rpc error message online

[s]

WE have Windows XP worked great for over a year; hard
drive crashed yesterday (a virus I suppose). Wiped it and
re-installed. Now anytime I go online a message box
appears saying that NT Authority/System is shutting down
windows due to Remote Procedure Call system. FIrst I
reinstalled XP. THen, using the help menu the best I could
figure was that it had something to do with windows
messaging (which was a new upgrade we did not have
installed previously) so I uninstalled that portion of
windows. Went online again - stayed connected a little
longer but the system still shut down.

 

[Chris Lanier]

Hi, You need to enable your firewall in Windows XP *before* connecting to
the internet. Reinstall Windows XP doesn't do anything to fix your
unprotected system.

To stop your PC from shutting down Goto Start>>Run>>Type "shutdown -a" (Hit
Enter) Then see the following sites to help you remove and patch your
system so it doesn't happen again.

A tool is available to remove Blaster worm and Nachi worm infections from
computers that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

 

[Rick \Nutcase\ Rogers]

Hi S,

When the shutdown warning appears, click start/run and enter "shutdown -a"
to halt the process. It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone