Win XP - NT Authority\System Shutdown

Discussion in 'Computer Support' started by Jim PKP, Nov 2, 2003.

  1. Jim PKP

    Jim PKP Guest

    Hi all,

    Had to reinstall Win XP Pro. Everthing fine except about every 2 hours,
    for no reason that I can see, I get the following message, and the
    system shuts down after a minute:

    The system is shutting down. Please save all work in progress. Any
    unsaved changes will be lost. This shutdown was initiated by NT
    Authority\System.

    Message:
    Windows must be restarted because Remote Procedure Call (RPC)
    unexpectedly terminated.

    Any ideas?

    Thanks
     
    Jim PKP, Nov 2, 2003
    #1
    1. Advertisements

  2. Jim PKP

    Patrick Guest

    Taken from a post by 'Boomer', quote;

    Blaster worm would be my guess.
    http://www.microsoft.com/security/incident/blast.asp

    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
     
    Patrick, Nov 2, 2003
    #2
    1. Advertisements

  3. Jim PKP

    °Mike° Guest

    <Canned response>

    Boot into Safe Mode and start your registry editor:
    Start / Run / regedit

    Navigate to:
    HKEY_LOCAL_MACHINE
    +Software
    +Microsoft
    +Windows
    +CurrentVersion
    +Run

    In the right-hand pane, look for any entry/ies that include
    MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
    DELETE it/them.
    These are the files associated with the different variants:
    Variant A - msblast.exe
    Variant B - penis32.exe
    Variant C - teekids.exe

    You just disabled the worm from running at startup, so boot into
    normal mode again, and turn off ALL system restores to purge
    your system.

    Open Windows Explorer to the ..\Windows\System32\ or
    ...\WinNT\System32\ folder and DELETE *any* of the
    files named above.

    Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
    and find the reference to the above file/s (any reference will
    be similar to: <filename.exe>-<alphanumerics>.PF), for example,
    msblast.exe-0235D8H6.pf, and DELETE it/them.

    Now you can download and install the patch, configure your
    firewall and update your virus scanner.

    Virus Alert About the Blaster Worm and Its Variants
    http://support.microsoft.com/default.aspx?kbid=826955

    Microsoft Security Bulletin MS03-026
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

    What you should know about the Blaster worm
    http://www.microsoft.com/security/incident/blast.asp

    Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
    http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

    How to Use The KB 823980 Scanning Tool to Identify Host Computers
    That Do Not Have The 823980 Security Patch (MS03-026) Installed
    http://support.microsoft.com/default.aspx?kbid=826369

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

    W32.Blaster.B.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

    W32.Blaster.C.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

    W32.Blaster.Worm Removal Tool
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
     
    °Mike°, Nov 2, 2003
    #3
  4. It was on Sun, 02 Nov 2003 16:01:03 +0000, just as I was halfway through a
    large jam doughnut, that °Mike° wrote:

    Good grief!! Blaster has been around for...how long?
    And he doesn't know what it does or what it is YET??
    JHC..

    <Snip>
     
    William Poaster, Nov 2, 2003
    #4
  5. Jim PKP

    Guest Guest

    If he had no interest in pc's and purchased a new one from a well known pc
    store with said blaster pre installed (as I did)
    Why would he know??
     
    Guest, Nov 2, 2003
    #5
  6. Jim PKP

    Jim PKP Guest


    Thanks for your help, Mike and Patrick
     
    Jim PKP, Nov 2, 2003
    #6
  7. Jim PKP

    Jim PKP Guest


    You're assuming I care, you idiot.
     
    Jim PKP, Nov 2, 2003
    #7
  8. Jim PKP

    Mara Guest

    You're either new here, or you haven't spent much time in this group.

    "That's evident from the very fact that you made this statement. Google is your
    friend. Try to remember that."
     
    Mara, Nov 2, 2003
    #8
  9. Jim PKP

    Jim PKP Guest

    "What are you on about?"
     
    Jim PKP, Nov 2, 2003
    #9
  10. It was on Sun, 02 Nov 2003 16:53:44 +0000, just as I was halfway through a
    If he (TINH) had no interest in pc's, why buy one?
    Which he (TINH) didn't.
     
    William Poaster, Nov 2, 2003
    #10
  11. Jim PKP

    Jim PKP Guest

    I use it for work.
    I don't have a huge interest (or a great knowledge of) how it works.
    I'm subscribed here for two reasons:

    (1) to pick up tips from people like Mike
    (2) to be entertained by idiots like Mara.
     
    Jim PKP, Nov 2, 2003
    #11
  12. Jim PKP

    °Mike° Guest

    And it's been unprotected all this time?
    You've been posting to this group long enough to know
    about the Blaster worm.
    An unprotected/unpatched machine says that *you* are
    the idiot, I think.
     
    °Mike°, Nov 2, 2003
    #12
  13. Jim PKP

    °Mike° Guest

     
    °Mike°, Nov 2, 2003
    #13
  14. Jim PKP

    Mara Guest

    It says much more than his words do, doesn't it? :)
     
    Mara, Nov 2, 2003
    #14
  15. Jim PKP

    Mara Guest

    I saw your other post - I'd appreciate it of you'd clip his stupidities about me
    out, if you would. I'm not sure if he's trying to troll me or if he just has a
    hard-on for me and is trying to attract my attention, but in either case I find
    him ignorant and boring and would rather he didn't get _any_ sort of attention
    from me - even through your posts. Please? :)
     
    Mara, Nov 2, 2003
    #15
  16. Jim PKP

    °Mike° Guest

    Words are just words.
     
    °Mike°, Nov 2, 2003
    #16
  17. Jim PKP

    °Mike° Guest

    Sorry. My mistake. :(
     
    °Mike°, Nov 2, 2003
    #17
  18. It certainly does.
    Also trying to respond to someone who's plonked
    him, makes him look follish too...
     
    William Poaster, Nov 2, 2003
    #18
  19. Jim PKP

    Mara Guest

    Don't worry about it. I just wanted to bring it to your attention, that's all.
    Frankly I was quite surprised to see him still frothing at the mouth, but that's
    usenet for you. :)

    You're a good man, °Mike°, and I, for one, value that. :)

    "I mean that, too."
     
    Mara, Nov 2, 2003
    #19
  20. Jim PKP

    Mara Guest

    I'll see your "l," and raise you one "o." ;)

    "I'm in a gambling sort of mood, today."
     
    Mara, Nov 2, 2003
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.