remote procedure call(RPC) service

[Guest]

Can anybody help me with this one? Each time I go to download service pack 1 it goes through the usual motions but each and every time my computer states that it is shutting down as a result of NT AUTHORITY SYSTEM and displays the reason as REMOTE PROCEDURE CALL (RCP) SERVICE TERMINATED UNEXPECTEDLY.
Please help as my head is getting well mashed!!

 

[Guest]

-----Original Message-----
Can anybody help me with this one? Each time I go to

download service pack 1 it goes through the usual motions
but each and every time my computer states that it is
shutting down as a result of NT AUTHORITY SYSTEM and
displays the reason as REMOTE PROCEDURE CALL (RCP)
SERVICE TERMINATED UNEXPECTEDLY.

Please help as my head is getting well mashed!!
.
Sounds like you have the blaster worm/virus the fix for

this has only been out since July.

 

[Rick \Nutcase\ Rogers]

Hi Dean,

It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

Can anybody help me with this one? Each time I go to download service pack

1 it goes through the usual motions but each and every time my computer
states that it is shutting down as a result of NT AUTHORITY SYSTEM and
displays the reason as REMOTE PROCEDURE CALL (RCP) SERVICE TERMINATED
UNEXPECTEDLY.

 

[Freddy Flares]

Can anybody help me with this one? Each time I go to download service pack

1 it goes through the usual motions but each and every time my computer
states that it is shutting down as a result of NT AUTHORITY SYSTEM and
displays the reason as REMOTE PROCEDURE CALL (RCP) SERVICE TERMINATED
UNEXPECTEDLY.

Please help as my head is getting well mashed!!

You've got the msblaster.exe worm.

Start->Run "shutdown -a" will stop the countdown, then you can go about
removing it from your system and installing the relevant patches to stop it
returning.

FF.