Shutdown initiated by NT Authority

[Harny]

When I am using Outlook Express or Internet Explorer I get a window that
says, "Shutdown initiated by NT Authority System" Then it says, "Remote
Procedure Call Service Terminated Unexpectedly" The computer then reboots.

I think this has something to do with The Authenticated Users whish I think
has the words "NT Authority"

Anyone know how to fix this? I have looked at the Microsoft Knowledge Base
article #300067 but this article does not mention theis "Shutdown" problem.

 

[Jym]

You have a worm / virus. Use the find button in news , type in rpc and you
will find many of the same problems and a fix. Jym

 

[Ray]

This is a problem that I have seen in relation to the
blaster virus. If you go into your running processes
look to see if there is a blaster process running, End it
and run a virus scanner or virus cleaning program.
Something like Mcafee's Stinger.

 

[Guest]

get the patch for the msblast virus (blaster)

 

[Chuck]

When I am using Outlook Express or Internet Explorer I get a window that
says, "Shutdown initiated by NT Authority System" Then it says, "Remote
Procedure Call Service Terminated Unexpectedly" The computer then reboots.

I think this has something to do with The Authenticated Users whish I think
has the words "NT Authority"

Anyone know how to fix this? I have looked at the Microsoft Knowledge Base
article #300067 but this article does not mention theis "Shutdown" problem.

Harry,

You are infected by the Blaster worm or its variant. The following
articles should help:

http://www.microsoft.com/security/incident/blast.asp
http://www.newtechhelp.com/virus/blaster-welchia/index.htm

Cheers,

Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH