Remote procedure call problem

A

Ahmad

dear sir
After I go on the net the following message appear :
"this system is going to shutdown , this process is
intiated by NT Authority\system , windows must restart
because Remote procedure call (RPC) service terminated
unexpectedly" .
Then the windows count down 30 sec then restart.
Please help me solving this problem.
Sincerely yours
Ahmad
 
C

CWatters

Sounds like the Baster worm.

Search this newsgroup for "RPC" in the subject field.
 
M

Mcploppy ©

Ahmad bashed at the keyboard and said:
dear sir
After I go on the net the following message appear :
"this system is going to shutdown , this process is
intiated by NT Authority\system , windows must restart
because Remote procedure call (RPC) service terminated
unexpectedly" .
Then the windows count down 30 sec then restart.
Please help me solving this problem.
Sincerely yours
Ahmad


It is a virus that started spreading very quickly on *August 11, 2003*
It works by exploiting unpatched Windows 2000/XP computers.
It's been named Lovesan (LovSan, LuvSan) or Blaster.

Follow Steps Below

1. Enable your firewall:

Windows XP : How to Enable Internet Connection Firewall (ICF) on Windows XP
On the taskbar at the bottom of your screen, click Start, and then click
Control Panel.
Click the Network and Internet Connections category.
(If the Network and Internet Connectionsis not visible, click Switch to
Category View under Control Panel on the left side of the Control Panel
window.)
Click Network Connections.
Right-click the Dial-up, LAN, or High-Speed Internet connection that you use
to connect to the Internet, and then click Properties from the context menu.
On the Advanced tab, under Internet Connection Firewall, select Protect my
computer and network, and then click OK.
The Windows XP firewall is now enabled.

2. Update Windows: http://windowsupdate.microsoft.com/

3. Use Antivirus Software

4. Remove the virus - Symantec has made available a virus removal tool
http://securityresponse.symantec.com/avcenter/FixBlast.exe


--
McPloppy ©

{ Remove both MyShoes to email me }
{ Homepage: http://tinyurl.com/bbel }
{ Local Radio: http://tinyurl.com/j1vi }
{ My Alternative Site: http://tinyurl.com/rynb }
 
G

Guest

-----Original Message-----
dear sir
After I go on the net the following message appear :
"this system is going to shutdown , this process is
intiated by NT Authority\system , windows must restart
because Remote procedure call (RPC) service terminated
unexpectedly" .
Then the windows count down 30 sec then restart.
Please help me solving this problem.
Sincerely yours
Ahmad
.
dear Ahmed
you may have a worm virus, I had the same
problem, it was caused by the msworm welchiab virus.
if you have a virus checker run your virus scanner to
identify the culprit. if your virus checker cant delete
the worm you can download a virus specific tool from
www.symantec.com. if the file wont let you delete it then
restart windows in safe mode, do this by start-run type
in msconfig.exe then click on the boot tab and check the
box that says safe mode. while in safe mode you can
delete the worm manually. then start up in normal mode.
 
G

Guest

While this is only a temporary solution, it at least
allows you to keep working or save your work, it worked
for me.

Go to start-run and then type "cmd" without the quotations
in the box

Click enter

Then type "shutdown -a" without the quotations, then hit
enter.

Now close the black box.

Now after this procedure the countdown will quit until it
decides to pop up again.

I have also noticed that after doing this that cut-copy-
paste and certain pop up buttons do not work (like posting
a reply or forwarding a message in outlook).

The fix that works for me is to go to add remove/programs
and select internet explorer and remove. A box pops up -
select repair (not remove), then reboot. It should restore
the cut-paste, ect... until the next time this RPC error
comes up...

Hope this at least helps some...

I am currently trying to save my files onto an external
drive so that I can reinstall windows xp.
 
B

Bruce Chambers

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top