RPC Call Failure on XP

[Lois]

I have a user that is running windows XP that has been
working fine but now everytime she launches Compuserve she
receives the error message "RPC Call failure. This
computer will restart in 30 seconds. Please save you
work." This only occurs when trying to use Compuserve.

 

[purplehaz]

Is this a client or a user in your office. If it's a client tell them they
NEED to have a firewall and anti-virus software installed and if its an
office and you don't have a firewall and AV installed and running, you
should be ashamed. Always run a firewall and av program. It would have
stopped this prob you have:

You are most likely infected with the Blaster worm virus.



To stop the rebooting/shutdowns, right click on the task bar, choose task
manager, processes tab, look for msblast.exe. Highlight it and click end
process. Then turn on the xp firewall.

To turn on the firewall: control panel, network and internet connections,
network connections, right click your connection, properties, advanced tab,
check the protect my computer box. Do this as quickly as you can once the
desktop comes up. Then visit the sites below for the removal and patch info.

Symantec: removal info and removal tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Network associates: removal instructions
http://vil.nai.com/vil/content/v_100547.htm


Also make sure to follow the links to the Microsoft pages for the patch or
visit windows update for the patch after you remove it.

http://support.microsoft.com/?kbid=823980

http://www.microsoft.com/security/incident/blast.asp

 

[Lois]

This client is actually a church that has 8 computers all
with different dialup services and norton on their pc's
but they do not update the definitions regularly. Their
new network (a proper one) is being installed in January.
I have all the updates for XP so I will go and load them
and run liveupdate for norton.

Thanks

 

[Lindsay]

I have seen the same message twice in the space of half an hour. I have no
viruses and am using a firewall. What else would cause this?

 

[purplehaz]

After you remove the virus, make sure they either enable the xp firewall or
install a free firewall like zone alarm as well.

 

[purplehaz]

If you get the RPC is going to shutdown in 30 or 60 secs message, then the
firewall could not be configured right or the av program your using isn't
updated. There are several variants of the original blaster virus.

 

[Ron Martell]

I have a user that is running windows XP that has been
working fine but now everytime she launches Compuserve she
receives the error message "RPC Call failure. This
computer will restart in 30 seconds. Please save you
work." This only occurs when trying to use Compuserve.

The computer has been infected by the Blaster virus/worm.

1. Get MVP Doug Knox's Blaster removal script from MVP Kelly Theriot's
web site: http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
2. Get the Microsoft patch from
http://support.microsoft.com/default.aspx?scid=kb;en-us;823980#WinXP

If possible do the first two steps on an uninfected computer and copy
the downloaded files to a 3.5 inch diskette (they will both fit on the
same 1.44 mb diskette) or burn them to a CD

3. Disconnect from the Internet. Unplug Cable/DSL modem if you have
one. That prevents reinfection during the time interval between
running the script and the completion of the patch installation.
4. Run the script.
5. Install the patch.
6. Activate the Internet Connection Firewall in Windows XP
7. Reconnect to the Internet. Update your antivirus software and do
a complete scan.
8. Go to the Windows Update and get all repeat all of the critical
updates for your computer.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH