Help! System Shutting Down - RPC

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

Bonnie,

The cause of this system shutdown is some slimeware, not necessarily caught by
anti-virus software. You can start up the system in safe mode and (hopefully)
identify the culprit by running MSCONFIG or (better yet) Hijackthis, a bit of
freeware that scans your software environment and reports modifications to your
standard browser configuration and shows all programs launched when the system
starts up. There are several web sites dedicated to describing all this garbage
software now infecting computers and how to remove it. I cannot remember the
name of the varmint in your computer, but I have removed something like it from
clients' computers in the last two weeks. Do a Google search for either the
symptoms as youv've described them or Google for some of the strangely named
programs identified by Hijackthis... Ben Myers

On Mon, 28 Jun 2004 13:27:57 -0500, "Bonnie Dyson" <johnbonn@softdisk.com>
wrote:

>Lately several times a day I'm getting a message saying "System Shutting
>Down," something about NT Authority System and RPC service terminated. Then
>the system shuts down. Can anybody enlighten me what is going on? My
>anti-virus s/w is up to date and I check often.
>
>Thanks,
>Bon
>
>

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

Bonnie;
Sounds like you caught Blaster or maybe Sasser;
Follow this:
http://www3.telus.net/dandemar/sasser.htm

--
Jupiter Jones
http://www3.telus.net/dandemar/


"Bonnie Dyson" <johnbonn@softdisk.com> wrote in message
news:FuSdnRmFO-2t_n3dRVn2jQ@www.bayou.com...
> Lately several times a day I'm getting a message saying "System
Shutting
> Down," something about NT Authority System and RPC service
terminated. Then
> the system shuts down. Can anybody enlighten me what is going on?
My
> anti-virus s/w is up to date and I check often.
>
> Thanks,
> Bon

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

"Bonnie Dyson" <johnbonn@softdisk.com> wrote:

>Lately several times a day I'm getting a message saying "System Shutting
>Down," something about NT Authority System and RPC service terminated. Then
>the system shuts down. Can anybody enlighten me what is going on? My
>anti-virus s/w is up to date and I check often.


Yea, Blaster worm...

Gateway actually has a pretty good info page about this one...

http://support.gateway.com/s/issues/2-976684501.shtml

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

If memory serves me well (a dubious possibility), the Symantec web site has a
free download to remove the stinking Blaster worm... Ben Myers

On Tue, 29 Jun 2004 02:23:36 -0500, Jeff S <jeffs210@NOSPAMsio.midco.net> wrote:

>"Bonnie Dyson" <johnbonn@softdisk.com> wrote:
>
>>Lately several times a day I'm getting a message saying "System Shutting
>>Down," something about NT Authority System and RPC service terminated. Then
>>the system shuts down. Can anybody enlighten me what is going on? My
>>anti-virus s/w is up to date and I check often.
>
>
>Yea, Blaster worm...
>
>Gateway actually has a pretty good info page about this one...
>
>http://support.gateway.com/s/issues/2-976684501.shtml
>
>

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

Thank you all so much!

Bon

Archived from groups: alt.sys.pc-clone.gateway2000 (More info?)

On Mon, 28 Jun 2004 13:27:57 -0500, Bonnie Dyson <johnbonn@softdisk.com> wrote:
> Lately several times a day I'm getting a message saying "System Shutting
> Down," something about NT Authority System and RPC service terminated. Then
> the system shuts down. Can anybody enlighten me what is going on? My
> anti-virus s/w is up to date and I check often.

Sounds very much like Blaster or similar worms, which exploited an open
Windows port without even having to open any e-mail. A co-worker got that
at home. Some of those worms do something to deactivate your virus
protection. For example see
http://securityresponse.symantec.com/avcenter/venc/data...

--
David Efflandt - All spam ignored http://www.de-srv.com/