RPC shutdown - Please Help

[Bubba]

Please help me. I am totally stumped.

When running surfing the internet with between 2 and 4
Explorer windows open at different websites. I get
the "Remote Procedure Call (RPC)", initiated by NT
Authority\System" error message that others in this forum
have talked about and gotten solutions based on the
problem being the blaster virus. So, I breathed a sigh of
relief and followed the solutions offered.

But, the solutions didn't work. I have used both the
Symantec fixblast tool and the Mcafee tool. I followed the
instructions and turned off System Restore and then ran
them. When I ran Symantec 1 time in normal mode from an
administrator account, the tool said it couldn't find
blaster and I figured the virus was protecting itself in
normal mode so I booted in safe mode and per Symantec's
instructions ran the tool twice. The tool came back both
times with a "blaster is not on the system" message.

So I tried to go into the registry manually with "start--
run--regedit" and the registry came up momentarily and
then disappeared. So I did "ctrl-alt-delete" to get the
task manager and it did the same thing. When I tried both
again, they didn't come up at all. I got the hour glass
and then the mouse pointer went back to normal. So I went
back to safe mode and the regedit did come up. I went to
the key referenced in the instructions under manual
removal and looked for "windows auto update" and couldn't
find it. Figuring I messed up, I went to edit-find and
looked for "windows auto update." The search came back
with a message that essentially said there is no "windows
auto update" registry key. So I went to explorer and
looked in windows/system32 and windows/system. But
msblast.exe wasn't in either. So I tried Search
on "blast" on all three of my disk drives. Again it did
not find msblast. It did find some sound blaster file
folders so I believe I did the search right.

I have tried to install and run Norton AV 2002 but, like
regedit and task manager, it too comes up and then
immediately shuts down. Norton's system scan from their
website comes back with no viruses found. When I try
McAfee the process hangs. When I try to install the MS03-
026 patch the install terminates. A scan across my home
network with the virus scanner in Norton SystemWorks with
latest updates says there are no viruses.

I am totally at my wits end. I still believe there is a
virus in there somewhere but can't find it. What do I do?

 

[Jupiter Jones [MVP]]

Bubba;
First Enable the firewall:
http://support.microsoft.com/?kbid=283673

Then scan for viruses online, you most likely have another virus other
than Blaster:
http://security.symantec.com/ssc/home.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=EZTSYNBRFNJSVSTIVVB

Then disconnect the network/modem cable and follow this to ensure
blaster is gone:
http://www3.telus.net/dandemar/blaster.htm

Do NOT reconnect network/modem cable until computer is clean and
firewall properly enabled.
It only takes seconds for Blaster to get on the computer, no surfing
necessary.

Also see:
http://www3.telus.net/dandemar/Security.htm

 

[Bubba]

I will do this. Thank-you very.

-----Original Message-----
Bubba;
First Enable the firewall:
http://support.microsoft.com/?kbid=283673

Then scan for viruses online, you most likely have another virus other
than Blaster:
http://security.symantec.com/ssc/home.asp? j=1&langid=ie&venid=sym&plfid=23&pkj=EZTSYNBRFNJSVSTIVVB

Then disconnect the network/modem cable and follow this to ensure
blaster is gone:
http://www3.telus.net/dandemar/blaster.htm

Do NOT reconnect network/modem cable until computer is clean and
firewall properly enabled.
It only takes seconds for Blaster to get on the computer, no surfing
necessary.

Also see:
http://www3.telus.net/dandemar/Security.htm

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/se tup.asp
http://dts-l.org/index.html





.

 

[Jan]

Suggest that you give consideration to the W32Welchia
worm. It's still around, and Symantec has a tool
specifically for removal of Welchia.

 

[Bubba]

Thanks, I'll check it out.

-----Original Message-----
Suggest that you give consideration to the W32Welchia
worm. It's still around, and Symantec has a tool
specifically for removal of Welchia.


.