System shutdown message/system reboots

[Tom]

I just reformated my friends PC who is running Win XP
Home Edition. I am now receiving the following error
message and then the computer reboots itself. This
typically happens 10-15 min once the system reboots. Here
is the message... "This system is shutting down. Please
save all work in progress and log off. Any unsaved
charges will be lost. This shutdown was initiated by NT
AUTHORITY\SYSTEM. Windows must now restart because the
Remote Procedure Call (RPC) service terminated
unexpectedly."

Any help would be greatly appreciated.

Thank you!

 

[Joe Roberts]

Go to Google and do a find using

"This shutdown was initiated by NT AUTHORITY\SYSTEM. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly."

and that should lead you to a site which will answer the problem.

--
Joe

=====================================
ALL INCOMING AND OUTGOING MESSAGES ARE SCANNED BY NORTON ANTIVIRUS 2002

=====================================

 

[Rick \Nutcase\ Rogers]

Hi Tom,

When the shutdown warning appears, click start/run and enter "shutdown -a"
to halt the process. It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

 

[dev]

/Tom/ said:

I just reformated my friends PC who is running Win XP
Home Edition. I am now receiving the following error
message and then the computer reboots itself. This
typically happens 10-15 min once the system reboots. Here
is the message... "This system is shutting down. Please
save all work in progress and log off. Any unsaved
charges will be lost. This shutdown was initiated by NT
AUTHORITY\SYSTEM. Windows must now restart because the
Remote Procedure Call (RPC) service terminated
unexpectedly."

Answered almost hourly here. Search the group when possible - for fast info.

Bruce Chambers often replies with the following compilation...

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger