Remote Procedure Call

Discussion in 'Computer Support' started by bpgordon, Feb 16, 2004.

  1. bpgordon

    bpgordon Guest

    Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    goes into "System Shutdown initiated by NT Authority\System. Windows must
    now restart because the Remote Procedure Call (RPC) terminated
    unexpectedly." When I follow Windows XP network connections troubleshooting
    procedure, Network Tasks, Change Settings of this Connection, Client for
    Microsoft Network, Properties, System; the Service Control Manager gives an
    Event 7022 each time the computer shuts down. I just installed a new modem.

    Any ideas
     
    bpgordon, Feb 16, 2004
    #1
    1. Advertising

  2. bpgordon

    Mara Guest

    On Mon, 16 Feb 2004 11:50:46 -0600, bpgordon wrote:

    >Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    >goes into "System Shutdown initiated by NT Authority\System. Windows must
    >now restart because the Remote Procedure Call (RPC) terminated
    >unexpectedly." When I follow Windows XP network connections troubleshooting
    >procedure, Network Tasks, Change Settings of this Connection, Client for
    >Microsoft Network, Properties, System; the Service Control Manager gives an
    >Event 7022 each time the computer shuts down. I just installed a new modem.
    >
    >Any ideas


    You are infected with Blaster, sounds like.

    http://www.sophos.com/support/disinfection/blastera.html

    "Patch your system."


    >


    --
    "... by God I *KNOW* what this network is for, and you can't have it."
    -- Russ Allbery, 3/31/98
     
    Mara, Feb 16, 2004
    #2
    1. Advertising

  3. bpgordon

    °Mike° Guest

    Boot into Safe Mode and start your registry editor:
    Start / Run / regedit

    Navigate to:
    HKEY_LOCAL_MACHINE
    +Software
    +Microsoft
    +Windows
    +CurrentVersion
    +Run

    In the right-hand pane, look for any entry/ies that include
    MSBLAST.EXE, PENIS32.EXE, TEEKIDS.EXE, MSPATCH.EXE,
    MSLAUGH.EXE or ENBIEI.EXE .
    DELETE it/them.
    These are the files associated with the different variants:
    Variant A - msblast.exe
    Variant B - penis32.exe
    Variant C - teekids.exe
    Variant D - mspatch.exe
    Variant E - mslaugh.exe
    Variant F - enbiei.exe

    You just disabled the worm from running at startup, so boot into
    normal mode again, and turn off ALL system restores to purge
    your system.

    Open Windows Explorer to the ..\Windows\System32\ or
    ...\WinNT\System32\ folder and DELETE *any* of the
    files named above.

    Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
    and find the reference to the above file/s (any reference will
    be similar to: <filename.exe>-<alphanumerics>.PF), for example,
    msblast.exe-0235D8H6.pf, and DELETE it/them.

    Now you can download and install the patch, configure your
    firewall and update your virus scanner.

    Virus Alert About the Blaster Worm and Its Variants
    http://support.microsoft.com/default.aspx?kbid=826955

    Microsoft Security Bulletin MS03-026
    http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

    What you should know about the Blaster worm
    http://www.microsoft.com/security/incident/blast.asp

    Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
    http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php

    How to Use The KB 823980 Scanning Tool to Identify Host Computers
    That Do Not Have The 823980 Security Patch (MS03-026) Installed
    http://support.microsoft.com/default.aspx?kbid=826369

    W32.Blaster.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

    W32.Blaster.B.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.b.worm.html

    W32.Blaster.C.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.c.worm.html

    W32.Blaster.D.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.d.worm.html

    W32.Blaster.E.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.e.worm.html

    W32.Blaster.F.Worm
    http://www.symantec.com/avcenter/venc/data/w32.blaster.f.worm.html

    W32.Blaster.Worm Removal Tool
    http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


    On Mon, 16 Feb 2004 11:50:46 -0600, in
    <>
    bpgordon scrawled:

    >Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    >goes into "System Shutdown initiated by NT Authority\System. Windows must
    >now restart because the Remote Procedure Call (RPC) terminated
    >unexpectedly." When I follow Windows XP network connections troubleshooting
    >procedure, Network Tasks, Change Settings of this Connection, Client for
    >Microsoft Network, Properties, System; the Service Control Manager gives an
    >Event 7022 each time the computer shuts down. I just installed a new modem.
    >
    >Any ideas
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Feb 16, 2004
    #3
  4. bpgordon

    Harrison Guest

    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html


    On Mon, 16 Feb 2004 11:50:46 -0600, "bpgordon" <> wrote:

    >Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    >goes into "System Shutdown initiated by NT Authority\System. Windows must
    >now restart because the Remote Procedure Call (RPC) terminated
    >unexpectedly." When I follow Windows XP network connections troubleshooting
    >procedure, Network Tasks, Change Settings of this Connection, Client for
    >Microsoft Network, Properties, System; the Service Control Manager gives an
    >Event 7022 each time the computer shuts down. I just installed a new modem.
    >
    >Any ideas
    >
     
    Harrison, Feb 16, 2004
    #4
  5. bpgordon

    Dan Shea Guest

    On Mon, 16 Feb 2004 11:50:46 -0600, "bpgordon" <>
    wrote:

    >Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    >goes into "System Shutdown initiated by NT Authority\System. Windows must
    >now restart because the Remote Procedure Call (RPC) terminated
    >unexpectedly." When I follow Windows XP network connections troubleshooting
    >procedure, Network Tasks, Change Settings of this Connection, Client for
    >Microsoft Network, Properties, System; the Service Control Manager gives an
    >Event 7022 each time the computer shuts down. I just installed a new modem.
    >
    >Any ideas


    Working on the assumption that you don't have the MS Blaster worm....

    Uninstall and re-install the Client for Microsoft Networks component.
    What other components do you have installed?

    Cheers,
    dan
     
    Dan Shea, Feb 16, 2004
    #5
  6. bpgordon

    JWooden271 Guest

    You appear to have the blaster virus.

    Here are some actions that you can take:

    1. Remove the virus. You can use this free tool from Microsoft to remove
    the virus:
    http://snipurl.com/3rq0

    2. Enable your Windows XP firewall. Follow these instructions:
    ********************************************
    How to Enable Internet Connection Firewall (ICF) on Windows XP

    1. On the taskbar at the bottom of your screen, click Start, and
    then click Control Panel.
    2. Click the Network and Internet Connections category.
    (If the Network and Internet Connectionsis not visible, click
    Switch to Category View under Control Panel on the left side of the
    Control Panel window.)
    3. Click Network Connections.
    4. Right-click the Dial-up, LAN, or High-Speed Internet connection
    that you use to connect to the Internet, and then click Properties from
    the context menu.
    5. On the Advanced tab, under Internet Connection Firewall, select
    Protect my computer or network, and then click OK.
    *********************************************
    3. Update Windows.
    Go to http://windowsupdate.microsoft.com/
    Downlaod all of the critical patches. This may take a while to download
    and install

    4. Install anti-virus software. You can obtain many for free, such as:
    AVG Anti-Virus, http://www.grisoft.com/us/us_dwnl_free.php
    eTrust EZ Armor, http://www.my-etrust.com/microsoft/index.cfm

    More info see: http://www.microsoft.com/security/incident/blast.asp

    I hope this was helpful.

    bpgordon wrote:
    > Every 5-10 minutes after I am logged onto the Internet (MSN9), the computer
    > goes into "System Shutdown initiated by NT Authority\System. Windows must
    > now restart because the Remote Procedure Call (RPC) terminated
    > unexpectedly." When I follow Windows XP network connections troubleshooting
    > procedure, Network Tasks, Change Settings of this Connection, Client for
    > Microsoft Network, Properties, System; the Service Control Manager gives an
    > Event 7022 each time the computer shuts down. I just installed a new modem.
    >
    > Any ideas
    >
    >
     
    JWooden271, Feb 16, 2004
    #6
  7. bpgordon

    Tim Kettring Guest

    "JWooden271" <> wrote in message
    news:eM7Yb.3529$...
    > You appear to have the blaster virus.
    >
    > Here are some actions that you can take:
    >
    > 1. Remove the virus. You can use this free tool from Microsoft to remove
    > the virus:
    > http://snipurl.com/3rq0
    >
    > 2. Enable your Windows XP firewall. Follow these instructions:
    > ********************************************
    > How to Enable Internet Connection Firewall (ICF) on Windows XP
    >
    > 1. On the taskbar at the bottom of your screen, click Start, and
    > then click Control Panel.
    > 2. Click the Network and Internet Connections category.
    > (If the Network and Internet Connectionsis not visible, click
    > Switch to Category View under Control Panel on the left side of the
    > Control Panel window.)
    > 3. Click Network Connections.
    > 4. Right-click the Dial-up, LAN, or High-Speed Internet connection
    > that you use to connect to the Internet, and then click Properties from
    > the context menu.
    > 5. On the Advanced tab, under Internet Connection Firewall, select
    > Protect my computer or network, and then click OK.
    > *********************************************
    > 3. Update Windows.
    > Go to http://windowsupdate.microsoft.com/
    > Downlaod all of the critical patches. This may take a while to download
    > and install
    >
    > 4. Install anti-virus software. You can obtain many for free, such as:
    > AVG Anti-Virus, http://www.grisoft.com/us/us_dwnl_free.php
    > eTrust EZ Armor, http://www.my-etrust.com/microsoft/index.cfm
    >
    > More info see: http://www.microsoft.com/security/incident/blast.asp
    >
    > I hope this was helpful.
    >
    > bpgordon wrote:
    > > Every 5-10 minutes after I am logged onto the Internet (MSN9), the

    computer
    > > goes into "System Shutdown initiated by NT Authority\System. Windows

    must
    > > now restart because the Remote Procedure Call (RPC) terminated
    > > unexpectedly." When I follow Windows XP network connections

    troubleshooting
    > > procedure, Network Tasks, Change Settings of this Connection, Client for
    > > Microsoft Network, Properties, System; the Service Control Manager gives

    an
    > > Event 7022 each time the computer shuts down. I just installed a new

    modem.
    > >
    > > Any ideas
    > >
    > >

    >


    Mine was doing the exact same thing , msblaster.exe and mslaugh.exe

    To disable RPC , in an XP start>control pannel>administrative
    tools>recovery tab> select " take no action " for all 3

    It apparently remembered my IP addy because every time I deleated
    msblaster.exe , it would show up again

    It is stopped from coming back with the XP firewall enabled
     
    Tim Kettring, Feb 16, 2004
    #7
  8. bpgordon

    Harrison Guest

    >Mine was doing the exact same thing , msblaster.exe and mslaugh.exe
    >
    >To disable RPC , in an XP start>control pannel>administrative
    >tools>recovery tab> select " take no action " for all 3
    >
    >It apparently remembered my IP addy because every time I deleated
    >msblaster.exe , it would show up again
    >
    >It is stopped from coming back with the XP firewall enabled


    You need to use a removal tool. While these efforts may have treated the symptoms, the virus is more than likely still
    resident on your computer.
     
    Harrison, Feb 16, 2004
    #8
  9. bpgordon

    Tim Kettring Guest

    <Harrison> wrote in message
    news:p...
    > >Mine was doing the exact same thing , msblaster.exe and mslaugh.exe
    > >
    > >To disable RPC , in an XP start>control pannel>administrative
    > >tools>recovery tab> select " take no action " for all 3
    > >
    > >It apparently remembered my IP addy because every time I deleated
    > >msblaster.exe , it would show up again
    > >
    > >It is stopped from coming back with the XP firewall enabled

    >
    > You need to use a removal tool. While these efforts may have treated the

    symptoms, the virus is more than likely still
    > resident on your computer.


    True , but the op needs to be able to connect long enough to be able to use
    the removal tool , and the above should do it but should be set back to
    noraml once the blaster worm/virus is removed .
     
    Tim Kettring, Feb 17, 2004
    #9
  10. bpgordon

    reid decker Guest

    You have the virus I once had. I got rid of it by getting the Microsoft
    Patch. Use Google (I think I did).
    "bpgordon" <> wrote in message
    news:...
    > Every 5-10 minutes after I am logged onto the Internet (MSN9), the

    computer
    > goes into "System Shutdown initiated by NT Authority\System. Windows must
    > now restart because the Remote Procedure Call (RPC) terminated
    > unexpectedly." When I follow Windows XP network connections

    troubleshooting
    > procedure, Network Tasks, Change Settings of this Connection, Client for
    > Microsoft Network, Properties, System; the Service Control Manager gives

    an
    > Event 7022 each time the computer shuts down. I just installed a new

    modem.
    >
    > Any ideas
    >
    >
     
    reid decker, Feb 17, 2004
    #10
  11. bpgordon

    lisa nicholl Guest

    "bpgordon" <> wrote in message
    news:...
    > Every 5-10 minutes after I am logged onto the Internet (MSN9), the

    computer
    > goes into "System Shutdown initiated by NT Authority\System. Windows must
    > now restart because the Remote Procedure Call (RPC) terminated
    > unexpectedly." When I follow Windows XP network connections

    troubleshooting
    > procedure, Network Tasks, Change Settings of this Connection, Client for
    > Microsoft Network, Properties, System; the Service Control Manager gives

    an
    > Event 7022 each time the computer shuts down. I just installed a new

    modem.
    >
    > Any ideas
    >
    >
     
    lisa nicholl, Feb 23, 2004
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Patrick D.
    Replies:
    18
    Views:
    7,979
    °Mike°
    Aug 12, 2003
  2. Jill Sharp

    Remote Procedure Call Message

    Jill Sharp, Aug 15, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    514
    Philip SC
    Aug 15, 2003
  3. fokker
    Replies:
    7
    Views:
    1,151
    Fokker
    Sep 11, 2003
  4. MaryL

    Windows Remote Call Procedure

    MaryL, Jan 3, 2004, in forum: Computer Support
    Replies:
    13
    Views:
    753
    °Mike°
    Jan 5, 2004
  5. Dan

    Remote Procedure Call

    Dan, Jan 21, 2004, in forum: Computer Support
    Replies:
    4
    Views:
    648
Loading...

Share This Page