RPC Service shutting down immediately in XP

[Feanor727]

Well, my problem is as described above. Basically, I start my system, Windows XP loads, and then a system shutdown is immediately initiated by NT Authority because the RPC Service has been terminated. Any help would be _greatly_ appreciated. I really don't want to have to reinstall windows...

 

[n0cmonkey]

Make sure you are behind a firewall. Make sure all of your XP updates are installed. Don't get on the net without these protections again. Thanks!

 

[Feanor727]

Check (affirmative) on both. There was a period of about 30 minutes where I disabled the firewall to do some remote connection work (before this problem set in), but the problem continues despite re-enabling it...

Any ideas on fixing it?

EDIT: Thanks for the response, btw.

 

[n0cmonkey]

The only time I've seen this type of behaviour is with msblaster, or one of the worms that was out at the same time.

EDIT: Try booting up without a network connection and see if the problem still exists. Try safemode to see if you can find some logs.

 

[JustMike]

This is the now classic RPC exploit. Patch your system, run a virus scan and then put it back on the network. You have a virus!

 

[Feanor727]

Many thanks for the help! I must sound like a terrible n00b, but I'm kinda new to XP I'll give it a shot and let you know.

thanks again!

 

[InlineFive]

You have the MSBlaster virus.

For removal instructions and tools try
here.

And next time install a firewall and antivirus (if you arn't behind a router) before you plug it into the internet next time.

Cheers!

-Por

 

[TechnoPro]

Easy way to stop the shutdown process:

Start -> Run

Type "SHUTDOWN -A" (without quotes)

Click OK

Shutdown is aborted.

 

[speed01]

Patch your system.......Windows Update is there for a reason.

Speed

 

[wjsulliv]

You have a virus. Either the blaster or one of the other viruses that fed off the blaster (there was one that used the blaster to get in and then deleted blaster and did other stuff).

Find the specific virus on notrons website and download the fix. You may need to turn off automatic windows updating until you fix the virus. Windows update seemed to trigger the blaster to shut down the machine. You can also restart rpc, as described on nortons website.