Remote Procedure Call service terminating

[jtibaldi]

After installing SBC Yahoo! for $9.95/month, now every
time I log in to my Windows XP operating system on my PC I
immediately get the "Shutdown initiated by NT
AUTHORITY\SYSTEM" as it counts down from 60 seconds, with
the cryptic "Remote Procedure Call (RPC) service
terminated unexpectedly". There is nothing I can do to
prevent this from occurring. Then my PC shuts down at the
end of the 60 second countown. This sucks! I can't use
my PC, much less the Internet, at all. Does anyone out
there have a workaround??

Peace,
JT

 

[Carey Frisch [MVP]]

Apparently, your computer is infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
neglected to install the critical updates available at the Windows Update website.

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

Are you looking for info about the cause of "Remote Procedure Call (RPC)",
initiated by NT Authority\System error message that shuts down Windows
(you might also see svchost.exe error occasionally)?
http://www.faqs.org/rfcs/rfc1831.html


--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

-------------------------------------------------------------------------------


| After installing SBC Yahoo! for $9.95/month, now every
| time I log in to my Windows XP operating system on my PC I
| immediately get the "Shutdown initiated by NT
| AUTHORITY\SYSTEM" as it counts down from 60 seconds, with
| the cryptic "Remote Procedure Call (RPC) service
| terminated unexpectedly". There is nothing I can do to
| prevent this from occurring. Then my PC shuts down at the
| end of the 60 second countown. This sucks! I can't use
| my PC, much less the Internet, at all. Does anyone out
| there have a workaround??
|
| Peace,
| JT

 

[SJL]

JT - I SEEM TO HAVE THE SAME PROBLEM AS YOU. HAVE
RECENTLY UNDATED TO WINDOWS XP. DO NOT USE YAHOO. BUT
HAVE BEEN GETTING THIS MESSAGE FOR ABOUT A WEEK NOW, AND
AS YOU SAID GIVES YOU 60 SECONDS AND TOTALLY SHUTS YOU
DOWN, AND RESTARTS COMPUTER. HAVE NOT BEEN ABLE TO FIND
AN ANSWER. WOULD APPRECIATE ANY HELP ANYONE MAY HAVE. SJ

 

[mb]

JT - I SEEM TO HAVE THE SAME PROBLEM AS YOU. HAVE
RECENTLY UNDATED TO WINDOWS XP. DO NOT USE YAHOO. BUT
HAVE BEEN GETTING THIS MESSAGE FOR ABOUT A WEEK NOW, AND
AS YOU SAID GIVES YOU 60 SECONDS AND TOTALLY SHUTS YOU
DOWN, AND RESTARTS COMPUTER. HAVE NOT BEEN ABLE TO FIND
AN ANSWER. WOULD APPRECIATE ANY HELP ANYONE MAY HAVE. SJ

Please don't post in CAPS, it's difficult to read and considered to be
'shouting'
You have a virus, I don't think you looked very far for your answer.
It's the 'Blaster' virus or a variant:
http://www.microsoft.com/security/incident/blast.asp

 

[Guest]

Hi. I had the same problem with shutting down in 60 seconds, the only way I could get it sorted was to get my friend round & she phoned the freeserve help line & they talked her threw it & got rid of the problem. Thankfully it has worked, so try giving your inter net provider a call & see how you get on.

 

[Bruce Chambers]

Greetings --

First of all, please unstick your CapsLock key. Posting in all
caps, as you have done, is the Usenet equivalent of shouting, and is
considered very rude. More importantly, posting in all caps makes the
post very hard to read, further reducing your chances of getting help.

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

First of all, please unstick your CapsLock key. Posting in all
caps, as you have done, is the Usenet equivalent of shouting, and is
considered very rude. More importantly, posting in all caps makes the
post very hard to read, further reducing your chances of getting help.

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Oops! My mistake; please ignore the first paragraph.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH