RPC Terminated

[Dev]

Hi,

I had to re-install WindowsXp on my desktop PC. All went
well. But now xp keeps crashing with NT Authority / System
reboots (shutsdown) the pc because it says Win32 services
Remote Procedure Call Terminated Unexpectedly.

ANyone know what I should do. The pc does not stay up
long enough to get updates etc. I am sending this from my
laptop!

Thanks for any help - Dev

PS My disk was partioned using Partition Magic.

 

[Marc Reynolds [MSFT]]

It appears your computer has been infected with the Blaster virus. For more
information and how to fix this please see these links:

http://www.microsoft.com/downloads/...8b-fe98-493f-ad76-bf673a38b4cf&displaylang=en

http://support.microsoft.com/?kbid=826955

http://www.microsoft.com/security/incident/blast.asp

http://www.microsoft.com/security/protect/main.asp


--

Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Patti MacLeod]

Hi Dev,

Sounds like you've been bitten by the MSBlaster worm or the Welchia worm.

Have a look here for information about the Blaster worm and its variants:
http://www.microsoft.com/security/incident/blast.asp

And here is information about the Welchia worm:
http://tinyurl.com/kdp6

You need to d/load and install Security patch KB824146, available here:
http://support.microsoft.com/?kbid=824146#WinXP

Also, d/load and run the Blaster and Welchia worm removal tool:
http://support.microsoft.com/default.aspx?scid=833330


Regards,

 

[Hawkens]

You have gotten yourself infected with MSBlast or a
variation of it.

Go to Services select RPC and change the Recovery setting
to take no action. Now the system will not reboot.

Then download the all the critical updates from Windows
Update and enable your firewall.

Then go back to services and select RPC and change the
recovery settings back to reboot.

Hawkens

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Dev]

Hi, thanks to all who replyed. The PC was infected by W32 ?
Nachi.B worm. I had to download the virus sig. file using
my laptop. Load this into the virus software on my desktop
and disinfect the PC. The infection happened in probably
less than minute after I connected my newly built Windows
XP to the internet! I plan to keep a copy of the current
sig. file handly always. The auto update for the virus is
ok but not helpful when things go wrong and one has to
re-install the OS! Thanks again - Dev