RPC.exe error---HELP!!!!!!!!!!!!!!

[Igor Smeghead]

I'm new to this group. I have a real dilemma. I set up an PC for a
client of mine (with pre-installed OS). Normally, I wipe off the XP
and put Windows 2000 on PCs, but this person wanted to keep their XP
Home Edition. This PC is standalone in an office. It only is used
for minor bookeeping and internet usage (dialll-up). The user loves
MSN 8 and wants to browse with their browser. I activated MSN 8 (also
pre-installed) and it immediately converted her email to be viewed in
hotmail. Following the conversion, an error popped up that said the
browser had an RPC error and would shut down in 30 seconds.

Now everytime she goes online, she receives the same message, and her
computer reboots. I've search the FAQs and MSKB, and can't find a
reference to this. I installed no software (besides what was
pre-installed). This is supposed to be an "out of the box"
configuration. Of course, since I set the PC on the desk, it must've
been something that I did to it (according to the customer). I
suspect a virus. I saw nothing in her email that looked suspicious.

I need help...pleeeeeeeeeeeease

Igor

 

[Wislu Plethora]

-----Original Message-----
I'm new to this group. I have a real dilemma. I set up an PC for a
client of mine (with pre-installed OS). Normally, I wipe off the XP
and put Windows 2000 on PCs, but this person wanted to keep their XP
Home Edition. This PC is standalone in an office. It only is used
for minor bookeeping and internet usage (dialll-up). The user loves
MSN 8 and wants to browse with their browser. I activated MSN 8 (also
pre-installed) and it immediately converted her email to be viewed in
hotmail. Following the conversion, an error popped up that said the
browser had an RPC error and would shut down in 30 seconds.

Now everytime she goes online, she receives the same message, and her
computer reboots. I've search the FAQs and MSKB, and can't find a
reference to this. I installed no software (besides what was
pre-installed). This is supposed to be an "out of the box"
configuration. Of course, since I set the PC on the desk, it must've
been something that I did to it (according to the customer). I
suspect a virus. I saw nothing in her email that looked suspicious.

I need help...pleeeeeeeeeeeease

Igor
.

Let's see...You have "clients," which means that you are
somehow engaged in the business of selling computer
hardware and/or services. You normally "wipe off XP" and
replace it with 2000, thereby, in all likelihood, voiding
the manufacturer's warranty and leaving your clients with
outmoded technology. Then when the most highly publicized
malicious code since "Melissa" strikes (because of your
failure to properly configure your client's system)you
have to cry for help. It is not possible that you have
"searched the FAQs and MSKB" without finding the answer to
your problem, which means that in addition to being
a moron, you're also too lazy to do what you're being
paid to do. Nice work if you can get it, I guess.

 

[F Miller]

Since your computer is attempting to shutdown all the
time: Go to Start>Run>type CMD and press enter. At CMD
type: shutdown -a and press Enter Key. This should stop
the rebooting process.

It sounds like you have the WM Blaster Worm Virus. Be
sure and turn your FIREWALL on.

Suggest that you run a Virus checker on your computer.

Here are some aids:

Blaster worm info:
http://www.microsoft.com/security/incidnet/blast.asp

Remove Blaster Worm:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

Security patch from MS for Win XP against WM32 Blaster:
http://microsoft.com/downloads/details.aspx?FamilyId=
2354406C-C5B6-44AC-9532-3DE40F6

Without your FIREWALL enalbed these worms are very easy to
infect ones computer.

You can use the one with XP or get a free one at:
http://www.zonelabs.com

Be sure and download all the latest Upgrades to Win xp and
your Virus programs.

F Miller

 

[Edward]

It's the W32.blaster worm, Igor.

Go here,
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

While there it would be a good idea to have Symantec run a scan of the OS.

To allow time on-line to do this, go to Start/Run and type services.msc.
Scroll to Remote Procedure Call (Not Locator) and disable it.

You must also visit http://support.microsoft.com/ and download and install
SP1 which will prevent a rematch.

Remember to enable RPC after you've finished. Also check that the Microsoft
firewall is enabled if there is no other firewall on the PC.

Good luck,

Ed

 

[Guest]

I love your answer!!!

-----Original Message-----
up
an PC for a wipe
off the XP The
user loves to
be viewed in what looked

Let's see...You have "clients," which means that you are
somehow engaged in the business of selling computer
hardware and/or services. You normally "wipe off XP" and
replace it with 2000, thereby, in all likelihood, voiding
the manufacturer's warranty and leaving your clients with
outmoded technology. Then when the most highly publicized
malicious code since "Melissa" strikes (because of your
failure to properly configure your client's system)you
have to cry for help. It is not possible that you have
"searched the FAQs and MSKB" without finding the answer to
your problem, which means that in addition to being
a moron, you're also too lazy to do what you're being
paid to do. Nice work if you can get it, I guess.
.

 

[Malke]

I'm new to this group. I have a real dilemma. I set up an PC for a
client of mine (with pre-installed OS). Normally, I wipe off the XP
and put Windows 2000 on PCs, but this person wanted to keep their XP
Home Edition. This PC is standalone in an office. It only is used
for minor bookeeping and internet usage (dialll-up). The user loves
MSN 8 and wants to browse with their browser. I activated MSN 8 (also
pre-installed) and it immediately converted her email to be viewed in
hotmail. Following the conversion, an error popped up that said the
browser had an RPC error and would shut down in 30 seconds.

Now everytime she goes online, she receives the same message, and her
computer reboots. I've search the FAQs and MSKB, and can't find a
reference to this. I installed no software (besides what was
pre-installed). This is supposed to be an "out of the box"
configuration. Of course, since I set the PC on the desk, it must've
been something that I did to it (according to the customer). I
suspect a virus. I saw nothing in her email that looked suspicious.

You're setting up computers - you're a tech - and you don't know what's
going on here? I'm astonished. Your client has the msblaster virus. Go
to www.sarc.com and read all about it. You simply cannot connect an
NT-kernel based machine to the Net without applying the latest rpc
patch. Standard Operating Procedure - 1) install the new os; 2) patch
the new os with at the very *least* the rpc patch but preferrably
whatever SR* are available from a cd-r you (the tech) previously
created; 3) then hook up to the Internet and immediately go to Windows
Update and apply all security updates, rebooting as necessary; 4) when
the os is completely patched, install an antivirus program and update
its definitions.

Malke

 

[Guest]

Go work at McDonalds. Start with cleaning bathrooms and
eventually work your way up to making fries. Your family
will be proud!

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Igor Smeghead]

Let's see...You have "clients," which means that you are
somehow engaged in the business of selling computer
hardware and/or services. You normally "wipe off XP" and
replace it with 2000, thereby, in all likelihood, voiding
the manufacturer's warranty and leaving your clients with
outmoded technology. Then when the most highly publicized
malicious code since "Melissa" strikes (because of your
failure to properly configure your client's system)you
have to cry for help. It is not possible that you have
"searched the FAQs and MSKB" without finding the answer to
your problem, which means that in addition to being
a moron, you're also too lazy to do what you're being
paid to do. Nice work if you can get it, I guess.

I did not want to start a flame war. I never said that I was a
computer tech. When I said that I normally wiped XP, I was referring
to my home computers. (Which does not affect any one else's warranty).
The user is a client for the company I work for, that knew that I
dabbled in computers. They wanted me to unbox and hookup the
computer. I was told that I should not post to a newsgroup unless I
was willing to research the problem a little bit first. I was just
looking for a couple of answers to help someone out. I didn't mean to
bring the wrath of anyone that is so smart that they don't have time
to help others.

 

[Igor Smeghead]

Thanks to those that gave me suggestions. I've patched it, and
everything is fine