Remote Procedure Call (RPC)...

[V]

I just bought a New computer and there is something
screwy going on with it. after some time (no identifiable
pattern) an error message shows up telling me that a
shutdown was initiated by NT Authority/System and
that "Windows must be restarted because the Remote
Procedure Call (RPC) service terminated unexpectedly". it
then counts down from 60 and then restarts... what is
going on here? thanks for all your help!

 

[Rob Schneider]

Old news. You hooked the computer to the internet without adequate
security (a firewall) and without the getting updates. Your machine is
infected with the Blaster Worm.

See www.microsoft.com/blaster for info about what to do.

Hope this is useful to you. Let us know.

rms

 

[Jose]

Greetings :
You have the MSBLASTER/LOVSAN virus follow this instructions to remove it
from your system.


1. Disconnect the infected computer from the Internet and any network.
2. On a different computer, download the Blaster removal script from
www.kellys-korner-xp.com/xp_tweaks.htm, Line 257, Left Column, Remote
Procedure Call Worm and save the file to a diskette or burn it to a
CDROM.
3. On that same computer go to
http://support.microsoft.com/?kbid=823980 and download the security
patch for Windows XP and save it to a diskette (it will fit on the
same diskette as the script in item 2.
4. Start up the infected computer and insert the diskette. Open
Windows Explorer or My Computer and double click on Drive A: to show
the contents of it. Double click on the script file to run it. That
will clean the Blaster off the computer.
5. Double click on the patch file to install it. You are now
protected from this particular virus.
6. Open Control Panel - Network Connections. Right-click on the icon
for your Internet Connection and select Properties. Go the Advanced
tab and click on the checkbox for the Internet connection firewall to
activate it. Click on Apply and OK as needed to exit.

It is now safe to put that computer back onto the Internet and/or
network.

You now need to take *immediate* action to update your antivirus
software and do a complete virus scan of the computer.

Good luck


Ron Martell Duncan B.C. Canada

 

[Marc Reynolds [MSFT]]

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see these links:

http://www.microsoft.com/downloads/...8b-fe98-493f-ad76-bf673a38b4cf&displaylang=en

http://support.microsoft.com/?kbid=826955

http://www.microsoft.com/security/incident/blast.asp

http://www.microsoft.com/security/protect/main.asp


--

Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH