Unwelcome worm.

shamalive

Not really looking for a solution as I think I have the fix.
Just looking for some opinion/ info from those in the know.

I've never had a worm/ virus on any of my machines until the other day.
I have one particular desktop, winxp sp2,
it's probably the only one I have that's been unpatched in about 6 months.

Its getting the "remote call procedure" terminated unexpectedly error,
gives you 60 seconds and reboots.
Happens often at startup but other times at random.

Will try the symantec fix later
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


Anyone know how exactly the blaster worm might have got on it?
No downloads whatsoever, although a few people use the machine
to surf the web.
Using firefox, with the javascript blocker enabled.

AVG didn't pick up anything after a full scan,
nor did housecall.trendmicro.com
nor did the stinger tool.

shanethemofo

lol is that the sasser worm striking yet another victim... thought that had gone out of style now

SeanW

You don't necessarily have a virus but if you have an unpatched system (potentially including a firewall), a thwarted hack-attack can cause the Remote Procedure Call service to become permanently unstable.

Unfotunately the dumbazz Windows Authority shuts down the computer when this service dies, even though things would quite frankly work fine without it.

Here's what you need to do to stop that from happening:

Click Start => Settings => Control Panel
(or Start => Run => Control.exe)
Then go to Administrative Tools => Computer Management

Launch this and find the "Services" option in the Computer Management (Local) Tree.

Go down to Remote Procedure Call, right click and select properties. Click the recovery tab and set all three recovery options away from "Restart the Computer" preferably setting all to "Take No Action."

This won't stop the RPC service from dying, but it WILL prevent the damn thing from taking your computer down with it.

shamalive

SeanW wrote:

You don't necessarily have a virus but if you have an unpatched system (potentially including a firewall), a thwarted hack-attack can cause the Remote Procedure Call service to become permanently unstable.

Unfotunately the dumbazz Windows Authority shuts down the computer when this service dies, even though things would quite frankly work fine without it.

Here's what you need to do to stop that from happening:

Click Start => Settings => Control Panel
(or Start => Run => Control.exe)
Then go to Administrative Tools => Computer Management

Launch this and find the "Services" option in the Computer Management (Local) Tree.

Go down to Remote Procedure Call, right click and select properties. Click the recovery tab and set all three recovery options away from "Restart the Computer" preferably setting all to "Take No Action."

This won't stop the RPC service from dying, but it WILL prevent the damn thing from taking your computer down with it.

Nice one SeanW.