Urgent: Remote System Call (RCP) Service

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

In the last two days or so XP has been shutting down on me by itself stating that 'Windows must now restart because the Remote Procedure Call (RCP) service has terminated unexpectedly.

Now, even after a reformat (See my other thread 'Subject: Slow Speed after Reformat'), this problem still happens. I was told before that it might be the blaster virus, but after running the tools to remove that and reformatting, the problem is still here, so I assume that's not it

Any advice?
 
| In the last two days or so XP has been shutting down on me by itself
stating that 'Windows must now restart because the Remote Procedure Call
(RCP) service has terminated unexpectedly.'
|
| Now, even after a reformat (See my other thread 'Subject: Slow Speed after
Reformat'), this problem still happens. I was told before that it might be
the blaster virus, but after running the tools to remove that and
reformatting, the problem is still here, so I assume that's not it.
|
| Any advice?

If you reformatted the computer and then connected to the Internet without
enabling a firewall and repatching your system then you were reinfected with
the Blaster Worm. I only takes a couple of seconds. Any protective steps you
took prior to reformatting were lost in the formatting process.

http://www3.telus.net/dandemar/blaster.htm

Please take note at the top of this page thoughtfully provided by Jupiter
Jones.

"Follow the steps carefully and do not skip any steps."


--
D

I'm not an MVP a VIP nor do I have ESP.
I was just trying to help.
Please use your own best judgment before implementing any suggestions or
advice herein.
No warranty is expressed or implied.
Your mileage may vary.
See store for details. :)

Remove shoes to E-mail.
 
Hi Jordan,

When the shutdown warning appears, click start/run and enter "shutdown -a"
to halt the process. It's a virus called blaster or lovesan. Information:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://www.pchell.com/virus/msblast.shtml
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



Jordan said:
In the last two days or so XP has been shutting down on me by itself
Click to expand...
stating that 'Windows must now restart because the Remote Procedure Call
(RCP) service has terminated unexpectedly.'
Now, even after a reformat (See my other thread 'Subject: Slow Speed after
Click to expand...
Reformat'), this problem still happens. I was told before that it might be
the blaster virus, but after running the tools to remove that and
reformatting, the problem is still here, so I assume that's not it.
 
Greetings --

If you connected the PC to the Internet without having first
enabled a firewall, without having first installed an antivirus
application with current virus definition files, and before installing
the KB824146 Hotfix, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Back
Top