with XP do the following:

1. In Control Panel, double-click "Networking and Internet Connections",
and then click Network Connections.

2. Right-click the connection (your internet connection) on which you would
like to enable ICF, and then click Properties.

3. On the Advanced tab, click the box to select the option to "Protect my
computer or network".

4. If you want to enable the use of some applications and services
through the firewall, you need to enable them by clicking the Settings
button, and then selecting the programs, protocols, and services to be
enabled for the ICF configuration.



To Download the patch and remove the Worm do the Following:

Step 1:

Download patch:

1. Download the patch for your system from the link shown below these
steps.

http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

Clean the worm from your system you should do one of the following:

2. Run your Antivirus software with an updated definitions.

and

Customers should use some of the online removal tools located at:

§
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

§ http://vil.nai.com/vil/stinger

§ http://www.trendmicro.com/download/tsc.asp

Install the patch:

3. Run the patch from the location you downloaded it to in step 1.

At the same time, we suggest you often go to
http://www.microsoft.com/security/ and install all critical updates and
service packs from the Windows Update website:
http://windowsupdate.microsoft.com/. In this way, your system is always
protected from the potential security issues.

Once again I would like to thank you for contacting Microsoft Online Support
Service. I am going to go ahead and close this case.

If you require further assistance with this issue, simply respond with any
supplemental information. The case will then be reopened and forwarded back
to me for follow-up.

If you have additional technical questions or concerns not related to this
specific issue, please open up a new case. For your convenience I have
included the following link:

http://support.microsoft.com/support/webresponse.asp

Again, thank you for choosing Microsoft.

Best Regards,

Pavan Pediredla



ARCR
===========================
A: Running Windows system connected to internet
R: Computer shuts down unexpectedly
C: DDOS attack which uses the bug of "Buffer Overrun in RPC Interface"
R: Install 823980 patch
===========================



This posting is provided "AS IS" with no warranties, and confers no
rights

Please note I cannot respond to e-mailed questions.
Please use these newsgroups to let me know if the suggestions resolved the
issue.