RPC question

[Elsie]

Hi, can a newly installed XP have a window popping up with the message "RPC
terminated unexpectedly, windows will now shut down"?

I thought you have to be infected by the blaster worm to have this? I
scanned my system with Norton but no virus found. I can't find the
msblast.exe file too.

Elsie

 

[Guest]

Sure takes 10 seconds

You can stop it this way. Most posters don't know it
won't let you read anything from the links they post. (
It shuts you down !! dah!! )


You have a virus = Mblaster Follow the steps below.

1. Go to control Panel> Network connections > *Your
connection* rt click >properties, Advanced Tab, check to
enable> The Firewall.

2. Do a Ctrl + Alt + DeL , on task manager highlight
MBlaster.exe and end the Process.

3. Go here and download the fix.

http://www.microsoft.com/downloads/details.aspx?
FamilyId=E70A0D8B-FE98-493F-AD76-
BF673A38B4CF&displaylang=en

4. Get a XP update;

 

[Elsie]

Thanks, but when I open the task manager, there isn't any mblaster.exe
running under applications or processes.

Elsie

 

[Kelly]

Elsie,

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.

 

[Guest]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -
Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32
..welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
..removal.tool.html

 

[Elsie]

Hi, so do I have to patch XP with SP 1 or SP 1a first before moving on to
installing security patches?

feel like formatting the whole thing again

Elsie

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

Before you do anything, you have to get rid of the virus.

 

[cquirke (MVP Win9x)]

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.

To put longer teeth into that excellent advice:
- set Second and Subsequent RPC failures to Restart the Service too
- stop the system automatically restarting on system errors
- turn on the firewall to block RPC attack probes etc.

The second setting is in Control Panel, System, Advanced tab.

---------- ----- ---- --- -- - - - -

Consumer Asks: "What are you?"
Market Research: ' What would you like us to be? '

 

[Kelly]

Good points, Chris. Great to see you here. <w>

 

[cquirke (MVP Win9x)]

Good points, Chris. Great to see you here. <w>

Thanks, Kelly! Sure is busy here, eh? (he says, posting yet another
off-topic messages that contributes to the problem) <g>

-------------------- ----- ---- --- -- - - - -

Trsut me, I won't make a mistake!

 

[Michael Solomon \(MS-MVP Windows Shell/User\)]

In order to delete the offending files in the restore folder, I assume you
mean they are in System Restore's folder, you need to turn off System
Restore, reboot and turn it back on. Open Control Panel, open System, go to
the System Restore tab, and check "Turn off system restore on all drives,"
reboot and remove that check. Be sure to click apply and ok. Note, this
will remove all restore points up to now but they are useless to you anyway
as the folder contains infected files.

 

[Kelly]

Thanks, Kelly! Sure is busy here, eh?

Yup, little bit, Chris. )

Trsut me, I won't make a mistake!

Love it!