Windows XP home edition

  • Thread starter Thread starter vincent
  • Start date Start date
V

vincent

I am running Windows XP home edition. While being online,
via Explorer 6.0 or Netscape 7.1, after a few minutes I
receive the message that Windows has to be restarted
because the PRC service has stopped unexpectedly. Message
also says that the system will be shut down by NT authority
system. You than get 1 minute before the system physucally
shuts down and restarts.

Has anybody any clue what this is all about and more
important on how to solve it.


Thanks and Regards,

'Vincent
 
You can stop it this way. Most posters don't know it
won't let you read anything from the links they post. (
It shuts you down !! dah!! )


You have a virus = Mblaster Follow the steps below.

1. Go to control Panel> Network connections > *Your
connection* rt click >properties, Advanced Tab, check to
enable> The Firewall.

2. Do a Ctrl + Alt + DeL , on task manager highlight
MBlaster.exe and end the Process.

3. Go here and download the fix.

http://www.microsoft.com/downloads/details.aspx?
FamilyId=E70A0D8B-FE98-493F-AD76-
BF673A38B4CF&displaylang=en

4. Get a XP update;
http://v4.windowsupdate.microsoft.com/en/default.asp
 
That sounds like the Blaster Worm or one of its many variants. You should run a virus check and see if it can delete or quaratine the infected file(s). After you get that fixed, I would download the needed updates for Windows (check Windows Update).
 
Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Close. Your problem will then be that XP will protect the worm.

Do step 1 and 2 below. When Blaster restarts (and it will), go to Start, Run
and type "shutdown -a" without the quotes. This will abort the shutdown.

Now, go to http://www.symantec.com/avcenter/tools.list.html and get the
Blaster AND Welchia removal tools.

Next, and this is important, right-click on My Computer, System Restore. Put
a checkmark in the box to turn off System Restore. If you fail to do this
step, XP will restore the worm everytime you remove it.

Now. run the Fix Blaster and Fix Welchia files in that order. You most
likely have the Welchia worm because it uses the same vulnerabilities as
Blaster.

After it is done, turn System Restore back on then follow steps 3 and 4
below. The Microsoft patch is Q824146 by the way.

Finally, keep the firewall up. (I'd recommend getting a better one.) That's
how you got the worm in the first place.

Courtney
 
vincent said:
I am running Windows XP home edition. While being online,
via Explorer 6.0 or Netscape 7.1, after a few minutes I
receive the message that Windows has to be restarted
because the PRC service has stopped unexpectedly
Click to expand...

This is the Blast worm, or one of its family.

Boot and immediately go to Control Panel - Admin Tools - Services.
There look for the first line Remote Procedure Call (RPC) and double
click. On the Recovery page change the First Failure box to 'Restart
the Service' and click Apply; repeat at Second failure.

That will give breathing space in which to go to
http://www.kellys-korner-xp.com/xp_w.htm#worm
and get the removal script for W32.blastewr to run. While there I would
get and run the other two scripts as well
 
Back
Top