RPC Failure accross the domain

[Yaron Bental]

Hi,

We have seen a failure of RPC service at exactly the same
time almost across all servers one of our domains. In fact
all the servers that failed were on the same subnet. Some
machines on the DMZ Were NOT affected.

We are seeing in the event log massage:

The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

Giving the latest msblaster spread out we thought it could
be it. However we are not seeing any other signs of
msblaster. We have tried to use the tools provided from
Symantec to verify if the worm was on there and it didn't
find it.

Is anyone else experiencing the same problem?

Any idea would be greatly appreciated.

Thanks very much.

 

[Lanwench [MVP - Exchange]]

Did you patch all servers and workstations with the MS03-026 patch?

 

[Lanwench [MVP - Exchange]]

Install it on all servers ASAP. Then see the removal tool for the worm at
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You also need a good network firewall if you don't have one already...

 

[Yaron Bental]

yep it was the worm. it just have different behaviour when
you use terminal servers.

Thanks for you help.