Upgraded Windows ME to Windows XP Home Edition

[Jeanne]

I just upgraded my windows, and I keep getting a message
that Windows is restarting based on NT Authority/System.
It also says it is because the Remote Procedures Call was
interrupted. How do I resolve this?

[Carey Frisch [MVP]]

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an attacker to
remotely compromise a computer running Microsoft Windows and
gain complete control over it. You can help protect your computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en


--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

------------------------------------------------------------------------------------

"Jeanne" > wrote in message:
...

| I just upgraded my windows, and I keep getting a message
| that Windows is restarting based on NT Authority/System.
| It also says it is because the Remote Procedures Call was
| interrupted. How do I resolve this?

[Chris Holden]

"Jeanne" > wrote in message
...
> I just upgraded my windows, and I keep getting a message
> that Windows is restarting based on NT Authority/System.
> It also says it is because the Remote Procedures Call was
> interrupted. How do I resolve this?

One would suspect because: <stock answer>

You most likely have the blaster worm.
When the shutdown countdown starts go to: Start> run> type 'shutdown -a'
without the quotes. Hit okay. Do it again should the countdown start again
during the process.
Then go Start> contol panel> network connections> select your internet
connection and right click it. Select properties. Click the advanced tab and
tick the 'protect this...' box. Hit okay until the boxes disappear.
Now go to
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
and read the page. Download the fixblast.exe (link about half way down that
page). Run it.
When your machine is clean, go to windowsupdate.com and download all the
recommended fixes.
Chris

[Jack]

reload..your welcome..


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.577 / Virus Database: 366 - Release Date: 2/3/2004

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger



Bruce Chambers
--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

"Jeanne" > wrote in message
...
>I just upgraded my windows, and I keep getting a message
> that Windows is restarting based on NT Authority/System.
> It also says it is because the Remote Procedures Call was
> interrupted. How do I resolve this?

[Carr]

Yah - but the shame is really on Microsoft - not the users.

You should not need to patch a computer fresh out of the
box fron Circuit City / Best Buy / Comp USA with a patch
before you go to the internet after the problem has been
out ther for What - 6 months?

What are you allowing vendors to ship product loaded with
defective software - may be a month or two but Blaster
hit in August '03.

Look in the Mirror Microsoft - you are ablack eye on the
industry on this one!


>-----Original Message-----
>There are thousands of nasty computer viruses/worms
looking for unprotected
>computers. Your computer can be infected within a few
milliseconds the moment
>an internet connection is established if your computer is
not properly secured.
>
>Apparently, your computer is now infected with the
W32.Blaster.Worm or one of its variants.
>This happened because you have not been using an internet
connection firewall and have
>apparently neglected to install the critical updates
available at the Windows Update website.
>
>----------------------------------------------------------
--------
>
>If your computer is constantly attempting to shutdown
>or reboot, quickly go to:
>
>Start > Run and type: CMD , and hit enter.
>This opens the Command Prompt window.
>
>Then type: shutdown -a , and hit enter.
>
>This should halt the rebooting problem.
>
>----------------------------------------------------------
--------
>
>Then immediately turn-on Windows XP's built-in Firewall:
>http://www.microsoft.com/security/protect/
>
>Special note if you use AOL:
>
>America Online installs its own connection settings that
override
>the ones that come with Windows XP. America Online's
>connection settings don't include a way to turn on
Windows XP's
>built-in firewall.
>
>Visit the following web site for instructions on
downloading
>a FREE firewall program for your computer.
>
>Ref: http://www.updatexp.com/free.html
>
>What You Should Know About the Blaster Worm and Its
Variants
>http://www.microsoft.com/security/incident/blast.asp
>
>A tool is available to remove Blaster worm and Nachi worm
infections from computers
>that are running Windows 2000 or Windows XP
>http://support.microsoft.com/?kbid=833330
>
>A security issue has been identified that could allow an
attacker to
>remotely compromise a computer running Microsoft Windows
and
>gain complete control over it. You can help protect your
computer
>by installing this update from Microsoft.
>http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en
>
>
>--
>Carey Frisch
>Microsoft MVP
>Windows XP - Shell/User
>
>Be Smart! Protect your PC!
>http://www.microsoft.com/security/protect/
>
>----------------------------------------------------------
--------------------------
>
>"Jeanne" > wrote in
message:
> ...
>
>| I just upgraded my windows, and I keep getting a
message
>| that Windows is restarting based on NT
Authority/System.
>| It also says it is because the Remote Procedures Call
was
>| interrupted. How do I resolve this?
>.
>