Topic awaiting preservation: Remote Procedure Call service terminating

OK, I don't know what triggered this, but when my computer is on for about 5 minutes or so, eventually I'll click something or press a key and a box will pop up saying that the "Remote Procedure Call service" was unexpectedly terminated, and windows shuts down after 60 seconds. I don't know what triggers this.

I reinstalled windows trying to fix it, and the problem remains.

The only thing on my computer which is left over from when it started messing up (a few hours ago) is my second partition, on which I keep my personal files. I really don't want to lose this partition.

What can I do?

Wow...I just had this same exact problem today Slime.

Basically what I did was go into the Computer Mangement program (right click on my computer, pick "manage"), and go to 'services'.

I made sure that both the RPC service and the RPC locater were set to 'automatic' rather than manual and it seems to be ok....

It's a lovely new worm that's out that just about everyone I know has gotten, except me. Guess I'm just better than them or something . Well I am behind a router/firewall, and I do virus scans regularly. There was a patch for it somewhere on microsoft's site. Maybe just doing windows updates will help.

^what he said. Apparently there's some vulnerability in port 135 (netBIOS, naturally) that's being exploited.

Activate your Internet Connection Firewall (Control Panel -> Network Connections -> Right click connection -> Properties -> Advanced tab) as a temporary fix, so that your computer doesn't shut down on you. Get the patch, and then deactivate the ICF.

[This message has been edited by Raptor (edited 08-12-2003).]

MS has worked unusally quickly on this one and come out with fixes for it already...they're brought out fixes for the most recent versions of windows since the vulnerability exists accross the board...and here they are:

Win2K Fix: http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe

WinXP Fix: http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

You were a victim of the leatest (and greatest, heh) internet worm that has started spreading this monday...

More information (Gibson Reaserch Corporation): http://grc.com/default.htm
More information (CNN): http://www.cnn.com/2003/TECH/internet/08/11/internet.attack.ap/index.html

I suggest you to install a firewall and then check how it's working using ShieldsUp from Gibson Research Corporation (link from above).




[This message has been edited by mr.maX (edited 08-12-2003).]

I had the same problem:
Symantec offers a Removal Tool for the W32.Blaster Worm.
http://www.symantec.com

Worked great here.

Just thought I pass this along since this hasn't been mentioned before.

sib

"seems to be ok..." Seems being the key word. All kinds of other wonderful problems.

I have a firewall running, as well as anti-virus software.

Ah well.....thanks for all the info.

Thanks, guys. Now I wish I hadn't gone and reinstalled Windows =)

I managed to do a windows update last night... perhaps that will take care of it.

Edit: it didn't. I got the patch now though.

Anyway, thanks a lot! I don't have any firewall/antivirus installed yet, and I really should get something... =\

[This message has been edited by Slime (edited 08-12-2003).]

ZoneAlarm puts out a great free firewall, but you know that

(just checked with Shields up, am 100% stealth - this machine probed a dozen times while i read the report )

If you don't need control at application level (which programs can access the internet from your computer), Windows XP built-in firewall will do the job just fine...

Well I might have to eat my very large hat after what I said in this thread:
www.ozoneasylum.com/Forum1/HTML/007828.html

Google must index the site virtually every day

From today's logs:

quote:

---

reqs: search term
----: -----------
103: remote procedure call service
58: remote procedure call service terminated unexpectedly
43: remote procedure call service terminated
34: remote procedure call terminated
34: cache:xoas6opgbooj:www.ozoneasylum.com/forum1/html/007822.html remote procedure call worm
27: cache:2by7wwq0ursj:www.ozoneasylum.com/archives/archive 000002/html/20030505 1 006845.html notepad.exe crimson editor drop in
21: remote procedure call rpc service terminated unexpectedly
20: remote procedure call shut down
19: cache:7_jzug0tj20j:www.ozoneasylum.com/forum19/html/000254.html vanilla coke ireland dublin
17: cache:s05ck4r6mxoj:www.ozoneasylum.com/forum2/html/002195.html swf disable right click menu
17: cache:xoas6opgbooj:www.ozoneasylum.com/forum1/html/007822.html remote procedure call service
13: cache:a03kkqqy6qgj:www.ozoneasylum.com/archives/archive 000002/html/20030109 1 005828.html where can i make stor troopers
13: remote procedure call virus
13: remote procedure call terminated unexpectedly
9: remote procedure call worm
8: remote procedure call service virus
8: cache:ghuz08iyakej:www.ozoneasylum.com/archives/archive 000004/html/20010223 3 000875.html basic wires styles
7: how to fix remote procedure call
7: the remote procedure call rpc service terminated unexpectedly
6: remote procedure call rpc service terminated
695: [not listed: 592 search terms]

---

___________________
Emps

FAQs: Emperor

Where are those logs from?

Slime: They are yesterday's server logs from the Asylum:

:FAQ: Could I see the Asylum's server statistics?

[edit: They are back to 'normal' today but see:
www.ozoneasylum.com/stats/daily/2003-08-13/

for yesterday's results]

___________________
Emps

FAQs: Emperor

Oh, right, I remember that.

What's the user name / password again?

Slime: Its all in the FAQ.

___________________
Emps

FAQs: Emperor

Hot damn!
This little worm is so bleeding agressive!
I had to shut down ZA to access an FTP account yesterday, 2 minutes after that I was infected...
That's with ZA down and XP's internal firewall up, plus an updated Norton AV scanning!

I cleaned the machine and patched it so I guess I'm ok now, that's the first virus/worm I've ever got...
/Dan

{cell 260}
-{ a vibration is a movement that doesn't know which way to go }-

The poster has demanded we remove all his contributions, less he takes legal action.
We have done so.
Now Tyberius Prime expects him to start complaining that we removed his 'free speech' since this message will replace all of his posts, past and future.
Don't follow his example - seek real life help first.

I'm not too sure if this applies. I found that you also need to switch off System Restore before you scan to remove a virus or whatever. (otherwise it can stay in your system). Then when it is over remember to turn it back on again!

Yes, you have to download and install the MS patch, then turn off System Restore, then run the Symantec tool for the W32.Blaster Worm in case you got a dose already. Then turn Sys Restore back on again and reboot. There's Zone Alarm and Zone Alarm Pro (which is pretty good) But apparently anti virus or some firewalls won't stop you getting the worm as is comes in through a flaw in Windows itself. You need the patch and that's it. I have some friends whose machines keep repeatedly crashing every minute now (oh dear). Fortunately, on this occasion I was prepaired for this little critter.
The best place to get the patch is not necessarily the MS Windows update site as that apparrently is the one that has beed targeted and attacked the most by this worm and their servers are being overwhelmed by the deluge of links being made to it by people trying to grab the fix.

Here is an alternative link for the MS patch http://www.greenmountainaccess.net/wormblast.shtml



[This message has been edited by Xpirex (edited 08-18-2003).]

No prob, I did turn off the sys restore and all that. Plus you don't have to go through the std update url, there are tons of links from support pages, knowledge base, download areas all over MS.
Thanx anyway!
/Dan

{cell 260}
-{ a vibration is a movement that doesn't know which way to go }-

I can't figure out how to turn off the stupid system management! How do I do this?

You don't actually have to turn off system restore in oder to permanently rid yourself of a virus, just remember that once you get rid of the virus, immediatly create a new system restore point, and overwrite the old one. Do this evne before you restart your computer.

This viris has me by the balls and won't let go!!! lol
As soon as I turn my computer on... BOOM there's the countdown... lol I can't even turn it on automatic to give me more time cuz I only have 60 secs... lol what should I do???

one by one penguins steal my sanity...
I CAN'T SLEEP THE CLOWNS WILL EAT ME!!!

Thanks to skaarjj i might get my XP fixed Slimies i agree i duno what set mine off...but i redid my system 3 times and still no change!!..

DeadMan Inc.

ok i redid my comp a 4th time...still nothing i tried both the things SHAARJJ has but the both wont work with Win32.... what can i do to fix it?

DeadMan Inc.

[This message has been edited by Deadman_333 (edited 01-06-2004).]

Unplug your computer from the internet... Then throw up a firewall. Then plug it back in and fix it.

"Nothin' like a pro-stabbin' from a pro." -Weadah

HOW IN THE HELL WILL THAT HELP IT?

DeadMan Inc.

Jesus mate...calm the fuck down. It's incredibly annoying TO READ A MESSAGE ALL IN CAPITALS. IT CAN GET VERY FRUSTRATING TO THE READER, NOT TO MENTION THE FACT THAT YOUR TECHNICALLY SHOUTING AT THEM AND I DON'T REALLY THINK ANYONE HERE HAS DONE ANYTHING TO DESERVE THAT.

There...see how annoying that can get?

Now, synax has a point. The purpose of the worm is to spread it self. It appears that you are getting it over and over if it keeps reappearing after you get rid of it. So calm down, get yourself a firewall app, disconnect from the net and follow these instructions:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

download their removal tool, follow their instructions, then download and install this MS patch: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

Next, get your firewall running. And not window's bullshit internet firewall, that things got more holes than swiss cheese. Get the Sygate personal Firewall (called Managed Personal Firewall on their site I think) and run that.

And get yourself a bloody virus scanner and keep your defintions up to date. That's another good way of avoiding these things.

Now, I've been nice here and helped you. Post another message like your one previous and you porbably won't get much help around here again.

Hi. I was running xp home, and I decided to install xp pro. i put in the cd, chose 'upgrade'. It setup winxp pro, and while my security was down (before i could patch), one more worms had a chance to attack. I was told to read this message board, and so far I have been able to at least stop my computer from shutting down by going to 'My Computer, manage, services..' and setting Remote Procedure Call to 'restart the service'... but that was after I was sure my problems were over. I was able to install the security patches and service pack 1, and then I decided to install Norton Antivirus 2004 professional. In the pre-install scan it found 'W32.Spybot.Worm' infecting two files, and was able to repair. Apparently I must have another worm or something elsewhere that the scan did not locate because my computer is acting strange. If i got to 'start, all programs, windows update', itll take me to the page where it will scan for updates. I have installed SP1 and the updates a few times now and when i click 'scan for available updates' it still shows me all of the updates, as if I don't already have them. What else is strange, is when I try to install the security measure found here http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/b ulletin/MS03-026.asp .. i run the program, and when it says 'inspecting my configuration' it waits for a few seconds, then just closes itself. Same with trying to run Norton Antivirus, I try to run the program, but within a few seconds or so, the program closes all by itself. My computer is also running very slow anyways. Please Help Me =[

oh ya and one more thing.. I was gonna try to enable the 'internet connection firewall' ... i right click on my item in network connections, i choose properties.. and it says 'an unexpected error occurred'

I also followed all the instructions here http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.too l.html ... that symantec app didnt find a single worm or nothin.

LoL.. as well as all that, i right click, properties on My Computer, select the Automatic Updates tab, and after a moment it says the service is unavailable.

[This message has been edited by eVoL (edited 01-19-2004).]

[This message has been edited by eVoL (edited 01-19-2004).]

DrWolfgangVonBubbles, try entering windows in failsafe mode with network support. That should take care of the RPC crash. Also there is an easier way to reach the services list. Just run services.msc and there it is, and in case you don't know how to reach failsafe mode just keep pushing F8 like mad right after BIOS completes system check. At least it's F8 on my machine but if it doesn't work try holding SHIFT key while pushing F8 (other combos might exist as well, not quiet sure). Hope this helps. :P

If you want my opinion however, then you should get yourself Linux and double boot it with Windows 98 SE for any software you might need that you can't run under Linux :P That's how i run it and i'm glad i do. As far as i know some of the most recent virii only run under 2k, XP and NT.

Also a good free firewall you might want to check out is Agnitum Outpost 1.0 which can be found at www.agnitum.com.

[This message has been edited by Intor (edited 02-02-2004).]

I have a question... I've just managed to get rid of the worm (using symantecs patch). At first I tried to reinstall XP several times on different partitions before I finally found out it was a worm. Sometime during these formats and installs (a period of days) I had to run chkdsk which (I think) repaired quite a few media files on one of my partitions for some reason. Suddenly I discover that a lot of mpg-files don't work! Suddenly Windows media player says it doesn't support the format of the file. This seems to have affected files quite at random. In some folders none of the files will play and in others half or all will play... I think recently downloaded files are more affected than others...
Can anyone tell me if this was caused by blaster and if so can I fix it? Or might there be an unrelated problem with the file index and if so any ideas on how to fix that? Please, can anyone help as I dont want to throw away 10 gigs of stuff...

Well, I didn't have anything like this when I got the worm. Mayhap you have another nasty virus onboard? From Kazaa perhaps? There are some nasty ones on there.



[This message has been edited by Ramasax (edited 02-10-2004).]

I find it incredible that anyone could be on the net without a firewall and antivirus. There are good free programmes out there.
If any of you are using XP remember to turn off "System Restore" before you scan. If you don't and you do have a virus or worm, it will keep on reinfecting from there.
I hope this may be of help.

:::tao:::