RPC service terminates session

[jr]

I just loaded windows XP. Periodically I get a pop up
saying shutdown initiated by NT authority system. windows
must restart because the remote procedure call (RPC)
service terminated unexpectedly.

 

[Patti MacLeod]

Hi jr,

Sounds like you've been bitten by the MSBlaster worm or the Welchia worm.

Have a look here for information about the Blaster worm and its variants:
http://www.microsoft.com/security/incident/blast.asp

And here is information about the Welchia worm:
http://tinyurl.com/kdp6

You need to d/load and install Security patch KB824146, available here:
http://support.microsoft.com/?kbid=824146#WinXP

Also, d/load and run the Blaster and Welchia worm removal tool:
http://support.microsoft.com/default.aspx?scid=833330


Regards,

 

[Chris Holden]

I just loaded windows XP. Periodically I get a pop up
saying shutdown initiated by NT authority system. windows
must restart because the remote procedure call (RPC)
service terminated unexpectedly.

You most likely have the blaster worm.
When the shutdown countdown starts go to: Start> run> type 'shutdown -a'
without the quotes. Hit okay. Do it again should the countdown start again
during the process.
Then go Start> contol panel> network connections> select your internet
connection and right click it. Select properties. Click the advanced tab and
tick the 'protect this...' box. Hit okay until the boxes disappear.
Now go to
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
and read the page. Download the fixblast.exe (link about half way down that
page). Run it.
When your machine is clean, go to windowsupdate.com and download all the
recommended fixes.
Chris

 

[David H. Lipman]

When you get the shutdown message...

Go to; Start --> Run
enter; shutdown -a

This will halt the shutdown and give you a chance to Download the McAfee worm removal tool,
Stinger: http://vil.nai.com/vil/stinger/ or the Microsoft Lovsan/Blaster and Nachi/Welchia
Removal Tool
http://www.microsoft.com/downloads/...8B-FE98-493F-AD76-BF673A38B4CF&displaylang=en
and install the following patch for the RPC/RPCSS Buffer Overflow Vulnerability that is
addressed by Microsoft Security Bulletin MS03-39 http://support.microsoft.com/?kbid=824146

Please read: http://www.microsoft.com/security/incident/blast.asp

You also need a FireWall. If you don't patch the PC and not use a FireWall then you will
just be re-infected.

I also suggest the installation of *ALL* MS Critical Updates ASAP.

Dave



|
| I just loaded windows XP. Periodically I get a pop up
| saying shutdown initiated by NT authority system. windows
| must restart because the remote procedure call (RPC)
| service terminated unexpectedly.