Member Avatar for CRESTLINEJAMMER

Just installed XP pro. Installation procedure all good, no trouble. I begin to log onto the internet and do other things when I receive the following message.
SHUTDOWN WAS INITIATED BY NT AUTHORITY/SYSTEMS
message:
Windows must now restart because the RPC (Remote Procedure Call)service terminated unexpectedly.

A countdown of 1 minute starts and ultimately shuts down and re-starts my computer. Why does this happen and how can I stop it?
After re-boot the problem happens over and over again. help!
LOWTEC

  • 10 Contributors
  • 10 Replies
  • 729 Views
  • 7 Years Discussion Span
  • Latest Post Latest Post by absandbars

Dani AI

Generated

This thread describes the exact symptom that the 2003 Blaster/Lovsan family of worms caused: a one‑minute shutdown dialog that says RPC terminated unexpectedly and then the machine reboots repeatedly. was right to point toward a worm, and ’s follow‑up confirms it — the Blaster exploit used a DCOM/RPC buffer overflow and was widely documented by Microsoft and the malware community. (Microsoft: Blaster worm virus alert). (learn.microsoft.com)

Immediate priorities are containment and being able to work long enough to clean the machine: physically disconnect the PC from the network, stop the pending shutdown so the desktop is usable, and remove the running worm process before it re‑starts itself. Example quick commands that are commonly used:

shutdown -a
netstat -ano | findstr :4444
taskkill /PID <pid> /F

Then run an up‑to‑date removal tool (the Microsoft Malicious Software Removal Tool or a current AV vendor tool) and do a full scan; these tools are intended for post‑infection cleanup. If the GUI keeps restarting, boot to Safe Mode (no networking) or use a rescue/bootable scanner from a clean USB. (itprotoday.com)

After removal, patch the RPC/DCOM vulnerability (MS03‑026 and the later replacement updates such as KB824146) and enable a host firewall to block unnecessary inbound TCP/UDP ports (135/4444/69 were used by Blaster variants). Running day‑to‑day with least privilege (a non‑admin account) and keeping Windows Update active prevents re‑infection; ’s comment about reduced privileges is still good practice. (ftp.zx.net.nz)

A word on the service‑recovery idea mentioned earlier by : changing RPC service recovery actions can stop the immediate reboot but does not remove the worm and, for some core services, the recovery options may be unavailable or ineffective (certain system services run in the same process as the service controller). If tools fail or system integrity is badly damaged, back up personal data from Safe Mode or external media and consider an offline wipe/reinstall. For authoritative removal/cleanup steps and the official patch guidance, see the Microsoft guidance above. (learn.microsoft.com)

Recommended Answers

All 10 Replies

Member Avatar for CRESTLINEJAMMER

caperjack,
YES YOU WERE CORRECT. WORM. THANKS VERY MUCH FOR THE SOLUTION.
lowtec

Member Avatar for )BIG"B"Affleck

All could have been prevented by running on an account with less perms. Read BIG "B's IE forum sticky in site feedback.

Member Avatar for nju_pri245

Just installed XP pro. Installation procedure all good, no trouble. I begin to log onto the internet and do other things when I receive the following message.
SHUTDOWN WAS INITIATED BY NT AUTHORITY/SYSTEMS
message:
Windows must now restart because the RPC (Remote Procedure Call)service terminated unexpectedly.

A countdown of 1 minute starts and ultimately shuts down and re-starts my computer. Why does this happen and how can I stop it?
After re-boot the problem happens over and over again. help!
LOWTEC

Hai.

Im new to this forum.

Me to had the same problem after booting my system this error message was appear and after 1 minute my system was autometically shutdown. But now i dont have problem coz i had got the solution for this. Try this ok.


SOLUTION

To resolve this issue in Windows 2000 and XP you will need to perform the following steps:

  • Change the settings for the Remote Procedure Call (RPC) Service in order to connect to the internet without the computer shutting down

Note: This does not work in every case.
To change these settings you will need to perform the following:

  1. Right-click the My Computer icon on the Windows desktop or in the Start menu.
  2. Select Manage. The Computer Management window will open.
  3. In the left pane, double-click on Services and Applications.
  4. Select Services and a list of services should appear.
  5. In the right pane, locate the Remote Procedure Call (RPC) service, it will have a Status of "Started".

Note: This will be the first in a listing of two Remote Procedure Call (RPS) services.

  1. Right-click on the first Remote Procedure Call (RPC) service listed.
  2. Select Properties.
  3. Select the Recovery tab.
  4. Using the drop-down lists, change First failure, Second failure, and Subsequent failures from Restart the Computer to Take No Action.
  5. Click on Apply and then OK.

CAUTION: Make sure that you change these settings back after completing the final step to remove the worm.

Member Avatar for pallu

Please help

Just installed XP pro. Installation procedure all good, no trouble. I begin to log onto the internet and do other things when I receive the following message.
SHUTDOWN WAS INITIATED BY NT AUTHORITY/SYSTEMS
message:
Windows must now restart because the RPC (Remote Procedure Call)service terminated unexpectedly.

A countdown of 1 minute starts and ultimately shuts down and re-starts my computer. Why does this happen and how can I stop it?
After re-boot the problem happens over and over again. help!
LOWTEC

Member Avatar for olivershelby

windpw\system\services.exe terminated
shutdown by nt authority\system
it says code 1-

pc automatically restarts everytime turn it on, so all it does it cut off and on

Member Avatar for bobbyRanks

I use XP. I followed the instructions to change the settings for the RPC service, but when I click PROPERTIES the RECOVERY TAB does not appear. How can get back the RECOVERY TAB?

Member Avatar for Jamie101

Have same problem, followed the steps to change rpc recovery settings but everything is un-clickable(?) even though I am logged in as admin. Have also tried all sorts of other 'solutions' to this, although this seems to have the most relevance, so far these have not worked - turning off msn/windows messenger, switching off activex controls in internet explorer (also tried completely deleting explorer but it wouldnt let me), turning off automatic restart in computer>properties>advanced system settings, etc etc.

Member Avatar for P.arun

how to remove "generic host process for win32 services" virus. when i start a computer this error is coming. plz provide me a solution

Member Avatar for absandbars

I still have problem with the RCP. When i connect to the internet, download begins @ 200 kbps and since i use eset smart security 4 i check the network connections. And there i find this second svhost.exe process which has been exhaustng my free downloads. so when i try to stop the process, the dilog box appears which says "shutdown was initiated by .....Windows must now restart because the RPC (Remote Procedure Call)service terminated unexpectedly." so for temporary perposes i use the " temporarily deny communication for the process" option by eset. Please help me..
p/s i have already tried scanning the computer by the symantec for worms.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.