Windows will not stay on...

[Guest]

I just got a computer from a business that closed down. I have it all set up and everything runs. It is Windows XP Professional. When I log on to the internet it is only a few minutes and it displays "This system is shutting down. Please save all work and log off. This shutdown was initiated by NT Authority\System. Windows must restart because the Remote Procedure Call Service terminated" Does anyone have any suggestions of what I can do to fix this?

 

[Wÿrm]

I just got a computer from a business that closed down. I have it all set
up and everything runs. It is Windows XP >Professional. When I log on to
the internet it is only a few minutes and it displays "This system is
shutting down. Please save all >work and log off. This shutdown was
initiated by NT Authority\System. Windows must restart because the Remote
Procedure >Call Service terminated" Does anyone have any suggestions of
what I can do to fix this?

Learn to keep windows updated with windows updater and learn to use virus
killer...

Because it's probably Blaster worm... Get yourself a viruskiller and maybe
firewall and keep your windows updated.

http://www.microsoft.com/security/incident/blast.asp

 

[Peter]

Hi,

Possible your PC has infected by W32 blaster worm. You
can go to symantec.com to download the virus removal
tools and run it.
Or, you can change the RPC settings to "restart the
service" and then you can go on-line to symantec.com to
have an on-line security scan to ensure what virus is
infected, may be more than one virus.
Or you can go to windows update site to download the
patches.

Go to Control Panel/Adminstrative Tools/Component
Services.
In the left pane, click services (local)
In the right pane, nevigate to "Remote Procedure Call"
and doule click.
In the open window, click the Recovery tab.
Change the settings to "Restart the Service" for the
First Failure, Second Failure and Subsequent Failures.
Click Apply and OK keys then reboot.
After the reboot, you should be able to stay on-line.
After removal of the virus, reset the RPC settings
to "Restart the Computer"


Care: MUST NOT change the settings of "Remote Procedure
Call(RPC) Locator"

Peter

-----Original Message-----
I just got a computer from a business that closed down.

I have it all set up and everything runs. It is Windows
XP Professional. When I log on to the internet it is
only a few minutes and it displays "This system is
shutting down. Please save all work and log off. This
shutdown was initiated by NT Authority\System. Windows
must restart because the Remote Procedure Call Service
terminated" Does anyone have any suggestions of what I
can do to fix this?

 

[Rick \Nutcase\ Rogers]

Hi Nev,

It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

I just got a computer from a business that closed down. I have it all set

up and everything runs. It is Windows XP Professional. When I log on to
the internet it is only a few minutes and it displays "This system is
shutting down. Please save all work and log off. This shutdown was initiated
by NT Authority\System. Windows must restart because the Remote Procedure
Call Service terminated" Does anyone have any suggestions of what I can do
to fix this?