windows RPC shutdown error

whosurpaddy

has anyone seen this error b4?

I was just surfing away when this popped up & shut windows down. took a quick look in task mgr (it only gave me 60 seconds b4 shutdown) & thought id tracked it down to a file called save.exe which was eating up loads of memory at the time. found & removed the offending prog, but when it restarted it shut windows down again.

then just to be on the safe side i did a restore to a week earlier but it came up again & shut windows down again.

i dual boot so im in 2000 atm.


any ideas?

Eurorunner

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp


Its a windows vulnerability which i just encoutered myself over the past hour. You need to go to the link above and download the patch for yoour windblows OS.

Also, have u got your firewall running.


Dont hang about mate, do it now!

Eurorunner

As regards save.exe...


save.exe
Advertising Spyware. Stealth advertising components that are installed by some "shareware" products (and sometimes, legitimately purchased commercial software) and may collect personal information from your computer. These "adbots" are usually tied to a dodgy shareware program you have installed.
Looks like you have installed this software with music player.
Try to stop it.
More info:
http://www.cexx.org/adware.htm

clansman

i had that problem a few hours ago. it took me 4 times to DL the
patch cos it kept restarting!!!!

windows vulnerability

what is that and why did it happen?

sci0x

I was having the same fecking problem. But I ran ad aware 6 and the prob seems to have sorted itself out. However, Webmonkey told me: right click my computer, click properties, advanced, startup and recovery settings and unclick automatically restart so it wont restart when that bloody annoying thing comes on.

MrPinK

Bad idea denis. You may not be getting the shutdowns anymore, but the vulnerability is still there. The worm that's causing these will still be getting into your machine. Someone could connect to your machine and format your hard disk if they wanted, they will have complete admin access. Get the fix immediately

nore

how do you delete this msblast.exe file? it's in a protected folder...

MrPinK

Well make sure you delete the registry key first of all, to stop it from being run. I wasn't effected, so I can't tell you exactly how to remove it. Give it a day, and there should be complete details out.

eth0_

LOADS of ppl getting hit with this tonight! (Not me though...mmm unixy immunity )

This is how to fix it (it's a worm virus)
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

whosurpaddy

this is affecting a lot of people (i work in tech support & good few calls in bout this today). thanks for postin the fixes eurorunner.

sorry for creating 2 threads , but the system was shutting down so couldnt really see if the orinigal thread had loaded.

does anyone have more info as to where this came from?

Praetorian

This happened to me last night on my 2 pc's, it also happened on Retrogamers pc. How annoying.

Doodah7

Yes started happening to me as well. I tried adaware and it didn't cure it and also re-installed IE which didn't work either. Glad I'm not the only one. Got to download the patch. (Thank god for work computers!!)

I thought the reason that caused it was I downloaded a plug-in for real player. My next course of action was to uninstall Real Player.

Is it a virus or a Windows bug??? I'm running XP.

MrPinK

Bit of both actually. A worm that exploits a huge security bug that was found a couple of weeks ago

Praetorian

It's a Windows bug that lets a virus in. Install the patch from microsoft.

Run an upto date virus scanner. There is a free web based virus scanner available

http://housecall.trendmicro.com/housecall/start_corp.asp

Consider installing a firewall

elexes

its fecking annoying me now . im not sure exactly how to bring one pc back to the way it was a while back .. arg this may prove to be a problom

smemon

i got it too, most people dont have time to download it, another way is:

1. control panel
2.administritive tools
3.services
4.remote procedure call (rpc)
5.right click, click on properties
6. choose , 'take no action' for all 3 choices, it automatically chhoses, restart.

this disables DCOM RPC.

good luck!:D

suppafly

i when to the page where the patchs r available and am just wondering how do i know which edition i have(the 32 or 64bit edition)?

p.pete

I went for 32 on the basis that I have home and not professional although I'm still not sure on whether I choose the wrong one.

Also the 64 bit version is 5 megs compared to 1.2 or something for the 32 bit.

Praetorian

You need the 32bit patch, unless you have a 64bit processor (and 64 bit windows) which is highly unlikely.

MarkR

32 Bit is the one you wamt. Unless you are running a server with winxp pro. I think. :-)

Retr0gamer

Thanks for the help guys and especially to Praetorian for helping me get this fixed. I got a right ballicking from me ma because she was on the internet doing her thesis when it happened. Of course I got the blame.

suppafly

thanks lads for that. I thankfully haven't got this virus yet(afaik), but i wanna get this in so i don't get it.

anthonymcg

Originally posted by smemon
i got it too, most people dont have time to download it, another way is:

1. control panel
2.administritive tools
3.services
4.remote procedure call (rpc)
5.right click, click on properties
6. choose , 'take no action' for all 3 choices, it automatically chhoses, restart.

this disables DCOM RPC.

good luck!:D

AFAIK it doesnt. That'll stop the PC from rebooting but it wont shut down RPC. If you look at the dependencies for RPC, half of the system services are dependant on it hence shutting it down is not possible. Thats why the worm is smart, attack a service which has a lot of dependencies. Would like to see the source of this one.,

BlitzKrieg

thank you thank you thank you thank you thank you...you've saved my pitiful life...i could get drunk in peace thx to you saviours...