We help IT Professionals succeed at work.

My windows shuts down unexpectedly

kanary
kanary asked
on
hello experts,

here is my problem:

when i connect to the internet, after few minute this message appears:

"This system is shutting down, plzz save all ur work in progress and log off, any unsaved changes will be lost, this shutdown was initiated by NTAUTHORITY\SYSTEM

Message:
windows must restart because the Remote Procedure Call (RPC) service terminated unexpectedly."

and it shuts down in 60 seconds.

i tried to repair the windows installation, but the problem still exists.
i opened the services to notice the RPC, it suddenly get stopped and a windows error message appears, then the message above appears.

why allllll this ?

am i getting hacked?
Comment
Watch Question

Top Expert 2008
Commented:
Greetings, kanary!
  This could be due a rash of unauthorized access. Download the latest security batch from Microsoft

Buffer Overrun In RPC Interface Could Allow Code Execution and Reboot
http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Best wishes, war1
Commented:
If your having problems with the system shutting down then do the following:
Do a ctrl alt del
Click task manager
Click processes
Kill off MSBLAST.EXE

Do a regedit
Navigate to HKLM\SOftware\Microsoft\WIndows \CurrentVersion\Run
Remove the value 'Windows update" = msblast

now apply the update. if necessary restart your PC then apply. the msblast.exe is the culprit.
Commented:
Don't mean to spam these threads with cut/paste, but I don't want to type this again:


If you don't get an opportunity to apply the patch before the PC reboots, go to start > run > services.msc.

Right click Remote Procedure Call, select Properties, then Recovery. On all three drop-down boxes in this window, select take no action. The default is set to reboot. This will give you all the time you need to update. Please note that Control Panel > System > Advanced > Startup and Recovery > uncheck Automatically Restart does not seem to work to prevent system reboot.

Good luck
Top Expert 2008

Commented:
MadonnaC,
   Thank you for confirming what we have already posted.

Author

Commented:
thx every body for ur speedy help,

gemarti  u r right, the msblast.exe is the damn culprit :))

but why did it happen suddenly yesterday, every thing was fine before?
>>but why did it happen suddenly yesterday, every thing was fine before

This worm has emerged recently.

August First week:
**************
Around the Internet, system administrators report strange "rebooting" of their Windows systems as they are being taken over remotely, and many firewall watchers report a jump in scans for port 135. This problem is especially explosive because an attacker can run a rogue program by merely sending packets to a remote machine using any one of various ports. One of these, port 135, is commonly used to send pop-up messages across a network.

Microsoft released the security patch in July and unpatched systems are only vulnerable.

in future, have the latest patches installed from:

http://windowsupdate.microsoft.com
Top Expert 2008

Commented:
>> the msblast.exe is the damn culprit :))

The RPC Vulnerabilities is the problem. If you do the patch, the worm would not hurt your computer at all.  If you get rid of the worm and do not do the patch, another worm will come on to exploit the RPC.
Top Expert 2008

Commented:
kanary,
   We have not heard from you for awhile? Did any comment help you solve your problem? Do you have any more questions? If an Expert help you, please accept his/her answer with an excellent or good grade.

Thanks, war1

Author

Commented:
OOh, sorry pals.

i splitted the points b/w the comments that helped me out.

thx every body.
Top Expert 2008

Commented:
Glad to help!