Re: RPC Windows will be shut down in X secs

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 04/08/04


Date: Thu, 8 Apr 2004 01:38:15 -0700

Hi Buddy - The mind boogles - it's hard to believe that you've hear nothing
about the MS Blaster worm that has infected an estimated 6 - 8 million
computers world wide! But, evidently not, since that appears to be what you
have.

First, so that you can stay booted up long enough to follow the rest of the
directions:

Go to Start/Run and type in: services.msc. Scroll down to Remote Procedure
Call (RPC)/Recovery/First Failure/Restart the Service (instead of Restart
the Computer which it probably is now).

Now, download this script and execute it (courtesy of Kelly site here:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc):
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs After it's cleaned
up your machine of any of the five currently know variants of this worm, it
will ask you if you want to download the necessary patch to keep from being
re-infected. Say yes and then download and install this patch, 823980,
directly available also here: http://tinyurl.com/ir5h For safety's sake,
after you install the patch and re-boot, RE-RUN the msblast.vbs file to
clean up any infection that you just might have gotten between your first
clean up and installing the patch.

Note that the MSBlast worm is not the only thing that can attack your
machine in this particular fashion, and it's important that you install a
firewall which blocks certain specific ports. There's good information here
about this worm and a specific section about obtaining and installing a
firewall: http://www.microsoft.com/security/incident/blast.asp#steps

Follow these directions, and post back please with your results/problems.

-- 
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
 In news:1a1bd01c41d43$ae429530$a101280a@phx.gbl,
Buddy in trouble <koendebudt@hotmail.com> typed:
> Hi, dear Microsoft XP users,
>
> i have an irritating problem, that prevents me from
> lifelong surfing when using XP. after being connected, it
> often occurs that a small window appears, telling me
> windows will be shut down in x secs, due to RPC (or RCP, i
> don't know by heart).
>
> does anybody of you know this problem and how to avoid it?
> i strongly hope someone can help me and surfing the
> internet can be a pleasure and not some cause for being
> angry with the screen before me.
>
> thanks a lot
> with kind regards
> Buddy in trouble


Relevant Pages

  • Re: Hope this may be of some help to those with coolwebsearch issues
    ... Heck if I could get you the install date you could then doubt I was infected and ask me to prove that. ... That is a pretty old patch. ... If its true that there are other pathways for infection ... That will fix the Windows Media Player 9 whose executable is replaced by this worm. ...
    (microsoft.public.win2000.general)
  • Re: Hope this may be of some help to those with coolwebsearch issues
    ... Heck if I could get you the install date you could then doubt I was infected and ask me to prove that. ... That is a pretty old patch. ... If its true that there are other pathways for infection ... That will fix the Windows Media Player 9 whose executable is replaced by this worm. ...
    (microsoft.public.security)
  • Re: removing w32/sdbot.worm.gen
    ... Time to blow it away and start a new install. ... boot the Windows 2000 install CD-Rom or setup disks. ... because of the worm or something I dont know. ... the infection I cannot go to that Windows update site. ...
    (microsoft.public.win2000.general)
  • Re: Worm patch wont work
    ... > I have tried to download the worm patch for XP. ... If Automatic Updates are configured, or when you attempt to install updates, ... You cannot install some updates. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: virus from microsoft?
    ... this worm after your system has been infected is not a simple task.]] ... the hotlinks in this message are valid Microsoft links, ... You install a good antivirus program, keep it active, keep the virus ... you can proof your system against infection, ...
    (microsoft.public.security.virus)