Remote Procedure Call?

[news.verizon.net]

Just got new computer, running WinXP Home Edition.
About 6 times in last 2 days, a box poped up saying:
Initiated by NT Authority\System
Remote Procedure Call (RPC) service terminated
Computer will shut down in 30 seconds
What the heck is this?
Thanks
J

[Gary Tsang]

Hi,

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see follow this link:
http://www.microsoft.com/security/incident/blast.asp
http://www.microsoft.com/security/protect/main.asp

Microsoft Knowledge Base Article - 824146
A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs
http://support.microsoft.com/?kbid=824146

More information about this particular worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Removal Information can be found here
http://www.kellys-korner-xp.com/xp_qr.htm#rpc


--
Gary Tsang
Microsoft MVP - Windows XP Shell/User
http://www.microsoft.com/mvp
Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

"news.verizon.net" > wrote in message
...
> Just got new computer, running WinXP Home Edition.
> About 6 times in last 2 days, a box poped up saying:
> Initiated by NT Authority\System
> Remote Procedure Call (RPC) service terminated
> Computer will shut down in 30 seconds
> What the heck is this?
> Thanks
> J
>
>

[Rick \Nutcase\ Rogers]

Hi,

When the shutdown warning appears, click start/run and enter "shutdown -a"
to halt the process. It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!
http://mvp.support.microsoft.com/
Associate Expert - WinXP - Expert Zone
www.microsoft.com/windowsxp/expertzone
Win98 Help - www.rickrogers.org

"news.verizon.net" > wrote in message
...
> Just got new computer, running WinXP Home Edition.
> About 6 times in last 2 days, a box poped up saying:
> Initiated by NT Authority\System
> Remote Procedure Call (RPC) service terminated
> Computer will shut down in 30 seconds
> What the heck is this?
> Thanks
> J
>
>

[Epona]

news.verizon.net wrote:
> Just got new computer, running WinXP Home Edition.
> About 6 times in last 2 days, a box poped up saying:
> Initiated by NT Authority\System
> Remote Procedure Call (RPC) service terminated
> Computer will shut down in 30 seconds
> What the heck is this?
> Thanks
> J

Oh help yourself for Hades sake! This question was asked sixteen times in
the past 36 hours! http://groups.google.com. It would have taken you less
time to search than it did to post!

[Box134]

You know that might be why this is the "newusers" group, doofus.

"Epona" > wrote in message
...
>
> Oh help yourself for Hades sake! This question was asked sixteen times in
> the past 36 hours! http://groups.google.com. It would have taken you less
> time to search than it did to post!
>
>

[MARC REYNOLDS]

It is the Blaster virus.

"news.verizon.net" > wrote in message
...
> Just got new computer, running WinXP Home Edition.
> About 6 times in last 2 days, a box poped up saying:
> Initiated by NT Authority\System
> Remote Procedure Call (RPC) service terminated
> Computer will shut down in 30 seconds
> What the heck is this?
> Thanks
> J
>
>