Re: rpc shutdown (MSBLAST) behaviour I haven't seen before, please help

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Kenny (hotmail_at_coldmail.com)
Date: 04/24/04 

Date: Sun, 25 Apr 2004 00:01:04 +0300

first of all go to the RPC services and set them so that the services shut
down the computer, then you will have a better chance to find the problem

Kenny
www.computerboom.net

"greenzy" <1@2.3> wrote in message news:3Kyic.247536$oR5.233853@pd7tw3no...
> Hello all,
>
> I have dealt with the blaster worm virus and it's variants several times
> recently on friends computers etc. and have been able to remove it without
> too much difficulty.
>
> However the computer I am currently working on is perplexing me.
>
> on startup get the following error which continues to pop-up
> intermittently:
> "Microsoft Visual C++ runtime library runtime error" in
> c:\windows\system32\svchost.exe
>
> I then get the rpc shutdown screen associated with the blaster worm that
> counts down till the pc shuts down, the odd thing is that I get this
whether
> the pc is connected to the network or not.
>
> If I use shutdown -a it keeps the pc from shutting down but only for a
> minute or so, the start menu doesn't load and I cannot move files, view
> properties or change settings, all I can really do is use the run box to
run
> programs
>
> If I attempt to patch the computer I get the runtime error mentioned above
> and the installer hangs.
> If I run a blaster removal tool (I have tried several) it scans the
computer
> (for which I have to sit there to constantly shutdown the "rpc countdown
> screen", fun on a 120GB HD) and reports that it found no virus
>
> safe mode gives the same results
>
> I mounted the HD on another pc and scanned it, it found several copies of
> the "chemserv" virus and deleted them along with a trojan. I then put the
HD
> back in the original pc, booted it and am observing the exact same
behavior
>
> So basically I am completely unable to find a way to patch this or even
> determine what is wrong at this point
>
> While I am getting the rpc countdown screen, which I associate with
blaster,
> the other problems I am seeing are not ones I have run into when dealing
> with blaster before
>
> Any help very greatly appreciated
>
> Jim Greenz
>
>
>

Relevant Pages

  • Re: XP Firewall and blaster worm
    ... > interface which listens to RPC without properly checking ... XP ICF will block the probes to TCP port 135 ... > blaster typically gains access to RPC (and I had my port ... > reason for accepting the patch at some point down the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: BSOD Kernel_data_inpage_error win32k.sys
    ... usually the RPC shutdown is due to Blaster. ... Have you already run AdAware and Spybot? ... Blaster Security Patch: ...
    (microsoft.public.windowsxp.general)
  • Re: XP Firewall and blaster worm
    ... posts wherein the patch didn't actually install, ... "Is there any way blaster can connect to my TCP port 135 if it ... > interface which listens to RPC without properly checking ...
    (microsoft.public.windowsxp.security_admin)
  • Re: BSOD Kernel_data_inpage_error win32k.sys
    ... If you would have put RPC in your google search you would have found the ... Download the Blaster Security Patch at: ... Download AdAware & Spybot S & D: ... Run the Security Patch you downloaed earlier. ...
    (microsoft.public.windowsxp.general)
  • Re: SBS2003 Outlook HTTP/RPC not working
    ... You've rerun the CEICW and you've gone into connectcomputer and you've followed the Outlook over http instructions on the workstation? ... Painstakingly going through all of the manual verification and diagnostics documented in every KB article I found on the subject including the document "Microsoft Exchange Server 2003 RPC over HTTP Deployment ... Again, other than telling me the obvious that it does not connect to the RPC services, it reveals nothing of substance. ...
    (microsoft.public.windows.server.sbs)