remote shutdown

  • Thread starter Thread starter joe
  • Start date Start date
J

joe

my system keeps on shutting down automatically. the
message states that the shutdown is initiated by NT
WINDOWS\AUTHORITY. In addition, it states that the Remote
Procedure Call is engaged. How do I stop this from
interruption the computer while it is operating. It is
engaged primarily when I am surfing. Could someone please
respond.
Joe, Thank you
 
Hi,

It's a new virus called blaster. Information:

http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x

Associate Expert - WinXP - Expert Zone
 
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

There are 2 more variants out now.
The exes for the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -
 
Back
Top