Tech: Remote Procedure Call service terminated

Subject: RE: Tech: Remote Procedure Call service terminated
From: JohnInKansas
Date: 15 Aug 03 - 05:26 PM

"Opportunism at its finest" - or "Valuable service to Users" - take your pick.

I was in my local bit shop (CompUSA) yesterday, and they're selling a "fix CD" for this problem for $19.95, or offer to "clean and/or protect" your machine from this bug for $49.95, if you bring your computer in. I counted at least 14 large "WARNING" signs within the first 30 feet of entering the store.

John

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST
Date: 15 Aug 03 - 10:00 AM

SOB !!! Now you can catch a virus just by being connected to the net ! The solution I used was to call a buddy who just happened to catch the news on a late night news program. He's a computer guy and he was able to circumvent the worm, get the fix, and deworm my PC. Since my PC is an integral part of my business, I bought a refurbished, cheap, PC for net use and will never again connect my main PC to the web. I was lucky to get an extension on a government contract that was due today... otherwise, that worm would have cost me a bundle ! (Although, in light of the circumstances, I can't see even the government not granting such an extension, but you never know when you're dealing with the government.) Whew !!! Just glad it didn't eat my brain. Thanks for all the postings and concern guys.

Subject: RE: Tech: Remote Procedure Call service terminated
From: JohnInKansas
Date: 14 Aug 03 - 06:16 AM

A note in the Ziff-Davis eWeek newsletter comments that a "feature" of the worm incorporated in the most common variant of this RPC bug is a pending (Saturday) launch of a "Denial Of Service" attack on the Microsoft Software Update site. They strongly suggest not "waiting 'till the weekend" to get the fix... if anyone hasn't already got it cleaned up.

You may not be able to get in to get the fix if the DoS launches in any force, and you may contribute to the DoS if your machine isn't fixed.

The patch was announced and available in early July. There's also a credible tale going 'round that uncle Mickey was so worried about this one that they hired a well-known "spammer" (direct marketing email service!!!) to send out notices of the fix. Unfortunately, the spam service failed to authenticate the messages, so apparently at least a few people thought it was just another hoax.

John

Subject: RE: Tech: Remote Procedure Call service terminated
From: Mark Cohen
Date: 13 Aug 03 - 11:17 PM

Didn't men's suits formerly come with two sets of browsers?

Aloha,
Mark

(Amergin, what's a good, reasonably-priced hardware firewall? And what are the advantages and disadvantages of having one as opposed to software like ZoneAlarm? I'm on cable--RoadRunner.)

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST
Date: 13 Aug 03 - 11:14 PM

ones a bloody browser the other isnt.

Subject: RE: Tech: Remote Procedure Call service terminated
From: mack/misophist
Date: 13 Aug 03 - 11:11 PM

Dear Guest, Explorer and IExplorer and the same animal wearing different hats. As a matter of fact, you should have 2 browsers to have a spare on the day when everything goes to hell and you can't access your registry to fix it. Any browser will browse your filesystems.

Subject: RE: Tech: Remote Procedure Call service terminated
From: annamill
Date: 13 Aug 03 - 06:05 PM

Thank you, Amergin!! Thanks to you I can access my Outlook again. Yea!!

Love, Annamill

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST,amergin
Date: 13 Aug 03 - 03:29 PM

how are you connected?

if by cable or dsl go to the control panel then click on classic mode and then click on network connections and then you should see your connection in there (usually local area connection one)...you right click on it and go to properties and then go to the advanced tab...it should have the fire wall in there...you just click the check mark on or off and youre good to go...

one thing though...firewalls are not perfect...they can go bad and cause connectivity problems...software firewalls are really notorious for this....your best bet especially if you have high speed internet is to use a hardware firewall...

Subject: RE: Tech: Remote Procedure Call service terminated
From: Pooby
Date: 13 Aug 03 - 03:23 PM

Hate to come off as some computer-illiterate a-hole (I'm not by any means), but how do you activate/deactivate the firewall with Win XP? Last night I spent the better part of the evening trying to find the proverbial on-off switch, and gave up in frustration. What am I missing? Thanks.

Poobs

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST
Date: 13 Aug 03 - 02:52 PM

EXPLORER is the heart of windows....IEXPLORER is just the browser....

try repairing ie by going to aadd/remove programs and double clicking on it and selecting repair.

Chances are what is causing it though is either a bad cookie...delete all temp files and cookies...sometimes you have to go to the folder directly....or it is an embedded object causing this....

Subject: RE: Tech: Remote Procedure Call service terminated
From: Bill D
Date: 13 Aug 03 - 01:54 PM

please note...clicking on that link will immediately start downloading that .exe program...be sure that's what YOU want.

Subject: RE: Tech: Remote Procedure Call service terminated
From: Skipjack K8
Date: 13 Aug 03 - 01:15 PM

Thanks, Jim, did your instructions to the word, and the patch worked. However, I did get in touch with my ISP, and they sent me to

http://securityresponse.symantec.com/avcenter/FixBlast.exe


And that got rid of the blighter. Fortunately, that only took up a small part of my day.

Subject: RE: Tech: Remote Procedure Call service terminated
From: Sorcha
Date: 13 Aug 03 - 10:59 AM

Thanks, misophpist, but I have NO clue what to do about it....done everything I do know of and no joy.

Subject: RE: Tech: Remote Procedure Call service terminated
From: mack/misophist
Date: 13 Aug 03 - 10:38 AM

Take special note of those "IExplorer" errors, Sorcha. Explorer is the heart of windows. When it gets buggy everything else becomes vulnerable.

Subject: RE: Tech: Remote Procedure Call service terminated
From: Sorcha
Date: 13 Aug 03 - 01:31 AM

No worse than pop ups during Mudcat and Google and all the 'lexplore has caused an error in (take your pick) every 5 minutes. Geek coming Thursday.

Subject: RE: Tech: Remote Procedure Call service terminated
From: mack/misophist
Date: 13 Aug 03 - 01:13 AM

My ISP just sent an advisory about this worm. Congratulations to gnu for beating them by a good margin.

Subject: RE: Tech: Remote Procedure Call service terminated
From: Bill D
Date: 12 Aug 03 - 08:38 PM

there are usually settings within a firewall that tell it what to block...maybe you have the wrong box checked?

Subject: RE: Tech: Remote Procedure Call service terminated
From: annamill
Date: 12 Aug 03 - 08:20 PM

I set the firewall on my XP and now I can't use my Outlook Express. Even Max doesn't know whats causing it. A pain.

Annamill

Subject: RE: Tech: Remote Procedure Call service terminated
From: Amos
Date: 12 Aug 03 - 07:28 PM

I have been told Msoft has an update against this vulnerability, FWIW.

A

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST,KB
Date: 12 Aug 03 - 05:50 PM

I had this swine too - I subscribe to Norton antivirus, & they have a tool for removal of the virus.
I think the microsoft download is the patch to fix the loophole that the virus is attempting to use? Presumably you still need to get rid of the virus itself?
There is a file called something like msblast.exe which needs getting rid of, and also there will be an entry in the registry which will be invoking that executable when you start up windows.

Having spent best part of half a day trying to download the Norton fix tool & MS patch before the inevitable crash & getting the same infection again I have now activated the firewall that comes with XP, and have switched off ActiveX stuff in the browser just in case. God knows why I hadn't done all that before! I suppose you just don't bother til you've been bitten....

Subject: RE: Tech: Remote Procedure Call service terminated
From: Jim McLean
Date: 12 Aug 03 - 05:00 PM

Check this out.
What you need to do is the following:

Click on start, then click on the 'my computer' icon with the Right mouse button then click on 'Manage'. Now on the box that appears click the + sign next to 'services and applications'. Now click 'services'

Now on the right hand side look for 'Remote Procedure call'. Click this with the right mouse button and click properties. Now click on the recovery tab and change the 3 'restart computer' options to 'take no action'.

Now click on the internet and go to the following URL:

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

then click download on the right hand side, once the file is downloaded – install it from where it was saved.

Then once this is complete, go back to the services and change the 'take no action' back to 'restart computer'.
Cheers,
Jim

Subject: RE: Tech: Remote Procedure Call service terminated
From: GUEST,MMario
Date: 12 Aug 03 - 04:22 PM

I'm reading the first post saying to myself "He's got a worm or a really active piece of spyware"

Bingo.

Subject: RE: Tech: Remote Procedure Call service terminated
From: Bill D
Date: 12 Aug 03 - 04:11 PM

just saw it on the news..seems to be a rapid spread of this worm.....

Subject: RE: Tech: Remote Procedure Call service terminated
From: Musicman
Date: 12 Aug 03 - 12:27 PM

ok gang..
i had this problem yesterday... spoke with microsoft techies about it... when i was on the call.. there were about 5-6 others with the same problem..
the calls waiting went from 200 to 450 plus in about 1 hr....

and we found the resolution....

if you are on dsl or cable, unplug from the internet and reboot the computer....
activate the firewall (winxp) then connect to the internet again....
go to this Microsoft Fix document
and install the update.

reboot the computer, then you can deactivate the firewall and that will fix the problem...

it was discovered i think to be some sort of worm that was working through the system....

musicman

Subject: RE: Tech: Remote Procedure Call service terminated
From: Amos
Date: 12 Aug 03 - 12:14 PM

Hope it works, gnu -- from the sound of it if it doesn't restore the RPC functionality you'll need to reinstall.

A

Subject: RE: Tech: Remote Procedure Call service terminated
From: gnu
Date: 12 Aug 03 - 12:13 PM

Nope. Goin down in flames again...

Subject: RE: Tech: Remote Procedure Call service terminated
From: gnu
Date: 12 Aug 03 - 12:10 PM

I just tried a system restoration to August 3 and now I am waiting to see if I get booted out again. I'll return... with good news, I hope.

Subject: Tech: Remote Procedure Call service terminated
From: gnu
Date: 12 Aug 03 - 12:01 PM

About five minutes after getting on the net, a dialogue box appears telling me that the system will be shut down in 60 seconds by the NT Authority System because the Remote Procedure Call service has been terminated unexpectedly; save all present work, blah, blah. At 60 seconds, the computer restarts. Anyone ?

confusedgnu