Remote Procedure Call

[Lisa]

I just upgraded from ME to XP Home and I keep getting
this Remote Procedure Call (RPC service) automotic
shutdown. I will be working in a program and all of a
sudden it will begin this shutdown process. What am I
doing wrong?

Lisa

 

[Rick \Nutcase\ Rogers]

Hi Lisa,

It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

 

[Guest]

-----Original Message-----
I just upgraded from ME to XP Home and I keep getting
this Remote Procedure Call (RPC service) automotic
shutdown. I will be working in a program and all of a
sudden it will begin this shutdown process. What am I
doing wrong?

Lisa
.

 

[Guest]

-----Original Message-----
I just upgraded from ME to XP Home and I keep getting
this Remote Procedure Call (RPC service) automotic
shutdown. I will be working in a program and all of a
sudden it will begin this shutdown process. What am I
doing wrong?

Lisa
.
Lisa, I had this problem and it's not a virus...I have

had a lot of problems from people telling me that it's a
virus. All you need to do is go to
my computer>change a setting>administrative
tools>component services>services (local)

now find 'Remote Procedure Call' iun the list and click
it. Click the 'Recovery' tab and set all three settings
to 'Do Nothing'.
This should solve your problem

 

[Gracie Mae]

Lisa, I had this problem and it's not a virus...I have
had a lot of problems from people telling me that it's a
virus. All you need to do is go to
my computer>change a setting>administrative
tools>component services>services (local)

now find 'Remote Procedure Call' iun the list and click
it. Click the 'Recovery' tab and set all three settings
to 'Do Nothing'.
This should solve your problem

 

[chris_tech]

-----Original Message-----

.
I have an easier way, go to control panel from start

manu and then go to hardware. From there look to the left
and you will see system. Then go to the tab advanced, and
at the recovery section click settings and then uncheck
automatically restart. There you have it.

From,

Chris_Tech

 

[David Hurst]

You have the Blaster Worm virus .

Go to this website to learn how to disinfect the virus on your computer .

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[Ronnie Vernon MVP]

Lisa, I had this problem and it's not a virus...I have
had a lot of problems from people telling me that it's a
virus. All you need to do is go to
my computer>change a setting>administrative
tools>component services>services (local)

now find 'Remote Procedure Call' iun the list and click
it. Click the 'Recovery' tab and set all three settings
to 'Do Nothing'.
This should solve your problem

Gracie

Sorry, but it really is a virus. The procedure you describe here will only
stop the RPC Service from shutting down, it will not clean the virus. If you
have had this problem and you did not clean the virus from your system, then
your machine is likely spreading the virus to other computers. Read here:

What You Should Know About the Blaster Worm and Its Variants:
http://www.microsoft.com/security/incident/blast.asp


--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.

 

[Guest]

Well, all I can say is that you had better tell Symantec
that their online security check isn't working, as they
gave me the all clear

 

[Bruce Chambers]

Greetings --

If you've connected the PC to the Internet without having first
enabling a firewall, without having first installed an antivirus
application with current virus definition files, and/or before
installing the KB824146 Hotfix, you're very likely to have been
infected from any of the thousands of PCs on the Internet that are
constantly broadcasting the Blaster and/or Welchia worms. It only
takes a few seconds of exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH