PC keeps crashing !

My PC keeps crashing. It says

"This shutdown is initiated by NT AUTHORITY/SYSTEM"

"Windows must restart because the Remote Procedure Called (RPC) terminated
unexpectedly."

I've resinstalled Windows and still it keeps happening. I don't have a
firewall installed at the moment, could this be a DOS attack ? Anyone any
idea whats going on ?

Cheers for any help

Quantum Sleep bashed at the keyboard and said :

> My PC keeps crashing. It says
>
> "This shutdown is initiated by NT AUTHORITY/SYSTEM"
>
> "Windows must restart because the Remote Procedure Called (RPC)
> terminated unexpectedly."
>
> I've resinstalled Windows and still it keeps happening. I don't have a
> firewall installed at the moment, could this be a DOS attack ? Anyone
> any idea whats going on ?
>
> Cheers for any help

Go here: http://www.tandmdigital.com/

"Groove" <(E-Mail Removed)> wrote in message
news:Xns93D4DE3D34E8Ed4v1d@194.168.222.41...
> Quantum Sleep said this...
> > I've resinstalled Windows and still it keeps happening. I don't have a
> > firewall installed at the moment, could this be a DOS attack ? Anyone
any
> > idea whats going on ?
>
> It's an attack.
> http://isc.sans.org/diary.html?date=2003-08-11
> Without a firewall you're stuffed.
> Look for a file on your system called MSBLAST.exe
> If you find it you're in trouble. Report back.

I have msblast.exe...i'm just following through with the link given by
Mcploppy as i type...

"Mcploppy ©" <(E-Mail Removed)> wrote in message
news:bh8ul9$vm8kg$(E-Mail Removed)...
>
> Quantum Sleep bashed at the keyboard and said :
>
> > My PC keeps crashing. It says
> >
> > "This shutdown is initiated by NT AUTHORITY/SYSTEM"
> >
> > "Windows must restart because the Remote Procedure Called (RPC)
> > terminated unexpectedly."
> >
> > I've resinstalled Windows and still it keeps happening. I don't have a
> > firewall installed at the moment, could this be a DOS attack ? Anyone
> > any idea whats going on ?
> >
> > Cheers for any help
>
> Go here: http://www.tandmdigital.com/

How dreadfull is that, jesus h moley.....i don't know what i'm gonna have to
do, still thinking....

Quantum Sleep said this...
> I have msblast.exe...i'm just following through with the link given by
> Mcploppy as i type...
>


C&P from "alex fraser" with thanks.~~~~~~~~~~~~~~~~~~

First find and kill the process with Task Manager (Ctrl-Shift-Esc).

Then Start->Run... "regedit" and search for "msblast". Should get you to
here: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

You should see a "windows auto update" key as mentioned in the above link,
delete the key.
Finally, search for "msblast" on your system drive and delete it.

~~~~~~~~~~ this should clear it ~~~~~~~~~~~
--
º~ dªv¡d ~º

"Groove" <(E-Mail Removed)> wrote in message
news:Xns93D4E5C95CDC3d4v1d@62.253.162.115...
> Quantum Sleep said this...
> > I have msblast.exe...i'm just following through with the link given by
> > Mcploppy as i type...
> >
>
>
> C&P from "alex fraser" with thanks.~~~~~~~~~~~~~~~~~~
>
> First find and kill the process with Task Manager (Ctrl-Shift-Esc).
>
> Then Start->Run... "regedit" and search for "msblast". Should get you to
> here: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
>
> You should see a "windows auto update" key as mentioned in the above link,
> delete the key.
> Finally, search for "msblast" on your system drive and delete it.
>
> ~~~~~~~~~~ this should clear it ~~~~~~~~~~~
> --
> º~ dªv¡d ~º

All done and dusted ! I hope lol, Ty for that fab info, i was getting to my
wits end with it ! THANK YOU !!!!!

Incidentally which newsgroup did you get this info from cos i might
subscribe myself !

Quantum Sleep said this...

> All done and dusted ! I hope lol, Ty for that fab info, i was getting to
my
> wits end with it ! THANK YOU !!!!!
>
> Incidentally which newsgroup did you get this info from cos i might
> subscribe myself !

You're welcome. The info came from a thread in uk.comp.homebuilt
Some nice people in there.


--
º~ dªv¡d ~º

Quantum Sleep said this...

> p.s. i also found the file MSBLAST.EXE-1c3A3376.pf in the folder
> C:.WINDOWS/Prefetch. Should i delete that too ?

That will not be an executable so not a problem, but it can't hurt to delete
it anyway just to keep things tidy.

--
º~ dªv¡d ~º

On Mon, 11 Aug 2003 21:30:20 +0100 and in article <bh8ud3$cv3$1
@newsg1.svr.pol.co.uk>, Quantum Sleep said...
: My PC keeps crashing. It says
:
: "This shutdown is initiated by NT AUTHORITY/SYSTEM"
:
: "Windows must restart because the Remote Procedure Called (RPC) terminated
: unexpectedly."
:
*everyone* seems to having this flaw in Windows exploited tonite! My
friend at Uni has been experiencing it all nite as well until I fixed it
for her!

The fix is available as a critical security update on windowsupdate.
--
chris

On Mon, 11 Aug 2003 22:49:43 GMT and in article <Xns93D4F2F16DCF0d4v1d@
194.168.222.41>, Groove said...
: > All done and dusted ! I hope lol, Ty for that fab info, i was getting to
: my
: > wits end with it ! THANK YOU !!!!!
: >
: > Incidentally which newsgroup did you get this info from cos i might
: > subscribe myself !
:
: You're welcome. The info came from a thread in uk.comp.homebuilt
: Some nice people in there.
:
Incidentally, this whole exploit and fix is plastered over google
groups. I don't know why people don't at least try and help themselves
first!
--
chris