# What is an RPC and why is it making my computer restart?
**URL:** https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451
**Category:** Factual Questions
**Created:** [August 11, 2003, 7:01pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451 "2003-08-11T19:01:21Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Miller](https://boards.straightdope.com/u/Miller)
#### Post date: [August 11, 2003, 7:01pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/1 "2003-08-11T19:01:21Z")
I’ve been getting this error when I turn on my computer. It started about a week agO: I turned on my computer, and after running for a few minutes, I got this message:
> [@](#):
>
> This system is shutting down. Please save all work and log off. Any unsaved changes will be lost. The shutdown was initiated by NT AUTHORITY/SYSTEM
>
> Windows must now restart because the Remote Procedure Call (RPC) was terminated unexpectedly
It gives me one minute to stop whatever I was doing, then the damn thing restarts. And once it finishes restarting, it does the whole damn thing over again. After a while, it seems to stabilize, and I can use my computer (hence this thread). It’s done this on three different days, and has worked fine on the days in between. Today, when it started doing it again, I fired up my older, backup computer to log on here and ask this, and _that_ computer started doing the same thing! Both PCs are running Windows XP.
Can anyone tell me why this is happening, how I can stop it, and who I need to kill for it happening in the first place?
---
### Author:  [@Askia](https://boards.straightdope.com/u/Askia)
#### Post date: [August 11, 2003, 7:08pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/2 "2003-08-11T19:08:48Z")
This is too funny. I just got through spending the last hour fixing this problem. Go get a security patch from here, [http://v4.windowsupdate.microsoft.com/en/default.asp](http://v4.windowsupdate.microsoft.com/en/default.asp) it’ll fix you right up.
---
### Author:  [@Daizy](https://boards.straightdope.com/u/Daizy)
#### Post date: [August 11, 2003, 7:22pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/3 "2003-08-11T19:22:02Z")
Have you got all your critical windows updates done? In particular this patch?
[http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B331953](http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B331953)
---
### Author:  [@Miller](https://boards.straightdope.com/u/Miller)
#### Post date: [August 11, 2003, 8:49pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/4 "2003-08-11T20:49:57Z")
Okay, I managed to download and install all the patches (lotsa fun when your computer won’t stay on for more than three minutes at a stretch: thank God I’ve got a fast internet connection and the files were small) and it seems to have cleared things up, at least for the moment. Thanks for the help, **Askia** and **Daizy**. I promise to name my firstborn child after both of you.
Just for the hell of it, now that the problem is fixed, can anyone explain exactly what the problem was, and what the fix did? I hate not knowing what I’ve installed on my machine.
---
### Author:  [@Horseflesh](https://boards.straightdope.com/u/Horseflesh)
#### Post date: [August 11, 2003, 9:23pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/5 "2003-08-11T21:23:15Z")
I’m told by a colleague that’s more into the ‘hacking’ world that the code was just released a few days ago to the public domain that exploits the most recent bug in MS Windows NT (all versions and flavors). [Buffer Overrun in RPC Interface.](http://support.microsoft.com/?kbid=823980)
Looks like some malevolent soul has already used the code to create a virus/trojan/worm.
---
### Author:  [@Alereon](https://boards.straightdope.com/u/Alereon)
#### Post date: [August 11, 2003, 9:30pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/6 "2003-08-11T21:30:40Z")
You have been hit by the RPC-DCOM exploit. This allows a remote user to gain administrator access to your computer by exploiting the Remote Procedure Call service, thus allowing them to install programs of their choice, access your files, or use your computer to attack remote users. You will know you’re infected when you see a message about an “NT AUTHORITY” error saying that the system will shut down in 60 seconds.
First, install the patch from Microsoft. You can download the patch and read more information at [Microsoft Technet](http://www.microsoft.com/technet/security/bulletin/MS03-026.asp).
After this is installed, go to start, run, and type in msconfig. Go to the startup tab and UNCHECK “msblaster.exe”. Restart the computer, enter safemode by pressing the F8 key before windows loads and choosing Safemode from the menu that appears, and delete msblaster.exe. This is one of the several viruses that may have been installed.
**WARNING** : It is entirely possible that other viruses or trojans could have been installed. Furthermore, there may still be keyloggers or file servers running. Keyloggers will send your passwords or any credit card data you type in to a remote user. A file server could be hosting child pornography, pirated software, or other illegal content. _I strongly suggest that you format your computer, then install the patch on a clean system BEFORE you connect it to the internet_.
---
### Author:  [@jack\_ss](https://boards.straightdope.com/u/jack_ss)
#### Post date: [August 11, 2003, 9:53pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/7 "2003-08-11T21:53:36Z")
If you’re running Xp, firewall the internet connection before you go on line to windows update. Go to Control panle/network connections, Right click the connection, properties/advanced & check the box to firewall the connection.
This will (theoretically) allow you to stay connected long enough to get the update.
---
### Author:  [@Daizy](https://boards.straightdope.com/u/Daizy)
#### Post date: [August 11, 2003, 11:33pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/8 "2003-08-11T23:33:30Z")
Keep in mind the [w32.blaster.worm](http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html)
---
### Author:  [@lezlers](https://boards.straightdope.com/u/lezlers)
#### Post date: [March 17, 2004, 6:22am UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/9 "2004-03-17T06:22:37Z")
Yes, THANK YOU everyone. I just got done fighting this, myself as well as trying to imagine what kind of soulless creature would inflict this on purpose…
---
### Author:  [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)
#### Post date: [March 17, 2004, 1:43pm UTC](https://boards.straightdope.com/t/what-is-an-rpc-and-why-is-it-making-my-computer-restart/194451/10 "2004-03-17T13:43:50Z")
It’s a combination: the patch protects you from getting infected, but the behavior is that of the Blaster worm.
You need to apply the patch, then clean the virus. Symantec has a cleaning tool here: [http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html](http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html)