Remote Procedure Call

[Adam]

Hi does any one know why Remote Procedure call Will keep
restarting my bro's PC everytime he connects to the
internet.

It's fine for general use but when he connects
He gets an Error message saying
RPC Ended unexpectedly and the whole PC re-starts

Any help would be great as this thing is Brand new.
And not much use to him without the Net

I have read it needs a patch or Service pack but I can't
find an XP Comptible service pack.

Please Please help

 

[Chris Lanier]

You have got a virus, removal info at...
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

More info about the worm:
http://www.microsoft.com/security/incident/blast.asp

More info about the worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[Jason Tsang]

You have a virus.

Get the cleaner for Blaster from here
http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.html

After you remove the virus, IMMEDIATELY goto Windowsupdate and install the
latest patches. Previous failure to do so led to the computer being
infected with the virus

See here for more information
http://www.microsoft.com/security/protect/

 

[randwulf57]

Adam:
W32.BLASTER.WORM
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp
randwulf57

 

[Kenny]

He's got the Blaster worm, follow the steps here:
http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.blaster.worm.re
moval.tool.html
to remove it.

 

[Ryan Younger]

Your machine is infected with the Blaster worm. You will need to install
the MS03-039 update, use a worm removal tool to eradicate blaster and modify
your RPC service's recovery settings. A full breakdown can be found at
Microsoft's 'What You Should Know About the Blaster Worm and Its Variants'
website:

http://www.microsoft.com/security/incident/blast.asp

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger



Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH