System shuts down -RPC terminated unexpectedly

[Rio]

Hi,
My laptop was infected by the sasser virus before and now
I am getting the problem of the system shutting down with
the message that Remote Procedure Call service terminated
unexpectedly. Tried to run the program that cleaned it
from sasser but it says the system is not infected. I
looked at the application event log and there are so many
errors from the EventSystem (ie event id 4609 etc.). I
can't open any application. Thanks.
Rio

 

[A.A. Fussy]

Rio,
Window key+R-shutdown -a
Download the 8242146, i think from Windows update

 

[Will Denny]

Hi

Are you sure that the Sasser Worm has been *completely* eradicated. See the
following links:

"What You Should Know About the Sasser Worm and Its Variants"
http://www.microsoft.com/security/incident/sasser.asp

"How to protect your PC"
http://www.microsoft.com/security/protect/

Link to direct download:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

--

Will Denny
MS-MVP Windows - Shell/User


| Hi,
| My laptop was infected by the sasser virus before and now
| I am getting the problem of the system shutting down with
| the message that Remote Procedure Call service terminated
| unexpectedly. Tried to run the program that cleaned it
| from sasser but it says the system is not infected. I
| looked at the application event log and there are so many
| errors from the EventSystem (ie event id 4609 etc.). I
| can't open any application. Thanks.
| Rio

 

[Bruce Chambers]

Greetings --

Didn't catching Sasser teach you to use a firewall?

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB828471 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

MS04-012 Cumulative Update for Microsoft RPC-DCOM
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH