PRC service terminated

[Peter Smith]

The following fault has begun occurring recently on three
different computers - a six-month old high-specification
desktop running XP Pro and two laptops (a Sony Centrino
and a Dell Inspiron) both running XP Home.

An error message appears stating that the Remote
Procedure Call (RPC) service has been unexpectedly
terminated and that the system will be shut down. The
shut-down is initiated by the NT Authority/System and the
PC switches off in about one minute, with a second-by-
second countdown. There's no way of halting the shutdown.

There is no common factor relating to the generation of
this message; it has appeared on the various machines on
start-up, when trying to access e-mails and when writing
a Word document.

I do not believe it is hardware-related, because of the
wide variety of machines showing the same fault, and it
doesn't seem to be generated by a single piece of
software. I can find nothing about it in the Knowledge
Base, and I assume that it is caused by an obscure XP bug.

Has anybody met this problem and/or can anyone suggest
how to fix it?

 

[Colin M. McGroarty]

Peter,

These machines are most likely infected with the blaster virus.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

You'll have to clean up the virus and bring the Windows Updates up to date.

Regards,

--
Colin M. McGroarty
MCP+I, MCSE, NT-CIP

(e-mail address removed)
www.McGroarty.org

 

[Bruce Chambers]

Greetings --

Actually, hundreds of thousands of people have experienced exactly
what you've experienced, and many of them have also posted that exact
question here thousands of times. ;-}

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH