RPC Error when system starts

[Evan]

When my computer starts, I get this error message:
System Shutdown

This system is shutting down. Please save all work in progress
and log off. Any unsaved changes will be lost. This shutdown
was initiated by NT AUTHORITY\SYSTEM

Message:
Windows must now restart because the Remote Procedure Call
(RPC) service terminated unexpectedly


The error popped up after my system froze and subsequently rebooted
during a SBC Yahoo! DSL Online Protection Suite installation. I
suspect this has something to do with it.

I have worked with all of the viruses (Blaster, etc.) that caused this
problem, and none of those are on this system. I have tried booting
into Safe Mode, Last Known Good Configuration, and Safe Mode with
Command Prompt. I get the RPC error in them all. I cannot use System
Restore in the full boot of Windows or Safe Mode. This system just had
a fresh copy of Windows XP Home installed on it, and this was one of
the first things I installed. Help will be appreciated!

 

[PA Bear]

This system just had

a fresh copy of Windows XP Home installed on it...

That qualifies it as a "new computer": Have you taken care of everything
here before otherwise using the internet?...

Before You Connect a New Computer to the Internet
http://www.cert.org/tech_tips/before_you_plug_in.html

 

[Evan]

Yes, I have. I am behind a NAT router, with Service Pack 2 installed
on XP (which means firewall on), and all Windows Updates installed. I
can assure you that there is no virus on this computer (I did a free
online scan first).

 

[=?ISO-8859-1?Q?Claude_L=E8cre?=]

Evan a écrit :

 

[Tweety Boid]

Have you uninstalled the "SBC Yahoo! DSL Online Protection Suite"? If
so, does the problem go away?

 

[Guest]

Evan,

Please let me know how you resolved this. I too had the problem after
intsalling SBC Yahoo anti virus (having just removed norton anti virus). I to
am using XP SP2. I have tried many-many things to no avail. Your help is much
appreciated.

Thanks,
Don

 

[Rick \Nutcase\ Rogers]

Hi Don,

I doubt Evan will see your message as your are responding to an old post.
You would be better off creating a new post in most instances. In your
particular case, you probably have either the Sasser or Blaster worm. Both
cause this error message to occur. When the shutdown warning appears, click
start/run and enter "shutdown -a" to halt the process. Information on
blaster:

http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

And on Sasser:

http://vil.nai.com/vil/content/v_125007.htm
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A

Details on the patch needed to prevent it:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org