nt authority problem

Am having a problem with xp windows. On IE frequently
comes up with NT Authority/System error message .Also
says remote prodedure call (rpc) services terminated
unexpectedly and shuts system down. What is the problem
and how do i fix?????

[Will Denny]

Hi

The system has been infected by the Blaster Worm. Have a look at the
following links:

www.kellys-korner-xp.com/xp_qr.htm#rpc

Courtesy of MVP Kelly.

"Virus Alert About the Blaster Worm and Its Variants"
http://support.microsoft.com/?id=826955

"What You Should Know About the Blaster Worm and Its Variants"
http://www.microsoft.com/security/incident/blast.asp

--

Will Denny

MS-MVP Windows Shell/User
> wrote in message
...
> Am having a problem with xp windows. On IE frequently
> comes up with NT Authority/System error message .Also
> says remote prodedure call (rpc) services terminated
> unexpectedly and shuts system down. What is the problem
> and how do i fix?????


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.656 / Virus Database: 421 - Release Date: 09/04/2004

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger



Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html


You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


> wrote in message
...
> Am having a problem with xp windows. On IE frequently
> comes up with NT Authority/System error message .Also
> says remote prodedure call (rpc) services terminated
> unexpectedly and shuts system down. What is the problem
> and how do i fix?????

[Gary Tsang]

Hi,

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see follow this link:
http://www.microsoft.com/security/incident/blast.asp
http://www.microsoft.com/security/protect/main.asp

Microsoft Knowledge Base Article - 824146
A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs
http://support.microsoft.com/?kbid=824146

More information about this particular worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Removal Information can be found here
http://www.kellys-korner-xp.com/xp_qr.htm#rpc


--
Gary Tsang
Microsoft MVP - Windows XP Shell/User
http://www.microsoft.com/mvp


> wrote in message
...
> Am having a problem with xp windows. On IE frequently
> comes up with NT Authority/System error message .Also
> says remote prodedure call (rpc) services terminated
> unexpectedly and shuts system down. What is the problem
> and how do i fix?????

[Shenan Stanley]

RAJ wrote:
> this virus has been around for quite a while i first came across it
> about 2 years ago and below i have written how to fix without having
> to use any patches that may not work.
> I'm not sure if this works for everyone but it worked on my computer.
> to stop your computer restarting or shutting down you should. ..
> 1. open control panel and go to administrative tools and then
> services.
>
> 2.go down the list and look for nt authority, remote procedure call
> or what ever service your computer says has failed before it shuts
> down.
>
> 3. double click on the service and then click the recovery tab.
>
> 4. change first failure from restart the computer to restart service.
>
> 5. do the same for the second and third failure.
>
> 6. then click ok and exit services
>
> 7.Done!
>
> if your having problems starting your computer for long enough before
> it crashes then try starting in safe mode...
> by
> raj
>
> p.s this just disabes the virus from doing anything get norton
> antivirus or macafee or any anti virus thing just to get rid of it
> totally. but the problem will not re occur if you follow my
> instructions above. need help contact kimar_leah @hotmail.com. this
> is not my real account but my account to help people. SO DON'T SEND
> ANY CRAP.

Wha?!

--
<- Shenan ->
--

[RAJ]

this virus has been around for quite a while i first came across it about 2 years ago and below i have written how to fix without having to use any patches that may not work.
I'm not sure if this works for everyone but it worked on my computer.
to stop your computer restarting or shutting down you should. ..
1. open control panel and go to administrative tools and then services.

2.go down the list and look for nt authority, remote procedure call or what ever service your computer says has failed before it shuts down.

3. double click on the service and then click the recovery tab.

4. change first failure from restart the computer to restart service.

5. do the same for the second and third failure.

6. then click ok and exit services

7.Done!

if your having problems starting your computer for long enough before it crashes then try starting in safe mode...
by
raj

p.s this just disabes the virus from doing anything get norton antivirus or macafee or any anti virus thing just to get rid of it totally. but the problem will not re occur if you follow my instructions above. need help contact kimar_leah @hotmail.com.
this is not my real account but my account to help people. SO DON'T SEND ANY CRAP.