RPC service terminated error

[marty]

I have a message that comes up, at what seems to be
randomly, it is an intermittent problem that
states: "Remote Procedure Call Service Terminated
Unexpectedly", and it then gives me a few seconds to close
all open windows and applications, and then my computer
shuts down. Has anyone had a similar problem? Please let
me know if you know what may be causing this and/or how I
might be able to fix it. Thanks

 

[Bored]

Blaster Worm........
First, stop the bug from running by hitting CTRL-ALT-DELETE and
bringing up the task manager. Look for msblast.exe in the list, and
kill it. Now your computer won't shut down, but the bug is still there
and will run the next time you start your machine. Go to this URL to
find out how to get rid of it:
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.re
moval.tool.html>

See www.kellys-korner-xp.com/xp_qr.htm#rpc
<http://www.kellys-korner-xp.com/xp_qr.htm> for a quick removal tool for the
MSBlast worm and a link to the Microsoft patch to prevent future infection.
Then update your antivirus software and scan your system.

 

[Marc Reynolds [MSFT]]

Hi,

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see follow this link:

http://www.microsoft.com/security/incident/blast.asp

http://www.microsoft.com/security/protect/main.asp


Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

 

[Bruce Chambers]

Greetings --

If you've connected the PC to the Internet without having first
enabling a firewall, without having first installed an antivirus
application with current virus definition files, and/or before
installing the KB824146 Hotfix, you're very likely to have been
infected from any of the thousands of PCs on the Internet that are
constantly broadcasting the Blaster and/or Welchia worms. It only
takes a few seconds of exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Murph]

This just happened to my mother-in-law tonight (she got
that message then the computer shut down). Only now she
can't boot up properly. First it asked for her password
whne she clicked on her user account (she doesn't have
one). Then it rebooted. This happened a few times and
now it loads up Windows, but there are no icons or even a
task bar, so she can't even click the Start button,
basically she has no way of running any Windows
programs. The strange thing is she has Norton Anti-virus
2004, I installed it last week. So how does she get back
up and running? Anyway to get to the internet through
DOS? She has cable access, in fact she was on the
comcast (her ISP) web site when all this happened. Can I
possibly download the patch, burn it on a CD-ROM, and put
it on her machine (again I'd probably have to do this
thorugh DOS)

Thanks for your help.

 

[Tiffany Roach]

I'm having the same error, but this laptop has been updated with all
of the Microsoft Security patches and updates before I started getting
this error. I did a search of the entire hard drive and didn't find
the msblast.exe file and I also executed both of the fixes for the
Blaster and Welchia, which I downloaded from McAfee, and nothing was
found when I executed both of those fixes. My antivirus dat files are
completely up-to-date and I performed a full scan, but still didn't
find anything. Any suggestions??

Tiffany Roach

 

[Bruce Chambers]

Greetings --

While the Blaster Worm is by far and away the most common cause of
RPC errors, there can be cases when its not the worm that causes the
problems. Additionally, the Microsoft patch does not remove the
worm, nor is it intended to do so. It is designed to block the
vulnerability that lets the worm into your PC in the first place, and
to prevent reinfection.

In this case, more troubleshooting is indicated. Can the PC be
booted into Safe Mode? Here are a couple of things to try, in
addition to the tools listed in my first post:

HOW TO Perform Advanced Clean-Boot Troubleshooting in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&Product=winxp

Description of the Windows XP Recovery Console
http://support.microsoft.com/directory/article.asp?ID=kb;en-us;Q314058

System File Checker
System File Checker (sfc.exe) is a command line utility that scans and
verifies the versions of all protected system files after you restart
your computer. If System File Checker discovers that a protected file
has been overwritten, it retrieves the correct version of the file
from the %systemroot%\system32\dllcache folder, and then replaces the
incorrect file.

Syntax:

sfc [/scannow] [/scanonce] [/scanboot] [/cancel] [/quiet] [/enable]
[/purgecache] [/cachesize=x]

Parameters:

/scannow

Scans all protected system files immediately.

/scanonce

Scans all protected system files once.

/scanboot

Scans all protected system files every time the computer is restarted.

/cancel

Cancels all pending scans of protected system files.

/quiet

Replaces all incorrect file versions without prompting the user.

/enable

Returns Windows File Protection to default operation, prompting the
user to restore protected system files when files with incorrect
versions are detected.

/purgecache

Purges the Windows File Protection file cache and scans all protected
system files immediately.

/cachesize=x

Sets the size, in MB, of the Windows File Protection file cache.

If the above doesn't help, you may need to perform a repair
(a.k.a. in-place upgrade) installation:

How to Perform an In-Place Upgrade of Windows XP
http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q315341



Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Peter Hutchison]

This just happened to my mother-in-law tonight (she got
that message then the computer shut down). Only now she
can't boot up properly. First it asked for her password
whne she clicked on her user account (she doesn't have
one). Then it rebooted. This happened a few times and
now it loads up Windows, but there are no icons or even a
task bar, so she can't even click the Start button,
basically she has no way of running any Windows
programs. The strange thing is she has Norton Anti-virus
2004, I installed it last week. So how does she get back
up and running? Anyway to get to the internet through
DOS? She has cable access, in fact she was on the
comcast (her ISP) web site when all this happened. Can I
possibly download the patch, burn it on a CD-ROM, and put
it on her machine (again I'd probably have to do this
thorugh DOS)

No you cannot install through DOS as there is NO DOS mode!
You have to install in Windows, try booting in Safe Mode, load
Services.msc then find Remote Procedure Call (RPC) and change the
Recovery to 'Take No Action' instead of 'Restart the Computer'.

Then you can install the patches w/o the PC rebooting all the time.

Peter Hutchison
Windows FAQ
http://www.pcguru.plus.com/