Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Support > Any ideas?

Reply
Thread Tools

Any ideas?

 
 
Cherokee-LTD
Guest
Posts: n/a
 
      01-19-2004
I received an email from my sister and I am awaiting further hardware and OS
details... being a 98SE user, this means nothing to me but maybe someone
from the group could identify this problem:

In her words...
"..we bought a new computer yesterday. It's great and very fast, the only
thing is I keep getting a "System Shutdown" message from NT Authority\System
it says that the Remote Procedure Call Service has terminated unexpectedly"
I get 60 seconds and then Windows shuts down. This seems to be happening
about every 15 minutes. Do you have any idea how to fix this?
Any advice would be much appreciated! "

TIA
-Brian



 
Reply With Quote
 
 
 
 
Harrison
Guest
Posts: n/a
 
      01-19-2004
She has contracted the Blaster worm by connecting an unpatched,
unprotected XP computer to the net.
See http://tinyurl.com/3h8kw
and http://tinyurl.com/jozm


On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <(E-Mail Removed)>
wrote:

>I received an email from my sister and I am awaiting further hardware and OS
>details... being a 98SE user, this means nothing to me but maybe someone
>from the group could identify this problem:
>
>In her words...
>"..we bought a new computer yesterday. It's great and very fast, the only
>thing is I keep getting a "System Shutdown" message from NT Authority\System
>it says that the Remote Procedure Call Service has terminated unexpectedly"
>I get 60 seconds and then Windows shuts down. This seems to be happening
>about every 15 minutes. Do you have any idea how to fix this?
>Any advice would be much appreciated! "
>
>TIA
>-Brian
>
>


 
Reply With Quote
 
 
 
 
Unk
Guest
Posts: n/a
 
      01-19-2004
On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <(E-Mail Removed)> wrote:
>I received an email from my sister and I am awaiting further hardware and OS
>details... being a 98SE user, this means nothing to me but maybe someone
>from the group could identify this problem:
>
>In her words...
>"..we bought a new computer yesterday. It's great and very fast, the only
>thing is I keep getting a "System Shutdown" message from NT Authority\System
>it says that the Remote Procedure Call Service has terminated unexpectedly"
>I get 60 seconds and then Windows shuts down. This seems to be happening
>about every 15 minutes. Do you have any idea how to fix this?
>Any advice would be much appreciated! "
>
>TIA
>-Brian
>

Default setting to "Restart on failure"

Right click on "My Computer" and select Manage.
Expand the Event Viewer category and look through each of the three
sub-categories for the red flagged error records. The date and time
of these should correspond to your restarts. Double click on an
error record to see the details of the error.

You can change this restart behavior if you want.

Click Start, Settings, Control Panel, System, Advanced

In the Startup and Recovery section, click on the "Settings" button
to open the Startup and Recovery window.

In the System Failure section, uncheck "Automatically restart",
Click "Apply", "OK"

After that change the computer will no longer restart when a system
failure occurs. Instead it will probably throw up a "Blue Screen Of
Death" with a STOP error message and then halt completely, requiring
a manual power off and restart (or reset if it has a hardware reset
switch).

But the contents of the STOP error message will give a specific clue
as to the underlying cause of the problem.
 
Reply With Quote
 
NorthernPirate
Guest
Posts: n/a
 
      01-19-2004
go to start / settings/ control panel / system / advanced tab then click
"start up and recovery" in that pane under system failure unckeck the box
that says automatically restart...then find out what you have for hardware
and go an download the latest drivers and install them....by default windows
installs a stripped out version of a hardware driver just to get you up and
running the drivers from the manifacturer's are much more reliable...also
when installing the manufacturer's driver you may get a warning click
install anyway all it means is that microsoft has not certified the
driver...no biggie..hope this helps
cheeers


"Cherokee-LTD" <(E-Mail Removed)> wrote in message
news:5BIOb.95322$(E-Mail Removed) .cable.rogers.com...
> I received an email from my sister and I am awaiting further hardware and

OS
> details... being a 98SE user, this means nothing to me but maybe someone
> from the group could identify this problem:
>
> In her words...
> "..we bought a new computer yesterday. It's great and very fast, the only
> thing is I keep getting a "System Shutdown" message from NT

Authority\System
> it says that the Remote Procedure Call Service has terminated

unexpectedly"
> I get 60 seconds and then Windows shuts down. This seems to be happening
> about every 15 minutes. Do you have any idea how to fix this?
> Any advice would be much appreciated! "
>
> TIA
> -Brian
>
>
>



 
Reply With Quote
 
°Mike°
Guest
Posts: n/a
 
      01-19-2004
Boot into Safe Mode and start your registry editor:
Start / Run / regedit

Navigate to:
HKEY_LOCAL_MACHINE
+Software
+Microsoft
+Windows
+CurrentVersion
+Run

In the right-hand pane, look for any entry/ies that include
MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
DELETE it/them.
These are the files associated with the different variants:
Variant A - msblast.exe
Variant B - penis32.exe
Variant C - teekids.exe

You just disabled the worm from running at startup, so boot into
normal mode again, and turn off ALL system restores to purge
your system.

Open Windows Explorer to the ..\Windows\System32\ or
...\WinNT\System32\ folder and DELETE *any* of the
files named above.

Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
and find the reference to the above file/s (any reference will
be similar to: <filename.exe>-<alphanumerics>.PF), for example,
msblast.exe-0235D8H6.pf, and DELETE it/them.

Now you can download and install the patch, configure your
firewall and update your virus scanner.

Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955

Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/sec...n/MS03-026.asp

What you should know about the Blaster worm
http://www.microsoft.com/security/incident/blast.asp

Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

How to Use The KB 823980 Scanning Tool to Identify Host Computers
That Do Not Have The 823980 Security Patch (MS03-026) Installed
http://support.microsoft.com/default.aspx?kbid=826369

W32.Blaster.Worm
http://www.symantec.com/avcenter/ven...ster.worm.html

W32.Blaster.B.Worm
http://www.symantec.com/avcenter/ven...er.b.worm.html

W32.Blaster.C.Worm
http://www.symantec.com/avcenter/ven...er.c.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html


On Mon, 19 Jan 2004 03:57:53 GMT, in
<5BIOb.95322$(E-Mail Removed) le.rogers.com>
Cherokee-LTD scrawled:

>I received an email from my sister and I am awaiting further hardware and OS
>details... being a 98SE user, this means nothing to me but maybe someone
>from the group could identify this problem:
>
>In her words...
>"..we bought a new computer yesterday. It's great and very fast, the only
>thing is I keep getting a "System Shutdown" message from NT Authority\System
>it says that the Remote Procedure Call Service has terminated unexpectedly"
>I get 60 seconds and then Windows shuts down. This seems to be happening
>about every 15 minutes. Do you have any idea how to fix this?
>Any advice would be much appreciated! "
>
>TIA
>-Brian
>
>


--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html
 
Reply With Quote
 
mike
Guest
Posts: n/a
 
      01-19-2004

Unk <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <(E-Mail Removed)>

wrote:
> >I received an email from my sister and I am awaiting further hardware and

OS
> >details... being a 98SE user, this means nothing to me but maybe someone
> >from the group could identify this problem:
> >
> >In her words...
> >"..we bought a new computer yesterday. It's great and very fast, the only
> >thing is I keep getting a "System Shutdown" message from NT

Authority\System
> >it says that the Remote Procedure Call Service has terminated

unexpectedly"
> >I get 60 seconds and then Windows shuts down. This seems to be happening
> >about every 15 minutes. Do you have any idea how to fix this?
> >Any advice would be much appreciated! "
> >
> >TIA
> >-Brian
> >

> Default setting to "Restart on failure"
>
> Right click on "My Computer" and select Manage.
> Expand the Event Viewer category and look through each of the three
> sub-categories for the red flagged error records. The date and time
> of these should correspond to your restarts. Double click on an
> error record to see the details of the error.
>
> You can change this restart behavior if you want.
>
> Click Start, Settings, Control Panel, System, Advanced
>
> In the Startup and Recovery section, click on the "Settings" button
> to open the Startup and Recovery window.
>
> In the System Failure section, uncheck "Automatically restart",
> Click "Apply", "OK"
>
> After that change the computer will no longer restart when a system
> failure occurs. Instead it will probably throw up a "Blue Screen Of
> Death" with a STOP error message and then halt completely, requiring
> a manual power off and restart (or reset if it has a hardware reset
> switch).
>
> But the contents of the STOP error message will give a specific clue
> as to the underlying cause of the problem.


I brought my brand new computer recently and had the same problem. Turned
out it was a virus or Trojan. A real pain. There were three steps I was
advised to do.
1. fiddle around with some settings to stop the computer switching off.
2. download a patch
3. get a decent antivirus program working
I'm sure other people will give you precise advice, but this is the rough
idea....




---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.563 / Virus Database: 355 - Release Date: 17/01/04


 
Reply With Quote
 
Ralph Wade Phillips
Guest
Posts: n/a
 
      01-19-2004
Howdy!

<Harrison> wrote in message
news:(E-Mail Removed)...
> She has contracted the Blaster worm by connecting an unpatched,
> unprotected XP computer to the net.


Actually *ahem* She's been infected with the Win2K version - by a
Win2K machine.

The WinXP blaster on a WinXP machine won't cause the RPC shutdown,
and the same with the 2K version on a 2K machine. But since the entry
points are slightly different, the 2K version on an XP machine OR the XP
version on a 2K machine causes RPC to shut down ...

> See http://tinyurl.com/3h8kw
> and http://tinyurl.com/jozm


RwP


 
Reply With Quote
 
Cherokee-LTD
Guest
Posts: n/a
 
      01-19-2004
Thanks to all that have replied thus far... it seems the consensus is virus
and I have passed on the information the group has provided. Here are the
details of the system.. if it means anything now.

Intel Pentium 4 - 845gvsr mainboard
2.66ghz
512MB memory
Windows XP home edition
2004 Microsoft Works Suite

"If you need more specifics it is the " Horizon 2600 Plus" system from MDG.
All the software was pre-loaded by the techs at MDG after I purchased it so
Im assuming it's nothing to do with the installation. When I looked it up in
"Help" it brings up some stuff about firewalls if that is any help to you."



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
501 PIX "deny any any" "allow any any" Any Anybody? Networking Student Cisco 4 11-16-2006 10:40 PM
icmp weirdness - PIX 501 (does any really mean any??) news8080@yahoo.com Cisco 2 09-23-2005 04:04 PM
Anyone interested in getting any Certificationz from Microsoft, CISCO or any other IT CertificationzzzZ...?? get.certified@gmail.com Cisco 0 03-07-2005 03:09 PM
so what does IE or any of the IE shells have over firefox ? (any anti firefox ppl bother looking at recent plugins available?) *ProteanThread* Firefox 12 10-20-2004 08:31 AM
Does any one have any material for 70-015 Srinivas Iragavarapu MCSD 0 10-08-2003 05:48 AM



Advertisments