"This system is shutting down" ERROR!

[precjednik]

Recently, iI try to optimize my system for video editing (analog capturing and encoding), so I follow instructions from some Web pages related to this problem.
Basicly, I managed to increase performance in this field. I'm now able to capture in full res without any problems (droped frames ...)
But...
Another problem appeared. Probably related to some disabled service (I turned them almost all :), at least those "irelevant" ones.).

This is message after copule of minutes after booting WindowsXP.
Please have a look. Anibody know what's going on?
"Remote Procedure Call (RPC)" service are set to automatic by default ?!

Sucks ass :(
I cant' post attachments so I'll have to write down the error message:

"This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: 00:00:59

Message:
Windows must restart because the Remote Procedure Call (RPOC) service terminated unexpectedly"

It took me 5 times to write this down because of multiple random shutdowns :(
Please Help!
Thanx for all your help!

[vorbis]

i'm pretty sure this is a virus. A friend's pc generated a RPC terminated error when he launched IE. He thinks it was XP protecting against a worm. Don't know much more than that about it. I think the virus files are in the System32 directory. Will ask him about it when i see him.

[precjednik]

Wow, you are just to fast with your reply, thnx!
The mesaage is running now... i have to be quick iiia...

Thanx for help, i'll restart and continue

EDIT:
OK, I manage to log on succesfuly so I'll provide links to the error pictures

ERROR1 (http://web.vip.hr/precjednik.vip/Video/error.jpg)

and the folloving one just appeared:

ERROR2 (http://web.vip.hr/precjednik.vip/Video/error2.jpg)

Sorry for all gramatical and spelling errors, I'm not english native speaker :D

[mrlipring]

this has been all over the news, i'm surprised you haven't heard about it. it's causing havoc across the net.

dunno any urls, but a quick google should help you no probs, or check the register or something. easy to fix, don't worry. :)

[precjednik]

Originally posted by mrlipring
this has been all over the news, i'm surprised you haven't heard about it. it's causing havoc across the net.

dunno any urls, but a quick google should help you no probs, or check the register or something. easy to fix, don't worry. :)

Well, I'm at work ATM. I haven't heard anything about it, till now. THX!
Some quick google search resulted in following link:
http://vil.nai.com/vil/content/v_100547.htm

There is explained everything, wow... I can't belive, I haven't had any of virus related problem till now. Honestly! I haven't had anti-virus software either. (Except MANY years ago, anybody remember "good old" AMIGA viruses "Lamer extreminator", "Joshua" etc :) :) :) :) )
Probably I was just lucky :)

[Zhnujm]

Originally posted by precjednik
(Except MANY years ago, anybody remember "good old" AMIGA viruses "Lamer extreminator", "Joshua" etc :) :) :) :) )

i even dont know anymore how many bootblocks were overwritten by these fu..... viruses and so destroyed my favorite game disks :D

[precjednik]

Originally posted by Zhnujm
i even dont know anymore how many bootblocks were overwritten by these fu..... viruses and so destroyed my favorite game disks :D

In fear to be more than offtopic, can you remember the name of ultra popular virus thosedays in Amiga, manifesting only as some kind "guru meditation" mode?. C*** or something... some numbers...

Sory for offtopic, I was in some discusion with my old friend and no one seems to remember it's name.

Nevermind, thx all for your help!

[Zhnujm]

no, sorry, to long ago...
but wasnt the guru meditation itself a virus created by commodore ? :D
maybe theres an amiga virus database on the net, so we can try them in an emulator ;)

[precjednik]

Originally posted by Zhnujm
no, sorry, to long ago...
but wasnt the guru meditation itself a virus created by commodore ? :D
maybe theres an amiga virus database on the net, so we can try them in an emulator ;)

Ah, I know what you mean :) Yes you can call it comodore virus :D but there was another one, not dangerous, which displays something in this "guru meditation" mode/window (whatewer) at bootup or restart (i don't remember. Something like, "blah blah ... copying is piracy".

Some anti-piracy virus. It was very funy, sort of, these days, ah...
I'm pretty sure I have it on more than hundred disks I have somevhere in my baseroom.

It's some kind antique to me.

I will surely made T-shirt with this guru meditation stuff, one of the reason I asked for information.

Cheers!

EDIT:

:)) something like this, isn't it nice

Only AMIGA fans! (http://web.vip.hr/precjednik.vip/Avatar/gurumeditation.gif)

[Zhnujm]

ahhh, much more flair than a simple blue screen. :)

was it that text:
a computer virus is a disease terrorism is a transgression software piracy is a crime this is the cure BGS9 Bundesgrenzschutz Sektion 9 Sonderkommando "EDV"

then its the BGS 9 Virus
http://home4.inet.tele.dk/vht-dk/amiga/desc/txt/bgs9-1.htm

i coudnt believe theres really a database with list most viruses with a detailed explanation:
http://home4.inet.tele.dk/vht-dk/amiga/desc/all.htm

[precjednik]

Absolutely amazing :D :D :D :D
You realy made my day, thx!

Can't belive that such database exist either. It realy deserves place in my bookmark, at least for old days sake.

I'm no longer upset for being far offtopic :) :)

[sarahjh69]

this is a virus called MSBLAST

[precjednik]

Originally posted by sarahjh69
this is a virus called MSBLAST

Yeah, I didn't know that at first. It was suprise to me cause I don't use any of Microsoft products (IE, Outlook... except OS :)).
Last two days it's all over the headlines here in Croatia.

[TactX]

Look into winnt\system32 for files called "msblast.exe" "penis32.exe" and "teekids.exe". If any of these exist, you are infected. Get removal tools from symantec, sophos or trendmicro and get the fix for the RPC-bug to make sure you'll not be infected in the future.

[precjednik]

Originally posted by TactX
Look into winnt\system32 for files called "msblast.exe" "penis32.exe" and "teekids.exe". If any of these exist, you are infected. Get removal tools from symantec, sophos or trendmicro and get the fix for the RPC-bug to make sure you'll not be infected in the future.

Already solved, manualy. There's no need for AV when there is regedit and Total Commander ;)