Re: System shutting down

From: Larry Samuels MS-MVP XP \(Shell/User\) (larry_at_mvps.org)
Date: 09/15/03


Date: Mon, 15 Sep 2003 13:47:38 -0400


Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.

-- 
Larry Samuels MS-MVP  (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone - www.microsoft.com/windowsxp/expertzone
"Dietmar Neuhaus" <dneuhaus@sprint.ca> wrote in message
news:0b2a01c37baf$e0776480$a001280a@phx.gbl...
> I am new to XP and am assuming the following problem is
> generated by a virus:
>
> "This system is shutting down.  Please save all work in
> progress and log off.  Any unsaved changes will be lost.
> This system shutdown was initiated by NT
> AUTHORIZATION\SYSTEM"
>
> Message
>      Windows must now restart because the Remote Procedure
> Call (RPC) service was terminated.
>
> This problem seems to initiate between 5 and ten minutes
> after internet dial up.  It does not happen if I remain
> offline.  I had Macaffee installed prior to the problem.
> I have attempted to install Norton anti virus post
> problem, however it will not completely install.  Any
> ideas on how to resolve this other than to reinstall
> Windows.


Relevant Pages

  • RE: Blaster Worm Solution
    ... plus the Value "windows auto update" under the ... to download the patch and install it. ... When you are informed of the system shutdown, ... Though this will stop the shutdown, the RPC server has ...
    (microsoft.public.windowsxp.security_admin)
  • Re: LSASS.EXE
    ... Download the patch. ... following when you get the shutdown message. ... You can also scan the system using the below multi AV Command Line Scanner front end utility ...
    (microsoft.public.windowsxp.general)
  • RE: patch
    ... Hi Marilyn, ... Rather than attempting to install this one patch, ... Here is the link to Windows Updates: ... | place to download the patch. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: OT: security patch for Windows
    ... There is a windows patch that needs to be applied. ... direct download. ... double-click Turn Off Autoplay ...
    (rec.pets.cats.anecdotes)
  • Re: RPC Service Shutdown
    ... Run the tool to remove the worm,then follow the onscreen prompts to download ... Make sure you download the 32bit patch if you are running XP. ... There are more variants out now. ... When the shutdown prompt appears,go to start/run and type ...
    (microsoft.public.security.virus)