shutdown (rpc)

[colin]

Can anyone help ??.I'm frequently getting a shutdown
message whilst on the internet.A Remote Procedure Call
(rpc)-NT AUTHORITY/SYSTEMS window pops up, usually when
i'm in the middle of something and i dont know what to do
about it.I'd appreciate any advice.
Thanks.

[Carey Frisch [MVP]]

Apparently, your computer is infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
neglected to install the critical updates available at the Windows Update website.

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

Are you looking for info about the cause of "Remote Procedure Call (RPC)",
initiated by NT Authority\System error message that shuts down Windows
(you might also see svchost.exe error occasionally)?
http://www.faqs.org/rfcs/rfc1831.html

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------

"colin" > wrote in message:
...

| Can anyone help ??.I'm frequently getting a shutdown
| message whilst on the internet.A Remote Procedure Call
| (rpc)-NT AUTHORITY/SYSTEMS window pops up, usually when
| i'm in the middle of something and i dont know what to do
| about it.I'd appreciate any advice.
| Thanks.

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"colin" > wrote in message
...
> Can anyone help ??.I'm frequently getting a shutdown
> message whilst on the internet.A Remote Procedure Call
> (rpc)-NT AUTHORITY/SYSTEMS window pops up, usually when
> i'm in the middle of something and i dont know what to do
> about it.I'd appreciate any advice.
> Thanks.

[TJThornton]

I've been having the same problem, but I have Firewall on, McAfee VS running and I ran Stinger just to be sure. No Blaster. I'm also up to date on all patches. It's driving me crazy. Now, after following all the advice here, all my system tools, such a
s regedit, msconfig , system configuration utility, and everything that I put RUN, quit the minute I click on them. They just show up then disappear. I'm reasonably computer literate but an XP newbie. I have home edition.

[Bruce Chambers]

Greetings --

You may have other unwelcome "guests."

This behavior, which also often applies to the Task Manager, is
typical behavior of more than one virus/worm, the three below being
the most common:

W32.Klez


W32.Yaha


W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"TJThornton" > wrote in message
...
> I've been having the same problem, but I have Firewall on, McAfee VS
running and I ran Stinger just to be sure. No Blaster. I'm also up
to date on all patches. It's driving me crazy. Now, after following
all the advice here, all my system tools, such as regedit, msconfig ,
system configuration utility, and everything that I put RUN, quit the
minute I click on them. They just show up then disappear. I'm
reasonably computer literate but an XP newbie. I have home edition.