unwanted system shutdown

[hans]

I am running XP home edition.For quite a while a receive
frequent - at random time intervals- a system message
that windows will shut down. It says that the shutdown
was called by NT- Authority\System and that RPC ( remote
Procedure Call ) had been terminated unexpectedly. This
happens whenever I am connected to the Internet ( but not
necessarily when browsing) It does not happen when I boot
up in safe mode. I have checked for viruses , found a
version of AGOBOT and cleaned up. I have only one
computer running, no network.

Any idea what,s going on. Would appreciate comments.

 

[CheshireCat]

I am running XP home edition.For quite a while a receive
frequent - at random time intervals- a system message
that windows will shut down. It says that the shutdown
was called by NT- Authority\System and that RPC ( remote
Procedure Call ) had been terminated unexpectedly. This
happens whenever I am connected to the Internet ( but not
necessarily when browsing) It does not happen when I boot
up in safe mode. I have checked for viruses , found a
version of AGOBOT and cleaned up. I have only one
computer running, no network.

Any idea what,s going on. Would appreciate comments.

afaik that's the msblast virus. Get your machine updated with the latest
critical updates and run the latest AV checker. Updating is vital.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH