RPC

[ibc99@aol/com]

system shuts down every few minutes with msg that RPC
(remonte procedure call) terminated unexpectedly. must
hurry bc it will shut down any second. Please help

 

[wojo]

In run diag type "services.msc /s"
Find the line "Remote Procedure Call (RPC)" NOT "(RPC) Locator
right Click | Properties
Recovery Tab
Change all failure drop down selection boxes to "Restart the Service"
instead of "Restart the Computer"
This will stop your computer from shutting down while you go to MS website
to get all the information about the .MBlaster Virus. THEN TURN ON YOUR
FIREWALL
Te removal tool etc.. is available there.
If you are able to get rid of the Blaster Worm w/o reinstalling XP then be
sure to change the service back to "Restart the Computer" when your done. If
the problem comes back then you didn't get rid of the worm. First thing once
you know the worm is gone is to download critical updats and patches so the
worm doesn't return
If you do end up needing to format and reinstall XP, which is the case with
a lot of people in this situation, MAKE SURE TO TURN YOUR FIREWALL ON before
you access the internet and then 1st thing you do is to download the
critical updates as one of them is a patch to avoid getting the Blaster
Worm.

 

[Kelly]

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.

Close Windows Explorer, run the edit on line 257 which includes the prompt
for the patch once your system has been cleaned.

This script removes all variants of the W32.Blaster.Worm (original, B, C, D,
E and F) and will inform you whether or not the patch is already installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

More information here:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

MS Blaster Tool: http://tinyurl.com/3h8kw

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH