SYSTEM SHUTDOWN

[bpar1]

my xp proffesional program keeps just shutting down with a
messagew saying"shutdown ititiated by NT AUSTHORITY\SYSTEM"
AND "MUST RESTART BECAUSE THE rEMOTE pROCEDURE cALL (RPC)
SERVICE TERMINATED UNEXPECTEDLY
WHAT DO i DO

 

[Carey Frisch [MVP]]

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an attacker to
remotely compromise a computer running Microsoft Windows and
gain complete control over it. You can help protect your computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en


--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-------------------------------------------------------------------------------------------------


| my xp proffesional program keeps just shutting down with a
| messagew saying"shutdown ititiated by NT AUSTHORITY\SYSTEM"
| AND "MUST RESTART BECAUSE THE rEMOTE pROCEDURE cALL (RPC)
| SERVICE TERMINATED UNEXPECTEDLY
| WHAT DO i DO

 

[Sir_George]

bpar1,

The following site will provide you with instructions on how to get rid of
the virus infection on your system;

http://www.antivirusebook.com/database/tmp/blaster-rpc-removal.html

I would suggest you run an Antivirus program and be sure to keep the virus
definitions up to date to avoid problems of this type.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Guest]

You can get this error due to virus named blaster or it may possible that rpc service has gone bad
To rectify this problem use the following steps to prevent the forced shut down

From the Start menu, click Run.

In the Run dialog box, type: shutdown -a. Click OK.

Download the FixBlast.exe file from the Symantec Web site and run on the computer

Noteisable the system restore and if computer is connected to cable modem or dsl disconnect it from the computer

End task on msblast.exe.

On your keyboard, press the CTRL+ALT+DELETE keys.
In the Windows Security window, click Task Manager.
In the Windows Task Manager window, click the Processes tab.
On the Processes tab, click msblast.exe, and then click End Proces

After accomplishing above steps run FixBlast.exe in safe mode

After running the fixblast.exe download and install the "Blaster Worm: Critical Security Patch for Windows XP" patch from the Microsoft Web site to prevent this type of attack.

Enable the system restore