NT Authority system

[Brado]

I have just installed XP Pro.
After logging on to the internet, within 3 minutes I get
the following message--
NT Authority system will restart the computer in 45 sec.
The Remote Procedure Call has teminated.

It happens on any site. What can I do?
thanks for any help

[René]

Blaster Worm. Search this group for removal procedure.

[Carey Frisch [MVP]]

Apparently, your computer has an unwelcome visitor (VIRUS) known
as the WM32 Blaster/Lovsan WORM. It only takes a split second for
this WORM to infect your computer if a firewall is not enabled and you
have an active internet connection.

It entered the computer through the internet connection because the "firewall"
was not properly enabled and essential critical updates were not installed from
the Windows Update website. For instructions on fixing the problem, visit:

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Remove W32.MSBlast.Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Blaster Worm: Critical Security Patch for Windows XP (32-bit version)
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

Then immediately turn-on Windows XP's built-in Firewall:

Protect Your PC
http://www.microsoft.com/security/protect/default.asp


--
Carey Frisch
Microsoft MVP
Windows XP Shell/User

-----------------------------------------------------------------------------------

"Brado" > wrote in message:
...

| I have just installed XP Pro.
| After logging on to the internet, within 3 minutes I get
| the following message--
| NT Authority system will restart the computer in 45 sec.
| The Remote Procedure Call has teminated.
|
| It happens on any site. What can I do?
| thanks for any help
|

[Chris Lanier]

Greetings --

You have got a virus, removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

"Brado" > wrote in message
...
> I have just installed XP Pro.
> After logging on to the internet, within 3 minutes I get
> the following message--
> NT Authority system will restart the computer in 45 sec.
> The Remote Procedure Call has teminated.
>
> It happens on any site. What can I do?
> thanks for any help
>

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Brado" > wrote in message
...
> I have just installed XP Pro.
> After logging on to the internet, within 3 minutes I get
> the following message--
> NT Authority system will restart the computer in 45 sec.
> The Remote Procedure Call has teminated.
>
> It happens on any site. What can I do?
> thanks for any help
>

Thanks everyone for that help.
I can see now that my AVG antivirus was not working after
installing XP.

>-----Original Message-----
>Greetings --
>
>You have got a virus, removal info at...
>http://www.kellys-korner-xp.com/xp_qr.htm#rpc
>
>More info about the worm:
>http://www.microsoft.com/security/incident/blast.asp
>
>More info about the worm:
>http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html
>
>"Brado" > wrote in
message
...
>> I have just installed XP Pro.
>> After logging on to the internet, within 3 minutes I get
>> the following message--
>> NT Authority system will restart the computer in 45 sec.
>> The Remote Procedure Call has teminated.
>>
>> It happens on any site. What can I do?
>> thanks for any help
>>
>
>
>.
>

[Jupiter Jones [MVP]]

Do not blame the antivirus for getting Blaster.
Blame the lack of a firewall AND the lack of Critical Updates.
AV will not stop Blaster.

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html


> wrote in message
...
> Thanks everyone for that help.
> I can see now that my AVG antivirus was not working after
> installing XP.

[Jupiter Jones [MVP]]

Your unprotected computer most likely caught Blaster.
Follow this to get rid of Blaster:
http://www3.telus.net/dandemar/blaster.htm

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://www3.telus.net/dandemar/


"wispy" > wrote in message
...
>
>
> ----- Brado wrote: -----
>
> I have just installed XP Pro.
> After logging on to the internet, within 3 minutes I get
> the following message--
> NT Authority system will restart the computer in 45 sec.
> The Remote Procedure Call has teminated.
>
> It happens on any site. What can I do?
> thanks for any help
>
>
>
> I am expierencing the same problem. How did you solve it???

[wispy]

----- Brado wrote: -----

I have just installed XP Pro.
After logging on to the internet, within 3 minutes I get
the following message--
NT Authority system will restart the computer in 45 sec.
The Remote Procedure Call has teminated.

It happens on any site. What can I do?
thanks for any help



I am expierencing the same problem. How did you solve it???