Re: Problems due to disabling RPC Services. Please Help

From: Herb Martin (news_at_LearnQuick.com)
Date: 02/28/04 

Date: Fri, 27 Feb 2004 23:44:17 -0600

You might boot into the Recover Console (install CDROM, choose Repair, then
recovery console) and use the "ENABLE" command.

You will likely need to first use the "ListSvc" command to get the "official
names
of the services. 

-- 
Herb Martin
"Srikanth" <anonymous@discussions.microsoft.com> wrote in message
news:B3598989-AFA0-4805-BBF9-207FA06F50CC@microsoft.com...
> Hi,
>
> I have a Windows 2000 Advanced Server installed on my laptop. My machine
was attacked by a RALEKA.B worm a couple of days ago when I connected to
internet. To recover from it, I disabled RPC Services and RPC Locator
Services from Services MMC Console. I was trying to see if disabling RPC
Services and RPC Locator services would fix the problem. When I clicked to
disable these services, "Remote Procedure Call (RPC)" window mentioned that
a group of dependent services will also be disabled. Not knowing that RPC is
a very essential service for Windows to function normally, I said Yes.
>
> After rebooting, I figured out I made a costly mistake. I had problems
restarting from that point on. However, I was able to tweak the registry
settings for the "Remote Procedure Call (RPC)" and "Remote Procedure Call
(RPC) Locator" and made sure they are set to Automatic and Manual
respectively.
>
> I fixed the worm problem, only to discover I have a different one now. I
am able to start "Remote Procedure Call (RPC) Locator" service from Services
window. But when I try to start "Remote Procedure Call (RPC)", it complains
:
>
> "Could not start the Remote Procedure Call (RPC) Service on the local
computer. Error 1058: The Service cannot be started, either because it is
disabled or because it has no enabled devices associated with it."
>
> When I try starting other services which are dependent on RPC, obviously,
they would not start either. They say "Error 1068: The dependency service or
group failed to start."
>
> Neither the property windows in Services screen open, nor do the Events
Log display windows. Everytime I start the machine (Laptop), after windows
load up, it gives me "System error &H800706BA (-2147023174). The RPC Server
is unavailable."
>
> Give this scenario, I figured if I manually restarted the RPC Sevices, it
might fix the problems. (Executed C:\WinNT\System32\svchost -k rpcss)
>
> How can I come out this mess? What do I have to do to restore all my
services normally, as I had before? I cannot connect to Internet, cannot
browse files.
>
> Would repairing the Windows OS from the Windows Advanced Server fix this
mess? Please help.

Relevant Pages

  • [NEWS] Buffer Overrun In RPCSS Service Could Allow Code Execution
    ... Remote Procedure Call (RPC) is a protocol used by the Windows operating ... There are three newly identified vulnerabilities in the part of RPCSS ... Service that deals with RPC messages for DCOM activation- ...
    (Securiteam)
  • Re: System shutdown message/system reboots
    ... Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly." ...
    (microsoft.public.windowsxp.general)
  • Re: Windows update failing
    ... Either malware is causing this, there's interference with the update servers and RPC due to a 3rd party add-on, or the entire issue was caused by Trend OR leftover files from McAfee. ... Can I download a BITS installer and overright? ... I don't think you can move system files from one Vista system to another as in previous Windows OS' due to security descriptors. ... 2/ I think I mentioned that I tried to do a BITS repair and that the repair tool advised that BITS repair was not required - sfc/scannow returns: ...
    (microsoft.public.windowsupdate)
  • Re: RPC Server is unavailible
    ... "Could not start the Remote Procedure Call (RPC) Service. ... 2004 Windows MVP "Winny" Award ... > o enabled devices associated with it. ...
    (microsoft.public.windowsxp.general)
  • [NT] Buffer Overrun in RPC Interface Could Allow Code Execution
    ... to promote the most advanced vulnerability assessment solutions today. ... Remote Procedure Call (RPC) is a protocol used by the Windows operating ... The attacker would be able to take any action on the system, ...
    (Securiteam)