RPC Shut Down Message

B

bobd

I keep getting an RPC shut down message along with this
error in the event viewer.

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BA from line
44 of d:\nt\com\com1x\src\events\tier1
\eventsystemobj.cpp. Please contact Microsoft Product
Support Services to report this error.
 
S

Shenan Stanley

bobd said:
I keep getting an RPC shut down message along with this
error in the event viewer.

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BA from line
44 of d:\nt\com\com1x\src\events\tier1
\eventsystemobj.cpp. Please contact Microsoft Product
Support Services to report this error.


COULD be Blaster:

Get rid of Blaster first:
http://www.microsoft.com/security/incident/blast.asp

Once you get there - PRINT IT.. If the shutdown message appears, click on
START, select RUN and type in the following line:

shutdown -a

and click OK.

That will abort the shutdown and you can continue cleaning the machine.

After you have followed Microsoft's fine instructions, do these things to
really clean up the machine.. There is no telling what other parasites might
be hanging out in your computer:

Although some people complain about this "long list" of things I give, if
you do these things (some periodically) then I truly believe (because I see
it every day from others I have suggested it to) that you can keep your
machine spyware/adware/malware/virus/trojan free and running much better
than it likely does by the time you ask this question on a newsgroup like
this one.

So, that being said, here is the list:

Turn on that firewall...
http://www.microsoft.com/WindowsXP/home/using/howto/homenet/icf.asp
(It has been reported that it now works with AOL 9.0+)


Make sure you have all the updates (critical) installed from:
http://windowsupdate.microsoft.com/
(Scan for updates, Review and Install)


Get rid of the spy/ad/mal-ware..
(Yes - using MORE than one of these..
I recommend at least the first three. Also..
UPDATE the definitions for them before using.)

Spybot Search and Destroy
http://www.safer-networking.net/

Lavasoft AdAware
http://www.lavasoft.de

CWSShredder
http://www.spywareinfo.com/~merijn/downloads.html

Hijack This!
http://mjc1.com/mirror/hjt/

I also like "The Cleaner" and "SpywareBlaster" and "SpywareGuard".
- http://www.moosoft.com/
- http://www.javacoolsoftware.com/

The first is a PAY product, but useable for 30 days - it has found and
eliminated problems in the past the others did not. The latter two are
prevention mechanisms. I like SpywareGuard for those with enough processor
to have something running like antivirus software - and it prevents browser
hijacking quite well.


And Assortment of Others:
http://www.merijn.org/downloads.html


After you cleanup your PC somewhat of spy/ad/mal-ware, verify your antivirus
software is updated and run a full scan of your computer. If you have no
antivirus software - get one NOW! Grisoft AntiVirus:
http://www.grisoft.com/us/us_dwnl_free.php


Empty your Temporary Internet Files and shrink the size it stores to about
80 to 120MB (seems to be an optimal size for the normal user)

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section,
do the following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the
"Amount of disk space to use:" to something between 80MB
and 120MB. (Betting it is MUCH larger right now.)
- Click OK.
- Click on "Delete Files" and select to
"Delete all offline contents" (the checkbox) and click
OK. (If you had a LOT, this could take 2-10 minutes or
more.)
- Once it is done, click OK, close Internet Explorer
- Re-open Internet Explorer.


Uninstall any software you do not use often/ever. (If you have something
installed but never use it, uninstall it.) If you go through Control
Panel -> Add/Remove Programs and see things you seldom if ever use, it is to
your advantage to remove it.


Also, if you are tired of Web Page Pop-Ups/Unders.. You could try the
Google Toolbar.
http://toolbar.google.com/


Stop loading applications at logon.. run MSCONFIG and look under the startup
tab for things you DON'T want to startup! Search the Internet with Google
to discover what things are safe to remove and what things may even be
malware infecting your computer.


Better control your email and lessen the amount of time you spend dealing
with SPAM:
SpamBayes
http://spambayes.sourceforge.net
or
Spamihilator.
http://www.spamihilator.com
 
P

pauly [MSFT]

Hi Bob,

The RPC symptom you describe is typical of recent RPC vulnerabilities that
were patched in recently released Windows critical updates.

RECOMMENDATIONS:

1. You need to install all the latest Windows Critical Updates. Please
visit the Windows Update site:

http://windowsupdate.microsoft.com

2. Check for Critical Updates.

3. From the list, install *only* this specific update (alone, not with any
others):

824146 MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run

4. After you have installed that update, restart Windows XP

5. After restarting, visit the Windows Update site again:

http://windowsupdate.microsoft.com

6. Check for Critical Updates.

7. Install all other remaining critical updates.

8. After you have installed all critical updates restart Windows XP

MORE INFORMATION:

Three steps you can take to improve your computer's security:
http://www.microsoft.com/security/protect/

823980 MS03-026: Buffer Overrun in RPC May Allow Code Execution
http://support.microsoft.com/?id=823980

824146 MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run
http://support.microsoft.com/?id=824146

=========

This posting is provided "AS IS" with no warranties, and confers no rights.

Windows XP Security Homepage:
http://www.microsoft.com/windowsxp/security/default.asp

Windows 2000 Security Homepage:
http://www.microsoft.com/windows2000/security/default.asp

Top 10 Windows Newsgroups Security Questions:
http://www.microsoft.com/technet/newsgroups/default.asp?url=/technet/newsgro
ups/nodepages/sectop10.asp

=========
Paul Hayes, MCSE
Product Support Services
Microsoft Corporation
(e-mail address removed)


--------------------
| From: "bobd" <[email protected]>
| Subject: RPC Shut Down Message
| Date: Sat, 20 Mar 2004 16:00:55 -0800
|
| I keep getting an RPC shut down message along with this
| error in the event viewer.
|
| The COM+ Event System detected a bad return code during
| its internal processing. HRESULT was 800706BA from line
| 44 of d:\nt\com\com1x\src\events\tier1
| \eventsystemobj.cpp. Please contact Microsoft Product
| Support Services to report this error.
|
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top