Remote Procedure Calls shutting me down

[Doug McGinnis]

Help, please. I just upgraded to XP home. I purchased an
OEM version (Full, not upgrade). I installed it this
afternoon, but did NOT remove Win 98. Planning to, just
haven't yet. When I connect to the internet in XP, I will
eventually get an error message that says that windows
must shut down because something called NT AUTHORITY
\SYSTEM. It says that the remote procedure call (RPC) had
ended unexpectedly. This happens EVERY time, sometimes
soon, sometimes late, but it DOES happen. Can someone
help?

Thank you!

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

You are infected with Blaster.
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the worm.

W32.Blaster.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH