System shutdown due to RPC terminated unexpectedly

[Richard]

I have Windows XP Service pack 3 and starting yesterday I started getting
system shut downs about an hour after rebooting. The message is that the
Remote Procedure Call (RPC) terminated unexpectedly and NT AUTHORITY\SYSTEM
required a system shut down. Any idea what is going on and how to fix it?

 

[Leonard Grey]

Well, I haven't heard a report about this one in years. The Blaster
worm, IIRC. I wonder if it's making a comeback.

Make sure that your anti-malware software is running, then download the
latest signatures and run a full scan.

If you don't have comprehensive anti-malware software, that's like
driving a car without seats belts or air bags. Either way, you're
eventually going to get hammered. Install comprehensive anti-malware
software and learn how to use its features. A 'comprehensive' solution
scans for all types of malicious software in the background, on demand
and on schedule.

For now try scanning your system with /several/ of the better online
scanners, such as:
Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
Panda ActiveScan (http://www.pandasoftware.com/activescan)

Download HijackThis from www.trendsecure.com. Run it, save a log, and
post the log at one of the many sites that support HJT, such as
spywarewarrior.com, bleepingcomputer.com, and temerc.com -- but not
here. Within a day, sometimes within an hour, you'll have one-on-one
step-by-step advice from a security expert on cleaning up any
infestations—or you'll have a clean bill of health from the volunteer
expert.

Even the best detection and removal software can't fix every malware
infection. If none of the above remove the infection, you may want to
show the computer to a professional.

---
Leonard Grey
Errare humanum est

"A Day in the Life of a Web 2.0 Hacker" - PC Magazine
http://www.pcmag.com/article2/0,2817,2330952,00.asp

 

[Richard]

Thanks for your assistance Leonard.

While I was waiting for a reply, I ran Norton's Blaster Worm removal tool
(full scan in safe mode) and it didn't find the Blaster on my system.

I tried running the 2 online scans and both failed:
activescan got an error while trying to install "update error"
virusscanner got an error saying I had multiple java machines running and to
deactivate my anitivirus software, I did, but I still get the error.

I ran microsoft's malicious software removal tool, it found no malicious
software.

I have also run Norton's antivirus scan and found nothing.

(Both scans were the quick scans as my system shuts down before I can run a
full scan.)

I have changed my Norton firewall system to block the ports (incoming only)
identified in Microsoft's knowledge base regarding this worm.

I ran HijackThis's scan and no check boxes were checked.

*scratches head* Damned if I can figure out what is going on.

 

[Abel1712]

Hi i was reading this post cos im having the same problem, i have runed the
NOD32 Full Scan and it said that all is ok, I have runed 2 diferent sasser
and blaster removers and it said that no infection found.

What can i do.

Thx

 

[Matt]

I have been having the same problem as of yesterday. I have tried running
countless programs and nothing can be found. There has to be a fix for this?

 

[Leonard Grey]

Show your computer to a professional and tell them you have the Blaster
and/or Sasser worm.
---
Leonard Grey
Errare humanum est

"A Day in the Life of a Web 2.0 Hacker" - PC Magazine
http://www.pcmag.com/article2/0,2817,2330952,00.asp

 

[ept]

same problem

the same problem started today with my laptop. So far, Mcafee, Spyware Doctor and Spybot have been unable to find any worm. Any help out there?

 

[Richard]

Sorry Leonard, but I have scanned for the Sasser and the Blaster with several
tools. They do not exist in my system. I have also looked for the actual
files that are the telltale signs of the Blaster Worm. I do believe we have
a new creature here. All my virus definitions are up-to-date, but they
detect nothing on the computer.

 

[Dima]

I have identical problem on 3 computers that run SP3. Annoying but
this doesn't happen all the time and did not start immediately after
SP3 update. 2 of the computers in question have been reinstalled with
SP3 integrated in the installation CD. There are no viruses on either
of 3 computers in question. Scans were run in off-line HDD mode using
Panda, Norton , McAffee, NOD32, Bitdefender. I doubt that all of these
would have missed MSBlaster wich is now 5 years old.

 

[yakumo.baka66]

Hi guys. I also experienced the same problem on my system running WinXP SP2.

It's been that way for the past two days, but tonight my Symantec Endpoint Protection just detected a trojan that didn't appear on my previous scan, filename is A0176333.dll, just appeared in the quarantine list all of a sudden. I deleted it and now it's been more than one hour since I restarted -- I haven't seen the RPC thing pop up again.

I'll be shutting down for the night, but I'll check again tomorrow, see if it's really okay now.

 

[Zelda]

hi,

I have the same problem as Richard...
and I, too, ran several scans with anti-virus, spyware removal tool, etc...
nothing (like MSblast) was found...

yet it kept restarting by itself...(with the same RPC terminated message)
I really need help...

 

[idony]

I have the same problem on my WinXP SP2 as well. I got it the other day, tried everything online to get rid of it. But none of the scans (symantec, mcaffee & random other ones) have detected anything, even in safe mode. And like some of you said, there's no telltale signs of the worm in the system names.
For some reason however, although it didn't detect the worm, it hasn't restarted at all since and i had it on all day yesterday. i don't know what to make of it, as none of the scans turned up with anything and so couldn't have gotten rid of it. I don't really understand computers but can a computer virus be dormant??

 

[yakumo.baka66]

Well, it's been more than 1 hour since I booted up. Nothing out of the ordinary's happened so far.

I've attached a screenshot of with the name of the trojan my Symantec quarantined and I deleted last night. I can't conclusively say it's the actual cause of this whole mess, but the coincidence with when I deleted it and my system recovered is just too strong for me.

For now I'll have to call this one plausible, at least in my case, and worry about it again if it comes back later.

 

[SamuelOrozco]

Im having the same problem. No blaster found and my computer keeps restarting
because:The Remote Procedure Call (RPC) service terminated unexpectedly.
do you know if the problem can be fixed by driver reset tool (dell)?

 

[idony]

I have the same problem on my WinXP SP2 as well. I got it the other day, tried everything online to get rid of it. But none of the scans (symantec, mcaffee & random other ones) have detected anything, even in safe mode. And like some of you said, there's no telltale signs of the worm in the system names.
For some reason however, although it didn't detect the worm, it hasn't restarted at all since and i had it on all day yesterday. i don't know what to make of it, as none of the scans turned up with anything and so couldn't have gotten rid of it. I don't really understand computers but can a computer virus be dormant??

Ok, never mind, problem has not been fixed, it was good for a day and a half but has started restarting again with the RPC message. Anyone figured it out yet??

 

[Richard]

Ok, I've found a solution to the reboot issue, but I recommend you use it
only if you are reasonably sure that you don't have a virus. Use multilple
anit-virus programs to be sure that you don't have the Blaster or other
viruses. I suspect this is a bug in XP SP3, so here's the fix.

Click Start, Run and type in services.msc and press enter.

Scroll down to Remote Procedure Call, right click and select properties. (be
sure you do the one that doesn't say Access).

Go to the Recovery tab and change the settings from Restart the computer to
restart the service. This should stop the reboots from occurring.

 

[yakumo.baka66]

anyone tried this?

http://www.mvps.org/marksxp/WindowsXP/rpc.php

 

[SamuelOrozco]

Well, my problem is apparently fixed, im still letting the computer run for
another day just to make sure its ok now.
Basically what I did was download all the new windows updates, I ran mcafee
again and removed something called Generic PUP.z (no idea what that was) and
ran panda scan and removed some worm called dreammon. As I said, the problem
was apparently fixed after I downloaded the windows updates. Im still taking
precautions like not running any unnecessary programs to see if the computer
runs well.. after that Ill try to run some other test like hibernating it and
opening some other programs... lets hope this problem is over..
If anyone finds anything else.. please tell
Thanks

 

[Blade3609]

I had the same problem a couple of days ago.. i ran every scan there is
updated everything and it stopped ... but now today im getting the same
problem again... i checked for unusual processes , nothing... ran checks
again nolthing and there are no new avalable updates... did ur problem stop ?

 

[Blade3609]

thanks man , I use nod32 and today it updated and found a worm in spoolsv.exe
(win32/patched.n or something), lol!, it didnt restart anymore , i also super
super antispyware as u told me to use and i used also spy sweeper , and its
all good now i think ..worms and virusses are getting smarter , lol .. oh
well , hope everyone that has the same problem is happy now