RPC problem, windows xp shutdown cause of rpc problem

[behnood]

i have a sonylaptop with windows xp pro sp2 and auto update enable
it means that i have the latest patches and almost up to date system and norton antivirus 2003 (also up to date)
it's about 2-3 days that my system shows a message about windows will shutdown in 60sec, and starting a countdown. i learned to stop this by "shutdown -a" but i can't solve the problem. my norton antivirus 2003 finds no virus. also i used fixblast and again nothing! i tried to use system restore and i can't , cause the system restore doesn't run! also i can't connect to internet in win xp cause dial process doesn't run too. right now i installed win 2000 on another partition and use that to solve the problem.
so i have to question:
1- how i can solve this strange problem?
2- i have a backup file of my system state created by windows backup program, is it possible to restore my system by this file? (note: i can't run backup program from win xp too! it makes an error in the last step of restoring my backup file, also when i restore my system using backup program from win 200 then i can't start my system with win xp!)
regards
Reza

[snowmonkey]

This sounds like "Blaster" virus !!! here is the link to download "FixBlast" removal tool, just because your Anti virus did not catch anything does not mean you don't have virus.
http://securityresponse.symantec.com...r/FixBlast.exe

Download and launch the EXE, if "Blaster" virus is present in you computer, this will remove it.

Cheers

[behnood]

Originally Posted by snowmonkey

This sounds like "Blaster" virus !!! here is the link to download "FixBlast" removal tool, just because your Anti virus did not catch anything does not mean you don't have virus.
http://securityresponse.symantec.com...r/FixBlast.exe

Download and launch the EXE, if "Blaster" virus is present in you computer, this will remove it.

Cheers

thanks for your reply. if you read my post you will see that i used FIXBLAST with no success.
any other suggestion?

[firefighter]

Originally Posted by behnood

thanks for your reply. if you read my post you will see that i used FIXBLAST with no success.
any other suggestion?

you may have the sasser worm... http://securityresponse.symantec.com...oval.tool.html

[urbandrag0n]

First thing you can do to avoid the RPC shutdown in 60 sec thing is you can set the RPC service to auto restart on errors... worded something like that. Secondly do a start>search> for files and folders.... search for HOSTS it will be located in the %systemroot%/system32/drivers/etc folder open this file. to do so right click and do open with.... shoose notepad from the list... if you have anything other than 127.0.0.1 localhost after the first bunch of #####commented out messages take a look and see what it says..

does any of them say something like this.
127.0.0.1 symantec.com or any other antivirus prog you use...
If so this is one good bet that you have a virus.... it sets your computer to thing that your local computer is the server hosting the updates and therefore will not dl updates. I would run a free online virus scan.. also run spyware removal tools.... not sure if you already did the last one here....