"RPC" error

[Sallah]

Every time I connect to the internet I get the following
error "The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 60000 milliseconds:
Reboot the machine." which force me to reboot the system
and I'm unable to download any windows updates or anti
virue software, etc.

what is this error and what should I do?

 

[Carey Frisch [MVP]]

There are thousands of nasty computer viruses/worms looking for unprotected
computers. Your computer can be infected within a few milliseconds the moment
an internet connection is established if your computer is not properly secured.

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

------------------------------------------------------------------

If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.

------------------------------------------------------------------

Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/

What You Should Know About the Blaster Worm and Its Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an attacker to
remotely compromise a computer running Microsoft Windows and
gain complete control over it. You can help protect your computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-------------------------------------------------------------------------


| Every time I connect to the internet I get the following
| error "The Remote Procedure Call (RPC) service terminated
| unexpectedly. It has done this 1 time(s). The following
| corrective action will be taken in 60000 milliseconds:
| Reboot the machine." which force me to reboot the system
| and I'm unable to download any windows updates or anti
| virue software, etc.
|
| what is this error and what should I do?

 

[cquirke (MVP Win9x)]

On Tue, 20 Jan 2004 11:10:37 -0600, "Carey Frisch [MVP]"

Apparently, your computer is now infected with the W32.Blaster.Worm or one of its variants.
This happened because you have not been using an internet connection firewall and have
apparently neglected to install the critical updates available at the Windows Update website.

And the reason you have to pull updates is because MS neglected to
find and fix a code defect within the RPC/DCOM system from NT4 through
to XP SP1, having documented it for the first time in July 2003.

By August 2003, Lovesan/Blaster and several other RPC attackers were
attempting to penetrate this hole, causing PCs to crash when the
attack packet's offsets were mis-aligned (Win2000 and XP require
different offsets, so what infects one crashes the other).

By September 2003, MS had discovered a number of defects in the
original July 2003 patch, and re-issued a new fix - the one you need++

Meantime:

1) Activate your firewall (XP's built-in one will do for this)
2) Stop the PC from resetting on all system errors
3) Stop the PC from resetting on all RPC service failures
4) Get offline, and clean active malware off the system
5) Get and apply the patch to repair the RPC/DCOM defects

It is (2) and (3) that cause every love-tap from an RPC attacker
anywhere in the 'net to reset the PC.

On (2), XP is set by duhfault to "Restart on system errors"; find that
setting in System Properties, Advanced and turn it off.

On (3), XP is set by duhfault to "Restart the computer" every time the
RPC service falls on its ass. Admin Tools, Services, go into
Properties for RPC, Recovery tab, set to "Restart the service".

It is these two stupid defaults that are causing a large part of the
grief caused by RPC attackers. Code defects will always be with us,
but spare us these brain-dead design decisions please!

--------------- ----- ---- --- -- - - -

Dreams are stack dumps of the soul