Remote procedure call

[linda]

my computer keeps shutting down when im online. i get a
message 'nt authority\system' below which it reads
shutting down due to a remote procedure call.

i am using windows xp home so i dont know what nt
authority refers to.

its driving me nuts. any help would be greatly appreciated

 

[ceedee]

there are so many posts about this and so much info on google
but to repeat it again

goto administrative tools/services
select rpc service and select recovery tab
set all of them to restart service instead of restart computer

before you do this do a virus scan as this problem is normally caused
by the msblaster worm or hybrids of it

 

[The Unknown]

First, stop the bug from running by hitting CTRL-ALT-DELETE and
bringing up the task manager. Look for msblast.exe in the list, and
kill it. Now your computer won't shut down, but the bug is still there
and will run the next time you start your machine. Go to this URL to
find out how to get rid of it:
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.re
moval.tool.html>



see www.kellys-korner-xp.com/xp_qr.htm#rpc
<http://www.kellys-korner-xp.com/xp_qr.htm> for a quick removal tool for the
MSBlast worm and a link to the Microsoft patch to prevent future infection.
Then update your antivirus software and scan your system.

 

[Guest]

Check below reply from Bruce Chambers on same subject:

Greetings --

If you've connected the PC to the Internet without
having first
enabling a firewall, without having first installed an
antivirus
application with current virus definition files, and/or
before
installing the KB824146 Hotfix, you're very likely to
have been
infected from any of the thousands of PCs on the Internet
that are
constantly broadcasting the Blaster and/or Welchia
worms. It only
takes a few seconds of exposure.

To stay on-line long enough to get the necessary
updates, patches,
and removal tools, click Start > Run, and
enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut
down. Also, make
sure you've enabled a firewall before starting, to
preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.wor
m.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.wor
m.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.wor
m.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers