RPC service termination?

[Wayne]

My NT Auth/System is shutting down on a regular basis
with a sixty second warning to close all programs. The
reason listed is: Remote Procedure Call(RPC) service
terminated unexpectedly.

Can anyone give me a clue? I have a window popping up at
startup that tries to connect me to the web to the
following address: gatorcme.gator.com.

 

[Chris Lanier]

Hi,

You have got a virus, removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Blasting The Blaster!
http://aumha.org/win5/a/blaster.htm

 

[Gary Tsang]

Hi,

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see follow this link:

http://www.microsoft.com/security/incident/blast.asp
http://www.microsoft.com/security/protect/main.asp

More information about this particular worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Removal Information can be found here
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

 

[David Robbins]

My NT Auth/System is shutting down on a regular basis
with a sixty second warning to close all programs. The
reason listed is: Remote Procedure Call(RPC) service
terminated unexpectedly.

Can anyone give me a clue? I have a window popping up at
startup that tries to connect me to the web to the
following address: gatorcme.gator.com.

lets see, you have multiple problems so multiple clues:

1. msblaster worm
2. gator hijackware

clue for fixes... search for daily faq message on microsoft.public.security
group.... and oh yeah, one more thing... now that you have used your real
email address on a news group you can expect to be receiving a pile of fake
microsoft security updates that are infected with a virus.

 

[Guest]

-----Original Message-----
My NT Auth/System is shutting down on a regular basis
with a sixty second warning to close all programs. The
reason listed is: Remote Procedure Call(RPC) service
terminated unexpectedly.

Can anyone give me a clue? I have a window popping up at
startup that tries to connect me to the web to the
following address: gatorcme.gator.com.
.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

To deal with pop-ups caused by any sort of "adware" and/or
"spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
KaZaA, and their remnants, that you've deliberately (but without
understanding the consequences) installed, two products that are
quite effective (at finding and removing this type of scumware) are
Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
http://security.kolla.de/. Both have free versions. It's even
possible to use SpyBot Search & Destroy to "immunize" your system
against most future intrusions. I use both and generally perform
manual scans every week or so to clean out cookies, etc.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH