Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

NT Authority / System shutdown? 11

Status
Not open for further replies.
SinisterX

SinisterX

Technical User
Jun 23, 2003
4
0
0
US
Whenever I start up windows xp about a minute later, a message appears stating this is from the NT Authority / System and that "windows must now restart because the Remote Procedure Call (RPC) terminated unexpectedly." It goes into a 50 sec. countdown and windows just restarts automatically everythime? I can't get rid of this message or this error problem. What can I do?

Thanks,
Omar
 
Sort by date Sort by votes
Interesting.

Test bedded the following.

Disconnect.

CTRL/ALT/DELETE and bring up the processes tab. Killed MSBLAST

Searched for the file MSBLAST.EXE and delete it.

Turned on the XP version of firewall.

And then connected fine without re-infection. (No reg-hack, no noughting else (it's easier to explain to moron...er customers).

Telling them to connect straight away and get the update works fine.

Maybe a problem with sygate?
 
Upvote 0 Downvote
Thx.. was planning to do just that in the morning.


You have been a great help.

THANKS !!
 
Upvote 0 Downvote
I have an idea on how to beat the 60 secs. goto Remote Procedure Call (RPC) service, click properties,goto recovery tab. On the "first failure" box, make sure it's "Restart the computer". Now click "Restart Computer Options" then key how many minutes, put as many as you want. But I'm not sure if you can solve your problem:(
 
Upvote 0 Downvote
You are welcome Yogi39 and all. It is interesting to see the evolution of this worm. Both Linney and I responded as early as August 5th to RPC failures and strange TFTP payloads. It is really impressive to watch the geometric spread of a worm over the internet.

Code Red all over again. It is a little odd because many ISPs were blocking at least 135 after the Code Red worm, and I thought still were. This of course does not absolve the user from taking firewall precautions, but it is amazing to see large managed sites effected by this MSBLAST worm. I expect to see some people fired over this one.
 
Upvote 0 Downvote
bcastner,
You mentioned TFTP.
I posted that I had two new files added to my startup folder called TFTP1800 and TFTP? can't remember the name?
Do you know why these were created?
And everyone might want to check their startup folder /all users, for these 2 files. I couldn't see them from the task manager.
Two other things to ponder...
Did you disable SystemRestore before deleting the virus?
And did you turn it back on?
And is it possible to delete the restore points prior to 8/11?
tav
 
Upvote 0 Downvote
MSBLAST comes in through TCP port 135 and initates an agent. The agent then contacts through TFTP on port 4444 to obtain a payload. (Those are the two TFTP files you see). The payload is executed to install MSBLAST.exe in c:\windows\system32, and to make the registry edit to have MSBLAST.exe run on startup. Finally the agent makes direct RPC service calls with faulty packets to force a buffer overflow. (This is what the MS security patch stops, the RPC buffer overflow). On an unpatched system the RPC buffer overflow causes a critical error and after a timeout setting (which can be changed in the properties of the RPC service) the system reboots.

The TFTP payload files are evidence that you were infected far enough for the agent to use port 4444 to receive the payload. Delete the files, but they are in a sense harmless just by themselves.
 
Upvote 0 Downvote
When should I - in the process of getting rid of this worm and downloading patches, etc. - turn off system restore? And how do I do this?

Do I have to do this, or if the other steps work, then what?

Also, how do I get to RPC and to safe mode if I need to?
 
Upvote 0 Downvote
If you have been infected, your most recent restore points are suspect. Use Start, Help and Support to access the System Restore facility and delete suspect restore points.

Remove the infection, if present.

Immediately set manually a new restore point.


To get to safe Mode you can Start, Run, MSCONFIG and enable Safe Mode on Startup and reboot; or just reboot and hit the F8 key early and often.

To modify RPC settings (not recommended) Start, Run, services.msc and double-click the Remote Procedure Call Service.
 
Upvote 0 Downvote
What should I set the restore points to????

If I just get everything cleaned up, get the patch, enable the firewall connection, etc - do I still need to mess with system restore?

If so, what should I set it to?
 
Upvote 0 Downvote
allis,
bcastner has a great thread that worked for most people.
Look at my post above (18th post).

It says first disable your system restore.
Probably in this order->
Follow his instructions for stopping msblast, editing the register and deleting the files.
(instead of using virus scan, for now look in your windows32 folder for msblast and delete, then edit the register).
Next as soon as you plug into the net Follow his link straight to the patch. (it's the quickest way there), this is the only way to beat the 59 second shutdown.
The link he gave was

Note: don't plug into the internet until your ready to download the patch.
tav
 
Upvote 0 Downvote
So welcome me to the club, I thought it won't happen to me, I'm a new member already. Lucky I'm reading this post last night that's why I'm ready.

Things that I've done:

1. unplug the NIC cable
2. delete msblast.exe
3. remove the entry in the registry
4. update svc pack for win2k pro(I got a cd version sp3), no need for XP pro.
5. reboot and applied corresponding patches from Microsoft 6. reboot again then plug back the NIC cable. All seems OK.

So that's what I did.. did I miss something
 
Upvote 0 Downvote
bcastner,

Firstly another start for you.. The truth is I've been convincing the other site to purchase a router but I can't put it in a convincing way that's why they ignore it. On my current site we have it that's why we're not affected but sadly, one of my job is to support the other site. Right now they asking get a firewall as fast as possible. I got three quotation already from different companies. Firewall companies will really benefit from this outbreak:).

I think we're not-aware/ignoring the tcp/udp filtering that comes together with tcp/ip protocol because maybe we are not sure of ports assignments that we need to filter and allow. Like HTTP is 80. smtp is 25, pop3 is 110 etc. This is the complete list
For the benefit of people wihtout a firewall, can anybody suggest what are the ports that we need to allow to connect to internet? Maybe basically first as a start?

Thanks
 
Upvote 0 Downvote
ok i cannt find msblast.exe. could someone for 1 last time summarise how to fix the shutdown problem? or even email it to me. i would really appreciate your help. im only 15 lol so coudl you try and make it a bit easier?im not computer illiterate but not a master. darthsaber88@hotmail.com for anyone who would like to lend me a hand. thanks alot
aj
 
Upvote 0 Downvote
 
Upvote 0 Downvote
Hi All, This is a GREAT thread but I believe I have a different set of circumstances that causes the fix (ANY fix) to be impossible to install. PLEASE see if you can help!!

This is for my Dad (MY system has a firewall and all Windows Updates) he's only been a computer user for 8 mos. and he's bummed...he's got an IBM NetVision 8311. IBM seems to have a software level BEFORE the Windows XP boots...something about "System Utilities". The IBM stuff comes up black screen white letters - like maybe its DOS?? Then the WXP splash screen appears for 15 - 20 sec then it goes BACK to the IBM screen. I tried to F8 to log in to safe mode but when I choose safe mode (NO networking -- and yes the network connection is physically unplugged) a big list of WINDOWS\SYSTEM32\DRIVERS scrolls across the screen then it goes back to flipping between the IBM splash screen and the WXP splash screen.

Is he screwed? Am I gonna be Formatting his hard drive soon?

Please let me know if any one has any ideas. You tek people ROCK (lets here it for the SQL folks [tongue]!)

Thanks in Advance!!!

PenelopeC
~~~>-/O~~~~~swimming right along
 
Upvote 0 Downvote
PenelopeC,

This does not sound like the msblast worm.

It sounds like bad RAM.

It does not sound like a hard disk issue.

When you see the IBM System Utilities Screen, hit F10 (I think, or try F1 and try F2) If I remember from (this is IBM laptop experience) there should be a menu appear that includes a system test utility. You want to run that utility if you can get to it.
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

hamburg18w
  • Locked
  • Question
Task Host is Stopping the Shutdown
Replies
1
Views
220
Ign3us
Ign3us
spamjim
  • Locked
  • Question
Sanitizing illegal filenames on NTFS volumes
Replies
2
Views
85
spamjim
spamjim
Thespian
  • Locked
  • Question
Transfer files and applications from a hard drive to a new system
Replies
4
Views
74
gbaughma
gbaughma
Shimmy613
  • Locked
  • Question
Systematically and safely deleting folder shortcuts seemingly to itself 1
Replies
6
Views
90
Mike Lewis
Mike Lewis
goombawaho
  • Locked
  • Question
Hang at shutdown
2
Replies
21
Views
155
edfair
edfair

Part and Inventory Search

Sponsor

Back
Top