NT AUTHORITY/SYSTEM

[Ray]

I keep getting a message every time I log onto the
internet. After about 2 minutes of surfing, I get a
message which says something like "this shutdown was
initiated by NT AUTHORITY/SYSTEM. Windows must shut down
because Remote Procedure Call (RPC) service terminated
unexpectedly". Then it gives a countdown of 1 minute
before re-booting.
Can anyone help me?

 

[Roger Abell]

Turn on your firewall, then
visit Windows Update and get up-to-date on released
critical service
and
visit an anti-virus, and likely anti-malware vendor website
to make use of their scanning and cleaning tools

as you are likely in need of both if you have been getting
this old RPCbased shutdown happening.

 

[Guest]

Thanks for that Roger.
I'm not quite sure how to turn on my firewall, but the
main thing is that I can't get on to any website to
download any Windows Updates because every time I get onto
a website that error message comes up within 2 minutes of
surfing and shuts my PC down.
Is there anything I can do such as downloading a virus
removal tool from another PC and transfering across on a
floppy disk? If I can get my PC to stop shutting down
then I can do the Critical Updates.
Thanks.

 

[Roger Abell]

Disconnect the machine from its network.
In the r-click properties of My Network Places,
in the right pane, r-click into the properties of
the net interface connectoid, and then on the
Advanced tab check the firewall checkbox.

Try stinger from the Symantec website.

 

[Guest]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

Special note if you use AOL:
America Online installs its own connection settings that
override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows
XP's
built-in firewall.


What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -
Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32
..welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
..removal.tool.html

 

[Lanwench [MVP - Exchange]]

Start | run |
type "shutdown -a" without quotes
Then proceed.

This virus (and similar ones )has been around for a long time now,
relatively speaking...never ever evern connect a non-firewalled computer to
the Internet, not even for a few seconds. That's all it takes.

Also make sure you have good, updated antivirus software and in the future
run Windows Update regularly to get all critical patches.