Shutdown Initiated by "NT Authority System"

[Tom Gandara]

Someone please help. My desktop and laptop have just
begun to shutdown within a few minutes of starting windows
home XP. The message reads in part, "This shutdown was
initiated by NT Authority System. Remote Procedure Call
Service (RPC) terminated unexpectedly."

What in the world is going on???

Tom G.

 

[Chris Lanier]

Thanks for looking around alittle

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

Enable the windows XP Firewall
https://www.microsoft.com/technet/t...nol/winxppro/proddocs/hnw_enable_firewall.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[Wendy]

***GO OFFLINE TO HAVE TIME TO DO THIS. IF YOU HAVE CABLE
MODEM, COPY AND PASTE THIS MESSAGE TO YOUR CLIPBOARD,
UNPLUG MODEM, AND FOLLOW INSTRUCTIONS****

Unfortunatley, I did a destructive restore before I was
able to solve this problem. Do not do it! Fix your
network connection first! I wish I had.


The computer is trying to protect itself from hacking. Go
to CONTROL PANEL. Go to NETWORK CONNECTIONS. Click on the
one you use, go to left panel(Network Tasks) and select
CHANGE SETTINGS OF THIS CONNECTION. Click on the ADVANCED
tab, and put a check in the box : "PROTECT MY COMPUTER
AND NETWORK BY LIMITING OR PREVENTING ACCESS TO THIS
COMPUTER FROM THE INTERNET"

 

[Ronnie Vernon MVP]

Someone please help. My desktop and laptop have just
begun to shutdown within a few minutes of starting windows
home XP. The message reads in part, "This shutdown was
initiated by NT Authority System. Remote Procedure Call
Service (RPC) terminated unexpectedly."

What in the world is going on???

Tom

There's a new major worm currently hitting the Internet. You can get more
info about the worm here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

The following fix procedure is courtesy of Ron Martell, MVP

This is caused by a new and rapidly spreading worm.

To clear up the "NT Authority\System" and RPC call errors:

1. Go to http://support.microsoft.com/?kbid=823980 and download the
security patch. If at all possible do this on a clean machine and copy the
patch to a 3.5 inch diskette.

2. Boot the infected machine into Safe Mode (tapping the F8 key multiple
times
before and during the boot menu). Insert the 3.5 inch diskette with the
patch on it and run it. Do not reboot yet.

3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the entry
for MSBLAST.EXE and clear the checkbox for it.

4. Use Start - Search and check all your hard drives for the file
MSBLAST.EXE and delete all copies of it.

5. Shut down and restart the computer normally.

6. Immediately do an update of your antivirus software and when the updates
are installed do a complete virus scan of your hard drive.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

 

[rick]

would like to fix the "worm" problem, but I cannot stay
connected to the internet long enough to download the
patch. Windows restarts which does not allow for enough
time to download. What now?

 

[Sam Aspiranti]

Someone please help. My desktop and laptop have just
begun to shutdown within a few minutes of starting windows
home XP. The message reads in part, "This shutdown was
initiated by NT Authority System. Remote Procedure Call
Service (RPC) terminated unexpectedly."

What in the world is going on???

Tom G.

Here is a link to the answer. Copy and paste it to your browser. It
definetly works. There is a bug in windows that allows hackers to
access your PC. Here is a link. Down load the script that looks for
the Mapblast virus. It will clean it if it is there. Then run the
patch which is also linked on the website. Disconnect yourself from
the network if you are on one. Start up ion safe mode then run the
script and the patch. They both fit on a floppy disk. You should
also update your antivirus software and do a full sytem scan.


http://www.bigblackglasses.com/Article.aspx?Article=342