REMOTE PROCEEDURE CALL ( RPC )

[SJL]

IF ANYONE HAS ANY INFORMATION ON THIS MESSAGE THAT SEEMS
TO SHOW UP A FEW MINUTES AFTER I SIGN ON LINE EACH TIME.
SOMETIMES IT WILL SHOW UP MORE THAN ONCE. GIVES ME 60
SECONDS, AND TOTALLY SHUTS DOWN MY COMPUTER AND RESTARTS
IT. I HAVE WINDOWS XP. MESSAGE CONTAINS THE FOLLOWING
INFO. NT AUTHORITY/ SYSTEM, REMOTE PROCEDURE CALL ( RPC )
SEVICE TEMIMATED UNEXPECIDELY. THEN IT COUNTS DOWN FROM
60 SECONDS AND SHUTS ME OFF, THEN RESTARTS MY COMPUTER.
VERY ANNOYING, AND CONSUMES A LOT OF TIME.

 

[Chris Lanier]

Hi, TYPING IN CAPS IS CONSIDERED YELLING, So please don't do it.

You have got a virus, removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

 

[mb]

IF ANYONE HAS ANY INFORMATION ON THIS MESSAGE THAT SEEMS
TO SHOW UP A FEW MINUTES AFTER I SIGN ON LINE EACH TIME.
SOMETIMES IT WILL SHOW UP MORE THAN ONCE. GIVES ME 60
SECONDS, AND TOTALLY SHUTS DOWN MY COMPUTER AND RESTARTS
IT. I HAVE WINDOWS XP. MESSAGE CONTAINS THE FOLLOWING
INFO. NT AUTHORITY/ SYSTEM, REMOTE PROCEDURE CALL ( RPC )
SEVICE TEMIMATED UNEXPECIDELY. THEN IT COUNTS DOWN FROM
60 SECONDS AND SHUTS ME OFF, THEN RESTARTS MY COMPUTER.
VERY ANNOYING, AND CONSUMES A LOT OF TIME.

Please don't post in CAPS, it's difficult to read and considered to be
'shouting'
You have a virus, I don't think you looked very far for your answer.
It's the 'Blaster' virus or a variant:
http://www.microsoft.com/security/incident/blast.asp

 

[Bruce Chambers]

Greetings --

First of all, please unstick your CapsLock key. Posting in all
caps, as you have done, is the Usenet equivalent of shouting, and is
considered very rude. More importantly, posting in all caps makes the
post very hard to read, further reducing your chances of getting help.

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH