RPC ERROR every time I boot

[The Litwaks]

I bought a new hard drive on Sunday and a copy of WIndows XP HOme
Edition. I installed XP on to the new, empty drive. Last night I was
able to be up for quite a while. Today, I can't. Every time I boot up
into my user session, Windows about three minutes later tells me that a
serious error has occurred. It cannot find some RPC piece of code and
shuts down the system all by itself. I'll be lucky to finish this
message. What could be wrong and how can I fix it? Thanks.

(Desperate) Ken

 

[Carey Frisch [MVP]]

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

Special note if you use AOL:

America Online installs its own connection settings that override
the ones that come with Windows XP. America Online's
connection settings don't include a way to turn on Windows XP's
built-in firewall.

Visit the following web site for instructions on downloading
a FREE firewall program for your computer.

Ref: http://www.updatexp.com/free.html

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

MS03-039: A Buffer Overrun in RPCSS Could Allow
an Attacker to Run Malicious Programs
http://support.microsoft.com/default.aspx?kbid=824146


--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------------------


| I bought a new hard drive on Sunday and a copy of WIndows XP HOme
| Edition. I installed XP on to the new, empty drive. Last night I was
| able to be up for quite a while. Today, I can't. Every time I boot up
| into my user session, Windows about three minutes later tells me that a
| serious error has occurred. It cannot find some RPC piece of code and
| shuts down the system all by itself. I'll be lucky to finish this
| message. What could be wrong and how can I fix it? Thanks.
|
| (Desperate) Ken
|

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[The Litwaks]

I've never had this kind of problem before with 98, 2000 or XP. I
ran msconfig and it said that Remote Procedure Call/Locator was stopped.
Is that a symptom of the Blaster worm or is this actually a problem
in XP? Thanks. I do intend on adding my anti-virus software back on
but I just got the new system up and running.


Ken

 

[Cerridwen]

I bought a new hard drive on Sunday and a copy of WIndows XP HOme
Edition. I installed XP on to the new, empty drive. Last night I was
able to be up for quite a while. Today, I can't. Every time I boot
up into my user session, Windows about three minutes later tells me
that a serious error has occurred. It cannot find some RPC piece of
code and shuts down the system all by itself. I'll be lucky to
finish this message. What could be wrong and how can I fix it?
Thanks.

(Desperate) Ken

Another NSF. Ever heard of Google?!

 

[The Litwaks]

NO idea what you're talking about. What possible benefit would
Google be when the operating system itself is obviously hosed out of the
box? In twenty five years of PC usage, I've never seen anything this
bad, not even from Microsoft. They topped themselves this time. Thanks.

Ken

 

[Jupiter Jones [MVP]]

Ken;
The problem, if any, from Microsoft's end is not enabling the firewall
by default.
Once an unprotected computer is connected to the internet, it takes
just seconds for something like Blaster to get in.
No surfing, Email etc required, just a connection.

Follow this to get rid of Blaster:
http://www3.telus.net/dandemar/blaster.htm

 

[Cerridwen]

NO idea what you're talking about. What possible benefit would
Google be when the operating system itself is obviously hosed out of
the box? In twenty five years of PC usage, I've never seen anything
this bad, not even from Microsoft. They topped themselves this time.
Thanks.

Ken

If the system is "hosed" then how are you managing to post to Usenet?! This
is an FAQ, it would have taken you less time to search for the answer than
it did post! It isn't "hosed out of the box" and it has nothing whatsoever
to do with MS. Had you bothered to do even an iota of research, you'd have
known that!