RPC

[Crysti]

My computer shuts down every few minutes.....A box comes
up and says systemis now shutting down....authorized by
NT authority/system....then has a countdown box.....under
that it says Remote Procedure Call service terminated
unexpectedly......Please help me to figure out why it is
doing this.

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

You have the Blaster Worm:
For a quick, small removal tool for W32.Blaster.Worm, see
www.kellys-korner-xp.com/xp_qr.htm#rpc

http://www.microsoft.com/security/incident/blast.asp

826955 Virus Alert About the W32.Blaster.Worm Worm
http://support.microsoft.com/?id=826955

 

[Anja]

-----Original Message-----
My computer shuts down every few minutes.....A box comes
up and says systemis now shutting down....authorized by
NT authority/system....then has a countdown box.....under
that it says Remote Procedure Call service terminated
unexpectedly......Please help me to figure out why it is
doing this.
.

I just went through this myself, you have the worm MS
BLAST!!
First of all, put up a firewall and you won't get kicked
out anymore.
To do so go to "My computer" then "Network Connections"
right click the icon that you use to connect to the
internet. Go to "properties" then "advanced" and click the
box to put up the firewall.

Once you can stay on the net, go to the microsoft website
and download a patch they have for the worm and follow
their instructions. They have a chapter that tells you
what to do once you have the worm.

Also a great free web based program from www.trend
micro.com called "house call" will identify all of your
infected files. Just search the net on how to get rid of
the worm, I just took the last infected file off. Good
luck!

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -