RPC shut downs, can't install 10 critical updates, can keep regedit open

Discussion in 'Windows Update' started by Taz, Feb 25, 2004.

  1. Taz

    Taz Guest

    I keep getting the remote procedure call (RPC) service
    terminated unexpectedly and my computer restareds after a
    60 sec count down. I installed all the critical updates
    but after restarting even thought it wasn't required 10
    are still there like I didn't install them!! this
    happened witht he windows media update last week before I
    reinstalled windows but now it is 10! I was trying to
    snoop around in the reg but regedit and regedt32 won't
    stay open for more then about 10 sec. I have run
    Mcafee's online virus scan and nothing!!! HELP!!!
     
    Taz, Feb 25, 2004
    #1
    1. Advertisements

  2. http://www.microsoft.com/security/incident/blast_faq.asp
    Blaster Worm FAQ

    1. CTRL-ALT-DELETE to bring up the Task Manager. Look for msblast.exe and select
    it and End Process. This will stop the computer from shutting down.
    It doesn't remove the worm.

    To enable your firewall :
    - Click Start
    - Click Control Panel
    - Double Click "Network Connections"
    - Right-click on your Dial up Connection, then left click 'Properties'
    - Left Click 'Advanced' Under "Internet Connection Firewall" tick the box
    'Protect my computer and networking by limiting or preventing access to this
    computer from the internet'
    - Click Ok and Close the "network connections" box.
    You can then connect to the Internet and download the Microsoft relevant patch.

    You could also try:
    Click Start/Run then type in cmd
    and then type in : shutdown -a
    Do this when the shutdown prompt appears.

    W32.Blaster.Worm patch is available here:-
    MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
    Programs
    http://support.microsoft.com/?kbid=824146

    You must download and install the patch. In many cases, you will need to do this
    before you can continue with the removal of the worm.
    Because of the way the worm works, it may be difficult to connect to the
    Internet to obtain the patch, definitions, or removal tool before the worm shuts
    down the computer. It has been reported that, for users of Windows XP,
    activating the Windows XP firewall may allow you to download and install the
    patch, obtain virus definitions, and run the removal tool. This may also work
    with other firewalls, although this has not been confirmed.

    2. You can download the Symantec Removal Tool from here
    http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
    or you can visit this site to assist in the removal of the worm
    http://www3.ca.com/virusinfo/virus.aspx?ID=36265
    To download ClnPoza.zip - a utility that cleans a local machine affected by
    Win32.Poza,
    or this site for assistance: http://www.kellys-korner-xp.com/xp_qr.htm#rpc

    http://www.updatexp.com/cryptographic-service.html
    For information on the Cryptographic Services
     
    Kaylene aka Taurarian, Feb 25, 2004
    #2
    1. Advertisements

  3. Jupiter Jones [MVP], Feb 25, 2004
    #3
  4. Taz

    taz Guest

    I will try the tool but I suspected Blaster right away
    and used a tool from the norton anti virus site, and I
    don't see blaster in the processes. I'm a little
    concrened that I can't use the registry.
     
    taz, Feb 25, 2004
    #4
  5. Taz

    Taz Guest

    I tried the tools to remove blaster and a couple other
    worms that were listed on the site and they all said that
    the worms are not on my computer!! This is really getting
    on my nerves! I'm running out of ideas I don't want to
    go through reinstalling again I just did all that. the
    only processes that seem a little out of place are
    Mdm.exe, alg.exe, windowsfx.exe, type32.exe, everthing
    else I'm pretty sure should be there.
     
    Taz, Feb 25, 2004
    #5
  6. Taz

    taz Guest

    I looked in the system32 file for all the files microsoft
    talks about with these worms (Msblast.exe, Nstask32.exe,
    Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll,
    or Yuetyutr.dll) and none of them are there!!!!
     
    taz, Feb 25, 2004
    #6
  7. TAZ..
    Go to www.safer-networking.org and download Spybot..
    Once installed, start the program and scann everything..
    Remove EVERYTHING listed afterwards (solve problems)

    If u have time, pay attention to who created the problems
    u solve (signed by microsoft and installed with windows!)

    Hope this solves ur problem..
     
    Henning M. Pedersen, Feb 25, 2004
    #7
  8. Taz;
    It still sounds like a virus or spyware of some kind.
    You ran Mcafee online?
    Try norton online as well, #1 on this link, and then #5 and #6 to get
    spyware:
    http://www3.telus.net/dandemar/slowcom.htm

    Then check for corrupt/missinf system files:
    Start/Run
    Type "sfc /scannow" ENTER
    Have the Windows XP CD available.
     
    Jupiter Jones [MVP], Feb 27, 2004
    #8
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.