Re: RPC message

From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 03/16/04


Date: Tue, 16 Mar 2004 01:45:55 -0800

Hi Johanne - The mind boogles - it's hard to believe that you've hear
nothing about the MS Blaster worm that has infected an estimated 500,000
computers world wide! But, evidently not, since that appears to be what you
have.

First, so that you can stay booted up long enough to follow the rest of the
directions:

Go to Start/Run and type in: services.msc. Scroll down to Remote Procedure
Call (RPC)/Recovery/First Failure/Restart the Service (instead of Restart
the Computer which it probably is now).

Now, download this script and execute it (courtesy of Kelly site here:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc):
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs After it's cleaned
up your machine of any of the five currently know variants of this worm, it
will ask you if you want to download the necessary patch to keep from being
re-infected. Say yes and then download and install this patch, 823980,
directly available also here: http://tinyurl.com/ir5h For safety's sake,
after you install the patch and re-boot, RE-RUN the msblast.vbs file to
clean up any infection that you just might have gotten between your first
clean up and installing the patch.

Note that the MSBlast worm is not the only thing that can attack your
machine in this particular fashion, and it's important that you install a
firewall which blocks certain specific ports. There's good information here
about this worm and a specific section about obtaining and installing a
firewall: http://www.microsoft.com/security/incident/blast.asp#steps

Follow these directions, and post back please with your results/problems.

-- 
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
 In news:de3401c40ae8$0cf41630$a101280a@phx.gbl,
Johanne <anonymous@discussions.microsoft.com> typed:
> Hi Guys :-)
>
> Just installed XP professional & when logging on to the
> ie6, it gives me 40s of internet access...then this
> message comes up:
>
> RPC service terminated unexpectedly
>
> NT Authority/system
>
> and XP shuts down!! How do I get my internet access to
> last longer & get rid of this error message?
>
> PS/ Also need info on how to remove W32.Blaster.Worm.
> from Win32 files too!!
>
> Cheers


Relevant Pages

  • RE: pc keeps rebooting
    ... > other similarily unprotected computers. ... Sounds like you've gotten caught by the Sasser worm. ... Install an antivirus program and keep it updated. ... Take the infected machine off the Internet and any lan immediately. ...
    (microsoft.public.windowsxp.general)
  • Re: Worm patch wont work
    ... > I have tried to download the worm patch for XP. ... If Automatic Updates are configured, or when you attempt to install updates, ... You cannot install some updates. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Security Patches will not show up in the Add & remove programs
    ... Are you saying that KB824016 installs OK on all computers? ... Patch 824016 supercedes patch 823980: ... If you are getting Nachi, you have at least two problems. ... Then install KB824016 patch on all the computers. ...
    (microsoft.public.security.virus)
  • Re: NT AUTHORITY/SYSTEM/AUTO SHUTDOWN
    ... If it installs the patch, ... >This stops the worm from running, so your system will not shut ... or download and install another one such as the free ... connection, then ...
    (microsoft.public.windowsxp.general)
  • Compass Rule Manger
    ... The errors above are caused by a known Worm Virus issue. ... patch to fix the issue for all of the effected systems ... effected Windows 2000 or Windows XP operating system. ... then download and install the MS04-011 patch from the ...
    (microsoft.public.windowsxp.security_admin)