Closed Thread Icon

Topic awaiting preservation: Remote Procedure Call service terminating (Page 1 of 1) Pages that link to <a href="http://ozoneasylum.com/backlink?for=6705" title="Pages that link to Topic awaiting preservation: Remote Procedure Call service terminating (Page 1 of 1)" rel="nofollow" >Topic awaiting preservation: Remote Procedure Call service terminating <span class="small">(Page 1 of 1)</span>\

 
Slime
Lunatic (VI) Mad Scientist

From: Massachusetts, USA
Insane since: Mar 2000

posted posted 08-12-2003 05:07

OK, I don't know what triggered this, but when my computer is on for about 5 minutes or so, eventually I'll click something or press a key and a box will pop up saying that the "Remote Procedure Call service" was unexpectedly terminated, and windows shuts down after 60 seconds. I don't know what triggers this.

I reinstalled windows trying to fix it, and the problem remains.

The only thing on my computer which is left over from when it started messing up (a few hours ago) is my second partition, on which I keep my personal files. I really don't want to lose this partition.

What can I do?

DL-44
Maniac (V) Inmate

From: under the bed
Insane since: Feb 2000

posted posted 08-12-2003 05:57

Wow...I just had this same exact problem today Slime.

Basically what I did was go into the Computer Mangement program (right click on my computer, pick "manage"), and go to 'services'.

I made sure that both the RPC service and the RPC locater were set to 'automatic' rather than manual and it seems to be ok....

maninacan
Paranoid (IV) Inmate

From: Seattle, WA, USA
Insane since: Oct 2001

posted posted 08-12-2003 06:37

It's a lovely new worm that's out that just about everyone I know has gotten, except me. Guess I'm just better than them or something . Well I am behind a router/firewall, and I do virus scans regularly. There was a patch for it somewhere on microsoft's site. Maybe just doing windows updates will help.

Raptor
Paranoid (IV) Inmate

From: AČ, MI, USA
Insane since: Nov 2001

posted posted 08-12-2003 08:46

^what he said. Apparently there's some vulnerability in port 135 (netBIOS, naturally) that's being exploited.

Activate your Internet Connection Firewall (Control Panel -> Network Connections -> Right click connection -> Properties -> Advanced tab) as a temporary fix, so that your computer doesn't shut down on you. Get the patch, and then deactivate the ICF.

[This message has been edited by Raptor (edited 08-12-2003).]

Skaarjj
Maniac (V) Mad Scientist

From: :morF
Insane since: May 2000

posted posted 08-12-2003 09:30

MS has worked unusally quickly on this one and come out with fixes for it already...they're brought out fixes for the most recent versions of windows since the vulnerability exists accross the board...and here they are:

Win2K Fix: http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe

WinXP Fix: http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

mr.maX
Maniac (V) Mad Scientist

From: Belgrade, Serbia
Insane since: Sep 2000

posted posted 08-12-2003 09:32

You were a victim of the leatest (and greatest, heh) internet worm that has started spreading this monday...

More information (Gibson Reaserch Corporation): http://grc.com/default.htm
More information (CNN): http://www.cnn.com/2003/TECH/internet/08/11/internet.attack.ap/index.html

I suggest you to install a firewall and then check how it's working using ShieldsUp from Gibson Research Corporation (link from above).




[This message has been edited by mr.maX (edited 08-12-2003).]

sib
Bipolar (III) Inmate

From: lala-land
Insane since: Jul 2002

posted posted 08-12-2003 13:22

I had the same problem:
Symantec offers a Removal Tool for the W32.Blaster Worm.
http://www.symantec.com

Worked great here.

Just thought I pass this along since this hasn't been mentioned before.

sib

DL-44
Maniac (V) Inmate

From: under the bed
Insane since: Feb 2000

posted posted 08-12-2003 13:27

"seems to be ok..." Seems being the key word. All kinds of other wonderful problems.

I have a firewall running, as well as anti-virus software.

Ah well.....thanks for all the info.

Slime
Lunatic (VI) Mad Scientist

From: Massachusetts, USA
Insane since: Mar 2000

posted posted 08-12-2003 14:52

Thanks, guys. Now I wish I hadn't gone and reinstalled Windows =)

I managed to do a windows update last night... perhaps that will take care of it.

Edit: it didn't. I got the patch now though.

Anyway, thanks a lot! I don't have any firewall/antivirus installed yet, and I really should get something... =\

[This message has been edited by Slime (edited 08-12-2003).]

velvetrose
Paranoid (IV) Inmate

From: overlooking the bay
Insane since: Apr 2001

posted posted 08-12-2003 15:30

ZoneAlarm puts out a great free firewall, but you know that

(just checked with Shields up, am 100% stealth - this machine probed a dozen times while i read the report )

mr.maX
Maniac (V) Mad Scientist

From: Belgrade, Serbia
Insane since: Sep 2000

posted posted 08-12-2003 16:01

If you don't need control at application level (which programs can access the internet from your computer), Windows XP built-in firewall will do the job just fine...


Emperor
Maniac (V) Mad Scientist with Finglongers

From: Cell 53, East Wing
Insane since: Jul 2001

posted posted 08-15-2003 03:29

Well I might have to eat my very large hat after what I said in this thread:
www.ozoneasylum.com/Forum1/HTML/007828.html

Google must index the site virtually every day

From today's logs:

quote:
reqs: search term
----: -----------
103: remote procedure call service
58: remote procedure call service terminated unexpectedly
43: remote procedure call service terminated
34: remote procedure call terminated
34: cache:xoas6opgbooj:www.ozoneasylum.com/forum1/html/007822.html remote procedure call worm
27: cache:2by7wwq0ursj:www.ozoneasylum.com/archives/archive 000002/html/20030505 1 006845.html notepad.exe crimson editor drop in
21: remote procedure call rpc service terminated unexpectedly
20: remote procedure call shut down
19: cache:7_jzug0tj20j:www.ozoneasylum.com/forum19/html/000254.html vanilla coke ireland dublin
17: cache:s05ck4r6mxoj:www.ozoneasylum.com/forum2/html/002195.html swf disable right click menu
17: cache:xoas6opgbooj:www.ozoneasylum.com/forum1/html/007822.html remote procedure call service
13: cache:a03kkqqy6qgj:www.ozoneasylum.com/archives/archive 000002/html/20030109 1 005828.html where can i make stor troopers
13: remote procedure call virus
13: remote procedure call terminated unexpectedly
9: remote procedure call worm
8: remote procedure call service virus
8: cache:ghuz08iyakej:www.ozoneasylum.com/archives/archive 000004/html/20010223 3 000875.html basic wires styles
7: how to fix remote procedure call
7: the remote procedure call rpc service terminated unexpectedly
6: remote procedure call rpc service terminated
695: [not listed: 592 search terms]



___________________
Emps

FAQs: Emperor

Slime
Lunatic (VI) Mad Scientist

From: Massachusetts, USA
Insane since: Mar 2000

posted posted 08-15-2003 17:06

Where are those logs from?

Emperor
Maniac (V) Mad Scientist with Finglongers

From: Cell 53, East Wing
Insane since: Jul 2001

posted posted 08-15-2003 17:32

Slime: They are yesterday's server logs from the Asylum:

:FAQ: Could I see the Asylum's server statistics?

[edit: They are back to 'normal' today but see:
www.ozoneasylum.com/stats/daily/2003-08-13/

for yesterday's results]

___________________
Emps

FAQs: Emperor

Slime
Lunatic (VI) Mad Scientist

From: Massachusetts, USA
Insane since: Mar 2000

posted posted 08-15-2003 17:51

Oh, right, I remember that.

What's the user name / password again?

Emperor
Maniac (V) Mad Scientist with Finglongers

From: Cell 53, East Wing
Insane since: Jul 2001

posted posted 08-15-2003 17:55

Slime: Its all in the FAQ.

___________________
Emps

FAQs: Emperor

DmS
Paranoid (IV) Inmate

From: Sthlm, Sweden
Insane since: Oct 2000

posted posted 08-18-2003 09:28

Hot damn!
This little worm is so bleeding agressive!
I had to shut down ZA to access an FTP account yesterday, 2 minutes after that I was infected...
That's with ZA down and XP's internal firewall up, plus an updated Norton AV scanning!

I cleaned the machine and patched it so I guess I'm ok now, that's the first virus/worm I've ever got...
/Dan

{cell 260}
-{ a vibration is a movement that doesn't know which way to go }-

InI
Paranoid (IV) Mad Scientist

From: Somewhere over the rainbow
Insane since: Mar 2001

posted posted 08-18-2003 10:02

The poster has demanded we remove all his contributions, less he takes legal action.
We have done so.
Now Tyberius Prime expects him to start complaining that we removed his 'free speech' since this message will replace all of his posts, past and future.
Don't follow his example - seek real life help first.

Taobaybee
Maniac (V) Inmate

From: The Pool Of Life
Insane since: Feb 2003

posted posted 08-18-2003 11:22

I'm not too sure if this applies. I found that you also need to switch off System Restore before you scan to remove a virus or whatever. (otherwise it can stay in your system). Then when it is over remember to turn it back on again!

Xpirex
Paranoid (IV) Inmate

From: Dammed if I know...
Insane since: Mar 2003

posted posted 08-18-2003 12:27

Yes, you have to download and install the MS patch, then turn off System Restore, then run the Symantec tool for the W32.Blaster Worm in case you got a dose already. Then turn Sys Restore back on again and reboot. There's Zone Alarm and Zone Alarm Pro (which is pretty good) But apparently anti virus or some firewalls won't stop you getting the worm as is comes in through a flaw in Windows itself. You need the patch and that's it. I have some friends whose machines keep repeatedly crashing every minute now (oh dear). Fortunately, on this occasion I was prepaired for this little critter.
The best place to get the patch is not necessarily the MS Windows update site as that apparrently is the one that has beed targeted and attacked the most by this worm and their servers are being overwhelmed by the deluge of links being made to it by people trying to grab the fix.

Here is an alternative link for the MS patch http://www.greenmountainaccess.net/wormblast.shtml



[This message has been edited by Xpirex (edited 08-18-2003).]

DmS
Paranoid (IV) Inmate

From: Sthlm, Sweden
Insane since: Oct 2000

posted posted 08-18-2003 15:59

No prob, I did turn off the sys restore and all that. Plus you don't have to go through the std update url, there are tons of links from support pages, knowledge base, download areas all over MS.
Thanx anyway!
/Dan

{cell 260}
-{ a vibration is a movement that doesn't know which way to go }-

SuicidalMaster
Obsessive-Compulsive (I) Inmate

From: The Pit
Insane since: Oct 2003

posted posted 10-13-2003 05:03

I can't figure out how to turn off the stupid system management! How do I do this?

Skaarjj
Maniac (V) Mad Scientist

From: :morF
Insane since: May 2000

posted posted 10-13-2003 11:57

You don't actually have to turn off system restore in oder to permanently rid yourself of a virus, just remember that once you get rid of the virus, immediatly create a new system restore point, and overwrite the old one. Do this evne before you restart your computer.

DrWolfgangVonBubbles
Obsessive-Compulsive (I) Inmate

From: My own private hell
Insane since: Oct 2003

posted posted 10-17-2003 21:09

This viris has me by the balls and won't let go!!! lol
As soon as I turn my computer on... BOOM there's the countdown... lol I can't even turn it on automatic to give me more time cuz I only have 60 secs... lol what should I do???

one by one penguins steal my sanity...
I CAN'T SLEEP THE CLOWNS WILL EAT ME!!!

Deadman_333
Nervous Wreck (II) Inmate

From: Millerstown PA U.S.A
Insane since: Jan 2004

posted posted 01-05-2004 20:21

Thanks to skaarjj i might get my XP fixed Slimies i agree i duno what set mine off...but i redid my system 3 times and still no change!!..

DeadMan Inc.

Deadman_333
Nervous Wreck (II) Inmate

From: Millerstown PA U.S.A
Insane since: Jan 2004

posted posted 01-06-2004 20:14

ok i redid my comp a 4th time...still nothing i tried both the things SHAARJJ has but the both wont work with Win32.... what can i do to fix it?

DeadMan Inc.

[This message has been edited by Deadman_333 (edited 01-06-2004).]

synax
Maniac (V) Inmate

From: Cell 666
Insane since: Mar 2002

posted posted 01-07-2004 13:52

Unplug your computer from the internet... Then throw up a firewall. Then plug it back in and fix it.

"Nothin' like a pro-stabbin' from a pro." -Weadah

Deadman_333
Nervous Wreck (II) Inmate

From: Millerstown PA U.S.A
Insane since: Jan 2004

posted posted 01-08-2004 04:33

HOW IN THE HELL WILL THAT HELP IT?

DeadMan Inc.

Skaarjj
Maniac (V) Mad Scientist

From: :morF
Insane since: May 2000

posted posted 01-08-2004 06:01

Jesus mate...calm the fuck down. It's incredibly annoying TO READ A MESSAGE ALL IN CAPITALS. IT CAN GET VERY FRUSTRATING TO THE READER, NOT TO MENTION THE FACT THAT YOUR TECHNICALLY SHOUTING AT THEM AND I DON'T REALLY THINK ANYONE HERE HAS DONE ANYTHING TO DESERVE THAT.

There...see how annoying that can get?

Now, synax has a point. The purpose of the worm is to spread it self. It appears that you are getting it over and over if it keeps reappearing after you get rid of it. So calm down, get yourself a firewall app, disconnect from the net and follow these instructions:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

download their removal tool, follow their instructions, then download and install this MS patch: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

Next, get your firewall running. And not window's bullshit internet firewall, that things got more holes than swiss cheese. Get the Sygate personal Firewall (called Managed Personal Firewall on their site I think) and run that.

And get yourself a bloody virus scanner and keep your defintions up to date. That's another good way of avoiding these things.

Now, I've been nice here and helped you. Post another message like your one previous and you porbably won't get much help around here again.

eVoL
Obsessive-Compulsive (I) Inmate

From: third dimension
Insane since: Jan 2004

posted posted 01-19-2004 17:34

Hi. I was running xp home, and I decided to install xp pro. i put in the cd, chose 'upgrade'. It setup winxp pro, and while my security was down (before i could patch), one more worms had a chance to attack. I was told to read this message board, and so far I have been able to at least stop my computer from shutting down by going to 'My Computer, manage, services..' and setting Remote Procedure Call to 'restart the service'... but that was after I was sure my problems were over. I was able to install the security patches and service pack 1, and then I decided to install Norton Antivirus 2004 professional. In the pre-install scan it found 'W32.Spybot.Worm' infecting two files, and was able to repair. Apparently I must have another worm or something elsewhere that the scan did not locate because my computer is acting strange. If i got to 'start, all programs, windows update', itll take me to the page where it will scan for updates. I have installed SP1 and the updates a few times now and when i click 'scan for available updates' it still shows me all of the updates, as if I don't already have them. What else is strange, is when I try to install the security measure found here http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/b ulletin/MS03-026.asp .. i run the program, and when it says 'inspecting my configuration' it waits for a few seconds, then just closes itself. Same with trying to run Norton Antivirus, I try to run the program, but within a few seconds or so, the program closes all by itself. My computer is also running very slow anyways. Please Help Me =[

oh ya and one more thing.. I was gonna try to enable the 'internet connection firewall' ... i right click on my item in network connections, i choose properties.. and it says 'an unexpected error occurred'

I also followed all the instructions here http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.too l.html ... that symantec app didnt find a single worm or nothin.

LoL.. as well as all that, i right click, properties on My Computer, select the Automatic Updates tab, and after a moment it says the service is unavailable.

[This message has been edited by eVoL (edited 01-19-2004).]

[This message has been edited by eVoL (edited 01-19-2004).]

Intor
Neurotic (0) Inmate
Newly admitted

From:
Insane since: Feb 2004

posted posted 02-02-2004 15:11

DrWolfgangVonBubbles, try entering windows in failsafe mode with network support. That should take care of the RPC crash. Also there is an easier way to reach the services list. Just run services.msc and there it is, and in case you don't know how to reach failsafe mode just keep pushing F8 like mad right after BIOS completes system check. At least it's F8 on my machine but if it doesn't work try holding SHIFT key while pushing F8 (other combos might exist as well, not quiet sure). Hope this helps. :P

If you want my opinion however, then you should get yourself Linux and double boot it with Windows 98 SE for any software you might need that you can't run under Linux :P That's how i run it and i'm glad i do. As far as i know some of the most recent virii only run under 2k, XP and NT.

Also a good free firewall you might want to check out is Agnitum Outpost 1.0 which can be found at www.agnitum.com.

[This message has been edited by Intor (edited 02-02-2004).]

andypandy
Obsessive-Compulsive (I) Inmate

From: Stockholm, Sweden
Insane since: Feb 2004

posted posted 02-10-2004 03:12

I have a question... I've just managed to get rid of the worm (using symantecs patch). At first I tried to reinstall XP several times on different partitions before I finally found out it was a worm. Sometime during these formats and installs (a period of days) I had to run chkdsk which (I think) repaired quite a few media files on one of my partitions for some reason. Suddenly I discover that a lot of mpg-files don't work! Suddenly Windows media player says it doesn't support the format of the file. This seems to have affected files quite at random. In some folders none of the files will play and in others half or all will play... I think recently downloaded files are more affected than others...
Can anyone tell me if this was caused by blaster and if so can I fix it? Or might there be an unrelated problem with the file index and if so any ideas on how to fix that? Please, can anyone help as I dont want to throw away 10 gigs of stuff...

Ramasax
Paranoid (IV) Inmate

From: PA, US
Insane since: Feb 2002

posted posted 02-10-2004 03:19

Well, I didn't have anything like this when I got the worm. Mayhap you have another nasty virus onboard? From Kazaa perhaps? There are some nasty ones on there.



[This message has been edited by Ramasax (edited 02-10-2004).]

Taobaybee
Maniac (V) Inmate

From: The Pool Of Life
Insane since: Feb 2003

posted posted 02-10-2004 04:14

I find it incredible that anyone could be on the net without a firewall and antivirus. There are good free programmes out there.
If any of you are using XP remember to turn off "System Restore" before you scan. If you don't and you do have a virus or worm, it will keep on reinfecting from there.
I hope this may be of help.

:::tao:::

« BackwardsOnwards »

Show Forum Drop Down Menu