Windows xp home edition

[mark betz]

My father in laws computer is infected, but the computer
shuts down and reboots before we have time to load patch
over the internet. How can I stop from shutting down and
rebooting long enough to download patch.

 

[Dawn]

Hi Mark:

First do this:

Restoring Internet connectivity and preventing the
computer from shutting down
In many cases, on both Windows 2000 and XP, changing the
settings for the Remote Call Procedure (RPC) service may
allow you to connect to the Internet to obtain downloads,
and will stop the computer from shutting down.

Click Start > Run. (The Run dialog box appears.)
Type:

SERVICES.MSC /S

in the open line, and then click OK. (The Services window
opens.)


In the right pane, locate the Remote Procedure Call (RPC)
service.

then go to
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.removal.tool.html

for the free tool.

Good luck!

 

[Dawn]

Duh, you need the whole list, sorry:

Restoring Internet connectivity and preventing the
computer from shutting down
In many cases, on both Windows 2000 and XP, changing the
settings for the Remote Call Procedure (RPC) service may
allow you to connect to the Internet to obtain downloads,
and will stop the computer from shutting down.

Click Start > Run. (The Run dialog box appears.)
Type:

SERVICES.MSC /S

in the open line, and then click OK. (The Services window
opens.)


In the right pane, locate the Remote Procedure Call (RPC)
service.



----------------------------------------------------------
----------------------
CAUTION: A service named Remote Procedure Call (RPC)
Locator exists. Do not confuse the two.
----------------------------------------------------------
----------------------



Right-click the Remote Procedure Call (RPC) service, and
then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second
failure, and Subsequent failures to "Restart the
Service."
Click Apply, and then click OK.

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Go to http://www.kellys-korner-xp.com/xp_qr.htm#rpc and download the removal
tool.
Run the tool to remove the worm,then follow the onscreen prompts to download
the patch.
Make sure you download the 32bit patch if you are running XP.

There are more variants out now.
The exes for 2 of the variants are teekids.exe and penis32.exe
Kelly's script kills all known variants.
As more variants are found Kelly and Doug are adding removal instructions to
the script to kill them as well.

If you are having trouble staying up to get the patch and removal tool:
When the shutdown prompt appears,go to start/run and type
shutdown -a to abort the shutdown process to allow you to stay up and
online.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -