Windows Error Shuts Down Every 10 min. (RPC error)

[PowerMan57two]

Okay I was online on the computer reading through my new html book. Messing around with WordPad as this is my fist time learning html. I am sitting here and get this error:

Remote Procedure Call (RPC) Service Terminated Unexpectidy.


I have no idea what it means. I tried doing windows xp restore point. That didn't help. So I totally deleted windows, moved anything important to the 2nd hard drive and reinstalled Windows.

So for about 20minutes everything is fine. But the message comes up. So now I have no clue what it could be since I just re-did my computer.

Do you guys/gals have any suggestions or any patches/fixes you know of. This is annoying to restart every 10-20minutes!

[PowerMan57two]

Oh and I forgot to mention one thing.

When I do Ctrl+Alt+Delete and I click the Processes tab there are a bunch of

svchost.exe username=network service
svchost.exe username=local service
svchost.exe username=system
svchost.exe username=system


And I cannot remember which one it is, but when I close one or end the process that is when the little shutdown warning box comes up and counts down from 1minute.

[johnsmatrix]

It's a security problem in XP thats being exploited by somesort of virus code.. The thread links below will guide you to the patch updates but they may also privide information about what to do after the fact.

http://www.zeropaid.com/bbs/showthre...ighlight=virus

http://www.zeropaid.com/bbs/showthre...ighlight=virus

http://www.zeropaid.com/bbs/showthre...ighlight=virus

http://www.zeropaid.com/bbs/showthre...threadid=13572

Keep an eye on these as an answer may pop up... There are many new threads popping up on this subject that the answer may never reach you unless you search and keep up to date. I would subscribe to those threads to keep up on it.. Hope it helps. [/B]

[Krell]

Ironically, it was The Matrix Reloaded I was watching when this thing shut down my other machine. I patched it too, and then reconfigured my services and used msconfig to examine start up group items again.


Thx johnsmatrix for taking the time to provide some solid links and info.


PowerMan57two = examine your Event logs, watch what happens and notice the times.

The rest of you, can compare those times to events in your firewall.

[PowerMan57two]

Okay I downloaded the patch form the 2nd link you gave me. I'll let you know if I get anymore messages. I still see the 4
svchost.exe username=network service
svchost.exe username=local service
svchost.exe username=system
svchost.exe username=system

Are those supose to be there still?
I really have no idea how I got this thing. I was just reading my new html book that I got an Barnes and Nobel today :mellow

LoL and there I got the message.

[beardedwonder]

Symantec Info:

http://securityresponse.symantec.com...ster.worm.html

There is a tool here to remove it.

Patch for Windows:

http://www.microsoft.com/technet/tre...n/MS03-026.asp

Affected systems are: XP, 2000, NT4 and server 2003

McAfee DAT

http://download.mcafee.com/us/updates/updates.asp

4283 will detect the worm, 4284 will clean it.

I hope that helps you guys, oh yeah you might also want to block ports TCP 4444, if you don't use these apps you should also block :
TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

According to www.neowin.net

PS: PowerMan it is normal to have those svchost services running.

[Krell]

Yes you will always see svchost and generic host processes.

Use the Windows upadate tool, get all the security updates, and follow the steps and links provided by beardedwonder.

https://grc.com/x/portprobe=135

[PowerMan57two]

Okay I read the first parts of the news from news.com they say this:

Dubbed "MSBlast" by its author, the worm is spreading quickly, according to an initial analysis


I do ctrl+alt+delete and under processes I see the MSBlast running. What do I do! I am dumb as a rock for internet and blocking stuff, TCP ports, and all this other crap. I am just learning php/html now. LoL. Give me a computer to build and you got it done.

This is my first time receiving a virus that I actually couldn't fix. Usually if I got one before it was a simple restart, or reformat. It didn't work this time!

[Krell]

Heres what you do



First, stop panicking. Nothing is on fire.

Second, you follow the links in the above posts and read the articles.

You get the patches, and follow the steps recomended, nothing less, nothing more.

There is nothing lacking in this, or any of the other 4 current threads about this. Just do it.

I suggest you turn off your PC, go to bed, and do it tomorrow.

[PowerMan57two]

LoL to late. Have already read, and updating my computer now. 98.4MB worth of updates for me on Windows XP Pro. Thanks for the help. I haven't got the error now. It should be all good. Thank you a bunch.

[^_{E17}_^]

I have exactly the same problem right now! Thank God i found this thread early. I was getting pretty mad about this!!!

[kiwibank]

me too!! just got shut down myself by something and received error message - something to do with " NT Data Control" or some crap like that. so what did i do? why i went straight to zeropaid forums of course where the most helpful links and advice have enabled me to clean XP house, so to speak and my XP sys now running error free at the moment. many thanks zeropaiders. bloody great service.

regards

kiwibank

[alliercollins]

You know what sucks... I actually was one of the first few to get infected, like a month or so ago. No one knew what was causing it or how to fix it. Then MS released a patch and I finally got it fixed (There was a patch on windows update a week or two ago)... After all of that (weeks of having it restart at random times), it's nice to see you all finally catching up and having to suffer to :P :wings.

If you haven't updated yet, you should asap. My mom got infected this morning and I had to go back and fix her computer by applying the patch. For comparison, we both run XP Pro, but I have a 1.5 mbit connection and she has 56k. She is only online for about an hour a day, while my computer is on 24/7. She also has never downloaded any file in her life (I get her what she needs so she will avoid viruses (She is a total "noob"). As you can see, it seems to affect everyone.

[MoonMan]

lol you think this is bad ? EVERYONE of my friends has gotton whatever the hell this is, and came crying to me for help. Luckily it is fairly easy to sort out once you identify what the problem is.

[Ken17625]

Luckily, I patched a few days ago. Also did a virus scan (updated defs).

I'm clean..................:fire