NT Authority/RPC termination, TFTP files added in startup

[PC]

This system is shutting down. Please save all work in
progress
and log off. Any unsaved changes will be lost. This
shutdown
was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: 00:00:59

Message:
Windows must now restart because the Remote Procedure
Call
(RPC) service terminated unexpectedly


Can someone tell me how to fix this problem? I also have a
TFTP216 file o kb. in my startup.
Help!

 

[Charles]

I am getting the same thing. It keeps shutting down my
servers, what is this???

 

[Roger Abell [MVP]]

make certain that you have the patch for security bulletin
ms03-026 applied to your systems

 

[charles]

I searched up the security bulletin ms03-026 and the
windows update said there were no new updates available
to install.

I deleted the TFTPxxx files out of my startup progams
menu and have not had a problem as of yet. If it starts
again I dont know what I would do though.

regards,
charles
www.TournamentChampions.com
Why you ask?...
We love to play games!

 

[Kent W. England [MVP]]

It's too late for you. You have already been taken over by an RPC attack
as per MS03-026 vulnerability.

You need to disconnect from the Internet, run an AV/trojan/worm scanner
and identify the infection, then download a removal tool or instructions
from your AV vendor's site and remove the infection if possible. Once
you are clean, install the critical update and a firewall to block any
reinfection and then you can reconnect to the Internet.

However, if this is a complete takeover, you may need to do a clean
reinstall to rid yourself of whatever the attacker has added since
taking over your machine.

 

[Brian79]

I found something very similar in my startup menu, but I deleted it,
and now, my computer is running fine.

 

[splatter]

"PC" <[email protected]> wrote in message




blaster
http://www.symantec.com/region/mx/avcenter/data/la-w32.blaster.worm.html