rpc error but can't find msblast.exe

[sam]

well...my problem was that i had the rpc error for the
whole day and didn't know what to do until i found this
newsgroup and read about the worm. then i did what some
of the people suggested, such as finding the worm and
deleting it but when i went to search for it with
programs and search in microsoft, nothing came up. so
anyone have any ideas what might have happened? i've
already scanned my computer with some of the suggested
files that people posted. thank you for any help.

 

[Gini]

The same thing is happening to me and I am totally
clueless, if you find a solution please share it, ok? much
thanks in advance!
I have scrolled down hundreds of messages and never found
that paul anderson :-(

 

[Nick Goetz]

well...my problem was that i had the rpc error for the
whole day and didn't know what to do until i found this
newsgroup and read about the worm. then i did what some
of the people suggested, such as finding the worm and
deleting it but when i went to search for it with
programs and search in microsoft, nothing came up. so
anyone have any ideas what might have happened? i've
already scanned my computer with some of the suggested
files that people posted. thank you for any help.

You don't need to be infected by a worm to get the "RPC" error.

I started getting it a few days ago and I am not infected by any
worm, virus or trojan.

What was happening was this:
- an attempt was made to access my system from the internet using
ports 137 and 138.

- using RPC (Remote Proceedural Call) and probably DCOM
(Distributed Component Object Model)the intruder then tried to use
TFTP.exe (Trivial File Transfer Protocal) to access the internet
from my computer thru ports 137 or 138.

- Sygate Firewall popped up a warning, asking if TFTP should be
allowed thru... to which I checked "no".

- At that point the countdown to reboot started and my system was
re-started.

- upon reboot, I blocked ports 135, 137, 138, 139 (TCP and UDP)
both incoming and outgoing. This allowed time to download and
apply the "patch" referenced in the other posts about this problem.

Prior to closing the ports:
Everytime it "hit", a complete scan with updated E-Trust, a check
of the registry and a check of all running services was made and no
sign of any infection was found.

Nick Goetz

 

[sam]

any idea why i can't install the patch for the problem? i
downloaded the file but when i tried to install it, it
said "setup could not verify the integrity of the file
Update.inf. Make sure the Cryptographic service is
running on this computer." i've looked at the
cryptographic service and it was on auto already..so i
don't know what to do. anyone have any ideas on what i
can do? thanks in advance.