Windoes XP RPC Error message

[Sandman]

Hi, I've got a laptop with Windows XP Home.
Everything has been running fine and dandy, until Monday when I logged onto the Internet. After a few minutes I was chucked off by Windows and received the following error message:-

"Shutdown initiated by NT Authority System.
Windows must now restart because Remote Procedure Call (RPC) was terminated unexpectedly"

Everything has been fine for monthes, then now this, problem is still persisting today. I can get online for a few minutes, then get switched off, irrespective of the website that I'm on. As far as I know, I've not changed any of the settings. I've even tried going back to the Laptops settings as of a few weeks ago, but it doesn't make any difference.

Anyone got a clue what the message means, and, more importantly, how do I sort the feckin' thing?

Cheers.

[Valken]

It's an exploit that can be used to plant trojans on your machine by messing with part of the OS that handles MS' implementation of distributed computing. RPC is "remote proceedure call". There's a windows update patch that has been out since July 16th that you should install.

[wod]

its a virus see on here http://vil.nai.com/vil/content/v_100547.htm and http://ntsc-uk.domino.org//viewtopic.php?t=10580

[Ginger Tosser]

follow boogs advice

I keep telling you in IRC lad.

DISABLE THE RPC SERVICE!

Control Panel => Administrative Tools => Remote Procedure Call (RPC) => Disable, or if you can't, change the 1st, 2nd and 3rd failures to "Do Nothing" instead of "Restart"

[Valken]

But disabling the reboot on failure thingy won't do much help as you'll still be vunerable

Just install the patch and follow the removal instructions for the worm and you're set.

[Sandman]

mmm, I don't see how it can be a virus, I have my virus checker on all the time (AVG). I actually ran the virus check as well and it's not detected any viruses. Also, it doesn't seem to have bothered this clockwork desktop PC and they share the same sites.

The other problem is, I can't stay on the damn internet long enough to download anything - 2 - 4 mins seems to be my limit.

[wod]

its not really a virus more a vunabilty in windows thats exploited with a worm. the virus checker should pick it up.

if you have any of these on your pc then you've got it

msblast.exe
tftp
W32.Blaster.Worm (Symantec)
Win32.Poza (CA)
WORM_MSBLAST.A (Trend)

theres a patch you can install from here it takes about 1min to download

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

[Kirby]

To stop the shutdown go to Start -> Run, type cmd, then type shutdown -a

Or just create a text file with shutdown -a in and rename it from .txt to .bat file

[Sandman]

Okay, major apologies - I've read the other threads, and yes, I've got that fooking virus!!! ft:

My problem is, I'm no tech-head, so everything that I've read in those other threads has gone way way over my head.

I would be eternally grateful if some kind soul would walk me slowly through what I can do to shift that bastud thing off my laptop.

In theory, can I download bits and pieces of stuff onto this PC, then save them on my plug-in usb magic stick, then copy them over to the laptop then execute them, or can you suggest how I can do it all on my laptop?

Cheers

[wod]

theres a remover that you can download from http://vil.nai.com/vil/stinger/ and follow the instructions , it will scan and repair any infected files. download the latest version as its been updated to include remover of the virus you have.

[Sandman]

Okay, all sorted now

Have also implemented firewall on my connection, but now some web-sites can't load, do I need to alter any of the Firewall settings?

Anyway, Valken, Wod, Ginger Tosser, and Kirby, many thanks - you've been brilliant, and I couldn't have sorted the problem without you

Cheers Guys.

[YOUWIN]

my m8's got this problem too, he's just come back off holiday on monday, switched his PC on, and bang all these error messages, pc shutting down after 60 secs or so - this thread is gonna be a big help for me, as he's been on the phone asking me to sort it for him - 40 ish he is, and a complete ****ing numpty where pc's are concerned, it's gonna be long, drawn out, and painful for me trying to explain all this over the phone.

but cheers to those that's replied

[Chief H]

I've been struck by the same thing. Norton caught the virus one of the times it sprung up but couldn't do anything about it. Enabling a firewall tends to help until things are sorted.

Cheers boys

[Sandman]

- this thread is gonna be a big help for me, as he's been on the phone asking me to sort it for him - 40 ish he is, and a complete ****ing numpty where pc's are concerned, it's gonna be long, drawn out, and painful for me trying to explain all this over the phone.

LOL - you could be very nearly describing me there m8 ('cept I'm heading toward the big 50)

It's worth mentioning that I couldn't access any of the downloads with my Laptop - couldn't stay online long enough. I got all the downloads using my old Windows 98 Desktop - it seems the worm/virus doesn't affect 98.
I saved the downloads on a USB Memory Stick, then transferred them to my Laptop and then sorted the fooker.

If your m8 hasn't got access to 98, then he'll probably need to follow Ginger's/Boogaloo's advice first.

[Wools]

Bugger, me too.

Ive tried all of what you guys and girls have said but I cant sem to download any of the patches or virus detection thingey's.

Look like it's a trip to PC world...