Bill
Tue Aug 26 23:35:15 CDT 2003
Any chance the message mentioned RPC or Remote Procedure Call?
It is perfectly possible to be hit by the Blaster worm on a dialup
connection, and a newly installed machine connected to the Internet is
unpatched against that vulnerability.
Here's a message from a Microsoft staff person explaining how to deal with a
Blaster infection. Whether or not you have this infection, you need the
patch for it.
----------------------------------------------------------------------------
My name is Rita Nikas and I have some fairly simple steps that should help
you with this problem.
As I understand, you have received the following error messages when using
your computer:
"This system is shutting down. Please save all work in progress and log
off. This shutdown was initiated by NT Authority/System."
"Windows must restart because the Remote Procedure Call (RPC) service
terminated unexpectedly."
This is a known security issue which was first found on July 15. There is
currently an Internet Worm that is taking advantage of this security issue.
Microsoft published the patch to fix this issue on July 16 for all of the
affected systems on our web site. For more information, please refer to the
following page:
Microsoft's latest Information on the Blaster Worm including links for
other Windows Operating Systems
http://www.microsoft.com/security/incident/blast.asp
For the latest information on this security bulletin
http://www.microsoft.com/security/security_bulletins/ms03-026.asp
______________________________________________________
The resolution to this issue is to clean the worm from your system and
install the patch mentioned above.
Do this In Order:
1) Turn on your Internet Connection Firewall (Windows XP)
2) Install the patch from Microsoft to remove the vulnerability
3) Run a removal Tool from an Anti-Virus company to remove all traces of
the virus from your system
4) Go to Windows Update and get all other needed Critical Updates
Alternate Download Sites are located at:
*
http://www.microsoft.com/downloads/details.aspx?FamilyID=2354406c-c5b6-44ac-
9532-3de40f69c074&displaylang=en
*
http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/Wind
owsXP-KB823980-x86-ENU_1d296adab6699e66210e5a350236381.exe
IMPORTANT
__________
Whenever your computer attempts to shutdown or reboot, quickly:
Click the Start Button and then click RUN and type in
shutdown -a
and hit enter.
This should halt the rebooting problem temporarily.
You can also disconnect your computer from the internet while you do the
first step of turning on the Internet Connection Firewall.
----------------------------------------------------
1)
Turn on the Internet Connection Firewall (Windows XP)
For XP Pro Users
http://www.microsoft.com/windowsxp/pro/using/howto/networking/icf.asp
For XP Home Users
http://www.microsoft.com/WindowsXP/home/using/howto/homenet/icf.asp
Generic Instructions for XP Users:
1. In Control Panel, double-click "Networking and Internet Connections",
and then click Network Connections.
2. Right-click the connection (your internet connection) on which you would
like to enable ICF, and then click Properties.
3. On the Advanced tab, click the box to select the option to "Protect my
computer or network".
4. If you want to enable the use of some applications and services through
the firewall, you need to enable them by clicking the Settings button,
and then selecting the programs, protocols, and services to be enabled for
the ICF configuration.
2)
Install the Patch from Microsoft for your Operating System
Windows XP (32-bit)
http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a9
83f01/WindowsXP-KB823980-x86-ENU.exe
3)
Run a removal Tool from an Anti-Virus Company to get the Virus off your
system
Network Associates
http://vil.nai.com/vil/stinger/
Trend Micro
http://housecall.trendmicro.com/
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.rem
oval.tool.html
Computer Associates
http://www3.ca.com/virusinfo/virus.aspx?ID=36265
4)
When you get a chance after everything calms down, with Internet Explorer
up and running, go to the top menu and click Tools and click Windows Update
and install all the latest Critical Updates.
http://v4.windowsupdate.microsoft.com/en/default.asp
You can also configure Automatic Updates to automatically download updates
for you. How to Configure and Use Automatic Updates in Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;en-us;306525
Sincerely,
Rita Nikas, MCSE MCDBA
Microsoft MVP Lead
Product Support Services
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
Please note I cannot respond to e-mailed questions.
Please use respond to this thread to let me know if the steps and
suggestions helped you to resolve the issue.
"Aaron" <dasbowza@juno.com> wrote in message
news:059701c36c42$f8441a80$a501280a@phx.gbl...
> I recently, installed Windows Xp Pro Edition on my
> friends computer. Set up dial-up connection, and
> activated her copy. Now, i think i might have used the
> cd myself, for my computers, but im not sure. But, when
> we were connected, an error came up, with a note
> like "System/Security" "Computer will be shutdown in 50
> seconds, all information will be lost"
> I have no idea what is causing this, and i have never
> seen it before. I know that if the cd was activated too
> many times, it would say it. So can please someone help
> me solve this problem. Thnx