remote procedure call service terminated

[Matt Harrell]

I have a new PC with Windows XP Home. At random times
while connected to the internet, I get a message saying
the computer must shut down because the Remote Procedure
Call (RPC) service terminated unexpectedly. It gives no
error code, but does show a countdown timer that reboots
the pc after it reaches 0:00. What causes this and how
do I get it to stop?

 

[Ray at]

Here are some suggestions:
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.
Keep your computer up-to-date.

http://www.microsoft.com/security/incident/blast.asp

Ray at home

 

[Mark]

This issue is caused by the W32.Blaster.Worm, which
attempts to download and run the Msblast.exe file on
systems using Windows XP.

The "Blaster Virus" is affecting the entire personal
computer industry
and may impact any computer system running Microsoft
Windows XP or
Windows 2000.

The worm can exploit the security vulnerability on
unprotected Microsoft
Windows XP or Windows 2000 computers.

The following information will help you resolve the error
associated
with the virus, remove the virus from your system, and
prevent the
virus from reoccurring in the future.

Use the following steps to prevent the computer from
restarting, to
remove the virus, and to prevent the virus from re-
infecting the
computer. HP does not guarantee the success of this
procedure.

NOTE: The following steps require virus scanning
software (Norton
AntiVirus or McAfee VirusScan) and that the
person logged on
have administrative privileges.

1. Click Start, Run and then type: shutdown -a

This prevents the system from automatically restarting
long enough
for you to download and install the Microsoft security
update.

2. Click OK.
3. If the "shutdown -a" command fails to keep the
computer from
restarting, use the following steps:

a. Click Start, Run, and then type: services.msc

A Services window appears.

b. Click OK.
c. Double-click Remote Procedure Call (RPC) and
select the
Recovery tab. Be careful to not use the Remote
Procedure Call
(RPC) Locator item.
d. Set the First Failure, Second Failure, and
Subsequent Failures
items to Take No Action.
e. Click OK to apply the settings.

4. Install the latest critical updates using Windows
Update. For more
information, go to the following Web sites:

* Microsoft's Security Bulletin: MS03-0266:


http://www.microsoft.com/security/security_bulletins/ms03-
026.asp

5. Remove the worm using your antivirus software. Do this
by attaining
the latest virus definitions and then performing a
scan. For more
detailed information go to the following Web sites:

* McAfee's VirusScan Web page on the W32/Lovsan.worm
virus:

http://us.mcafee.com/virusInfo/default.asp?
id=description&virus_k=100547

* Symantec's Norton AntiVirus Web page on the
32.Blaster.Worm
virus.

http://securityresponse.symantec.com/avcenter/venc/data/w32
..blaster.worm.html

NOTE: Clicking the links may give an error
indicating it is
invalid. If this occurs, copy the portion of
the address
on the second line and paste it at the end of
the address
showing in your browser.

If all went well, the computer is now clean and
protected.

6. If you used the "services.msc" command (as explained
above in
Step 3) to prevent your computer from restarting, I
recommend
that you restore your RPC recovery settings to their
original state
as follows:

a. Click Start, Run, and then type: services.msc
b. Click OK.
c. Double-click Remote Procedure Call (RPC) and
select the
Recovery tab. Be careful to not use the Remote
Procedure Call
(RPC) Locator item.
d. Set the First Failure, Second Failure, and
Subsequent Failures
items to Restart the Computer.
e. Click OK to apply the settings.

You should no longer get the error message.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH