Win XP error msg, system shutdown, NT authority system

[Carol]

Help! I have Windows XP professional on my home
computer. Today I started getting an error message while
online. It says something like: "System Shutdown.
Windows must restart now because the remote procedure
call service terminated unexpectedly....system is
shutting down..save all work...NT Authority System". It
gives me 60 seconds, then shuts down and reboots the
computer. I don't have Windows NT on my computer. I
updated my Norton and did a virus scan but it didn't find
any viruses. Also did a system restore to a few days
ago. Still no help. This message has shut my computer
down at least 10 times today. Can anyone help???
Thank you!

 

[Chris Lanier]

Thanks for looking around alittle before posting

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

Enable the windows XP Firewall
https://www.microsoft.com/technet/t...nol/winxppro/proddocs/hnw_enable_firewall.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[Ronnie Vernon MVP]

Help! I have Windows XP professional on my home
computer. Today I started getting an error message while
online. It says something like: "System Shutdown.
Windows must restart now because the remote procedure
call service terminated unexpectedly....system is
shutting down..save all work...NT Authority System". It
gives me 60 seconds, then shuts down and reboots the
computer. I don't have Windows NT on my computer. I
updated my Norton and did a virus scan but it didn't find
any viruses. Also did a system restore to a few days
ago. Still no help. This message has shut my computer
down at least 10 times today. Can anyone help???
Thank you!

There's a new major worm currently hitting the Internet. You can get more
info about the worm here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

The following fix procedure is courtesy of Ron Martell, MVP

This is caused by a new and rapidly spreading worm.

To clear up the "NT Authority\System" and RPC call errors:

1. Go to http://support.microsoft.com/?kbid=823980 and download the
security patch. If at all possible do this on a clean machine and copy the
patch to a 3.5 inch diskette.

2. Boot the infected machine into Safe Mode (tapping the F8 key multiple
times
before and during the boot menu). Insert the 3.5 inch diskette with the
patch on it and run it. Do not reboot yet.

3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the entry
for MSBLAST.EXE and clear the checkbox for it.

4. Use Start - Search and check all your hard drives for the file
MSBLAST.EXE and delete all copies of it.

5. Shut down and restart the computer normally.

6. Immediately do an update of your antivirus software and when the updates
are installed do a complete virus scan of your hard drive.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

 

[Chip]

I have exactly the same problem. I downloaded some
upgrades to Windows from Microsoft and my system has been
crashing with the same message over and over. If you
find a solution please let me know. I'll keep looking
myself.

 

[Chip]

Thanks, I think. It might be too early to celebrate. I
downloaded the MS03-026 fix for XP home edition and so
far I haven't gotten that message again.
I looked into turning on the firewall and couldn't find
it. I'm not sure if XP-home edition has the capability.

 

[Carol]

Chris - you are a godsend. Thank you so much for your
help! It appears that I was infected with this new
worm. Thanks for sharing your knowledge. MUCH
appreciated!!! :0)

 

[Carol]

Ronnie - THANK YOU so much for your help!!! I very much
appreciate your time and help. This is my first time
going on a newsgroup, so please excuse me if I have made
any errors or haven't replied properly. I very much
appreciate everyone's generous assistance.

 

[mrtee]

Control panel » right click Network connections » click properties » click advanced.

--
Just my 2¢ worth,
Jeff
__________in response to__________
| Thanks, I think. It might be too early to celebrate. I
| downloaded the MS03-026 fix for XP home edition and so
| far I haven't gotten that message again.
| I looked into turning on the firewall and couldn't find
| it. I'm not sure if XP-home edition has the capability.

 

[Carol]

Hi Chip - The problem is caused by a new virus. Read
the reply that Ron posted to my question, and it will
give you instructions for removal. The process works -
thank God for helpful people out there who take the time
to help.

 

[Ronnie Vernon MVP]

Ronnie - THANK YOU so much for your help!!! I very much
appreciate your time and help. This is my first time
going on a newsgroup, so please excuse me if I have made
any errors or haven't replied properly. I very much
appreciate everyone's generous assistance.

Carol

Your Welcome. Glad this helped.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.