Any ideas?

Discussion in 'Computer Support' started by Cherokee-LTD, Jan 19, 2004.

  1. Cherokee-LTD

    Cherokee-LTD Guest

    I received an email from my sister and I am awaiting further hardware and OS
    details... being a 98SE user, this means nothing to me but maybe someone
    from the group could identify this problem:

    In her words...
    "..we bought a new computer yesterday. It's great and very fast, the only
    thing is I keep getting a "System Shutdown" message from NT Authority\System
    it says that the Remote Procedure Call Service has terminated unexpectedly"
    I get 60 seconds and then Windows shuts down. This seems to be happening
    about every 15 minutes. Do you have any idea how to fix this?
    Any advice would be much appreciated! "

    TIA
    -Brian
    Cherokee-LTD, Jan 19, 2004
    #1
    1. Advertising

  2. Cherokee-LTD

    Harrison Guest

    She has contracted the Blaster worm by connecting an unpatched,
    unprotected XP computer to the net.
    See http://tinyurl.com/3h8kw
    and http://tinyurl.com/jozm


    On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <>
    wrote:

    >I received an email from my sister and I am awaiting further hardware and OS
    >details... being a 98SE user, this means nothing to me but maybe someone
    >from the group could identify this problem:
    >
    >In her words...
    >"..we bought a new computer yesterday. It's great and very fast, the only
    >thing is I keep getting a "System Shutdown" message from NT Authority\System
    >it says that the Remote Procedure Call Service has terminated unexpectedly"
    >I get 60 seconds and then Windows shuts down. This seems to be happening
    >about every 15 minutes. Do you have any idea how to fix this?
    >Any advice would be much appreciated! "
    >
    >TIA
    >-Brian
    >
    >
    Harrison, Jan 19, 2004
    #2
    1. Advertising

  3. Cherokee-LTD

    Unk Guest

    On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <> wrote:
    >I received an email from my sister and I am awaiting further hardware and OS
    >details... being a 98SE user, this means nothing to me but maybe someone
    >from the group could identify this problem:
    >
    >In her words...
    >"..we bought a new computer yesterday. It's great and very fast, the only
    >thing is I keep getting a "System Shutdown" message from NT Authority\System
    >it says that the Remote Procedure Call Service has terminated unexpectedly"
    >I get 60 seconds and then Windows shuts down. This seems to be happening
    >about every 15 minutes. Do you have any idea how to fix this?
    >Any advice would be much appreciated! "
    >
    >TIA
    >-Brian
    >

    Default setting to "Restart on failure"

    Right click on "My Computer" and select Manage.
    Expand the Event Viewer category and look through each of the three
    sub-categories for the red flagged error records. The date and time
    of these should correspond to your restarts. Double click on an
    error record to see the details of the error.

    You can change this restart behavior if you want.

    Click Start, Settings, Control Panel, System, Advanced

    In the Startup and Recovery section, click on the "Settings" button
    to open the Startup and Recovery window.

    In the System Failure section, uncheck "Automatically restart",
    Click "Apply", "OK"

    After that change the computer will no longer restart when a system
    failure occurs. Instead it will probably throw up a "Blue Screen Of
    Death" with a STOP error message and then halt completely, requiring
    a manual power off and restart (or reset if it has a hardware reset
    switch).

    But the contents of the STOP error message will give a specific clue
    as to the underlying cause of the problem.
    Unk, Jan 19, 2004
    #3
  4. go to start / settings/ control panel / system / advanced tab then click
    "start up and recovery" in that pane under system failure unckeck the box
    that says automatically restart...then find out what you have for hardware
    and go an download the latest drivers and install them....by default windows
    installs a stripped out version of a hardware driver just to get you up and
    running the drivers from the manifacturer's are much more reliable...also
    when installing the manufacturer's driver you may get a warning click
    install anyway all it means is that microsoft has not certified the
    driver...no biggie..hope this helps
    cheeers


    "Cherokee-LTD" <> wrote in message
    news:5BIOb.95322$...
    > I received an email from my sister and I am awaiting further hardware and

    OS
    > details... being a 98SE user, this means nothing to me but maybe someone
    > from the group could identify this problem:
    >
    > In her words...
    > "..we bought a new computer yesterday. It's great and very fast, the only
    > thing is I keep getting a "System Shutdown" message from NT

    Authority\System
    > it says that the Remote Procedure Call Service has terminated

    unexpectedly"
    > I get 60 seconds and then Windows shuts down. This seems to be happening
    > about every 15 minutes. Do you have any idea how to fix this?
    > Any advice would be much appreciated! "
    >
    > TIA
    > -Brian
    >
    >
    >
    NorthernPirate, Jan 19, 2004
    #4
  5. Cherokee-LTD

    °Mike° Guest

    Boot into Safe Mode and start your registry editor:
    Start / Run / regedit

    Navigate to:
    HKEY_LOCAL_MACHINE
    +Software
    +Microsoft
    +Windows
    +CurrentVersion
    +Run

    In the right-hand pane, look for any entry/ies that include
    MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
    DELETE it/them.
    These are the files associated with the different variants:
    Variant A - msblast.exe
    Variant B - penis32.exe
    Variant C - teekids.exe

    You just disabled the worm from running at startup, so boot into
    normal mode again, and turn off ALL system restores to purge
    your system.

    Open Windows Explorer to the ..\Windows\System32\ or
    ...\WinNT\System32\ folder and DELETE *any* of the
    files named above.

    Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
    and find the reference to the above file/s (any reference will
    be similar to: <filename.exe>-<alphanumerics>.PF), for example,
    msblast.exe-0235D8H6.pf, and DELETE it/them.

    Now you can download and install the patch, configure your
    firewall and update your virus scanner.

    Virus Alert About the Blaster Worm and Its Variants
    http://support.microsoft.com/default.aspx?kbid=826955

    Microsoft Security Bulletin MS03-026
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

    What you should know about the Blaster worm
    http://www.microsoft.com/security/incident/blast.asp

    Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
    http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

    How to Use The KB 823980 Scanning Tool to Identify Host Computers
    That Do Not Have The 823980 Security Patch (MS03-026) Installed
    http://support.microsoft.com/default.aspx?kbid=826369

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

    W32.Blaster.B.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

    W32.Blaster.C.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

    W32.Blaster.Worm Removal Tool
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


    On Mon, 19 Jan 2004 03:57:53 GMT, in
    <5BIOb.95322$>
    Cherokee-LTD scrawled:

    >I received an email from my sister and I am awaiting further hardware and OS
    >details... being a 98SE user, this means nothing to me but maybe someone
    >from the group could identify this problem:
    >
    >In her words...
    >"..we bought a new computer yesterday. It's great and very fast, the only
    >thing is I keep getting a "System Shutdown" message from NT Authority\System
    >it says that the Remote Procedure Call Service has terminated unexpectedly"
    >I get 60 seconds and then Windows shuts down. This seems to be happening
    >about every 15 minutes. Do you have any idea how to fix this?
    >Any advice would be much appreciated! "
    >
    >TIA
    >-Brian
    >
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jan 19, 2004
    #5
  6. Cherokee-LTD

    mike Guest

    Unk <> wrote in message
    news:...
    > On Mon, 19 Jan 2004 03:57:53 GMT, "Cherokee-LTD" <>

    wrote:
    > >I received an email from my sister and I am awaiting further hardware and

    OS
    > >details... being a 98SE user, this means nothing to me but maybe someone
    > >from the group could identify this problem:
    > >
    > >In her words...
    > >"..we bought a new computer yesterday. It's great and very fast, the only
    > >thing is I keep getting a "System Shutdown" message from NT

    Authority\System
    > >it says that the Remote Procedure Call Service has terminated

    unexpectedly"
    > >I get 60 seconds and then Windows shuts down. This seems to be happening
    > >about every 15 minutes. Do you have any idea how to fix this?
    > >Any advice would be much appreciated! "
    > >
    > >TIA
    > >-Brian
    > >

    > Default setting to "Restart on failure"
    >
    > Right click on "My Computer" and select Manage.
    > Expand the Event Viewer category and look through each of the three
    > sub-categories for the red flagged error records. The date and time
    > of these should correspond to your restarts. Double click on an
    > error record to see the details of the error.
    >
    > You can change this restart behavior if you want.
    >
    > Click Start, Settings, Control Panel, System, Advanced
    >
    > In the Startup and Recovery section, click on the "Settings" button
    > to open the Startup and Recovery window.
    >
    > In the System Failure section, uncheck "Automatically restart",
    > Click "Apply", "OK"
    >
    > After that change the computer will no longer restart when a system
    > failure occurs. Instead it will probably throw up a "Blue Screen Of
    > Death" with a STOP error message and then halt completely, requiring
    > a manual power off and restart (or reset if it has a hardware reset
    > switch).
    >
    > But the contents of the STOP error message will give a specific clue
    > as to the underlying cause of the problem.


    I brought my brand new computer recently and had the same problem. Turned
    out it was a virus or Trojan. A real pain. There were three steps I was
    advised to do.
    1. fiddle around with some settings to stop the computer switching off.
    2. download a patch
    3. get a decent antivirus program working
    I'm sure other people will give you precise advice, but this is the rough
    idea....




    ---
    Outgoing mail is certified Virus Free.
    Checked by AVG anti-virus system (http://www.grisoft.com).
    Version: 6.0.563 / Virus Database: 355 - Release Date: 17/01/04
    mike, Jan 19, 2004
    #6
  7. Howdy!

    <Harrison> wrote in message
    news:...
    > She has contracted the Blaster worm by connecting an unpatched,
    > unprotected XP computer to the net.


    Actually *ahem* She's been infected with the Win2K version - by a
    Win2K machine.

    The WinXP blaster on a WinXP machine won't cause the RPC shutdown,
    and the same with the 2K version on a 2K machine. But since the entry
    points are slightly different, the 2K version on an XP machine OR the XP
    version on a 2K machine causes RPC to shut down ...

    > See http://tinyurl.com/3h8kw
    > and http://tinyurl.com/jozm


    RwP
    Ralph Wade Phillips, Jan 19, 2004
    #7
  8. Cherokee-LTD

    Cherokee-LTD Guest

    Thanks to all that have replied thus far... it seems the consensus is virus
    and I have passed on the information the group has provided. Here are the
    details of the system.. if it means anything now.

    Intel Pentium 4 - 845gvsr mainboard
    2.66ghz
    512MB memory
    Windows XP home edition
    2004 Microsoft Works Suite

    "If you need more specifics it is the " Horizon 2600 Plus" system from MDG.
    All the software was pre-loaded by the techs at MDG after I purchased it so
    Im assuming it's nothing to do with the installation. When I looked it up in
    "Help" it brings up some stuff about firewalls if that is any help to you."
    Cherokee-LTD, Jan 19, 2004
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Monte Comeau

    Intermittent connectons: Any ideas?

    Monte Comeau, Feb 7, 2005, in forum: Wireless Networking
    Replies:
    3
    Views:
    653
    mikeFNB
    Feb 7, 2005
  2. Jon
    Replies:
    1
    Views:
    425
    =?Utf-8?B?QkFS?=
    Feb 22, 2005
  3. IHateSpam

    Any ideas why this is happening ?

    IHateSpam, Feb 23, 2004, in forum: Cisco
    Replies:
    0
    Views:
    395
    IHateSpam
    Feb 23, 2004
  4. Fokker
    Replies:
    3
    Views:
    3,493
    °Mike°
    Sep 20, 2003
  5. Networking Student
    Replies:
    4
    Views:
    1,283
    vreyesii
    Nov 16, 2006
Loading...

Share This Page