What happen!!

[James]

Hi Guys,

Any workaround solution for this problem.. Could'nt get
anything from the knowledge base.

"windows must now restart because the remote procedure
call (RPC) service terminated unexpectedly. The shutdown
was initialed by NT Authority\System. Please save all
work in progress and log off."

Thanks.

 

[Mcploppy ©]

James bashed at the keyboard and said :

Hi Guys,

Any workaround solution for this problem.. Could'nt get
anything from the knowledge base.

"windows must now restart because the remote procedure
call (RPC) service terminated unexpectedly. The shutdown
was initialed by NT Authority\System. Please save all
work in progress and log off."

Thanks.

James,

The W32/blaster-A worm (aka W32/Lovsan.worm, W32.Blaster.Worm,
WORM_MSBLAST.A) is a worm that scans networks looking for computers
vulnerable to Microsoft's DCOM RPC security exploit. On finding a suitable
victim the worm causes the remote machine to acquire a copy of the worm
using TFTP, which is saved as msblast.exe in the Windows system folder.

If your system reboots every 3 or 4 minutes with the message "Windows must
now restart because the Remote Procedure Call (RPC) Service terminated
unexpectedly".....then you likely have it!

The following operating systems are affected by this virus:
Microsoft Windows NT® 4.0
Microsoft Windows NT 4.0 Terminal Services Edition
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows ServerT 2003

More information on this exploit can be found on Microsoft's website at:
http://www.microsoft.com/security/incident/blast.asp


--
McPloppy ©

{ Remove both MyShoes to email me }
{ Homepage: http://tinyurl.com/bbel }
{ Local Radio: http://tinyurl.com/j1vi }
{ My Alternative Site: http://tinyurl.com/rynb }

 

[Guest]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

Special note if you use AOL:
America Online installs its own connection settings that
override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows
XP's
built-in firewall.


What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -
Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32
..welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
..removal.tool.html

 

[Eric Witte]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.

Or actually *trying* to be infected. I've seen it do this yet never
get infected. Although it always had up to date virus software.

ERic

 

[Rob Elder MVP-Networking]

Sounds like a spyware ad to me.

<[email protected]> wrote in message

Or actually *trying* to be infected. I've seen it do this yet never
get infected. Although it always had up to date virus software.

ERic

 

[Eric Witte]

Sounds like a spyware ad to me.

Except it happens with no spyware. I've seen it on freshly installed
machines as well. I had a 2003 server that did it to me this weekend.
Just installed it Friday night. Virus software was installed and
updated. No spyware yet. Sunday night RPC crashed and it rebooted
itself while I was configuring through TS. We had problems getting
the PIX to work. The old netopia was put on with just a basic netbios
filter

Eric