Help me understand Event Viewer and Resolve issue

[Nariman]

Am using WinXP Pro SP2.
Require help to understand Event Manager and resolve the issue.

Atleast once a day my system shuts down with message : This system is shuting down. Please save all work........ The shutdown was initiated by NT AUTHORITY\SYSTEM.Message
: Windows must now restart because the Remote Procedure Call (RPC) Service terminated unexpectedly.
On opening Event Manager I find the following ERROR :


Eror Propereties.
Event : Date : 7/17/2006 Source: Userenv
Time : 2:53:39 PM. Category : None.
Type : Error Event ID : 1090
User : NT AUTHORITY\SYSTEM
Computer : Home
Description :
Windows couldn't log the RSoP (Resultant et of Policies) session status.
An attempt to connect to WMI failed. No more RSoP logging will be done for this

application of policy.
Forore information, see Help and Support Center at
http//go.microsoft.com/fwlink/events.asp

Can anyone of you computer buffs help me ?
Regards
Nariman

[kalpik]

Have a look here: http://www.eventid.net/display.asp?e...serenv&phase=1

[serendipiti]

seems like a blaster worm infection!Had it long back..there are tools availabale on the net for its removal.Google up.

[Nariman]

Hi
It is neither Sasser nor Blaster nor any otjrt work/Adware/pywre or virus. My machine is clean.
This appears to eb a windows fault.
Nariman

Originally Posted by kalpik

Have a look here: http://www.eventid.net/display.asp?e...serenv&phase=1

Thanks for the site. Tried but could not delete the files in
% SystemRoot\System32\wbem\Repository. Get message being used by someone.
Will try later in safemode.
Thanks oncemore.
Nariman