Remote Procedure Call error

  • Thread starter Thread starter Aves
  • Start date Start date
A

Aves

Hi,

I had a friend call me because he wanted help with an
error he was getting. When ever he opened a program that
used the internet (and sometimes he would get this just
in windows) he gets an error and Windows
restarts "Remote Procedure Call (RPC) service was
terminated ..." Then he would get another error
about "NT authority/system ..." His system was working
fine until he emptied out his recycle bin. To me, this
sounds like he might have a virus, but his anti virus
program has not been updated and he can not update it.
Safe mode with networking would still crash the system.
The only thing I could do was to place the system into a
clean boot and disable all services also. I tried to
start some basic services to get online but to no avail.
Checked the knowledgebase and newsgroups but I could not
find a solution. any ideas? Any help, other than
formatting and reinstalling?

Thanks
 
-----Original Message-----
Hi,

I had a friend call me because he wanted help with an
error he was getting. When ever he opened a program that
used the internet (and sometimes he would get this just
in windows) he gets an error and Windows
restarts "Remote Procedure Call (RPC) service was
terminated ..." Then he would get another error
about "NT authority/system ..." His system was working
fine until he emptied out his recycle bin. To me, this
sounds like he might have a virus, but his anti virus
program has not been updated and he can not update it.
Safe mode with networking would still crash the system.
The only thing I could do was to place the system into a
clean boot and disable all services also. I tried to
start some basic services to get online but to no avail.
Checked the knowledgebase and newsgroups but I could not
find a solution. any ideas? Any help, other than
formatting and reinstalling?

Thanks
.
Click to expand...


There can be a few situation where this problem occurs.
The 3 are mentioned below:

From Kelly - MVP:
Close Windows Explorer, End Process in the Task Manager
for msblast.exe, run
the edit on line 257 then run the patch listed below it:
http://www.kellys-korner-xp.com/xp_tweaks.htm

Windows XP Security Patch: Buffer Overrun In RPC Interface
Could Allow Code
Execution: http://tinyurl.com/ir5h

More information here:
www.kellys-korner-xp.com/xp_qr.htm#rpc


From Barb Bowman - MVP:
1) Unplug the cable that connects your computer to the
modem then reboot your computer.
2) Enable ICF (the internet connection firewall)

Barb Bowman's column on enabling ICF is here:
http://tinyurl.com/jqyg

(short version of above):
To activate ICF (from Barb Bowman - MVP):

1) Click Start, and then click My Network Places. To open
My Network Places if your Start menu doesn’t already
include a shortcut to it, open My Computer. Under Other
Places, click My Network Places.
2) Under Network Tasks, click View Network Connections OR
right-click My Network Places and then click Properties.
3) Right-click the connection used for the Internet, and
then click
Properties.
4) Click the Advanced tab, and select the Protect my
computer and network check box to turn on ICF. (This also
makes the Settings button active, allowing you to
configure advanced parameters.)
Plug the cable back in. This will protect you long enough
to get the patch
for the RPC vulnerability.
5) Download the MS patch here:
http://tinyurl.com/h5l9

You should use a firewall if you are connected directly to
the Internet at
all times to help protect against these things.


Symantec has a removal tool:
http://tinyurl.com/jqdf


Hope this helps!

Gary Thorn
MVP-Windows Technologies/Xbox
Associate Expert


More about the Windows XP Expert Zone:


More about the MS MVP Program:
http://tinyurl.com/n08
 
Back
Top