Re: RPC

From: Larry Samuels MS-MVP XP \(Shell/User\) (larry_at_mvps.org)
Date: 08/20/03


Date: Tue, 19 Aug 2003 22:39:33 -0400


You are infected with the blaster worm or one of it's variants.
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.

-- 
Larry Samuels MS-MVP  (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone - www.microsoft.com/windowsxp/expertzone
"pam rivi" <gonegolfing1@aol.com> wrote in message
news:094901c366be$3f8bece0$a101280a@phx.gbl...
> I GET A MESSAGE THAT SAYS WINDOWS IS SHUTTING DOWN
> REMOTE PROCEDURE CALL SERVICE TERMINATED UNEXPECTEDLEY.
>  MY COMPUTER SHUTS DOWN.
>  IT SAYS   SENT BY NT AUTHORITY/ SYSTEM.
>  I CAN NOT FIX IT.
>  THANK YOU
>  PAM RIVI


Relevant Pages

  • Re: Explorer shutdown by NT Authority/System
    ... "What You Should Know About the Blaster Worm and Its Variants" ... firewall and go to the Windows Update website to ... > shutdown notice which starts a countdown. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: NT Authoritysystem shutdown
    ... Run the tool to remove the worm,then follow the onscreen prompts to download ... Make sure you download the 32bit patch if you are running XP. ... There are more variants out now. ... When the shutdown prompt appears,go to start/run and type ...
    (microsoft.public.windowsxp.security_admin)
  • Re: SYSTEM SHUTTING DOWN
    ... There are 2 more variants out now. ... If you are having trouble staying up to get the patch and removal tool: ... When the shutdown prompt appears,go to start/run and type ... Unofficial FAQ for Windows Server 2003 at ...
    (microsoft.public.windowsxp.security_admin)
  • Re: NT AUTHORITY QUESTION
    ... You are infected with the blaster worm or one of it's variants. ... Run the tool to remove the worm,then follow the onscreen prompts to download ... When the shutdown prompt appears,go to start/run and type ... >I RECENTLY RE-INSTALLED WINDOWS ON A CLOANED PC THAT WAS ...
    (microsoft.public.windowsxp.security_admin)
  • Re: computer restatrt message
    ... You are infected with the blaster worm or one of it's variants. ... Run the tool to remove the worm,then follow the onscreen prompts to download ... When the shutdown prompt appears,go to start/run and type ... Unofficial FAQ for Windows Server 2003 at ...
    (microsoft.public.windowsxp.security_admin)