Some probs during accessing the internet..

[anjul]

hi,
Im sending u the whole system log files....
pls reply me with sollution soon.


Event Type: Information
Event Source: RemoteAccess
Event Category: None
Event ID: 20158
Date: 17-Aug-03
Time: 10:46:03 PM
User: N/A
Computer: MASTERPIECE
Description:
The user adgeru@nda successfully established a connection
to Vsnl using the device COM4.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 17-Aug-03
Time: 10:49:09 PM
User: NT AUTHORITY\SYSTEM
Computer: MASTERPIECE
Description:
The process winlogon.exe has initiated the restart of
MASTERPIECE for the following reason: No title for this
reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the Remote
Procedure Call (RPC) service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...




Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 17-Aug-03
Time: 10:49:11 PM
User: N/A
Computer: MASTERPIECE
Description:
The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 60000 milliseconds:
Reboot the machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Information
Event Source: RemoteAccess
Event Category: None
Event ID: 20159
Date: 17-Aug-03
Time: 10:51:30 PM
User: N/A
Computer: MASTERPIECE
Description:
The connection to Vsnl made by user adgeru@nda using
device COM4 was disconnected.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 17-Aug-03
Time: 10:51:32 PM
User: N/A
Computer: MASTERPIECE
Description:
The Remote Procedure Call (RPC) service entered the
running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 17-Aug-03
Time: 10:51:32 PM
User: N/A
Computer: MASTERPIECE
Description:
The Terminal Services service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 17-Aug-03
Time: 10:51:32 PM
User: NT AUTHORITY\SYSTEM
Computer: MASTERPIECE
Description:
The Fast User Switching Compatibility service was
successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 17-Aug-03
Time: 11:38:10 PM
User: N/A
Computer: MASTERPIECE
Description:
The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 60000 milliseconds:
Reboot the machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 17-Aug-03
Time: 11:38:09 PM
User: NT AUTHORITY\SYSTEM
Computer: MASTERPIECE
Description:
The process winlogon.exe has initiated the restart of
MASTERPIECE for the following reason: No title for this
reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the Remote
Procedure Call (RPC) service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...




etc......

waiting for early reply.

Yours'
-Anjul.

 

[Ron Lowe]

hi,
Im sending u the whole system log files....
pls reply me with sollution soon.

<snippage>




You have been infected with the W32/Lovsan worm,
also refered to as the msblast worm, or RPC worm:

http://www.microsoft.com/security/incident/blast.asp


Also, you may want to visit windowsupdate from time to time and
pick up the latest Critical updates. These are often released to plug
any security hole before any malicious code is in the wild which
exploits that hole. This security hole was plugged around a month ago.