Patching a New XP Installation via the Internet
Before you connect your new Windows XP to the Internet, you should enable your internect connection firewall and install an antivirus program. If you don't have these installed or active, you may find that any one of thousands of infected PC's on the Internet will burden you with one of a number of worms that will cause "NT Authority\system" shutdown via "Remote Procedure Call" (RPC) and your system will commence shutdown. Take these steps to stay online long enough to patch your XP.
"NT
Authority\system" Shutdown
Select Run from the start menu and enter "shutdown -a" when the next RPC countdown has commended. This will abort the shutdown process and allow you to stay online.
IMPORTANT: This error indicates that your system is infected. You should take the additional steps listed later to remove the worm.
Download Two
Patches Immediately
Security Update for Windows XP (KB823980)
Security Update for Windows XP (KB824146)
Additional
Steps for Worm Removal
What You Should Know
About the Blaster Worm and its Variants
http://www.microsoft.com/security/incident/blast.asp
W32.Blaster.Worm
or Lovesan
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
W32.Blaster.Worm
Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
W32.Welchia.Worm or
Nachi
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
W32.Welchia.Worm
Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
McAfee
AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger
"Stinger is a stand-alone utility used to detect and remove specific viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system."
Additional resources can be found on this website here:
Revision Date: 4 Apr 2004