Win XP - NT Authority\System Shutdown

Hi all,

Had to reinstall Win XP Pro. Everthing fine except about every 2 hours,
for no reason that I can see, I get the following message, and the
system shuts down after a minute:

The system is shutting down. Please save all work in progress. Any
unsaved changes will be lost. This shutdown was initiated by NT
Authority\System.

Message:
Windows must be restarted because Remote Procedure Call (RPC)
unexpectedly terminated.

Any ideas?

Thanks

 

Taken from a post by 'Boomer', quote;

Blaster worm would be my guess.
http://www.microsoft.com/security/incident/blast.asp

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

 

<Canned response>

Boot into Safe Mode and start your registry editor:
Start / Run / regedit

Navigate to:
HKEY_LOCAL_MACHINE
+Software
+Microsoft
+Windows
+CurrentVersion
+Run

In the right-hand pane, look for any entry/ies that include
MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
DELETE it/them.
These are the files associated with the different variants:
Variant A - msblast.exe
Variant B - penis32.exe
Variant C - teekids.exe

You just disabled the worm from running at startup, so boot into
normal mode again, and turn off ALL system restores to purge
your system.

Open Windows Explorer to the ..\Windows\System32\ or
...\WinNT\System32\ folder and DELETE *any* of the
files named above.

Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
and find the reference to the above file/s (any reference will
be similar to: <filename.exe>-<alphanumerics>.PF), for example,
msblast.exe-0235D8H6.pf, and DELETE it/them.

Now you can download and install the patch, configure your
firewall and update your virus scanner.

Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955

Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

What you should know about the Blaster worm
http://www.microsoft.com/security/incident/blast.asp

Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

How to Use The KB 823980 Scanning Tool to Identify Host Computers
That Do Not Have The 823980 Security Patch (MS03-026) Installed
http://support.microsoft.com/default.aspx?kbid=826369

W32.Blaster.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.B.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

W32.Blaster.C.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

 

It was on Sun, 02 Nov 2003 16:01:03 +0000, just as I was halfway through a
large jam doughnut, that °Mike° wrote:

Good grief!! Blaster has been around for...how long?
And he doesn't know what it does or what it is YET??
JHC..

<Snip>

 

If he had no interest in pc's and purchased a new one from a well known pc
store with said blaster pre installed (as I did)
Why would he know??

 

Thanks for your help, Mike and Patrick

 

You're assuming I care, you idiot.

 

You're either new here, or you haven't spent much time in this group.

"That's evident from the very fact that you made this statement. Google is your
friend. Try to remember that."

 

"What are you on about?"

 

It was on Sun, 02 Nov 2003 16:53:44 +0000, just as I was halfway through a

If he (TINH) had no interest in pc's, why buy one?

Which he (TINH) didn't.

 

I use it for work.
I don't have a huge interest (or a great knowledge of) how it works.
I'm subscribed here for two reasons:

(1) to pick up tips from people like Mike
(2) to be entertained by idiots like Mara.

 

And it's been unprotected all this time?

You've been posting to this group long enough to know
about the Blaster worm.

An unprotected/unpatched machine says that *you* are
the idiot, I think.

 

It says much more than his words do, doesn't it?

 

I saw your other post - I'd appreciate it of you'd clip his stupidities about me
out, if you would. I'm not sure if he's trying to troll me or if he just has a
hard-on for me and is trying to attract my attention, but in either case I find
him ignorant and boring and would rather he didn't get _any_ sort of attention
from me - even through your posts. Please?

 

Words are just words.

 

Sorry. My mistake.

 

It certainly does.
Also trying to respond to someone who's plonked
him, makes him look follish too...

 

Don't worry about it. I just wanted to bring it to your attention, that's all.
Frankly I was quite surprised to see him still frothing at the mouth, but that's
usenet for you.

You're a good man, °Mike°, and I, for one, value that.

"I mean that, too."

 

I'll see your "l," and raise you one "o."

"I'm in a gambling sort of mood, today."