Thrown off of the intenet by XP

[Jim]

Ever since I install Windows XP over Win98 on my HOME
computer it routinely throws me off of the internet with a
message that goes something like this: " The System is
shutting down in 60 seconds. Save all open files.
Shutdown is being initiated by NT AUTHORITY\SYSTEM.
Remote Procedure Call (RPC) Sevice terminated
unexpectedly"

This happens so frequently I could even e-mail this to you
on my home computer ( I tried) so I'm sending this from my
work computer. HELP!

 

[Bill]

Ever since I install Windows XP over Win98 on my HOME
computer it routinely throws me off of the internet with a
message that goes something like this: " The System is
shutting down in 60 seconds. Save all open files.
Shutdown is being initiated by NT AUTHORITY\SYSTEM.
Remote Procedure Call (RPC) Sevice terminated
unexpectedly"

This happens so frequently I could even e-mail this to you
on my home computer ( I tried) so I'm sending this from my
work computer. HELP!

Blaster virus?

 

[Carey Frisch [MVP]]

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

MS03-039: A Buffer Overrun in RPCSS Could Allow
an Attacker to Run Malicious Programs
http://support.microsoft.com/default.aspx?kbid=824146

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

----------------------------------------------------------------------------------


| Ever since I install Windows XP over Win98 on my HOME
| computer it routinely throws me off of the internet with a
| message that goes something like this: " The System is
| shutting down in 60 seconds. Save all open files.
| Shutdown is being initiated by NT AUTHORITY\SYSTEM.
| Remote Procedure Call (RPC) Sevice terminated
| unexpectedly"
|
| This happens so frequently I could even e-mail this to you
| on my home computer ( I tried) so I'm sending this from my
| work computer. HELP!
|

 

[Jim Macklin]

You have been infected with the Blaster worm because you did
not take proper security procedures before connecting to the
Internet.
Get STINGER http://vil.nai.com/vil/stinger/
How do I use Stinger?


1.. Download Stinger.exe v2.1.9 [749,568 bytes] (4/4/2004)
This version of Stinger includes detection for all known
variants, as of April 4, 2004:
BackDoor-AQJ BackDoor-JZ Bat/Mumu.worm
Exploit-DcomRpc IPCScan IRC/Flood.ap
IRC/Flood.bi IRC/Flood.cd NTServiceLoader
PWS-Narod PWS-Sincom.dll W32/Anig.worm
W32/Bagle@MM W32/Blaster.worm (Lovsan)
W32/Bugbear@MM
W32/Deborm.worm.gen W32/Doomjuice.worm W32/Dumaru
W32/Elkern.cav W32/Fizzer.gen@MM W32/FunLove
W32/Klez W32/Lirva W32/Lovgate
W32/Mimail W32/MoFei.worm W32/Mumu.b.worm
W32/MyDoom W32/Nachi.worm W32/Netsky
W32/Nimda W32/Pate W32/Sdbot.worm.gen
W32/SirCam@MM W32/Sober W32/Sobig
W32/SQLSlammer.worm W32/Swen@MM W32/Yaha@MM


2..


| Ever since I install Windows XP over Win98 on my HOME
| computer it routinely throws me off of the internet with a
| message that goes something like this: " The System is
| shutting down in 60 seconds. Save all open files.
| Shutdown is being initiated by NT AUTHORITY\SYSTEM.
| Remote Procedure Call (RPC) Sevice terminated
| unexpectedly"
|
| This happens so frequently I could even e-mail this to you
| on my home computer ( I tried) so I'm sending this from my
| work computer. HELP!
|

 

[Phil \(a.k.a. purplehaz\)]

I can't imagine how any one that uses a computer still doesn't know about
this as it was in all the papers, tv news, radio news, internet news....
etc.. for months.



Always run a firewall and anti-virus programs on your computer at all times.



You are infected with the Blaster worm virus.



To stop the rebooting/shutdowns, right click on the task bar, choose task
manager, processes tab, look for msblast.exe. Highlight it and click end
process. Then turn on the xp firewall.

To turn on the firewall: control panel, network and internet connections,
network connections, right click your connection, properties, advanced tab,
check the protect my computer box. Do this as quickly as you can once the
desktop comes up. Then visit the sites below for the removal and patch info.

Symantec: removal info and removal tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Also make sure to follow the links to the Microsoft pages for the patch or
visit windows update for the patch after you remove it.

http://support.microsoft.com/?kbid=823980

http://www.microsoft.com/security/incident/blast.asp

 

[Jim]

I didn't pay any attention to any of those because it
didn't start happening until last week when I installed
XP. Thanks for your help...

 

[Phil \(a.k.a. purplehaz\)]

You're welcome.

I didn't pay any attention to any of those because it
didn't start happening until last week when I installed
XP. Thanks for your help...