RPC Shut Down

Guest · Jan 18, 2004

Every five minutes or so, my computer is shutting down.....the message it's giving is that it's being shut down by the NT AUTHORITY\SYSTEM, and is due to the RPC. I just did a complete factory restore, so I can't figure out why....

Jupiter Jones [MVP] · Jan 18, 2004

Did you enable the firewall BEFORE physically connecting the network
cable?
You most likely caught Blaster.
Follow this to get rid of Blaster:
http://www3.telus.net/dandemar/blaster.htm

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://www3.telus.net/dandemar/

jjk001 said:
Every five minutes or so, my computer is shutting down.....the

message it's giving is that it's being shut down by the NT
AUTHORITY\SYSTEM, and is due to the RPC. I just did a complete
factory restore, so I can't figure out why....

Carey Frisch [MVP] · Jan 18, 2004

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an attacker to
remotely compromise a computer running Microsoft Windows and
gain complete control over it. You can help protect your computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

--------------------------------------------------------------------------------------------------------------
--------

| Every five minutes or so, my computer is shutting down.....the message it's giving is that it's being shut
down by the NT AUTHORITY\SYSTEM, and is due to the RPC. I just did a complete factory restore, so I can't
figure out why....

Richard Urban · Jan 18, 2004

You can't figure out why your computer is infected with the Blaster Worm?
It's because you went on the internet without a condom! You need a firewall
and a working, up to date, version of an antivirus program. You also need
good surfing habits.

Now, go here for removal instructions:
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

--
Regards:

Richard Urban

aka Crusty (-: Old B@stard :-)

jjk001 said:
Every five minutes or so, my computer is shutting down.....the message

it's giving is that it's being shut down by the NT AUTHORITY\SYSTEM, and is
due to the RPC. I just did a complete factory restore, so I can't figure
out why....

Guest · Jan 19, 2004

I know what you mean i got the same problem i built my computer from scratch a year ago and a week ago i had a paracite i could'nt find let alone remove now i wiped the hard drive and reinstalled xp and now this nt/system shutdown aurtority thing is realy annoying i imagin its a bug i though it may be because i registerd the same copy twice but it was from the same ip so i though they would figure it out when it kept happening i disconnected the internet and it still did it.

Its realy getting annoying maybe its somthing to do with the fact that if you dont do anything it shuts down coz if i load a game as soon as the comps booted it don't shut down i would like an answer as my comp is No1 in the network in our house two outher comps access the internet through mine and it means that the outher comps lose internet and one will lose printer ability this is how were networked:

(Dad/MUM's)
PC
/
/ ____________________ My PC
(connected directly to internet)---------------Internet
/
Brothers PC __________/
(hosting printer)

That is basicaly it connections are bridged this is very annoying though.

I I ______________ I ________________
I I I I I I
I I I I I I
I------------I I_______ I I I
I I I I I________________I
I I I I I
I I I_____________ I__________ I

please help

Bruce Chambers · Jan 19, 2004

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

Bruce Chambers

--
Help us help you:

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

jjk001 said:
Every five minutes or so, my computer is shutting down.....the

message it's giving is that it's being shut down by the NT
AUTHORITY\SYSTEM, and is due to the RPC. I just did a complete
factory restore, so I can't figure out why....

Bruce Chambers · Jan 19, 2004

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

Bruce Chambers

--
Help us help you:

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

Whitewolf said:
I know what you mean i got the same problem i built my computer from

scratch a year ago and a week ago i had a paracite i could'nt find let
alone remove now i wiped the hard drive and reinstalled xp and now
this nt/system shutdown aurtority thing is realy annoying i imagin its
a bug i though it may be because i registerd the same copy twice but
it was from the same ip so i though they would figure it out when it
kept happening i disconnected the internet and it still did it.

Its realy getting annoying maybe its somthing to do with the fact

that if you dont do anything it shuts down coz if i load a game as
soon as the comps booted it don't shut down i would like an answer as
my comp is No1 in the network in our house two outher comps access the
internet through mine and it means that the outher comps lose internet
and one will lose printer ability this is how were networked:

(Dad/MUM's)
PC
/
/ ____________________ My PC
(connected directly to internet)---------------Internet
/
Brothers PC __________/
(hosting printer)

That is basicaly it connections are bridged this is very annoying though.

I I ______________ I ________________
I I I

I I I

I I I

I I I

I------------I I_______ I I I
I I I

I I________________I

RPC Shut Down

Guest

Jupiter Jones [MVP]

Carey Frisch [MVP]

Richard Urban

Guest

Bruce Chambers

Bruce Chambers