XP error message causing shutdown and restart

Jim Albright wrote:

> You have a virus! Get a good virus checker and have it remove this.
> Jim
> "Sharon" <anonymous@discussions.microsoft.com> wrote in message
> news:078101c3c8c1$a2055e50$a001280a@phx.gbl...

>> I just bought a new hard drive for a PIII computer and
>> installed it. I originally put in Win98 2nd ed since I
>> had originally had that on the computer with an upgrade to
>> XP. When I "upgraded", I noticed that the instructions
>> said I could do a "new" installation if I didn't want to
>> keep existing files and personalized settings and would
>> allow me to choose a file system (NTFS) so that's what I
>> did. Everything seemed fine. I installed MSN dial-up so
>> I could download updates to XP and that's when it seemed
>> the trouble started. I got an error message in a box
>> which said..."this shutdown was initiated by NT
>> Authority\System....windows must now shut down because
>> Remote Procedure Call (RPC) service terminated unexpectedly
>> ....the shutdown and restart then starts automatically
>> after 60 seconds (I think). I now find that MSN doesn't
>> seem to have anything to do with it and the computer is
>> now showing the error immediately when the restart
>> completes and, of course, the cycle starts again. I hope
>> someone can help me (I'm sending this message by way of my
>> laptop). Please note that XP does not allow me to access
>> anything else when it gives this error and begins the
>> shutdown and restart. Thanks.

Here's a little more info. Credit goes to Ken Blake
I just did a cut and paste.

gls858
You have the MSBlaster worm. To remove it, do the following:

The following instructions are in three parts

1. Stop it from running

2. Remove it from your system

3. Make sure it doesn't come back



Before beginning, if you have an always-on internet connection,
it's a good idea to disconnect it.



1. Stop it from running

Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
Processes tab, click msblast.exe and then "End process." Reply
"Yes" to the warning message that comes up.

This stops the worm from running, so your system will not shut
down. However, it doesn't remove it, and if that's all you do, it
will start up again the next time you boot.


***

2. Remove it from your system

a. Start the registry editor program, regedit, by going to Start

> Run, and typing REGEDIT

Navigate to HKEY_Local_Machine\Software\Microsoft\Windows\Curr ent
Version\Run by clicking the plus signs next to each of the
folders in the left hand pane. When you get to the last of them,
Run, click the word Run itself.

Find an entry called "Windows Auto Update" on the right side.
Right-click it and delete it.

b. Do a Windows search for msblast, and delete all files found.

The worm is now gone, and won't start again the next time you
boot. But if that's all you do, you can get reinfected just as
you did the first time.

***


3. Make sure it doesn't come back

a. Make sure you're running a firewall that prevents worms like
this from getting in. You can enable the built-in Windows XP
firewall, or download and install another one such as the free
version of ZoneAlarm. To enable the built-in firewall, go to
Control Panel, double-click Networking and Internet Connections,
then click Network Connections. Right-click your connection, then
click Properties, and on the Advanced tab, click the option
"Protect my computer and network..."


b. If you've disconnected your internet connection, reconnect it.
Download and install the Microsoft patch at
http://download.microsoft.com/downlo...80-x86-ENU.exe

That will remove the vulnerability that the worm exploits.


c. Be sure you are running an anti-virus program, and that you
regularly download the latest updated virus definitions.

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

thanks for the advice, however, when I go to the task
manager, msblast doesn't appear but mslaugh does and even
when I end the task, the shutdown and restart still takes
place and, of course, it is back in the processes list
when it restarts. I am will to fdisk the hard drive and
start over if this will resolve the problem. If so, can
you tell me the process for that. Thanks, again.
Sharon

>-----Original Message-----
>Jim Albright wrote:

>> You have a virus! Get a good virus checker and have it

remove this.

>> Jim
>> "Sharon" <anonymous@discussions.microsoft.com> wrote in

message

>> news:078101c3c8c1$a2055e50$a001280a@phx.gbl...

>>> I just bought a new hard drive for a PIII computer and
>>> installed it. I originally put in Win98 2nd ed since I
>>> had originally had that on the computer with an

upgrade to

>>> XP. When I "upgraded", I noticed that the instructions
>>> said I could do a "new" installation if I didn't want

to

>>> keep existing files and personalized settings and would
>>> allow me to choose a file system (NTFS) so that's what

I

>>> did. Everything seemed fine. I installed MSN dial-up

so

>>> I could download updates to XP and that's when it

seemed

>>> the trouble started. I got an error message in a box
>>> which said..."this shutdown was initiated by NT
>>> Authority\System....windows must now shut down because
>>> Remote Procedure Call (RPC) service terminated

unexpectedly

>>> ....the shutdown and restart then starts automatically
>>> after 60 seconds (I think). I now find that MSN

doesn't

>>> seem to have anything to do with it and the computer is
>>> now showing the error immediately when the restart
>>> completes and, of course, the cycle starts again. I

hope

>>> someone can help me (I'm sending this message by way

of my

>>> laptop). Please note that XP does not allow me to

access

>>> anything else when it gives this error and begins the
>>> shutdown and restart. Thanks.

>
>Here's a little more info. Credit goes to Ken Blake
>I just did a cut and paste.
>
>gls858
>You have the MSBlaster worm. To remove it, do the

following:

>
>The following instructions are in three parts
>
>1. Stop it from running
>
>2. Remove it from your system
>
>3. Make sure it doesn't come back
>
>
>
>Before beginning, if you have an always-on internet

connection,

>it's a good idea to disconnect it.
>
>
>
>1. Stop it from running
>
>Press Ctrl-Alt-Delete to bring up the Task Manager, then

on the

>Processes tab, click msblast.exe and then "End process."

Reply

>"Yes" to the warning message that comes up.
>
>This stops the worm from running, so your system will not

shut

>down. However, it doesn't remove it, and if that's all

you do, it

>will start up again the next time you boot.
>
>
>***
>
>2. Remove it from your system
>
>a. Start the registry editor program, regedit, by going

to Start

>> Run, and typing REGEDIT

>Navigate to

HKEY_Local_Machine\Software\Microsoft\Windows\Curr ent

>Version\Run by clicking the plus signs next to each of the
>folders in the left hand pane. When you get to the last

of them,

>Run, click the word Run itself.
>
>Find an entry called "Windows Auto Update" on the right

side.

>Right-click it and delete it.
>
>b. Do a Windows search for msblast, and delete all files

found.

>
>The worm is now gone, and won't start again the next time

you

>boot. But if that's all you do, you can get reinfected

just as

>you did the first time.
>
>***
>
>
>3. Make sure it doesn't come back
>
>a. Make sure you're running a firewall that prevents

worms like

>this from getting in. You can enable the built-in Windows

XP

>firewall, or download and install another one such as the

free

>version of ZoneAlarm. To enable the built-in firewall, go

to

>Control Panel, double-click Networking and Internet

Connections,

>then click Network Connections. Right-click your

connection, then

>click Properties, and on the Advanced tab, click the

option

>"Protect my computer and network..."
>
>
>b. If you've disconnected your internet connection,

reconnect it.

>Download and install the Microsoft patch at
>http://download.microsoft.com/download/9/8/b/98bcfad8-

afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

>
>That will remove the vulnerability that the worm exploits.
>
>
>c. Be sure you are running an anti-virus program, and

that you

>regularly download the latest updated virus definitions.
>
>--
>Ken Blake - Microsoft MVP Windows: Shell/User
>Please reply to the newsgroup
>
>
>.
>

> thanks for the advice, however, when I go to the task

> manager, msblast doesn't appear but mslaugh does and even
> when I end the task, the shutdown and restart still takes
> place and, of course, it is back in the processes list
> when it restarts. I am will to fdisk the hard drive and
> start over if this will resolve the problem. If so, can
> you tell me the process for that. Thanks, again.
> Sharon

>> -----Original Message-----
>> Jim Albright wrote:

>>> You have a virus! Get a good virus checker and have it remove this.
>>> Jim
>>> "Sharon" <anonymous@discussions.microsoft.com> wrote in message
>>> news:078101c3c8c1$a2055e50$a001280a@phx.gbl...
>>>> I just bought a new hard drive for a PIII computer and
>>>> installed it. I originally put in Win98 2nd ed since I
>>>> had originally had that on the computer with an upgrade to
>>>> XP. When I "upgraded", I noticed that the instructions
>>>> said I could do a "new" installation if I didn't want to
>>>> keep existing files and personalized settings and would
>>>> allow me to choose a file system (NTFS) so that's what I
>>>> did. Everything seemed fine. I installed MSN dial-up so
>>>> I could download updates to XP and that's when it seemed
>>>> the trouble started. I got an error message in a box
>>>> which said..."this shutdown was initiated by NT
>>>> Authority\System....windows must now shut down because
>>>> Remote Procedure Call (RPC) service terminated unexpectedly
>>>> ....the shutdown and restart then starts automatically
>>>> after 60 seconds (I think). I now find that MSN doesn't
>>>> seem to have anything to do with it and the computer is
>>>> now showing the error immediately when the restart
>>>> completes and, of course, the cycle starts again. I hope
>>>> someone can help me (I'm sending this message by way of my
>>>> laptop). Please note that XP does not allow me to access
>>>> anything else when it gives this error and begins the
>>>> shutdown and restart. Thanks.

>>
>> Here's a little more info. Credit goes to Ken Blake
>> I just did a cut and paste.
>>
>> gls858
>> You have the MSBlaster worm. To remove it, do the following:
>>
>> The following instructions are in three parts
>>
>> 1. Stop it from running
>>
>> 2. Remove it from your system
>>
>> 3. Make sure it doesn't come back
>>
>>
>>
>> Before beginning, if you have an always-on internet connection,
>> it's a good idea to disconnect it.
>>
>>
>>
>> 1. Stop it from running
>>
>> Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
>> Processes tab, click msblast.exe and then "End process." Reply
>> "Yes" to the warning message that comes up.
>>
>> This stops the worm from running, so your system will not shut
>> down. However, it doesn't remove it, and if that's all you do, it
>> will start up again the next time you boot.
>>
>>
>> ***
>>
>> 2. Remove it from your system
>>
>> a. Start the registry editor program, regedit, by going

> to Start

>>> Run, and typing REGEDIT

>> Navigate to

> HKEY_Local_Machine\Software\Microsoft\Windows\Curr ent

>> Version\Run by clicking the plus signs next to each of the
>> folders in the left hand pane. When you get to the last of them,
>> Run, click the word Run itself.
>>
>> Find an entry called "Windows Auto Update" on the right side.
>> Right-click it and delete it.
>>
>> b. Do a Windows search for msblast, and delete all files found.
>>
>> The worm is now gone, and won't start again the next time you
>> boot. But if that's all you do, you can get reinfected just as
>> you did the first time.
>>
>> ***
>>
>>
>> 3. Make sure it doesn't come back
>>
>> a. Make sure you're running a firewall that prevents worms like
>> this from getting in. You can enable the built-in Windows XP
>> firewall, or download and install another one such as the free
>> version of ZoneAlarm. To enable the built-in firewall, go to
>> Control Panel, double-click Networking and Internet Connections,
>> then click Network Connections. Right-click your connection, then
>> click Properties, and on the Advanced tab, click the option
>> "Protect my computer and network..."
>>
>>
>> b. If you've disconnected your internet connection, reconnect it.
>> Download and install the Microsoft patch at
>> http://download.microsoft.com/download/9/8/b/98bcfad8-

> afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

>>
>> That will remove the vulnerability that the worm exploits.
>>
>>
>> c. Be sure you are running an anti-virus program, and that you
>> regularly download the latest updated virus definitions.
>>
>> --
>> Ken Blake - Microsoft MVP Windows: Shell/User
>> Please reply to the newsgroup
>>
>>
>> .

Did you follow ALL of the instruction above carefully.
If not you will be re-infected after booting up and
accessing the net.

gls858

See if the information below resolves it:
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32-bit patch if you are running XP.

Kelly's script kills all known variants.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Michael Solomon MS-MVP
Windows Shell/User
Backup is a PC User's Best Friend
DTS-L.Org: http://www.dts-l.org/

"Sharon" <anonymous@discussions.microsoft.com> wrote in message
news:078101c3c8c1$a2055e50$a001280a@phx.gbl...

>I just bought a new hard drive for a PIII computer and
> installed it. I originally put in Win98 2nd ed since I
> had originally had that on the computer with an upgrade to
> XP. When I "upgraded", I noticed that the instructions
> said I could do a "new" installation if I didn't want to
> keep existing files and personalized settings and would
> allow me to choose a file system (NTFS) so that's what I
> did. Everything seemed fine. I installed MSN dial-up so
> I could download updates to XP and that's when it seemed
> the trouble started. I got an error message in a box
> which said..."this shutdown was initiated by NT
> Authority\System....windows must now shut down because
> Remote Procedure Call (RPC) service terminated unexpectedly
> ....the shutdown and restart then starts automatically
> after 60 seconds (I think). I now find that MSN doesn't
> seem to have anything to do with it and the computer is
> now showing the error immediately when the restart
> completes and, of course, the cycle starts again. I hope
> someone can help me (I'm sending this message by way of my
> laptop). Please note that XP does not allow me to access
> anything else when it gives this error and begins the
> shutdown and restart. Thanks.