RPC call

[shajeer]

I have a Compaq Presario 2100 (notebook) with
windows xp installed in it. When I connect to the internet
I get a message "Generic host process for win 32 services
has encountered a problem and needs to close" .It then ask
me whether to send an error report which I do. Most of the
times I also get the following message while connecting to
the internet "The system is shutting down. please save any
files, etc. The shutdown was initiated by NT AUTHORITY \
SYSTEM. Message: windows must now restart because the
remote procedure call service (RPC) terminated
unexpectedly" and then it shutdowns after 1 minute. I use
a dial up connection .Are the two messages related? The
system is relatively new and I have not installed any
other software which might interfere .Please advice &
reply as quickly as possible.

 

[David]

"Virus"
You have the W32.Blaster.Worm
http://www.microsoft.com/security/incident/blast.asp

To remove Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Dave

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

You are infected with the blaster worm or one of it's variants.
Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all 3 variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -