ANYONE?? RPC Shutdown?

[Chelle]

I can be in the mist of doing something and a box will
pop up saying Initialed by NT Authority/System Windows
must now restart becasue Remote Procedure Call (RPC)
Service Terminated Unexpectedly. Then it does a
countdown and shuts the system down and restarts it.

I have done a COMPLETE Factory Restore of my system but
right after, it still did it again.

Since I have updated all Windows files and so far it has
not popped back up, but I expect it will any minute.

Any and all help with this will be greatly appreciated!
Thanks!!
Chelle

 

[Chad]

I have been getting this message frequently as of the
last month. It pops up in random places, today i had just
booted my machine, was using internet explorer, and went
to adjust my display settings when it came up. I hope
not to have to completely reinstall windows! Any help on
this is much appreciated/

 

[Chelle]

Chad,
Same thing with me. I called and talked with a rep at
Microsoft and they said they had no known problems but
that if it continued to please call back. I did a
complete factory restore and it STILL did it. Then I
went and dl/installed all Windows updates and it has not
done it since. ((HOLDING BREATH))
Not sure what is up... but with many of us having the
same problem something just does not seem right somewhere.

Hope we find out soon.
Chelle

 

[Chad]

For some reason i cannot switch my Windows Automatic
update back on (grayed out) and when i go to Windows
website to check for updates, it says that there are none
available, which I know is not true.

Anyways, windows does know about this problem and it is a
major issue. Found this link by another user and
manually applied patch myself. Hope this will fix RPC
problem. As for updating windows... I dont know what
else to do.

http://www.microsoft.com/technet/treeview/default.asp?
url=/technet/security/bulletin/MS03-026.asp

 

[Chad]

Ok i figured out how to fix my update problem by visiting
here:

http://v4.windowsupdate.microsoft.com/troubleshoot/#Proble
m%20reaching%20Windows%20Update

Had to add a language to my IE options.. go figure. My
windows update used to scan quickly to 100% and found no
updates, now it found 4 critical updates and several
others. Crossing my fingers that this will forever
eliminate RPC errors. For others having this problem,
use windows update and see if it works.

 

[Dravyn]

I SOOO Hate this error. It did it over 20 times
yesterday so I called Microsoft who said they would talk
to me for $245 dollars to that I say kiss off Microsoft
and fix this problem that more then just a few are having.

 

[Ronnie Vernon MVP]

Chad,
Same thing with me. I called and talked with a rep at
Microsoft and they said they had no known problems but
that if it continued to please call back. I did a
complete factory restore and it STILL did it. Then I
went and dl/installed all Windows updates and it has not
done it since. ((HOLDING BREATH))
Not sure what is up... but with many of us having the
same problem something just does not seem right somewhere.

Hope we find out soon.
Chelle

Chelle

You could have been the victim of a hack that takes advantage of a newly
discovered vulnerability in XP. There is s fix for this this on the Windows
Update website, which you installed and has fixed this vulnerability.

The issue is detailed here:

Microsoft Security Bulletin MS03-026:
Buffer Overrun In RPC Interface Could Allow Code Execution (823980)
http://www.microsoft.com/technet/security/bulletin/MS03-026.asp?frame=true
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

 

[Karl Levinson [x y] mvp]

Microsoft did fix the problem a long time ago and emailed all their
customers with the fix. It's been all over the news too. We also post it
here daily in the FAQ. Given all that, if they want to charge someone $245
who hasn't checked any of those sources, I have no problem with that.
Microsoft did more than their due diligence here to try to get the fix into
everyone's hands.

From the FAQ:

My computer is giving RPC Remote Procedure Call messages, or there is a TFTP
message on my computer, or my computer keeps locking up, or rebooting, or
telling me that it will reboot in 1 minute.
http://www.google.com/[email protected]

BTW, if you're hacked by this, just installing the MS03-026 patch leaves
your computer still hacked and still remotely controllable. You also want
to do this:

http://securityadmin.info/faq.htm#hacked

Also, note that the use of a windows root kit named "stealther" or
"winshell" in one of these exploits can make it so that neither you nor your
antivirus can see the infected files on your computer that allow hackers to
remotely control your computer. If this is the case, some of the ways you
can tell if you might have a root kit installed include:

- Look for unusual items when you run NETSTAT -A and FPORT [the latter is
free from www.foundstone.com/knowledge]
- Look for unusual outbound items in your firewall logs [such as TCP 6667,
TCP 8719, etc.]. If you're not already, use a firewall such as
www.sygate.com or www.kerio.com [both are free]
- Connect to the computer through the network from another Windows computer
and scan for viruses that way
- Move the hard drive as a slave to another computer that is known to be
virus free, boot to the other version of Windows and scan for viruses that
way

 

[Gary]

I just got this message for the first time today, and now
it has done it twice within a few hours. I am assuming it
is some kind of a virus disguised as a Microsoft message,
but am not sure.

Does anyone know how to fix it? I intend to download the
most recent patches, but wonder if the computer will
continue running long enough to get the download
completed. (I am stuck with a dial-up connection, so it
can take hours, depending on the size of the files being
downloaded.)

Any ideas?

 

[Darin]

I can be in the mist of doing something and a box will

pop up saying Initialed by NT Authority/System Windows
must now restart becasue Remote Procedure Call (RPC)
Service Terminated Unexpectedly. Then it does a
countdown and shuts the system down and restarts it.

I have several customers running Windows XP that are complaining of
this same issue. I am thining that it might be related to the the RPC
patch that Microsoft was so insistent that everyone install. Here is
the link.

E:\Documents and Settings\darin\Local Settings\Temporary Internet
Files\OLK15\MS03-026.html

I am going to install this patch on those systems and see what
happens. By the way, I found that if I unplug my internet
connection, the problem stops.

 

[Rich Barry]

Wendy's link shortened http://tinyurl.com/h5l9

 

[Ron Martell]

I can be in the mist of doing something and a box will
pop up saying Initialed by NT Authority/System Windows
must now restart becasue Remote Procedure Call (RPC)
Service Terminated Unexpectedly. Then it does a
countdown and shuts the system down and restarts it.

I have done a COMPLETE Factory Restore of my system but
right after, it still did it again.

Since I have updated all Windows files and so far it has
not popped back up, but I expect it will any minute.

Any and all help with this will be greatly appreciated!
Thanks!!
Chelle

This is caused by a new and rapidly spreading virus.

To clear up the "NT Authority\System" and RPC call errors:

1. Go to http://support.microsoft.com/?kbid=823980 and download the
security patch. If at all possible do this on a clean machine and
copy the patch to a 3.5 inch diskette.

2. Boot the infected machine into Safe Mode. Insert the 3.5 inch
diskette with the patch on it and run it. Do not reboot yet.

3. Use Start - Run - MSCONFIG and go to the Startup tab. Locate the
entry for MSBLAST.EXE and clear the checkbox for it.

4. Use Start - Run - REGEDIT and locate and delete the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"windows auto update"="msblast.exe"

5. Use Start - Search and check all your hard drives for the file
MSBLAST.EXE and delete all copies of it.

6. Shut down and restart the computer normally.

7. Immediately do an update of your antivirus software and when the
updates are installed do a complete virus scan of your hard drive. So
far Symantec/Norton, Trend Micro (PC-Cillin) and Sophos seems to be
the only major companies with an update for this specific virus (4:30
p.m. PDT 11 Aug 2003) but the others will undoubtedly follow within 24
hours.


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."