NT Authority does system shutdown

[Randy Rausch]

I have XP Home

When I connect to the internet I can work for about
2 minutes when I get the message

NT Authority System SHUT DOWN

RPC Service Terminated Unexpectedly

Then my PC starts back up and we do it all over again?

HELP

Randy

 

[Nicholas]

Randy --

Apparently, your computer has an unwelcome visitor (VIRUS) known
as the WM32 Blaster/Lovsan WORM.

It entered the computer through the internet connection because the "firewall"
was not properly enabled and essential critical updates were not installed from
the Windows Update website. For instructions on fixing the problem, visit:

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Remove W32.MSBlast.Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Blaster Worm: Critical Security Patch for Windows XP (32-bit version)
http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:

How do I turn on the Firewall?
http://www.andyrathbone.com/tips/firewall.html


**** IMPORTANT ****

Visit this web site if you experience difficulty installing
Windows XP Security Patch 823980:

How To Fix The Cryptographic Service Error
http://www.updatexp.com/cryptographic-service.html


--
Nicholas

--------------------------------------------------------------------


| I have XP Home
|
| When I connect to the internet I can work for about
| 2 minutes when I get the message
|
| NT Authority System SHUT DOWN
|
| RPC Service Terminated Unexpectedly
|
| Then my PC starts back up and we do it all over again?
|
| HELP
|
| Randy
|

 

[S.Sengupta]

-----Original Message-----
I have XP Home

When I connect to the internet I can work for about
2 minutes when I get the message

NT Authority System SHUT DOWN

RPC Service Terminated Unexpectedly

Then my PC starts back up and we do it all over again?

HELP

Randy

Hello!
This is caused by a worm someone unleashed on the internet.
The short of it is that you should immediately disconnect
from the internet so you don't get infected if you aren't
already, enable a firewall, run a virus scan, and then go
to http://windowsupdate.microsoft.com and install all of
the critical updates.

To enable the built-in firewall, open the Network
Connections control panel. Then right click on your
internet connection, or the network card you use to connect
to broadband and select properties. Go to the Advanced tab
and check the checkbox labeled "Protect my computer and
network by limiting or preventing access to this computer
from the Internet."

There are online virus scanners out there. If you have a
virus scanner on your computer, make sure you download the
latest virus definitions for it.
Download the MS03-026 patch from Microsoft.

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

http://www.bigblackglasses.com/Article.aspx?Article=342
http://www.microsoft.com/security/incident/blast.asp

Worm Removal:
************
From Symantec: W32.Baster.Worm is exploiting the
vulnerabilities of the RPC interface.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

From McAfee:
http://vil.nai.com/vil/content/v_100547.htm
http://vil.nai.com/vil/content/v_100516.htm

Sophos:
http://www.sophos.com/virusinfo/analyses/w32blastera.html



If you still see the NT AUTHORITY\SYSTEM error message
after you have disabled DCOM and reconnected to the Internet:

Click the Start button, click Run, in the Open box type
shutdown -a and click OK.

Reconnect your cable modem or DSL modem.

Start an Internet session and go to this URL:

http://download.microsoft.com/downl...e-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

Close all open programs including Internet Explorer.

Double-click the filename to expand and execute the patch.
Follow the directions in the Wizard to complete the
installation.

The security patch should be applied when you restart Windows.


Remove The Virus/Worm From Your System

Update your virus scan software definition files at the
software vendor's web site and run a complete virus scan.

Alternatively, free stand alone virus/worm removal programs
are available from Symantec and McAfee:

Symantec:

http://securityresponse.symantec.com/avcenter/FixBlast.exe

McAfee:

http://download.nai.com/products/mcafee-avert/stinger.exe

Either of these programs can be downloaded and executed to
clean this virus/worm from your system

with regards/
ssg/pronetworks.org

 

[Chris Lanier]

You have got a virus, removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html