RPC shutting down my computer

[Kerri]

I just installed winxp on my computer. It installed right
and I typed in my registration code that came with the xp
cd. My problem is this: after being on internet for 10-20
minutes, a box pops up stating RPC protocol is shutting
down windows. How do I correct this problem?

 

[David H. Lipman]

When you get the shutdown message...

Go to; Start --> Run
enter; shutdown -a

This will halt the shutdown and give you a chance to Download the McAfee worm removal tool,
Stinger: http://vil.nai.com/vil/stinger/ or the Microsoft Lovsan/Blaster and Nachi/Welchia
Removal Tool
http://www.microsoft.com/downloads/...8B-FE98-493F-AD76-BF673A38B4CF&displaylang=en
and install the following patch for the RPC/RPCSS and DCOM Vulnerabilities that are
addressed by Microsoft Security Bulletin MS04-012 - KB828741
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741 and finally
http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

Please read: http://www.microsoft.com/security/incident/blast.asp

You also need a FireWall. If you don't patch the PC and not use a FireWall then you will
just be re-infected.

I also suggest the installation of *ALL* MS Critical Updates ASAP.

Dave







| I just installed winxp on my computer. It installed right
| and I typed in my registration code that came with the xp
| cd. My problem is this: after being on internet for 10-20
| minutes, a box pops up stating RPC protocol is shutting
| down windows. How do I correct this problem?

 

[Phil]

Never go online without using a firewall.

Always run a firewall and anti-virus programs on your computer at all times.



You are infected with the Blaster worm virus.



To stop the rebooting/shutdowns, right click on the task bar, choose task
manager, processes tab, look for msblast.exe. Highlight it and click end
process. Then turn on the xp firewall.

To turn on the firewall: control panel, network and internet connections,
network connections, right click your connection, properties, advanced tab,
check the protect my computer box. Do this as quickly as you can once the
desktop comes up. Then visit the sites below for the removal and patch info.

Make sure to follow the link to the Microsoft pages for the fix, then visit
windows update for all the seciruty patches after you remove it.

http://www.microsoft.com/security/incident/blast.asp

 

[Kerri]

I already had the firewall turned on and anti virus
installed before I went online. When I went to task
manager, msblast is not in there at all. Since none of
the above applies, could I have a different problem?
Plus, since I reformatted the computer while upgrading to
xp, wouldnt the reformat have gotten rid of any potential
viruses? Computer ran fine until I installed xp over
win98.

Kerri

 

[David H. Lipman]

It means that you were not infected with Blaster/Lovsan. It does NOT mean you were not
vulnerable to it. Read my response and install the RRPC/RPCSS DCOM patch as prescribed.

You might have had the FireWall turned-on but it must not have been configured to block
TCP/UDP port 135. otherwise you would not have had been shutdown. Additionally if you had
patched your PC you would not have been shut down.

If you connect to the Internet via broadband such as Cable or DSL, get a Cable.DSL Router
such as the Linksys BEFSR41 and block TCP/UDP ports 135~139 and 445 and there would be
increased protection gained (there are *many* other benefits as well).

Dave




| I already had the firewall turned on and anti virus
| installed before I went online. When I went to task
| manager, msblast is not in there at all. Since none of
| the above applies, could I have a different problem?
| Plus, since I reformatted the computer while upgrading to
| xp, wouldnt the reformat have gotten rid of any potential
| viruses? Computer ran fine until I installed xp over
| win98.
|
| Kerri
|
|
| >-----Original Message-----
| >Never go online without using a firewall.
| >
| >Always run a firewall and anti-virus programs on your
| computer at all times.
| >
| >
| >
| >You are infected with the Blaster worm virus.
| >
| >
| >
| >To stop the rebooting/shutdowns, right click on the task
| bar, choose task
| >manager, processes tab, look for msblast.exe. Highlight
| it and click end
| >process. Then turn on the xp firewall.
| >
| >To turn on the firewall: control panel, network and
| internet connections,
| >network connections, right click your connection,
| properties, advanced tab,
| >check the protect my computer box. Do this as quickly as
| you can once the
| >desktop comes up. Then visit the sites below for the
| removal and patch info.
| >
| >Make sure to follow the link to the Microsoft pages for
| the fix, then visit
| >windows update for all the seciruty patches after you
| remove it.
| >
| >http://www.microsoft.com/security/incident/blast.asp
| >
| >
| >Kerri wrote:
| >> I just installed winxp on my computer. It installed
| right
| >> and I typed in my registration code that came with the
| xp
| >> cd. My problem is this: after being on internet for 10-
| 20
| >> minutes, a box pops up stating RPC protocol is shutting
| >> down windows. How do I correct this problem?
| >
| >
| >.
| >

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB828471 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

MS04-012 Cumulative Update for Microsoft RPC-DCOM
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Phil]

Sorry, I apologize, I need to update my reply. You most likely are infected
as there are many variations now that are named different than msblast. Just
follow the link to the ms site and do what they say to check for and remove
the virus and patch your system.