RPC Error Shuts Down Computer

[Greg]

I have a brand new HP Multimedia Computer running XP.
When I access the internet through Dial-up, it will stay
on line for a few minutes but eventually I encounter the
following error and the computer shuts down in 50s:

NT/Authority System

Message:
Windows must now restart because the RPC service
terminated unexpectedly.

Help!

 

[Ben Pang]

Regardless of the amount of time you have been online it
is definitely the blaster worm. You can download the fix
from www.sophos.com to clean your system and then download
the patch from Microsoft to prevent it happening again.
If it starts to shutdown, you can stop this by going to a
command prompt and typing "shutdown -a" (without the
quotes)

 

[Anja Thoreson]

-----Original Message-----
I have a brand new HP Multimedia Computer running XP.
When I access the internet through Dial-up, it will stay
on line for a few minutes but eventually I encounter the
following error and the computer shuts down in 50s:

NT/Authority System

Message:
Windows must now restart because the RPC service
terminated unexpectedly.

Help!

I just went through this myself, you have the worm MS
BLAST!!
First of all, put up a firewall and you won't get kicked
out anymore.
To do so go to "My computer" then "Network Connections"
right click the icon that you use to connect to the
internet. Go to "properties" then "advanced" and click the
box to put up the firewall.

Once you can stay on the net, go to the microsoft website
and download a patch they have for the worm and follow
their instructions. They have a chapter that tells you
what to do once you have the worm.

Also a great free web based program from www.trend
micro.com called "house call" will identify all of your
infected files. Just search the net on how to get rid of
the worm, I just took the last infected file off. Good
luck!

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Improbable as it may seem, you still need to check because you have all the
symptoms. Some of the tools below will actually tell you whether or not you
have the worm. If you do, you may want to contact HP about this or take a
very close look at what you have done since you received the machine and you
might want to inquire at the store where you purchased it as well.

For a quick, small removal tool for W32.Blaster. see
www.kellys-korner-xp.com/xp_qr.htm#rpc

http://www.microsoft.com/security/incident/blast.asp

826955 Virus Alert About the W32.Blaster.Worm Worm
http://support.microsoft.com/?id=826955

 

[Malcolm Jobling]

Hi!

Had the same problem last week (Tuesday). Sounds like
you've picked up the new 'blasterworm' virus. windows
update will help if you can stay on line long enough
followed up by advice from your anti-virus software
provider.

Good luck!

Malcolm J

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -