Shutdown!?

[Brent Money]

My computer is giving me a warning message that tells me
that the computer will restart in 60 seconds. Then it says,

"This shutdown was initiated by NT AUTHORITY\SYSTEM

Windows must now restart because the remote procedure call
(rpc) service terminated unexpectedly."

I have no idea what this means. It happens about 5 minutes
after I get online with my dial-up service. It started
about 3 days ago. Before that I was having no problems.
Please Help. I have Windows XP Professional which was
installed 2 weeks ago.

 

[John E. Carty]

You have been infected with the MSBLAST worm. See the following for
patch/removal details:

http://vil.nai.com/vil/content/v_100547.htm

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

My computer is giving me a warning message that tells me
that the computer will restart in 60 seconds. Then it says,

"This shutdown was initiated by NT AUTHORITY\SYSTEM

Windows must now restart because the remote procedure call
(rpc) service terminated unexpectedly."

I have no idea what this means. It happens about 5 minutes
after I get online with my dial-up service. It started
about 3 days ago. Before that I was having no problems.
Please Help. I have Windows XP Professional which was
installed 2 weeks ago.

There's a new major worm hitting the Internet currently. You can get more
info about the worm here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.htm
l







The following "fix" procedure is courtesy of Ron Martell





'This is caused by a new and rapidly spreading virus.



To clear up the "NT Authority\System" and RPC call errors:



1. Go to http://support.microsoft.com/?kbid=823980 and download the
security patch. If at all possible do this on a clean machine and copy the
patch to a 3.5 inch diskette.



2. Boot the infected machine into Safe Mode (use the F8 key multiple times
before and during the boot menu). Insert the 3.5 inch diskette with the
patch on it and run it. Do not reboot yet.



3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the entry
for MSBLAST.EXE and clear the checkbox for it.



4. Use Start - Search and check all your hard drives for the file
MSBLAST.EXE and delete all copies of it.



5. Shut down and restart the computer normally.



6. Immediately do an update of your antivirus software and when the updates
are installed do a complete virus scan of your hard drive. So far
Symantec/Norton, Trend Micro (PC-Cillin) and Sophos seems to be the only
major companies with an update for this specific virus (4:30 p.m. PDT 11 Aug

2003) but the others will undoubtedly follow within 24 hours.