Error Message

[Margaret Smith]

Just puchased an HP notebook with XP Home edition
installed.

Installed and began using MSN 8 but receive the following
error message and subsequent shutdown on a routine basis
when logging on to MSN 8:

"This system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost.
This shutdown was initiated by NT AUTHORITY\SYSTEM.

Message:
Windows must now restart because the Remote Call
Procedure (RPC) service terminated unexpectedly."

HELP! I'm not even using Windows NT. Any suggestions?

 

[Rickoshay]

Hi Margaret,
Sounds like you have been infected with the Blater worm, find below asome
links to help get rid of it.

But first to stop your comp shutting down do the following:
1. Restoring Internet connectivity
In many cases, on both Windows 2000 and XP, changing the settings for the
Remote Procedure Call (RPC) service may allow you to connect to the Internet
without the computer shutting down. To restore Internet connectivity to your
PC, follow these steps:

1.. Click Start > Run. The Run dialog box appears.
2.. Type:

SERVICES.MSC /S

in the open line, and then click OK. The Services window opens.


3.. In the right pane, locate the Remote Procedure Call (RPC) service.


----------------------------------------------------------------------------
CAUTION: There is also a service named Remote Procedure Call (RPC)
Locator. Do not confuse the two.
----------------------------------------------------------------------------


4.. Right-click the Remote Procedure Call (RPC) service, and then click
Properties.
5.. Click the Recovery tab.
6.. Using the drop-down lists, change First failure, Second failure, and
Subsequent failures to "Restart the Service."
7.. Click Apply, and then OK.


----------------------------------------------------------------------------
CAUTION: Make sure that you change these settings back once you have
removed the worm.
----------------------------------------------------------------------------

This will allow you to stay connected long enough to download and run the
worm removal tool.

RickO'Shay.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

 

[Margaret Smith]

Thank you for the suggestions. I will certainly try this.