NT Authority - 60 second shut down: Not a Blaster or a Sasser

[Jerid B]

Hello,
Windows XP SP2 and everything single fix available.
When I log in locally, network, user, or admin I get this pop up of NT
Authority and restarting due to RPC.
I ran Symantec Blaster and Sasser fixes and it came up with nothing. I ran
McAfee and AVG and that came up with nothing.
I went to Services and try to stop RPC or check the properties and it won't
let me do anything. A good 10 processes aren't starting (including Windows
Firewall). When I go to start the firewall it stops and the NT Authority
comes up.
I ahve been using the "shutdown -a" to stop it, but scans are coming up blank.
HELP PLEASE!

[Beck]

"Jerid B" > wrote in message
...
> Hello,
> Windows XP SP2 and everything single fix available.
> When I log in locally, network, user, or admin I get this pop up of NT
> Authority and restarting due to RPC.
> I ran Symantec Blaster and Sasser fixes and it came up with nothing. I ran
> McAfee and AVG and that came up with nothing.
> I went to Services and try to stop RPC or check the properties and it
> won't
> let me do anything. A good 10 processes aren't starting (including Windows
> Firewall). When I go to start the firewall it stops and the NT Authority
> comes up.
> I ahve been using the "shutdown -a" to stop it, but scans are coming up
> blank.
> HELP PLEASE!

You could try going into safe mode and into services and disabling messenger
service. I think that is the one which is linked to RPC (remote procedure
call). This is not the same as windows messenger or msn messenger.
Sounds like you have some kind of nasty going on which the antivirus is not
detecting. First ensure that the antivirus programs are up to date. You
can also try a free scan at http://housecall.antivirus.com (this is a one
time only scan and is not to be substituted for real time AV).
You could also try a scan with Spybot Search and Destroy, this may pick up
some spyware nested in your machine.

[Jerid B]

The problem is even in safe mode I can not end services.
Internet does not work so I can't do it that way either... I did a normal
install of AVG, McAfee (downloaded from another PC on CD).
I did check services and Messenger is already disabled.
Ran Spybot and Ad-aware and found nothing as well.
I also did a selective start up from MCConfig and used only Windows Services.
Same problem.

"Beck" wrote:

>
> "Jerid B" > wrote in message
> ...
> > Hello,
> > Windows XP SP2 and everything single fix available.
> > When I log in locally, network, user, or admin I get this pop up of NT
> > Authority and restarting due to RPC.
> > I ran Symantec Blaster and Sasser fixes and it came up with nothing. I ran
> > McAfee and AVG and that came up with nothing.
> > I went to Services and try to stop RPC or check the properties and it
> > won't
> > let me do anything. A good 10 processes aren't starting (including Windows
> > Firewall). When I go to start the firewall it stops and the NT Authority
> > comes up.
> > I ahve been using the "shutdown -a" to stop it, but scans are coming up
> > blank.
> > HELP PLEASE!
>
> You could try going into safe mode and into services and disabling messenger
> service. I think that is the one which is linked to RPC (remote procedure
> call). This is not the same as windows messenger or msn messenger.
> Sounds like you have some kind of nasty going on which the antivirus is not
> detecting. First ensure that the antivirus programs are up to date. You
> can also try a free scan at http://housecall.antivirus.com (this is a one
> time only scan and is not to be substituted for real time AV).
> You could also try a scan with Spybot Search and Destroy, this may pick up
> some spyware nested in your machine.
>
>

[Wesley Vogel]

Almost EVERYTHING depends on the Remote Procedure Call (RPC) service to be
running.

This service cannot be stopped or disabled using either the MMC services
snap in or the MSCONFIG utility. Disabling the Remote Procedure Call (RPC)
service will result in the operating system not loading.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ,
Beck <beck@none> hunted and pecked:
> "Jerid B" > wrote in message
> ...
>> Hello,
>> Windows XP SP2 and everything single fix available.
>> When I log in locally, network, user, or admin I get this pop up of NT
>> Authority and restarting due to RPC.
>> I ran Symantec Blaster and Sasser fixes and it came up with nothing. I
>> ran McAfee and AVG and that came up with nothing.
>> I went to Services and try to stop RPC or check the properties and it
>> won't
>> let me do anything. A good 10 processes aren't starting (including
>> Windows Firewall). When I go to start the firewall it stops and the NT
>> Authority comes up.
>> I ahve been using the "shutdown -a" to stop it, but scans are coming up
>> blank.
>> HELP PLEASE!
>
> You could try going into safe mode and into services and disabling
> messenger service. I think that is the one which is linked to RPC
> (remote procedure call). This is not the same as windows messenger or
> msn messenger.
> Sounds like you have some kind of nasty going on which the antivirus is
> not detecting. First ensure that the antivirus programs are up to date.
> You can also try a free scan at http://housecall.antivirus.com (this is
> a one time only scan and is not to be substituted for real time AV).
> You could also try a scan with Spybot Search and Destroy, this may pick up
> some spyware nested in your machine.

[Jerid B]

I was just throwing that out there...
The RPC is running, and I don't need it to stop. I jsut need this error to
go away.
RPC is what is the NT Authority is erroring off of.
I have been working on thsi laptop for 7 hours and still nothing... getting
frustrated.

"Wesley Vogel" wrote:

> Almost EVERYTHING depends on the Remote Procedure Call (RPC) service to be
> running.
>
> This service cannot be stopped or disabled using either the MMC services
> snap in or the MSCONFIG utility. Disabling the Remote Procedure Call (RPC)
> service will result in the operating system not loading.
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In ,
> Beck <beck@none> hunted and pecked:
> > "Jerid B" > wrote in message
> > ...
> >> Hello,
> >> Windows XP SP2 and everything single fix available.
> >> When I log in locally, network, user, or admin I get this pop up of NT
> >> Authority and restarting due to RPC.
> >> I ran Symantec Blaster and Sasser fixes and it came up with nothing. I
> >> ran McAfee and AVG and that came up with nothing.
> >> I went to Services and try to stop RPC or check the properties and it
> >> won't
> >> let me do anything. A good 10 processes aren't starting (including
> >> Windows Firewall). When I go to start the firewall it stops and the NT
> >> Authority comes up.
> >> I ahve been using the "shutdown -a" to stop it, but scans are coming up
> >> blank.
> >> HELP PLEASE!
> >
> > You could try going into safe mode and into services and disabling
> > messenger service. I think that is the one which is linked to RPC
> > (remote procedure call). This is not the same as windows messenger or
> > msn messenger.
> > Sounds like you have some kind of nasty going on which the antivirus is
> > not detecting. First ensure that the antivirus programs are up to date.
> > You can also try a free scan at http://housecall.antivirus.com (this is
> > a one time only scan and is not to be substituted for real time AV).
> > You could also try a scan with Spybot Search and Destroy, this may pick up
> > some spyware nested in your machine.
>
>

[Beck]

"Jerid B" > wrote in message
...
> The problem is even in safe mode I can not end services.
> Internet does not work so I can't do it that way either... I did a normal
> install of AVG, McAfee (downloaded from another PC on CD).
> I did check services and Messenger is already disabled.
> Ran Spybot and Ad-aware and found nothing as well.
> I also did a selective start up from MCConfig and used only Windows
> Services.
> Same problem.

Are you able to restore to the last known good configuration?
It certainy sounds like Blaster or something kind of variant. It could even
be a new variation that virus vendors have yet to pick up. When you
installed the V programs, did you also install up to date definitions?

Do you have XP service pack 2? I wonder if you can download it from another
PC bung to CD and install. Use shutdown -a to stop the countdown and see if
you can install it

CTRL+ALT+DEL when you start up, see what programs are running in the
background. This may or may not give you some clues to the offending
program.

If all else fails reinstall windows, but really that should be a last resort
as reinstall is a pain in the arse.

[R. McCarty]

If you have necessary tools, then here's a possible solution. First
you need a Disk Management tool.
1.) Shrink existing partition to leave 4 Gig unallocated.
2.) Create a partition, Format to NTFS mark Active
3.) Install XP in this newly created partition
4.) Load AV, Spyware removal tools & enable Internet
5.) Run Tools and On-line scans to remove "Baddies" specifically
on the original partition/volume
6.) When done, Remove new partition and re-extend the
original partition to it's full size.
I use Acronis Disk Director 10.0 for functions listed above.

-or-

Remove the drive, get a desktop IDE adapter module and install
it in a "Protected" PC to do the repairs.

"Jerid B" > wrote in message
...
>I was just throwing that out there...
> The RPC is running, and I don't need it to stop. I jsut need this error to
> go away.
> RPC is what is the NT Authority is erroring off of.
> I have been working on thsi laptop for 7 hours and still nothing...
> getting
> frustrated.
>
> "Wesley Vogel" wrote:
>
>> Almost EVERYTHING depends on the Remote Procedure Call (RPC) service to
>> be
>> running.
>>
>> This service cannot be stopped or disabled using either the MMC services
>> snap in or the MSCONFIG utility. Disabling the Remote Procedure Call
>> (RPC)
>> service will result in the operating system not loading.
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In ,
>> Beck <beck@none> hunted and pecked:
>> > "Jerid B" > wrote in message
>> > ...
>> >> Hello,
>> >> Windows XP SP2 and everything single fix available.
>> >> When I log in locally, network, user, or admin I get this pop up of NT
>> >> Authority and restarting due to RPC.
>> >> I ran Symantec Blaster and Sasser fixes and it came up with nothing. I
>> >> ran McAfee and AVG and that came up with nothing.
>> >> I went to Services and try to stop RPC or check the properties and it
>> >> won't
>> >> let me do anything. A good 10 processes aren't starting (including
>> >> Windows Firewall). When I go to start the firewall it stops and the NT
>> >> Authority comes up.
>> >> I ahve been using the "shutdown -a" to stop it, but scans are coming
>> >> up
>> >> blank.
>> >> HELP PLEASE!
>> >
>> > You could try going into safe mode and into services and disabling
>> > messenger service. I think that is the one which is linked to RPC
>> > (remote procedure call). This is not the same as windows messenger or
>> > msn messenger.
>> > Sounds like you have some kind of nasty going on which the antivirus is
>> > not detecting. First ensure that the antivirus programs are up to
>> > date.
>> > You can also try a free scan at http://housecall.antivirus.com (this
>> > is
>> > a one time only scan and is not to be substituted for real time AV).
>> > You could also try a scan with Spybot Search and Destroy, this may pick
>> > up
>> > some spyware nested in your machine.
>>
>>

[Jerid B]

Tried installing SP2 again, but it won't because most of the processes aren't
running and refuse to run. That's where the huge problewm lies. I can't get
anything Windows related to start. No internet, no install... last know good
config didn't work. I tried a system restore and that won't open.
I did shut of system restore to do scans. I am stuck formatting I think.

"Beck" wrote:

>
> "Jerid B" > wrote in message
> ...
> > The problem is even in safe mode I can not end services.
> > Internet does not work so I can't do it that way either... I did a normal
> > install of AVG, McAfee (downloaded from another PC on CD).
> > I did check services and Messenger is already disabled.
> > Ran Spybot and Ad-aware and found nothing as well.
> > I also did a selective start up from MCConfig and used only Windows
> > Services.
> > Same problem.
>
> Are you able to restore to the last known good configuration?
> It certainy sounds like Blaster or something kind of variant. It could even
> be a new variation that virus vendors have yet to pick up. When you
> installed the V programs, did you also install up to date definitions?
>
> Do you have XP service pack 2? I wonder if you can download it from another
> PC bung to CD and install. Use shutdown -a to stop the countdown and see if
> you can install it
>
> CTRL+ALT+DEL when you start up, see what programs are running in the
> background. This may or may not give you some clues to the offending
> program.
>
> If all else fails reinstall windows, but really that should be a last resort
> as reinstall is a pain in the arse.
>
>

[Beck]

"Jerid B" > wrote in message
...
> Tried installing SP2 again, but it won't because most of the processes
> aren't
> running and refuse to run. That's where the huge problewm lies. I can't
> get
> anything Windows related to start. No internet, no install... last know
> good
> config didn't work. I tried a system restore and that won't open.
> I did shut of system restore to do scans. I am stuck formatting I think.


Check out this page
http://www.yale.edu/cas/faqs/rpc/

It has a link the an RPC patch that you may be missing from your MS updates.