Lori
December 14th 03, 02:10 PM
Hi,
To keep this as brief as possible, will outline:
1. XP Pro, single computer (no network)
2. Returned from 2 wk vacation to find no Internet
connection (had 2 dial-ups). To my knowledge, no one used
the computer in my absence (highly unlikely that anyone
could). Inadvertently booted up with the XP CD in the
drive. I'ld been getting checkdisk on bootup before I
left, so problem may have originated before Aug 6.
3. First ISP got the dialer set up (but without a
firewall, which I hadn't been using before). Started
Internet Call Manager, ICQ, IE ... and got an RPC
shutdown message.
4. Called 2nd ISP, got their dialer reactivated, with
XP's firewall, and learned about the Blaster worm.
5. Downloaded MS security patches, but was running
extremely slowly (my ISPs only give 24kps or 26.4kps), so
I tried removing the firewall after a few hours. Seemed
to be fine, until later in the day, when it seized up,
and I got the RPC shutdown again. I think, but am not
sure, that that was shortly after I clicked ICQ on.
6. This morning, I thought to try Restore ... 3 separate
Restore points all returned the message that the system
could not be restored to those dates (mid-July to early
Aug).
7. Called ISP again (the one who said to use a firewall
in the first place) who suggested freedom.com. Used their
worm removal tool, then redid the MS security patch, then
ran the Freedom virus scan (mine had shown no virus). I
scanned everything, and it reported no viruses.
I clicked on ICQ and as soon as it loaded, up came the
RPC shutdown again.
8. I checked, per MS instructions, that the critical
update was installed (it was) and scanned the full system
again ... no viruses.
9. Searched for info, and found a site that said that the
worm could set up a new user in a system while the worm
was present. This seems to have happened. I had noticed a
reference to User, although I had long ago renamed that.
a) I now have 2 administrators ... the built-in one, with
the name I had given it, and the "new" one, which I
renamed and password protected today before I realized
that it might be the problem. I cannot get the original
one to show on the "Change User info screen", and I get
dire warnings about being the user when I try to delete
the "new" one.
b) I had 2 users in Users Group: NP authority and NP
authority interactive). NP Authority was the name on the
RPC shut down message. Should they have been there? I
removed them.
10. I also have the issues that Dave (above message)
raised ... My sound went bad after the first download of
the security patch, so I presently have the speakers
unhooked.
Is it likely that I have a ghost user, causing the
shutdowns?
How do I get the original Administrator (me) to show as a
user so I can log in as that?
How do I remove the 2nd uninvited Administrator when it
is the only way I can log on?
The Firewall, in combination with my slow dial-up, runs
too slowly for me to complete some tasks without timing
out. Is the slowdown part of the problem I am
experiencing or a feature of the Firewall?
Are there any other complaints connecting ICQ with the
RPC shutdown?
What should I try next?
Thank you for any help you can provide.
Lori
To keep this as brief as possible, will outline:
1. XP Pro, single computer (no network)
2. Returned from 2 wk vacation to find no Internet
connection (had 2 dial-ups). To my knowledge, no one used
the computer in my absence (highly unlikely that anyone
could). Inadvertently booted up with the XP CD in the
drive. I'ld been getting checkdisk on bootup before I
left, so problem may have originated before Aug 6.
3. First ISP got the dialer set up (but without a
firewall, which I hadn't been using before). Started
Internet Call Manager, ICQ, IE ... and got an RPC
shutdown message.
4. Called 2nd ISP, got their dialer reactivated, with
XP's firewall, and learned about the Blaster worm.
5. Downloaded MS security patches, but was running
extremely slowly (my ISPs only give 24kps or 26.4kps), so
I tried removing the firewall after a few hours. Seemed
to be fine, until later in the day, when it seized up,
and I got the RPC shutdown again. I think, but am not
sure, that that was shortly after I clicked ICQ on.
6. This morning, I thought to try Restore ... 3 separate
Restore points all returned the message that the system
could not be restored to those dates (mid-July to early
Aug).
7. Called ISP again (the one who said to use a firewall
in the first place) who suggested freedom.com. Used their
worm removal tool, then redid the MS security patch, then
ran the Freedom virus scan (mine had shown no virus). I
scanned everything, and it reported no viruses.
I clicked on ICQ and as soon as it loaded, up came the
RPC shutdown again.
8. I checked, per MS instructions, that the critical
update was installed (it was) and scanned the full system
again ... no viruses.
9. Searched for info, and found a site that said that the
worm could set up a new user in a system while the worm
was present. This seems to have happened. I had noticed a
reference to User, although I had long ago renamed that.
a) I now have 2 administrators ... the built-in one, with
the name I had given it, and the "new" one, which I
renamed and password protected today before I realized
that it might be the problem. I cannot get the original
one to show on the "Change User info screen", and I get
dire warnings about being the user when I try to delete
the "new" one.
b) I had 2 users in Users Group: NP authority and NP
authority interactive). NP Authority was the name on the
RPC shut down message. Should they have been there? I
removed them.
10. I also have the issues that Dave (above message)
raised ... My sound went bad after the first download of
the security patch, so I presently have the speakers
unhooked.
Is it likely that I have a ghost user, causing the
shutdowns?
How do I get the original Administrator (me) to show as a
user so I can log in as that?
How do I remove the 2nd uninvited Administrator when it
is the only way I can log on?
The Firewall, in combination with my slow dial-up, runs
too slowly for me to complete some tasks without timing
out. Is the slowdown part of the problem I am
experiencing or a feature of the Firewall?
Are there any other complaints connecting ICQ with the
RPC shutdown?
What should I try next?
Thank you for any help you can provide.
Lori