win xp shuts off after 5 .authority nt/system message

the message authority nt/system somes on and starts process of shutoff after beeing on the web about 5 minutes any suggestions

Do you have Broadband or dialup?

Which ever you have make sure that before you start your machine you disconnect either the modem, cat 5 or usb router cable from your PC, this is purley a precaution.

1. Once this is done start your machine.

2. Once started, click start -> Run -> and type "services.msc" without the quotes, locate the [i]Remote Procedure Call (RPC)[/i] service,

3.plug your modem, cat 5 or usb router cable back in and monitor the service.

4. When you the recieve the error your getting check that the service is still running.

If the service has ceased to run your PC is infected by the a virus that expoilts a vunerability in the RPC service.

A patch can be downloaded from the microsoft web site.

If the service is still running then you should check your event log by accessing computer management or by running eventvwr.msc from Start -> run.

hope this helps.

You could hit alt + crtl + Del, go into the task manager then to the processes tab and scroll thru till you see msblaster.exe and tell it to end that process. Then you can go to the symantec web site and look for security alert. On that page of the web site there will be a removal tool and a link to the Microsoft update page with the appropriate update so the virus can't come back into your machine. While you are downloading the removal tool and the patch, keep the task manager open and running in the backround and watch to make sure the msblaster.exe doesn't start again. If it does just end the process like before till you get the patch and tool downloaded. Enjoy

// Here is the link to the removal tool and update http://securityresponse.symantec.com/av ... .tool.html

As soon as the msblaster.exe file is launch the RPC service is stopped.

Instant shut down!

actually the msblaster.exe virus would give you a minute shutdown warning I disinfected about 5 PC's that had it, the time it took to affect varied but once the NT authority message came on you had 59 secs and the computer would reboot

I stand corrected.

Just got annoyed when friends and family were phoning me every other day.

Just sent em a CD in the end with removal tool and MS patch.

A minute's not a long time but the again the removal tool is onlly a couple of K.

having the same yet completly diffrent problems. I'm getting the same prompt that says blah blah blah will shut down in 50sec due to RPC etc etc the diffrence is that I've downloaded the patch and the symantec cleaner it says I dont have the virus but it still gives me the prompt and it still shuts down. also when i try install the patch it does the extracting files routine then goes to the agreement screen in which I agree then it goes to the inspecting files screen then just dissapers i try it again it may get 1/4 inch bar of the inpecting files then it just goes away anyone have any ideas whats going on it would be great I know I have the virus becuase i went to my task manager and thier is a USER32 source under the RPC deal for everytime it restarted.thanks alot
mitch

Here is a link to help you on the USER32 RPC shutdown

http://www.overclockers.com/tips00445/index02.asp

I hope it helps

thanks for the help. I went to the link and it just gave me info on the problem and the same fix as the rest of the sites. I attempted to re apply the patch and still just disappers after I attempt to appy the patch I have been searcing for 2 days for a fix with now luck at all.any step in the right direction will be great.thanks again.
mitch

i'm getting this exact same shutdown message, but when i open task manager i cannot find the msblaster.exe running. when i try to install any virus scanner it immediately closes. also when trying to install the windows patch, that closes. i turned off the remote process call as well. do i have a known variant of this virus? is there any??? please help!

check to see if you have loader.exe running

i don't see a program called loader.exe running..[/img]

if you do, then end task on it, it is a part of the MSblaster team of variants... in fact the original variant of the msblaster self destructed on January 10th 2004 but unfortunatly the variants have not...

ok do you have the remover tool from S.A.R.C. ? located at http://www.sarc.com/ they have a removal tool there that removes all variants... as said before you may need to boot into safe mode to run that tool effectively. additionally if your not connected to the internet, you computer wont try to reboot itself... so keep that in mind as well... if you ned some time to fix it then get off the net... as in remove your connection whether it is dial up or cable modem ... unplug it! good luck

here is a picture of what is currently running...