NT AUTHORITY\SYSTEM shutdown

  • Thread starter Thread starter Mike Bradley
  • Start date Start date
M

Mike Bradley

Hi There
Have a new and interesting problem.
In the past two days I have been tring to
e-mail a variety of things and 30 seconds to
2 minutes goes by and a message comes up.....
NT AUTHORITY \ SYSTEM
Windows must now restart because the
Remote Procedure Call (RPC) service
termininated unexpectedly.

Gives me 30 seconds or so then turns off the
computer.
I have never encountered such a thing in the
years I have been using computers.
I have tried every way I know to correct this
new problem. I can't use the internet nor e-mails
for my business at all.
What is going on ???
Do you have a fix??
Can I erase or modify the " NT Authority \System "??

The ISP's seem to be working fine. It is just that the
computer shuts off right in the middle of their functions.
For no aparent reason.

Intel Pent. 2 Gig. M
XP Home
Three internet services...
Worldnet
Juno
Sprint PCS ( Laptop Card Modem)
56K modem Dial up.
Same problem.... all devices.

Mike Bradley
(e-mail address removed)

Thanks for your help.
Mike
 
Mike --

Step #1

The first thing you should do is enable Windows XP's built-in Firewall:

1. In Control Panel, double-click Networking and Internet Connections, and
then click Network Connections.
2. Right-click the connection on which you would like to enable ICF, and
then click Properties.
3. On the Advanced tab, click the box to select the option to Protect my
computer or network.

Step #2:

Visit http://www.dougknox.com/xp/scripts_desc/xp_msblast.htm and follow
the instructions.

[Courtesy of MS-MVPs Doug Knox, Kelly Theriot, and Mike Koliz]

Step #3:

Download and install the following:

Blaster Worm: Critical Security Patch for Windows XP (32-bit version)
http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en


--
Nicholas

--------------------------------------------------------------------


| Hi There
| Have a new and interesting problem.
| In the past two days I have been tring to
| e-mail a variety of things and 30 seconds to
| 2 minutes goes by and a message comes up.....
| NT AUTHORITY \ SYSTEM
| Windows must now restart because the
| Remote Procedure Call (RPC) service
| termininated unexpectedly.
|
| Gives me 30 seconds or so then turns off the
| computer.
| I have never encountered such a thing in the
| years I have been using computers.
| I have tried every way I know to correct this
| new problem. I can't use the internet nor e-mails
| for my business at all.
| What is going on ???
| Do you have a fix??
| Can I erase or modify the " NT Authority \System "??
|
| The ISP's seem to be working fine. It is just that the
| computer shuts off right in the middle of their functions.
| For no aparent reason.
|
| Intel Pent. 2 Gig. M
| XP Home
| Three internet services...
| Worldnet
| Juno
| Sprint PCS ( Laptop Card Modem)
| 56K modem Dial up.
| Same problem.... all devices.
|
| Mike Bradley
| (e-mail address removed)
|
| Thanks for your help.
| Mike
 
Ok--I have a question--how do you download it if it
doesn't let you stay on the computer long enough to do
it. I want to download the info, went to microsoft
website to do it, but I get kicked out before I can do
anything about it. any suggestions, please let me know.

Michelle
(e-mail address removed)

-----Original Message-----
Mike --

Step #1

The first thing you should do is enable Windows XP's built-in Firewall:

1. In Control Panel, double-click Networking and Internet Connections, and
then click Network Connections.
2. Right-click the connection on which you would like to enable ICF, and
then click Properties.
3. On the Advanced tab, click the box to select the option to Protect my
computer or network.

Step #2:

Visit
Click to expand...
http://www.dougknox.com/xp/scripts_desc/xp_msblast.htm and
follow
the instructions.

[Courtesy of MS-MVPs Doug Knox, Kelly Theriot, and Mike Koliz]

Step #3:

Download and install the following:

Blaster Worm: Critical Security Patch for Windows XP (32- bit version)
http://microsoft.com/downloads/details.aspx? FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en----------


| Hi There
| Have a new and interesting problem.
| In the past two days I have been tring to
| e-mail a variety of things and 30 seconds to
| 2 minutes goes by and a message comes up.....
| NT AUTHORITY \ SYSTEM
| Windows must now restart because the
| Remote Procedure Call (RPC) service
| termininated unexpectedly.
|
| Gives me 30 seconds or so then turns off the
| computer.
| I have never encountered such a thing in the
| years I have been using computers.
| I have tried every way I know to correct this
| new problem. I can't use the internet nor e-mails
| for my business at all.
| What is going on ???
| Do you have a fix??
| Can I erase or modify the " NT Authority \System "??
|
| The ISP's seem to be working fine. It is just that the
| computer shuts off right in the middle of their functions.
| For no aparent reason.
|
| Intel Pent. 2 Gig. M
| XP Home
| Three internet services...
| Worldnet
| Juno
| Sprint PCS ( Laptop Card Modem)
| 56K modem Dial up.
| Same problem.... all devices.
|
| Mike Bradley
| (e-mail address removed)
|
| Thanks for your help.
| Mike
.
Click to expand...
 
You have the "blaster" worm virus. Go to www.microsoft.com
and follow their instructions for installing the update.
Do it asap. I am not a "PC guru" so cannot provide any
more help for you than this -- good luck.
 
Hi Mike,
It appears you have the blaster worm to remove it follow the steps below

You can use these steps yourself if you are comfortable working in your
registry:

1. Remove the infected computer from the network and reboot into Safe Mode.

2. Locate the files below, plus the Value "windows auto update" under the
Run registry key and deleted them all:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

MSBLAST.EXE under the "C:\Windows\system32" folder

MSBLAST.EXE-1c3a3376.PIF under the "C:\Windows\prefetch" folder

2a. If you are running Windows XP (any version) it is also recommended that
the Internet Connection Firewall be enabled to prevent re-infection when
connecting to the internet.

3.Contact your Antivirus provider for assistance in using any removal tools
they are providing or you can use one that Symantec is providing.
Symantec's Removal tool
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.re
moval.tool.html>.

4. If the OS continues to shut down when trying to connect to
http://www.microsoft.com/technet/security/bulletin/MS03-026.asp, with the
dialog box stating the OS will be shutting down in 30 seconds.

Set the RPC Service to "Take No Action" and reboot, this should allow you
to download the patch and install it.

Disclaimer:
While this may remove the worm in the short term it is advisable to backup
any data and then format and reinstall the computer. Once infected by a
virus, worm or other malicious program it is not possible to verify that
another program that could compromise the system has not been left by the
original infection.

Third party products mentioned in this posting are the sole responsobility
of the vendor providing them and in no way should this be considered an
endoresement by Microsoft.

--
Curtis Koenig
Support Professional
Microsoft Clustering Technologies Support
MCSA, MCSAS,MCSE, MCSES

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!
--------------------
 
Back
Top