Remote Procedure Call Service terminated unexpectedly?

Discussion in 'Computer Support' started by Patrick D., Aug 11, 2003.

  1. Patrick D.

    Patrick D. Guest

    I have an XP 1600+ 512 MB, ECS K7S5A running XP Pro. It had been
    running fine for a while, but it has started popping up an error
    message that says "Windows must now restart because the Remote
    Procedure Call(RPC) Service terminated unexpectedly." It says it was
    authorized by Windows NT Authority or something like that and gives me
    60 seconds to save my files and close programs.

    What is the problem and how can I fix it? I am on Win98SE right
    now(dual-boot), and just scanned my hard drive for viruses with the
    latest AVG update, but found nothing.
    Patrick D., Aug 11, 2003
    #1
    1. Advertising

  2. Patrick D.

    Mcploppy © Guest

    Patrick D. bashed at the keyboard and said :

    > I have an XP 1600+ 512 MB, ECS K7S5A running XP Pro. It had been
    > running fine for a while, but it has started popping up an error
    > message that says "Windows must now restart because the Remote
    > Procedure Call(RPC) Service terminated unexpectedly." It says it was
    > authorized by Windows NT Authority or something like that and gives me
    > 60 seconds to save my files and close programs.
    >
    > What is the problem and how can I fix it? I am on Win98SE right
    > now(dual-boot), and just scanned my hard drive for viruses with the
    > latest AVG update, but found nothing.


    Go Here: http://www.tandmdigital.com/
    --
    Mcploppy ©

    { Remove both MyShoes to email me}
    { Homepage: http://tinyurl.com/bbel }
    { Local Radio: http://tinyurl.com/j1vi }
    { Download Messenger 6 http://tinyurl.com/h7co }
    Mcploppy ©, Aug 11, 2003
    #2
    1. Advertising

  3. Patrick D.

    °Mike° Guest

    Curiouser and curiouser! This is the fifth time this question has been
    asked in less than two hours...

    The RPC Service Stops with Event ID 7031
    http://support.microsoft.com/search/preview.aspx?id=kb;en-us;327148


    On Mon, 11 Aug 2003 20:32:11 GMT, in
    <Xns93D493DD893EBpdopdo@63.240.76.16>
    Patrick D. scrawled:

    >I have an XP 1600+ 512 MB, ECS K7S5A running XP Pro. It had been
    >running fine for a while, but it has started popping up an error
    >message that says "Windows must now restart because the Remote
    >Procedure Call(RPC) Service terminated unexpectedly." It says it was
    >authorized by Windows NT Authority or something like that and gives me
    >60 seconds to save my files and close programs.
    >
    >What is the problem and how can I fix it? I am on Win98SE right
    >now(dual-boot), and just scanned my hard drive for viruses with the
    >latest AVG update, but found nothing.


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 11, 2003
    #3
  4. Patrick D.

    °Mike° Guest

    On Mon, 11 Aug 2003 21:43:23 +0100, in
    <bh8v18$v61t5$-berlin.de>
    Mcploppy © scrawled:

    >
    > °Mike° bashed at the keyboard and said :
    >
    >> Curiouser and curiouser! This is the fifth time this question has
    >> been asked in less than two hours...
    >>

    ><snip>
    >
    >Picked this up from another NG
    >
    >> There is currently a virus spreading across the net which basically
    >> leaves you open to hackers by using the RPC feature of Windows NT
    >> based systems (NT/2000/XP).
    >>
    >> Symptoms of the virus are:
    >>
    >> Your computer will shut itself down and then restart in order to
    >> allow the virus to finish propogating itself
    >>
    >> Antivirus software will NOT detect this as it is a modified version of
    >> useful program code!
    >>
    >> Please all ensure that you have downloaded the critical system updates
    >> supplied by Microsoft:


    <snip>

    >http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp


    Thanks.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 11, 2003
    #4
  5. Patrick D.

    Mcploppy © Guest

    Mcploppy ©, Aug 11, 2003
    #5
  6. Patrick D.

    Patrick D. Guest

    Mcploppy © <> wrote in
    news:bh8v18$v61t5$-berlin.de:

    >
    > °Mike° bashed at the keyboard and said :
    >
    >> Curiouser and curiouser! This is the fifth time this question has
    >> been asked in less than two hours...
    >>

    > <snip>
    >
    > Picked this up from another NG
    >
    >> There is currently a virus spreading across the net which basically
    >> leaves you open to hackers by using the RPC feature of Windows NT
    >> based systems (NT/2000/XP).
    >>
    >> Symptoms of the virus are:
    >>
    >> Your computer will shut itself down and then restart in order to
    >> allow the virus to finish propogating itself
    >>
    >> Antivirus software will NOT detect this as it is a modified version
    >> of useful program code!
    >>
    >> Please all ensure that you have downloaded the critical system
    >> updates supplied by Microsoft:



    Crap this is bad. :-(
    I'm struggling along with Win98SE, monitor at 40hz and mouse
    unrecognized... I logged on to XP Pro to run the fix, but comp got
    restarted while Setup was checking files..
    Patrick D., Aug 11, 2003
    #6
  7. Patrick D.

    Mcploppy © Guest

    °Mike° bashed at the keyboard and said :

    > On Mon, 11 Aug 2003 21:51:50 +0100, in
    > <bh8vh2$100iiq$-berlin.de>
    > Mcploppy © scrawled:
    >
    >>
    >> °Mike° bashed at the keyboard and said :
    >>
    >>
    >>> <snip>
    >>>
    >>>>

    >>

    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp
    >>>
    >>> Thanks.

    >>
    >> You're Welcome :)

    >
    > Sorry about the brain-fart typo of your nym, in the updated posts I
    > made in the other threads... :-/


    100 Lines: I must spell Mcploppy properly

    Have 6 pints and then try and say it 10 times
    :)
    Mcploppy ©, Aug 11, 2003
    #7
  8. Patrick D.

    °Mike° Guest

    On Mon, 11 Aug 2003 22:01:55 +0100, in
    <bh903v$v9stb$-berlin.de>
    Mcploppy © scrawled:

    >
    > °Mike° bashed at the keyboard and said :


    <snip>

    >> Sorry about the brain-fart typo of your nym, in the updated posts I
    >> made in the other threads... :-/

    >
    >100 Lines: I must spell Mcploppy properly


    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.
    I must spell Mcploppy properly. I must spell Mcploppy properly.

    >Have 6 pints and then try and say it 10 times
    >:)


    I'll pass on that one. :)

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 11, 2003
    #8
  9. Patrick D.

    Kenny Guest

    It's all over the MS groups as well, look here:
    news:microsoft.public.windowsxp.basics
    news:microsoft.public.windowsxp.general

    --

    Kenny


    "Mcploppy ©" <> wrote in message
    news:bh8vh2$100iiq$-berlin.de...
    >
    > °Mike° bashed at the keyboard and said :
    >
    >
    > > <snip>
    > >
    > >>

    >

    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
    bulletin/MS03-026.asp
    > >
    > > Thanks.

    >
    > You're Welcome :)
    >
    >
    Kenny, Aug 11, 2003
    #9
  10. Patrick D.

    Mcploppy © Guest

    °Mike° bashed at the keyboard and said :

    > On Mon, 11 Aug 2003 22:01:55 +0100, in
    > <bh903v$v9stb$-berlin.de>
    > Mcploppy © scrawled:
    >
    >>
    >> °Mike° bashed at the keyboard and said :

    >
    > <snip>
    >
    >>> Sorry about the brain-fart typo of your nym, in the updated posts I
    >>> made in the other threads... :-/

    >>
    >> 100 Lines: I must spell Mcploppy properly

    >
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    > I must spell Mcploppy properly. I must spell Mcploppy properly.
    >
    >> Have 6 pints and then try and say it 10 times
    >> :)

    >
    > I'll pass on that one. :)


    WITHOUT CUT ' N ' PASTE !!! :-0
    Mcploppy ©, Aug 11, 2003
    #10
  11. Patrick D.

    Patrick D. Guest

    °Mike° <> wrote in news:3f58fe98.16245004
    @localhost.dot.net:

    By the way, why is RPC even active on my computer? I disabled Remote
    Access, and I don't want anybody(even myself) to be able to execute code on
    my computer from another one, and I don't want to execute code on anybody
    else's machine anyway...
    Patrick D., Aug 11, 2003
    #11
  12. Patrick D.

    °Mike° Guest

    I never wrote that. Please include some of the message you
    are replying to; not the attribution WITHOUT the message!


    On Mon, 11 Aug 2003 21:08:33 GMT, in
    <Xns93D49A087C966pdopdo@204.127.199.17>
    Patrick D. scrawled:

    >°Mike° <> wrote in news:3f58fe98.16245004
    >@localhost.dot.net:
    >
    >By the way, why is RPC even active on my computer? I disabled Remote
    >Access, and I don't want anybody(even myself) to be able to execute code on
    >my computer from another one, and I don't want to execute code on anybody
    >else's machine anyway...


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 11, 2003
    #12
  13. Patrick D.

    Patrick D. Guest

    °Mike° <> wrote in news:3f6306ab.18311714
    @localhost.dot.net:

    > I never wrote that. Please include some of the message you
    > are replying to; not the attribution WITHOUT the message!


    Oops.. sorry.

    By the way, why is RPC even active on my computer? I disabled Remote
    Access, and I don't want anybody(even myself) to be able to execute code on
    my computer from another one, and I don't want to execute code on anybody
    else's machine anyway...
    Patrick D., Aug 11, 2003
    #13
  14. Patrick D.

    Mara Guest

    On Mon, 11 Aug 2003 22:30:12 +0100, °Mike° wrote:

    >On Mon, 11 Aug 2003 21:16:49 GMT, in
    > <Xns93D49B6EFD8F0pdopdo@204.127.199.17>
    > Patrick D. scrawled:
    >
    >>°Mike° <> wrote in news:3f6306ab.18311714
    >>@localhost.dot.net:
    >>
    >>> I never wrote that. Please include some of the message you
    >>> are replying to; not the attribution WITHOUT the message!

    >>
    >>Oops.. sorry.
    >>
    >>By the way, why is RPC even active on my computer? I disabled Remote
    >>Access, and I don't want anybody(even myself) to be able to execute code on
    >>my computer from another one, and I don't want to execute code on anybody
    >>else's machine anyway...

    >
    >Read the links given.
    >
    >http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
    >
    >Scroll down to "Workarounds".


    FYI: The worm is W32/Lovsan.worm. The executable is MSBLAST.EXE. And it is
    spreading at an alarming rate.

    "I figure you already probably know this, but the newbies don't/wont."


    --
    anyone know a free usenet browser that's not google?
    --SharpenedSpoon, from the somethingawful.com forum
    Mara, Aug 11, 2003
    #14
  15. Patrick D.

    °Mike° Guest

    On Mon, 11 Aug 2003 16:41:10 -0500, in
    <>
    Mara scrawled:

    >On Mon, 11 Aug 2003 22:30:12 +0100, °Mike° wrote:
    >
    >>On Mon, 11 Aug 2003 21:16:49 GMT, in
    >> <Xns93D49B6EFD8F0pdopdo@204.127.199.17>
    >> Patrick D. scrawled:
    >>
    >>>°Mike° <> wrote in news:3f6306ab.18311714
    >>>@localhost.dot.net:
    >>>
    >>>> I never wrote that. Please include some of the message you
    >>>> are replying to; not the attribution WITHOUT the message!
    >>>
    >>>Oops.. sorry.
    >>>
    >>>By the way, why is RPC even active on my computer? I disabled Remote
    >>>Access, and I don't want anybody(even myself) to be able to execute code on
    >>>my computer from another one, and I don't want to execute code on anybody
    >>>else's machine anyway...

    >>
    >>Read the links given.
    >>
    >>http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
    >>
    >>Scroll down to "Workarounds".

    >
    >FYI: The worm is W32/Lovsan.worm. The executable is MSBLAST.EXE.
    >And it is spreading at an alarming rate.
    >
    >"I figure you already probably know this, but the newbies don't/wont."


    I wasn't aware at first, but soon caught on. :)

    --
    "Virus check complete. All viruses functioning normally."
    °Mike°, Aug 11, 2003
    #15
  16. Patrick D.

    °Mike° Guest

    On Mon, 11 Aug 2003 22:59:05 +0100, in
    <bh93f5$vp48n$-berlin.de>
    Mcploppy © scrawled:

    >
    > °Mike° bashed at the keyboard and said :
    >
    >> On Mon, 11 Aug 2003 16:41:10 -0500, in
    >> <>
    >> Mara scrawled:
    >>
    >>> On Mon, 11 Aug 2003 22:30:12 +0100, °Mike° wrote:
    >>>
    >>>> On Mon, 11 Aug 2003 21:16:49 GMT, in
    >>>> <Xns93D49B6EFD8F0pdopdo@204.127.199.17>
    >>>> Patrick D. scrawled:
    >>>>
    >>>>> °Mike° <> wrote in news:3f6306ab.18311714
    >>>>> @localhost.dot.net:
    >>>>>
    >>>>>> I never wrote that. Please include some of the message you
    >>>>>> are replying to; not the attribution WITHOUT the message!
    >>>>>
    >>>>> Oops.. sorry.
    >>>>>
    >>>>> By the way, why is RPC even active on my computer? I disabled
    >>>>> Remote Access, and I don't want anybody(even myself) to be able to
    >>>>> execute code on my computer from another one, and I don't want to
    >>>>> execute code on anybody else's machine anyway...
    >>>>
    >>>> Read the links given.
    >>>>
    >>>> http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
    >>>>
    >>>> Scroll down to "Workarounds".
    >>>
    >>> FYI: The worm is W32/Lovsan.worm. The executable is MSBLAST.EXE.
    >>> And it is spreading at an alarming rate.
    >>>
    >>> "I figure you already probably know this, but the newbies
    >>> don't/wont."

    >>
    >> I wasn't aware at first, but soon caught on. :)

    >
    >Once you have a pplied the patche (s).... I take it it's just a case of
    >1. Delete the file
    >2. Delete entries in the registry to msblast.exe
    >??


    NO! NEVER install updates BEFORE cleaning your system!

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 11, 2003
    #16
  17. Patrick D.

    °Mike° Guest

    Courtesy of Ron Martell:

    This is caused by a new and rapidly spreading virus.

    To clear up the "NT Authority\System" and RPC call errors:

    1. Go to http://support.microsoft.com/?kbid=823980 and download the
    security patch. If at all possible do this on a clean machine and
    copy the patch to a 3.5 inch diskette.

    2. Boot the infected machine into Safe Mode. Insert the 3.5 inch
    diskette with the patch on it and run it. Do not reboot yet.

    3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the
    entry for MSBLAST.EXE and clear the checkbox for it.

    4. Use Start - Run - REGEDIT and locate and delete the following key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "windows auto update"="msblast.exe"

    5. Use Start - Search and check all your hard drives for the file
    MSBLAST.EXE and delete all copies of it.

    6. Shut down and restart the computer normally.

    7. Immediately do an update of your antivirus software and when the
    updates are installed do a complete virus scan of your hard drive. So
    far Symantec/Norton, Trend Micro (PC-Cillin) and Sophos seems to be
    the only major companies with an update for this specific virus (4:30
    p.m. PDT 11 Aug 2003) but the others will undoubtedly follow within 24
    hours. Addendum - more companies have added updates for this virus
    now, including McAfee and AVG.

    8. If you are running Windows XP make certain that you have the
    built-in firewall activated or third-party firewall program installed
    and running. Windows 2000 needs to have a firewall program installed.


    On Tue, 12 Aug 2003 13:59:12 GMT, in
    <Mo6_a.128151$YN5.86652@sccrnsc01>
    Trepain scrawled:

    >A similar problem started on my computer last night. It seems to vary
    >slightly.
    >
    >Here is some text I wrote concerning it...
    >
    >Firewall reports that the Trivial File transfer protocol "tftp.exe" is
    >attempting to access the network. When I choose no or don't respond I
    >receive the following message:
    >
    >"System Shutdown - This system is shutting down. Please save all work
    >in progress and log off. Any unsaved changes will be lost. This
    >shutdown was initiated by NT AUTHORITY/SYSTEM. Message - Windows must
    >now restart because the Remote Procedure Call (RPC) service terminated
    >unexpectedly."
    >
    >Actions taken in Sygate firewall - Block all hosts - ALL UDP traffic
    >both incoming and outgoing - applications - Trivial Fire Transfer
    >Protocol App.
    >
    >Shortly after I no longer received the firewall message. It just
    >tells me my computer is shutting down and then it reboots because I am
    >assuming whatever is causing the problem couldn't use tftp.exe and
    >then reboots my system. This started happening last night. I am
    >monitoring my firewall log and I cannot figure this out. I am
    >assuming based on information on the web that I have some type of
    >Trojan which uses the tftp.exe. I believe it is expecting me to allow
    >it to gain access and it "MAY" stop rebooting if I grant that access,
    >but I surely don't want to let it gain access without knowing it's
    >purpose.
    >
    >---
    >
    >I used TDS-3 Professional to scan for Trojans (evaluation version) and
    >also used Nortan Antivirus and everything appeared to be clean. I
    >also ran an application that specifically targets the nimba trojan
    >which sounds a little like what I might have, but again clean. A ran
    >W32.Blaster.Worm.Fix tool. No blaster worm found.
    >
    >Read that it may be "Windows XP Security Patch: Buffer Overrun In RPC
    >Interface Could Allow Code Execution". Ran patch...
    >
    >Hopefully it will stop whatever it is... I was hoping it was blaster.
    >It seems to be similar in terms of code being run remotely, but I have
    >NO IDEA what it is and wish I could clean it up.
    >
    >Anyone have any ideas or suggestions?
    >
    >Thank you in advance for any information,


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Aug 12, 2003
    #17
  18. Patrick D.

    Boomer Guest

    °Mike° said:

    > Courtesy of Ron Martell:
    >
    > This is caused by a new and rapidly spreading virus.
    >
    > To clear up the "NT Authority\System" and RPC call errors:

    [snip]
    > On Tue, 12 Aug 2003 13:59:12 GMT, in
    > <Mo6_a.128151$YN5.86652@sccrnsc01>
    > Trepain scrawled:
    >
    >>A similar problem started on my computer last night. It seems to
    >>vary slightly.
    >>
    >>Here is some text I wrote concerning it...

    [snip]
    >>"System Shutdown - This system is shutting down. Please save all
    >>work in progress and log off. Any unsaved changes will be lost.
    >>This shutdown was initiated by NT AUTHORITY/SYSTEM.

    [snip]

    <boggles>

    <sigh>
    Boomer, Aug 12, 2003
    #18
  19. Patrick D.

    °Mike° Guest

    On 12 Aug 2003 19:30:30 GMT, in
    <3f394054$0$225$>
    Boomer scrawled:

    >°Mike° said:
    >
    >> Courtesy of Ron Martell:
    >>
    >> This is caused by a new and rapidly spreading virus.
    >>
    >> To clear up the "NT Authority\System" and RPC call errors:

    >[snip]
    >> On Tue, 12 Aug 2003 13:59:12 GMT, in
    >> <Mo6_a.128151$YN5.86652@sccrnsc01>
    >> Trepain scrawled:
    >>
    >>>A similar problem started on my computer last night. It seems to
    >>>vary slightly.
    >>>
    >>>Here is some text I wrote concerning it...

    >[snip]
    >>>"System Shutdown - This system is shutting down. Please save all
    >>>work in progress and log off. Any unsaved changes will be lost.
    >>>This shutdown was initiated by NT AUTHORITY/SYSTEM.

    >[snip]
    >
    ><boggles>
    >
    ><sigh>


    My thoughts, exactly!
    °Mike°, Aug 12, 2003
    #19
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Jill Sharp

    Remote Procedure Call Message

    Jill Sharp, Aug 15, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    485
    Philip SC
    Aug 15, 2003
  2. fokker
    Replies:
    7
    Views:
    1,106
    Fokker
    Sep 11, 2003
  3. det282

    Server Unexpectedly Terminated Connection

    det282, Dec 2, 2003, in forum: Computer Support
    Replies:
    4
    Views:
    963
    M Mullen
    Dec 4, 2003
  4. MaryL

    Windows Remote Call Procedure

    MaryL, Jan 3, 2004, in forum: Computer Support
    Replies:
    13
    Views:
    691
    °Mike°
    Jan 5, 2004
  5. Replies:
    7
    Views:
    928
Loading...

Share This Page