XP error message causing shutdown and restart

[Sharon]

I just bought a new hard drive for a PIII computer and
installed it. I originally put in Win98 2nd ed since I
had originally had that on the computer with an upgrade to
XP. When I "upgraded", I noticed that the instructions
said I could do a "new" installation if I didn't want to
keep existing files and personalized settings and would
allow me to choose a file system (NTFS) so that's what I
did. Everything seemed fine. I installed MSN dial-up so
I could download updates to XP and that's when it seemed
the trouble started. I got an error message in a box
which said..."this shutdown was initiated by NT
Authority\System....windows must now shut down because
Remote Procedure Call (RPC) service terminated unexpectedly
.....the shutdown and restart then starts automatically
after 60 seconds (I think). I now find that MSN doesn't
seem to have anything to do with it and the computer is
now showing the error immediately when the restart
completes and, of course, the cycle starts again. I hope
someone can help me (I'm sending this message by way of my
laptop). Please note that XP does not allow me to access
anything else when it gives this error and begins the
shutdown and restart. Thanks.

 

[Jim Albright]

You have a virus! Get a good virus checker and have it remove this.
Jim

 

[gls858]

You have a virus! Get a good virus checker and have it remove this.
Jim

Here's a little more info. Credit goes to Ken Blake
I just did a cut and paste.

gls858
You have the MSBlaster worm. To remove it, do the following:

The following instructions are in three parts

1. Stop it from running

2. Remove it from your system

3. Make sure it doesn't come back



Before beginning, if you have an always-on internet connection,
it's a good idea to disconnect it.



1. Stop it from running

Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
Processes tab, click msblast.exe and then "End process." Reply
"Yes" to the warning message that comes up.

This stops the worm from running, so your system will not shut
down. However, it doesn't remove it, and if that's all you do, it
will start up again the next time you boot.


***

2. Remove it from your system

a. Start the registry editor program, regedit, by going to Start

Run, and typing REGEDIT

Navigate to HKEY_Local_Machine\Software\Microsoft\Windows\Current
Version\Run by clicking the plus signs next to each of the
folders in the left hand pane. When you get to the last of them,
Run, click the word Run itself.

Find an entry called "Windows Auto Update" on the right side.
Right-click it and delete it.

b. Do a Windows search for msblast, and delete all files found.

The worm is now gone, and won't start again the next time you
boot. But if that's all you do, you can get reinfected just as
you did the first time.

***


3. Make sure it doesn't come back

a. Make sure you're running a firewall that prevents worms like
this from getting in. You can enable the built-in Windows XP
firewall, or download and install another one such as the free
version of ZoneAlarm. To enable the built-in firewall, go to
Control Panel, double-click Networking and Internet Connections,
then click Network Connections. Right-click your connection, then
click Properties, and on the Advanced tab, click the option
"Protect my computer and network..."


b. If you've disconnected your internet connection, reconnect it.
Download and install the Microsoft patch at
http://download.microsoft.com/downl...e-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

That will remove the vulnerability that the worm exploits.


c. Be sure you are running an anti-virus program, and that you
regularly download the latest updated virus definitions.

 

[Sharon]

thanks for the advice, however, when I go to the task
manager, msblast doesn't appear but mslaugh does and even
when I end the task, the shutdown and restart still takes
place and, of course, it is back in the processes list
when it restarts. I am will to fdisk the hard drive and
start over if this will resolve the problem. If so, can
you tell me the process for that. Thanks, again.
Sharon

 

[gls858]

thanks for the advice, however, when I go to the task

manager, msblast doesn't appear but mslaugh does and even
when I end the task, the shutdown and restart still takes
place and, of course, it is back in the processes list
when it restarts. I am will to fdisk the hard drive and
start over if this will resolve the problem. If so, can
you tell me the process for that. Thanks, again.
Sharon

Did you follow ALL of the instruction above carefully.
If not you will be re-infected after booting up and
accessing the net.

gls858

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

See if the information below resolves it:
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32-bit patch if you are running XP.

Kelly's script kills all known variants.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.