Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Support > Remote Procedure Call

Reply
Thread Tools

Remote Procedure Call

 
 
bpgordon
Guest
Posts: n/a
 
      02-16-2004
Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
goes into "System Shutdown initiated by NT Authority\System. Windows must
now restart because the Remote Procedure Call (RPC) terminated
unexpectedly." When I follow Windows XP network connections troubleshooting
procedure, Network Tasks, Change Settings of this Connection, Client for
Microsoft Network, Properties, System; the Service Control Manager gives an
Event 7022 each time the computer shuts down. I just installed a new modem.

Any ideas


 
Reply With Quote
 
 
 
 
Mara
Guest
Posts: n/a
 
      02-16-2004
On Mon, 16 Feb 2004 11:50:46 -0600, bpgordon wrote:

>Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
>goes into "System Shutdown initiated by NT Authority\System. Windows must
>now restart because the Remote Procedure Call (RPC) terminated
>unexpectedly." When I follow Windows XP network connections troubleshooting
>procedure, Network Tasks, Change Settings of this Connection, Client for
>Microsoft Network, Properties, System; the Service Control Manager gives an
>Event 7022 each time the computer shuts down. I just installed a new modem.
>
>Any ideas


You are infected with Blaster, sounds like.

http://www.sophos.com/support/disinf.../blastera.html

"Patch your system."


>


--
"... by God I *KNOW* what this network is for, and you can't have it."
-- Russ Allbery, 3/31/98
 
Reply With Quote
 
 
 
 
°Mike°
Guest
Posts: n/a
 
      02-16-2004
Boot into Safe Mode and start your registry editor:
Start / Run / regedit

Navigate to:
HKEY_LOCAL_MACHINE
+Software
+Microsoft
+Windows
+CurrentVersion
+Run

In the right-hand pane, look for any entry/ies that include
MSBLAST.EXE, PENIS32.EXE, TEEKIDS.EXE, MSPATCH.EXE,
MSLAUGH.EXE or ENBIEI.EXE .
DELETE it/them.
These are the files associated with the different variants:
Variant A - msblast.exe
Variant B - penis32.exe
Variant C - teekids.exe
Variant D - mspatch.exe
Variant E - mslaugh.exe
Variant F - enbiei.exe

You just disabled the worm from running at startup, so boot into
normal mode again, and turn off ALL system restores to purge
your system.

Open Windows Explorer to the ..\Windows\System32\ or
...\WinNT\System32\ folder and DELETE *any* of the
files named above.

Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
and find the reference to the above file/s (any reference will
be similar to: <filename.exe>-<alphanumerics>.PF), for example,
msblast.exe-0235D8H6.pf, and DELETE it/them.

Now you can download and install the patch, configure your
firewall and update your virus scanner.

Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955

Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/sec...n/MS03-026.asp

What you should know about the Blaster worm
http://www.microsoft.com/security/incident/blast.asp

Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

How to Use The KB 823980 Scanning Tool to Identify Host Computers
That Do Not Have The 823980 Security Patch (MS03-026) Installed
http://support.microsoft.com/default.aspx?kbid=826369

W32.Blaster.Worm
http://www.symantec.com/avcenter/ven...ster.worm.html

W32.Blaster.B.Worm
http://www.symantec.com/avcenter/ven...er.b.worm.html

W32.Blaster.C.Worm
http://www.symantec.com/avcenter/ven...er.c.worm.html

W32.Blaster.D.Worm
http://www.symantec.com/avcenter/ven...er.d.worm.html

W32.Blaster.E.Worm
http://www.symantec.com/avcenter/ven...er.e.worm.html

W32.Blaster.F.Worm
http://www.symantec.com/avcenter/ven...er.f.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html


On Mon, 16 Feb 2004 11:50:46 -0600, in
<(E-Mail Removed)>
bpgordon scrawled:

>Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
>goes into "System Shutdown initiated by NT Authority\System. Windows must
>now restart because the Remote Procedure Call (RPC) terminated
>unexpectedly." When I follow Windows XP network connections troubleshooting
>procedure, Network Tasks, Change Settings of this Connection, Client for
>Microsoft Network, Properties, System; the Service Control Manager gives an
>Event 7022 each time the computer shuts down. I just installed a new modem.
>
>Any ideas
>


--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html
 
Reply With Quote
 
Harrison
Guest
Posts: n/a
 
      02-16-2004
http://securityresponse.symantec.com...ster.worm.html


On Mon, 16 Feb 2004 11:50:46 -0600, "bpgordon" <(E-Mail Removed)> wrote:

>Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
>goes into "System Shutdown initiated by NT Authority\System. Windows must
>now restart because the Remote Procedure Call (RPC) terminated
>unexpectedly." When I follow Windows XP network connections troubleshooting
>procedure, Network Tasks, Change Settings of this Connection, Client for
>Microsoft Network, Properties, System; the Service Control Manager gives an
>Event 7022 each time the computer shuts down. I just installed a new modem.
>
>Any ideas
>


 
Reply With Quote
 
Dan Shea
Guest
Posts: n/a
 
      02-16-2004
On Mon, 16 Feb 2004 11:50:46 -0600, "bpgordon" <(E-Mail Removed)>
wrote:

>Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
>goes into "System Shutdown initiated by NT Authority\System. Windows must
>now restart because the Remote Procedure Call (RPC) terminated
>unexpectedly." When I follow Windows XP network connections troubleshooting
>procedure, Network Tasks, Change Settings of this Connection, Client for
>Microsoft Network, Properties, System; the Service Control Manager gives an
>Event 7022 each time the computer shuts down. I just installed a new modem.
>
>Any ideas


Working on the assumption that you don't have the MS Blaster worm....

Uninstall and re-install the Client for Microsoft Networks component.
What other components do you have installed?

Cheers,
dan

 
Reply With Quote
 
JWooden271
Guest
Posts: n/a
 
      02-16-2004
You appear to have the blaster virus.

Here are some actions that you can take:

1. Remove the virus. You can use this free tool from Microsoft to remove
the virus:
http://snipurl.com/3rq0

2. Enable your Windows XP firewall. Follow these instructions:
********************************************
How to Enable Internet Connection Firewall (ICF) on Windows XP

1. On the taskbar at the bottom of your screen, click Start, and
then click Control Panel.
2. Click the Network and Internet Connections category.
(If the Network and Internet Connectionsis not visible, click
Switch to Category View under Control Panel on the left side of the
Control Panel window.)
3. Click Network Connections.
4. Right-click the Dial-up, LAN, or High-Speed Internet connection
that you use to connect to the Internet, and then click Properties from
the context menu.
5. On the Advanced tab, under Internet Connection Firewall, select
Protect my computer or network, and then click OK.
*********************************************
3. Update Windows.
Go to http://windowsupdate.microsoft.com/
Downlaod all of the critical patches. This may take a while to download
and install

4. Install anti-virus software. You can obtain many for free, such as:
AVG Anti-Virus, http://www.grisoft.com/us/us_dwnl_free.php
eTrust EZ Armor, http://www.my-etrust.com/microsoft/index.cfm

More info see: http://www.microsoft.com/security/incident/blast.asp

I hope this was helpful.

bpgordon wrote:
> Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
> goes into "System Shutdown initiated by NT Authority\System. Windows must
> now restart because the Remote Procedure Call (RPC) terminated
> unexpectedly." When I follow Windows XP network connections troubleshooting
> procedure, Network Tasks, Change Settings of this Connection, Client for
> Microsoft Network, Properties, System; the Service Control Manager gives an
> Event 7022 each time the computer shuts down. I just installed a new modem.
>
> Any ideas
>
>


 
Reply With Quote
 
Tim Kettring
Guest
Posts: n/a
 
      02-16-2004
"JWooden271" <(E-Mail Removed)> wrote in message
news:eM7Yb.3529$(E-Mail Removed)...
> You appear to have the blaster virus.
>
> Here are some actions that you can take:
>
> 1. Remove the virus. You can use this free tool from Microsoft to remove
> the virus:
> http://snipurl.com/3rq0
>
> 2. Enable your Windows XP firewall. Follow these instructions:
> ********************************************
> How to Enable Internet Connection Firewall (ICF) on Windows XP
>
> 1. On the taskbar at the bottom of your screen, click Start, and
> then click Control Panel.
> 2. Click the Network and Internet Connections category.
> (If the Network and Internet Connectionsis not visible, click
> Switch to Category View under Control Panel on the left side of the
> Control Panel window.)
> 3. Click Network Connections.
> 4. Right-click the Dial-up, LAN, or High-Speed Internet connection
> that you use to connect to the Internet, and then click Properties from
> the context menu.
> 5. On the Advanced tab, under Internet Connection Firewall, select
> Protect my computer or network, and then click OK.
> *********************************************
> 3. Update Windows.
> Go to http://windowsupdate.microsoft.com/
> Downlaod all of the critical patches. This may take a while to download
> and install
>
> 4. Install anti-virus software. You can obtain many for free, such as:
> AVG Anti-Virus, http://www.grisoft.com/us/us_dwnl_free.php
> eTrust EZ Armor, http://www.my-etrust.com/microsoft/index.cfm
>
> More info see: http://www.microsoft.com/security/incident/blast.asp
>
> I hope this was helpful.
>
> bpgordon wrote:
> > Every 5-10 minutes after I am logged onto the Internet (MSN9), the

computer
> > goes into "System Shutdown initiated by NT Authority\System. Windows

must
> > now restart because the Remote Procedure Call (RPC) terminated
> > unexpectedly." When I follow Windows XP network connections

troubleshooting
> > procedure, Network Tasks, Change Settings of this Connection, Client for
> > Microsoft Network, Properties, System; the Service Control Manager gives

an
> > Event 7022 each time the computer shuts down. I just installed a new

modem.
> >
> > Any ideas
> >
> >

>


Mine was doing the exact same thing , msblaster.exe and mslaugh.exe

To disable RPC , in an XP start>control pannel>administrative
tools>recovery tab> select " take no action " for all 3

It apparently remembered my IP addy because every time I deleated
msblaster.exe , it would show up again

It is stopped from coming back with the XP firewall enabled


 
Reply With Quote
 
Harrison
Guest
Posts: n/a
 
      02-16-2004
>Mine was doing the exact same thing , msblaster.exe and mslaugh.exe
>
>To disable RPC , in an XP start>control pannel>administrative
>tools>recovery tab> select " take no action " for all 3
>
>It apparently remembered my IP addy because every time I deleated
>msblaster.exe , it would show up again
>
>It is stopped from coming back with the XP firewall enabled


You need to use a removal tool. While these efforts may have treated the symptoms, the virus is more than likely still
resident on your computer.
 
Reply With Quote
 
Tim Kettring
Guest
Posts: n/a
 
      02-17-2004
<Harrison> wrote in message
news(E-Mail Removed)...
> >Mine was doing the exact same thing , msblaster.exe and mslaugh.exe
> >
> >To disable RPC , in an XP start>control pannel>administrative
> >tools>recovery tab> select " take no action " for all 3
> >
> >It apparently remembered my IP addy because every time I deleated
> >msblaster.exe , it would show up again
> >
> >It is stopped from coming back with the XP firewall enabled

>
> You need to use a removal tool. While these efforts may have treated the

symptoms, the virus is more than likely still
> resident on your computer.


True , but the op needs to be able to connect long enough to be able to use
the removal tool , and the above should do it but should be set back to
noraml once the blaster worm/virus is removed .


 
Reply With Quote
 
reid decker
Guest
Posts: n/a
 
      02-17-2004
You have the virus I once had. I got rid of it by getting the Microsoft
Patch. Use Google (I think I did).
"bpgordon" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Every 5-10 minutes after I am logged onto the Internet (MSN9), the

computer
> goes into "System Shutdown initiated by NT Authority\System. Windows must
> now restart because the Remote Procedure Call (RPC) terminated
> unexpectedly." When I follow Windows XP network connections

troubleshooting
> procedure, Network Tasks, Change Settings of this Connection, Client for
> Microsoft Network, Properties, System; the Service Control Manager gives

an
> Event 7022 each time the computer shuts down. I just installed a new

modem.
>
> Any ideas
>
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Remote Procedure Call Dan Computer Support 4 01-22-2004 07:44 AM
Windows Remote Call Procedure MaryL Computer Support 13 01-05-2004 08:49 AM
(RPC)Remote Procedure Call has closed and windows needs to shut down!!!!!!! fokker Computer Support 7 09-11-2003 07:50 AM
Remote Procedure Call Message Jill Sharp Computer Support 2 08-15-2003 11:20 AM
Remote Procedure Call Service terminated unexpectedly? Patrick D. Computer Support 18 08-12-2003 07:32 PM



Advertisments