RPC.exe error---HELP!!!!!!!!!!!!!!

[Igor Smeghead]

I'm new to this group. I have a real dilemma. I set up an PC for a
client of mine (with pre-installed OS). Normally, I wipe off the XP
and put Windows 2000 on PCs, but this person wanted to keep their XP
Home Edition. This PC is standalone in an office. It only is used
for minor bookeeping and internet usage (dialll-up). The user loves
MSN 8 and wants to browse with their browser. I activated MSN 8 (also
pre-installed) and it immediately converted her email to be viewed in
hotmail. Following the conversion, an error popped up that said the
browser had an RPC error and would shut down in 30 seconds.

Now everytime she goes online, she receives the same message, and her
computer reboots. I've search the FAQs and MSKB, and can't find a
reference to this. I installed no software (besides what was
pre-installed). This is supposed to be an "out of the box"
configuration. Of course, since I set the PC on the desk, it must've
been something that I did to it (according to the customer). I
suspect a virus. I saw nothing in her email that looked suspicious.

I need help...pleeeeeeeeeeeease

Igor

[Wislu Plethora]

>-----Original Message-----
>I'm new to this group. I have a real dilemma. I set up
an PC for a
>client of mine (with pre-installed OS). Normally, I wipe
off the XP
>and put Windows 2000 on PCs, but this person wanted to
keep their XP
>Home Edition. This PC is standalone in an office. It
only is used
>for minor bookeeping and internet usage (dialll-up). The
user loves
>MSN 8 and wants to browse with their browser. I
activated MSN 8 (also
>pre-installed) and it immediately converted her email to
be viewed in
>hotmail. Following the conversion, an error popped up
that said the
>browser had an RPC error and would shut down in 30
seconds.
>
> Now everytime she goes online, she receives the same
message, and her
>computer reboots. I've search the FAQs and MSKB, and
can't find a
>reference to this. I installed no software (besides what
was
>pre-installed). This is supposed to be an "out of the
box"
>configuration. Of course, since I set the PC on the
desk, it must've
>been something that I did to it (according to the
customer). I
>suspect a virus. I saw nothing in her email that looked
suspicious.
>
>I need help...pleeeeeeeeeeeease
>
>Igor
>.

Let's see...You have "clients," which means that you are
somehow engaged in the business of selling computer
hardware and/or services. You normally "wipe off XP" and
replace it with 2000, thereby, in all likelihood, voiding
the manufacturer's warranty and leaving your clients with
outmoded technology. Then when the most highly publicized
malicious code since "Melissa" strikes (because of your
failure to properly configure your client's system)you
have to cry for help. It is not possible that you have
"searched the FAQs and MSKB" without finding the answer to
your problem, which means that in addition to being
a moron, you're also too lazy to do what you're being
paid to do. Nice work if you can get it, I guess.

[Edward]

It's the W32.blaster worm, Igor.

Go here,
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

While there it would be a good idea to have Symantec run a scan of the OS.

To allow time on-line to do this, go to Start/Run and type services.msc.
Scroll to Remote Procedure Call (Not Locator) and disable it.

You must also visit http://support.microsoft.com/ and download and install
SP1 which will prevent a rematch.

Remember to enable RPC after you've finished. Also check that the Microsoft
firewall is enabled if there is no other firewall on the PC.

Good luck,

Ed


"Igor Smeghead" > wrote in message
...
> I'm new to this group. I have a real dilemma. I set up an PC for a
> client of mine (with pre-installed OS). Normally, I wipe off the XP
> and put Windows 2000 on PCs, but this person wanted to keep their XP
> Home Edition. This PC is standalone in an office. It only is used
> for minor bookeeping and internet usage (dialll-up). The user loves
> MSN 8 and wants to browse with their browser. I activated MSN 8 (also
> pre-installed) and it immediately converted her email to be viewed in
> hotmail. Following the conversion, an error popped up that said the
> browser had an RPC error and would shut down in 30 seconds.
>
> Now everytime she goes online, she receives the same message, and her
> computer reboots. I've search the FAQs and MSKB, and can't find a
> reference to this. I installed no software (besides what was
> pre-installed). This is supposed to be an "out of the box"
> configuration. Of course, since I set the PC on the desk, it must've
> been something that I did to it (according to the customer). I
> suspect a virus. I saw nothing in her email that looked suspicious.
>
> I need help...pleeeeeeeeeeeease
>
> Igor

I love your answer!!!

>-----Original Message-----
>
>>-----Original Message-----
>>I'm new to this group. I have a real dilemma. I set
up
>an PC for a
>>client of mine (with pre-installed OS). Normally, I
wipe
>off the XP
>>and put Windows 2000 on PCs, but this person wanted to
>keep their XP
>>Home Edition. This PC is standalone in an office. It
>only is used
>>for minor bookeeping and internet usage (dialll-up).
The
>user loves
>>MSN 8 and wants to browse with their browser. I
>activated MSN 8 (also
>>pre-installed) and it immediately converted her email
to
>be viewed in
>>hotmail. Following the conversion, an error popped up
>that said the
>>browser had an RPC error and would shut down in 30
>seconds.
>>
>> Now everytime she goes online, she receives the same
>message, and her
>>computer reboots. I've search the FAQs and MSKB, and
>can't find a
>>reference to this. I installed no software (besides
what
>was
>>pre-installed). This is supposed to be an "out of the
>box"
>>configuration. Of course, since I set the PC on the
>desk, it must've
>>been something that I did to it (according to the
>customer). I
>>suspect a virus. I saw nothing in her email that
looked
>suspicious.
>>
>>I need help...pleeeeeeeeeeeease
>>
>>Igor
>>.
>
>Let's see...You have "clients," which means that you are
>somehow engaged in the business of selling computer
>hardware and/or services. You normally "wipe off XP" and
>replace it with 2000, thereby, in all likelihood, voiding
>the manufacturer's warranty and leaving your clients with
>outmoded technology. Then when the most highly publicized
>malicious code since "Melissa" strikes (because of your
>failure to properly configure your client's system)you
>have to cry for help. It is not possible that you have
>"searched the FAQs and MSKB" without finding the answer
to
>your problem, which means that in addition to being
>a moron, you're also too lazy to do what you're being
>paid to do. Nice work if you can get it, I guess.
>.
>

[Malke]

Igor Smeghead wrote:

> I'm new to this group. I have a real dilemma. I set up an PC for a
> client of mine (with pre-installed OS). Normally, I wipe off the XP
> and put Windows 2000 on PCs, but this person wanted to keep their XP
> Home Edition. This PC is standalone in an office. It only is used
> for minor bookeeping and internet usage (dialll-up). The user loves
> MSN 8 and wants to browse with their browser. I activated MSN 8 (also
> pre-installed) and it immediately converted her email to be viewed in
> hotmail. Following the conversion, an error popped up that said the
> browser had an RPC error and would shut down in 30 seconds.
>
> Now everytime she goes online, she receives the same message, and her
> computer reboots. I've search the FAQs and MSKB, and can't find a
> reference to this. I installed no software (besides what was
> pre-installed). This is supposed to be an "out of the box"
> configuration. Of course, since I set the PC on the desk, it must've
> been something that I did to it (according to the customer). I
> suspect a virus. I saw nothing in her email that looked suspicious.
>

You're setting up computers - you're a tech - and you don't know what's
going on here? I'm astonished. Your client has the msblaster virus. Go
to www.sarc.com and read all about it. You simply cannot connect an
NT-kernel based machine to the Net without applying the latest rpc
patch. Standard Operating Procedure - 1) install the new os; 2) patch
the new os with at the very *least* the rpc patch but preferrably
whatever SR* are available from a cd-r you (the tech) previously
created; 3) then hook up to the Internet and immediately go to Windows
Update and apply all security updates, rebooting as necessary; 4) when
the os is completely patched, install an antivirus program and update
its definitions.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Igor Smeghead" > wrote in message
...
> I'm new to this group. I have a real dilemma. I set up an PC for a
> client of mine (with pre-installed OS). Normally, I wipe off the XP
> and put Windows 2000 on PCs, but this person wanted to keep their XP
> Home Edition. This PC is standalone in an office. It only is used
> for minor bookeeping and internet usage (dialll-up). The user loves
> MSN 8 and wants to browse with their browser. I activated MSN 8
(also
> pre-installed) and it immediately converted her email to be viewed
in
> hotmail. Following the conversion, an error popped up that said the
> browser had an RPC error and would shut down in 30 seconds.
>
> Now everytime she goes online, she receives the same message, and
her
> computer reboots. I've search the FAQs and MSKB, and can't find a
> reference to this. I installed no software (besides what was
> pre-installed). This is supposed to be an "out of the box"
> configuration. Of course, since I set the PC on the desk, it
must've
> been something that I did to it (according to the customer). I
> suspect a virus. I saw nothing in her email that looked suspicious.
>
> I need help...pleeeeeeeeeeeease
>
> Igor

[Igor Smeghead]

On Fri, 5 Dec 2003 06:38:01 -0800, "Wislu Plethora"
> wrote:

>
>>-----Original Message-----
>>I'm new to this group. I have a real dilemma. I set up
>an PC for a
>>client of mine (with pre-installed OS). Normally, I wipe
>off the XP
>>and put Windows 2000 on PCs, but this person wanted to
>keep their XP
>>Home Edition. This PC is standalone in an office. It
>only is used
>>for minor bookeeping and internet usage (dialll-up). The
>user loves
>>MSN 8 and wants to browse with their browser. I
>activated MSN 8 (also
>>pre-installed) and it immediately converted her email to
>be viewed in
>>hotmail. Following the conversion, an error popped up
>that said the
>>browser had an RPC error and would shut down in 30
>seconds.
>>
>> Now everytime she goes online, she receives the same
>message, and her
>>computer reboots. I've search the FAQs and MSKB, and
>can't find a
>>reference to this. I installed no software (besides what
>was
>>pre-installed). This is supposed to be an "out of the
>box"
>>configuration. Of course, since I set the PC on the
>desk, it must've
>>been something that I did to it (according to the
>customer). I
>>suspect a virus. I saw nothing in her email that looked
>suspicious.
>>
>>I need help...pleeeeeeeeeeeease
>>
>>Igor
>>.
>
>Let's see...You have "clients," which means that you are
>somehow engaged in the business of selling computer
>hardware and/or services. You normally "wipe off XP" and
>replace it with 2000, thereby, in all likelihood, voiding
>the manufacturer's warranty and leaving your clients with
>outmoded technology. Then when the most highly publicized
>malicious code since "Melissa" strikes (because of your
>failure to properly configure your client's system)you
>have to cry for help. It is not possible that you have
>"searched the FAQs and MSKB" without finding the answer to
>your problem, which means that in addition to being
>a moron, you're also too lazy to do what you're being
>paid to do. Nice work if you can get it, I guess.


I did not want to start a flame war. I never said that I was a
computer tech. When I said that I normally wiped XP, I was referring
to my home computers. (Which does not affect any one else's warranty).
The user is a client for the company I work for, that knew that I
dabbled in computers. They wanted me to unbox and hookup the
computer. I was told that I should not post to a newsgroup unless I
was willing to research the problem a little bit first. I was just
looking for a couple of answers to help someone out. I didn't mean to
bring the wrath of anyone that is so smart that they don't have time
to help others.

[Igor Smeghead]

Thanks to those that gave me suggestions. I've patched it, and
everything is fine

On Fri, 05 Dec 2003 12:44:12 GMT, Igor Smeghead
> wrote:

>I'm new to this group. I have a real dilemma. I set up an PC for a
>client of mine (with pre-installed OS). Normally, I wipe off the XP
>and put Windows 2000 on PCs, but this person wanted to keep their XP
>Home Edition. This PC is standalone in an office. It only is used
>for minor bookeeping and internet usage (dialll-up). The user loves
>MSN 8 and wants to browse with their browser. I activated MSN 8 (also
>pre-installed) and it immediately converted her email to be viewed in
>hotmail. Following the conversion, an error popped up that said the
>browser had an RPC error and would shut down in 30 seconds.
>
> Now everytime she goes online, she receives the same message, and her
>computer reboots. I've search the FAQs and MSKB, and can't find a
>reference to this. I installed no software (besides what was
>pre-installed). This is supposed to be an "out of the box"
>configuration. Of course, since I set the PC on the desk, it must've
>been something that I did to it (according to the customer). I
>suspect a virus. I saw nothing in her email that looked suspicious.
>
>I need help...pleeeeeeeeeeeease
>
>Igor