XP Restarts when on line

[Chris S]

Hi,

I am asking this for someone else.
They have just purchased a PC, it has XP Pro installed, the computer works
ok until they go online then they get the following message.

System Shutdown

This system is shutting down please save all work in progress and log off
Windows must now restart, all unsaved will be lost.
this shutdown was initiated by NTAUTHORITY\SYSTEM
The Remote Procedure Call(RPC) Service terminated unexpectedly

The PC then counts down from 60 and then restarts by itself.
The connection is Dial Up.

Any ideas why this happens or how to fix it.

Thanx

 

[mike_h]

Hi,

I am asking this for someone else.
They have just purchased a PC, it has XP Pro installed, the computer works
ok until they go online then they get the following message.

System Shutdown

This system is shutting down please save all work in progress and log off
Windows must now restart, all unsaved will be lost.
this shutdown was initiated by NTAUTHORITY\SYSTEM
The Remote Procedure Call(RPC) Service terminated unexpectedly

The PC then counts down from 60 and then restarts by itself.
The connection is Dial Up.

Any ideas why this happens or how to fix it.

Thanx

The system is infected with the W32.Blaster Worm. see information here
http://www.microsoft.com/security/incident/blast.asp

Michael

 

[Cerridwen]

Hi,

I am asking this for someone else.
They have just purchased a PC, it has XP Pro installed, the computer
works ok until they go online then they get the following message.

System Shutdown

This system is shutting down please save all work in progress and log
off Windows must now restart, all unsaved will be lost.
this shutdown was initiated by NTAUTHORITY\SYSTEM
The Remote Procedure Call(RPC) Service terminated unexpectedly

The PC then counts down from 60 and then restarts by itself.
The connection is Dial Up.

Any ideas why this happens or how to fix it.

Thanx

Oh FFS! What is this - moron month?! You're another NSF - have you been
living in a cave for the past 5½ years and have never heard of Google?! This
question is asked - and answered - almost hourly these days. Had you spent
the time searching instead of hoping someone would wipe your arse for you,
you could have avoided receiving a response like this! But you didn't, so
you're just going to have to live with it! It would have taken you less time
to find the answer yourself than it did to post!

 

[Chris S]

Oh FFS! What is this - moron month?! You're another NSF - have you been
living in a cave for the past 5½ years and have never heard of Google?! This
question is asked - and answered - almost hourly these days. Had you spent
the time searching instead of hoping someone would wipe your arse for you,
you could have avoided receiving a response like this! But you didn't, so
you're just going to have to live with it! It would have taken you less time
to find the answer yourself than it did to post!

Well Moron.
It isn't my computer that is having the trouble hence me being fortunate
enough not to have ran into you before.
Since I don't know what the problem was it is a bit hard to search for the
solution, and I obviously don't have as much time as you have to do this.
I have used Usenet before to find solutions to things, most people are
friendly and happy to give advice, there are a couple of people like you who
seem not to be here to help but to aggressive and abusive, this is normally
because they don't have any friends and have nothing interesting to do.

Plonk

 

[Shenan Stanley]

I am asking this for someone else.
They have just purchased a PC, it has XP Pro installed, the computer
works ok until they go online then they get the following message.

System Shutdown

This system is shutting down please save all work in progress and log
off Windows must now restart, all unsaved will be lost.
this shutdown was initiated by NTAUTHORITY\SYSTEM
The Remote Procedure Call(RPC) Service terminated unexpectedly

The PC then counts down from 60 and then restarts by itself.
The connection is Dial Up.

Any ideas why this happens or how to fix it.

Get rid of Blaster first:
http://www.microsoft.com/security/incident/blast.asp

Once you get there - PRINT IT.. If the shutdown message appears, click on
START, select RUN and type in the following line:

shutdown -a

and click OK.

That will abort the shutdown and you can continue cleaning the machine.

After you have followed Microsoft's fine instructions, do these things to
really clean up the machine.. There is no telling what other parasites might
be hanging out in your computer:

Although some people complain about this "long list" of things I give, if
you do these things (some periodically) then you can keep your
machine spyware/adware/malware/virus/trojan free and running much better
than it likely does by the time you ask this question on a newsgroup like
this one.

So, that being said, here is the list:

Turn on that firewall...
http://www.microsoft.com/WindowsXP/home/using/howto/homenet/icf.asp
(It has been reported that it now works with AOL 9.0+)


Make sure you have all the updates (critical) installed from:
http://windowsupdate.microsoft.com/
(Scan for updates, Review and Install)


Get rid of the spy/ad/mal-ware..
(Yes - using MORE than one of these..
I recommend at least the first three. Also..
UPDATE the definitions for them before using.)

Spybot Search and Destroy
http://www.safer-networking.net/

Lavasoft AdAware
http://www.lavasoft.de

CWSShredder
http://www.spywareinfo.com/~merijn/downloads.html

Hijack This!
http://mjc1.com/mirror/hjt/

I also like "The Cleaner" and "SpywareBlaster" and "SpywareGuard".
- http://www.moosoft.com/
- http://www.javacoolsoftware.com/

The first is a PAY product, but useable for 30 days - it has found and
eliminated problems in the past the others did not. The latter two are
prevention mechanisms. I like SpywareGuard for those with enough processor
to have something running like antivirus software - and it prevents browser
hijacking quite well.


And Assortment of Others:
http://www.merijn.org/downloads.html


After you cleanup your PC somewhat of spy/ad/mal-ware, verify your antivirus
software is updated and run a full scan of your computer. If you have no
antivirus software - get one NOW! Grisoft AntiVirus:
http://www.grisoft.com/us/us_dwnl_free.php


Empty your Temporary Internet Files and shrink the size it stores to about
80 to 120MB (seems to be an optimal size for the normal user)

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section,
do the following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the
"Amount of disk space to use:" to something between 80MB
and 120MB. (Betting it is MUCH larger right now.)
- Click OK.
- Click on "Delete Files" and select to
"Delete all offline contents" (the checkbox) and click
OK. (If you had a LOT, this could take 2-10 minutes or
more.)
- Once it is done, click OK, close Internet Explorer
- Re-open Internet Explorer.


Uninstall any software you do not use often/ever. (If you have something
installed but never use it, uninstall it.) If you go through Control
Panel -> Add/Remove Programs and see things you seldom if ever use, it is to
your advantage to remove it.


Also, if you are tired of Web Page Pop-Ups/Unders.. You could try the
Google Toolbar.
http://toolbar.google.com/


Stop loading applications at logon.. run MSCONFIG and look under the startup
tab for things you DON'T want to startup! Search the Internet with Google
to discover what things are safe to remove and what things may even be
malware infecting your computer.


Better control your email and lessen the amount of time you spend dealing
with SPAM:
SpamBayes
http://spambayes.sourceforge.net
or
Spamihilator.
http://www.spamihilator.com

 

[Chris S]

The system is infected with the W32.Blaster Worm. see information here
http://www.microsoft.com/security/incident/blast.asp

thanx


Michael

 

[Tegger®]

Well Moron.
It isn't my computer that is having the trouble hence me being
fortunate enough not to have ran into you before.
Since I don't know what the problem was it is a bit hard to search for
the solution,

You *knew* what the problem was. It was shutting down on you. I would have
gone here:
www.groups.google.com

and typed in the terms (exactly as you see it here):
system shutdown windows xp

or perhaps, a bit of the error message, such as:
"this system is shutting down"
(in brackets so Google knows to treat it like a single phrase)

and maybe the unusual word in there:
ntauthority

and I obviously don't have as much time as you have to
do this.

It would have taken seconds to type this, and seconds to receive the
answer. As it was, you had to wait much longer than that to get your
answer.

When I typed this just now, Google returned--within seconds--28,000
responses containing the answer, which is the Blaster worm.

I have used Usenet before to find solutions to things,

The problem is, 99% of the problems around have already been asked and
answered many, many times. That's what Google is for.

It is always a good idea to search Google first before posting your
question, just in case you are the 28,001st person to ask that question.

 

[Guest]

None of that excuses "Sir " cerridwen's rude and insulting reply. If he had just answered the question like you did he would've spent half the time with his reply. Instead he went on a juvenile tirade about people that post questions in HELP AND SUPPORT it's called HELP AND SUPPORT for a reason. It is not called INSULTS AND JACKA$$ES otherwise cerridwen would be an MVP along with his buddy Milton, Gator whatever... No one as far as I can tell is forcing anyone to participate in this NG. Like your mommy should have told you. "If you don't have anuthing nice to say..." PEACE-OU

----- Tegger® wrote: ----

It isn't my computer that is having the trouble hence me bein
fortunate enough not to have ran into you before
Since I don't know what the problem was it is a bit hard to search fo
the solution

You *knew* what the problem was. It was shutting down on you. I would have
gone here
www.groups.google.co

and typed in the terms (exactly as you see it here)
system shutdown windows x

or perhaps, a bit of the error message, such as
"this system is shutting down
(in brackets so Google knows to treat it like a single phrase

and maybe the unusual word in there
ntauthorit

and I obviously don't have as much time as you have t
do this

It would have taken seconds to type this, and seconds to receive the
answer. As it was, you had to wait much longer than that to get your
answer

When I typed this just now, Google returned--within seconds--28,000
responses containing the answer, which is the Blaster worm

I have used Usenet before to find solutions to things

The problem is, 99% of the problems around have already been asked and
answered many, many times. That's what Google is for

It is always a good idea to search Google first before posting your
question, just in case you are the 28,001st person to ask that question

 

[relic]

thanx

Any firewall would have prevented it. Even the built-in one.

 

[Jim Lee Jr.]

Hi,

I am asking this for someone else.
They have just purchased a PC, it has XP Pro installed, the computer works
ok until they go online then they get the following message.

System Shutdown

This system is shutting down please save all work in progress and log off
Windows must now restart, all unsaved will be lost.
this shutdown was initiated by NTAUTHORITY\SYSTEM
The Remote Procedure Call(RPC) Service terminated unexpectedly

The PC then counts down from 60 and then restarts by itself.
The connection is Dial Up.

Any ideas why this happens or how to fix it.

Thanx

Ditch Windoze and get a Macintosh. Sounds like you may have gotten a
Blaster-type virus. Meanwhile, I am getting things done on my Macs.

 

[Tegger®]

None of that excuses "Sir " cerridwen's rude and insulting reply. If
he had just answered the question like you did he would've spent half
the time with his reply. Instead he went on a juvenile tirade about
people that post questions in HELP AND SUPPORT it's called HELP AND
SUPPORT for a reason.

I understand your anger. I also understand Cerridwen's frustration.

Lurk around here regularly for a few weeks, and you too will marvel and
begin to roll your eyes about how the *exact same questions* get asked
dozens of times a week, every single week, every month and year.

You will discover that some MVPs have stock replies that they simply copy-
and-paste into messages asking such questions. Same question, same answer,
word for word, over and over again.

It looks like even at this late date, a lot of people are still not aware
that Google Groups is the semi-official archive of all Usenet posts.

A lot of people also never seem to consider that they may NOT be unique,
and are having problems that millions upon millions have had before them.

 

[Trollslayer@thecave]

Ditch Windoze and get a Macintosh. Sounds like you may have gotten a
Blaster-type virus. Meanwhile, I am getting things done on my Macs.

LMAO Now THAT'S funny. Do something on a MAC?
Bwahahahahahahahahahahahahahahahahahahahahaha!

 

[Cerridwen]

Well Moron.
It isn't my computer that is having the trouble hence me being
fortunate enough not to have ran into you before.
Since I don't know what the problem was it is a bit hard to search
for the solution, and I obviously don't have as much time as you have
to do this.

Erm, you know exactly what the problem is - it's the solution you don't
know. You're just too damned lazy to use Google. Why couldn't you have typed
'remote procedure call' into Google?! There's no reason except sheer bone
idleness.

I have used Usenet before to find solutions to things, most people are
friendly and happy to give advice, there are a couple of people like
you who seem not to be here to help but to aggressive and abusive,
this is normally because they don't have any friends and have nothing
interesting to do.

Usenet should be a /last/ resort when all other avenues have been exhausted.
Posting this just proves you're a lazy NSF. This is an FAQ which is asked
hourly. It would have taken you all of 20 seconds to find the answer.

If you want to see a moron, I suggest you look in the mirror.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Chris S]

Erm, you know exactly what the problem is

Doh, celtic sheep shagger.
I know what the problem is it was the solution I needed.
It was the cause I needed.

- it's the solution you don't
know.

Well your clever.
Do you think if I had known the solution I would have entered into a
discussion with you anyway.
Got better things to do.

You're just too damned lazy to use Google. Why couldn't you have typed
'remote procedure call' into Google?! There's no reason except sheer bone
idleness.

I did do it idiot.
I got 10s of thousands of replies ranging from what 'remote procedure call'
is, what it is for.
There are several causes to the error apart from a virus.
I could only know if it was a problem due to a virus if I had previous
knowledge of it and I had not.

Usenet should be a /last/ resort when all other avenues have been

exhausted.

Who says? You.
Where is this written, or have you made it up, prat.

Posting this just proves you're a lazy NSF.

coming from you it isn't an insult.
lol

This is an FAQ which is asked
hourly.

Which I would only know if I had used this ng many times, luckily I have not
so I am not aware of that.
But who are you to tell anyone, your no one.

It would have taken you all of 20 seconds to find the answer.

See above

If you want to see a moron, I suggest you look in the mirror.

Ooo, that is so rude.
lol