Re: log of by nt authority when downloading

From: Bruce Chambers (bchambers_at_nospamcableone.net)
Date: 01/19/04 

Date: Mon, 19 Jan 2004 10:09:36 -0700

Greetings --

      If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

    To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Removal Tool for Blaster/Nachi worm infections from computers running
Win2K or WinXP
http://support.microsoft.com/?kbid=833330

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

Bruce Chambers 

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace.  Or you can have freedom.  Don't ever count on
having both at once. -- RAH
"Craig" <anonymous@discussions.microsoft.com> wrote in message
news:023501c3de37$b12e8790$a601280a@phx.gbl...
>
> >-----Original Message-----
> >how do I get this turned of
> >.
> >
> At random times, but only when I'm connected to
> the internet, I received the above message.
>
>   "The System is shutting down.  Please save all
>   work in progress and log off.  Any unsaved
>   changes will be lost.  This shutdown was initiated
>   by NT AUTHORITY\SYSTEM
>
>   Time before shutdown: 00:00:60
>
>   Message
>   Windows must now restart because the
>   Remote Procedure Call (RPC) service
>   terminated unexpectedly"
>
> I have searched the MS support knowledge base.
>
> I would be grateful to receive any suggestion
> how to fix/eliminate this problem.

Relevant Pages

  • Re: System Shutdown RPC Service Terminated
    ... sure you've enabled a firewall before starting, ... W32.Blaster.Worm Removal Tool ... > spyware/other unwanted crap with Ad-Aware a "System Shutdown" prompt ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: System is shuttng down NT authority 60 seconds
    ... and removal tools, click Start> Run, and enter "shutdown -a" when the ... sure you've enabled a firewall before starting, ... What You Should Know About the Blaster Worm ... W32.Blaster.Worm Removal Tool ...
    (microsoft.public.windowsxp.security_admin)
  • Re: XP Upgrade - RPC shut-down
    ... sure you've enabled a firewall before starting, ... W32.Blaster.Worm Removal Tool ... RPC Shutdown activated through the Windows NT ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Help:Remote Procedure Call (RPC) service error, Forced to Shut Down often times
    ... sure you've enabled a firewall before starting, ... MS04-012 Cumulative Update for Microsoft RPC-DCOM ... W32.Blaster.Worm Removal Tool ... This shutdown was initiated by NT ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Remote procedure call error
    ... sure you've enabled a firewall before starting, ... W32.Blaster.Worm Removal Tool ... > will shutdown in 60 secs because RPC failed. ... > to shutdown starts and the machine reboots. ...
    (microsoft.public.windowsxp.general)