NT authority shutdown
hi there! a friend is having a problem with is computer getting the message This system is shutting down. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly u wouyld get this when infected with sasser but he doesnt have in his system any symptom produced by the virus.
hi there!
a friend is having a problem with is computer getting the message "This system is shutting down. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly" u wouyld get this when infected with sasser but he doesnt have in his system any symptom produced by the virus. no virus is running and no entry has been made to the registry key run.
my question is if it is not a virus what else could it be?
background:
hes running xp home.
i did a fresh installation form a formated HD.
he has not swith it on apart from a couple of time.
he started to get the problem when he tried to create a internet connection and conection to his ISP(which make virus infection possible).
connection is 56k.
when i tried to connet to another isp in the UK being the computer phisicaly in London ( the other connection is made from spain) no problem arises and im able to donwload sp1.
any ideas?
a friend is having a problem with is computer getting the message "This system is shutting down. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly" u wouyld get this when infected with sasser but he doesnt have in his system any symptom produced by the virus. no virus is running and no entry has been made to the registry key run.
my question is if it is not a virus what else could it be?
background:
hes running xp home.
i did a fresh installation form a formated HD.
he has not swith it on apart from a couple of time.
he started to get the problem when he tried to create a internet connection and conection to his ISP(which make virus infection possible).
connection is 56k.
when i tried to connet to another isp in the UK being the computer phisicaly in London ( the other connection is made from spain) no problem arises and im able to donwload sp1.
any ideas?
Participate on our website and join the conversation
This topic is archived. New comments cannot be posted and votes cannot be cast.
Responses to this topic
As far as my experience goes w32.balster.worm, and sasser could do that. there were a few more, that i wish i could remember cause i'm having the exact same problem here. Usually after you find the worm and remove it, you can install windows critical updates and it won'r happen again!!! (the reason i have it is because i installed some Beta version of the SP2 updates that some how messed everything up ;( ).
in my case my antivirus software is not picking anything up!!! Even thou it should!
I'll be installing windows updates manually to see if that could help. (if i don't format it first :x ) i'll post whatever more i learn to see if it could apply to your problem.
Good Luck.
Edit: actually it could be the actual server from the ISP is infected. I use high speed internet and in Canada infected servers are epidemic!!! I know My ISP's servers are infected (Bell Sympatico High-speed DSL), and i know Rogers servers are infected. but just some of them, not all of them!!! and my lucky day, i ran into an infected one!!! (i think they must switch to Linux! it's not like they would wanna play games on the server, but again what do i know!!! something should explain crappy service and tech support!)
in my case my antivirus software is not picking anything up!!! Even thou it should!
I'll be installing windows updates manually to see if that could help. (if i don't format it first :x ) i'll post whatever more i learn to see if it could apply to your problem.
Good Luck.
Edit: actually it could be the actual server from the ISP is infected. I use high speed internet and in Canada infected servers are epidemic!!! I know My ISP's servers are infected (Bell Sympatico High-speed DSL), and i know Rogers servers are infected. but just some of them, not all of them!!! and my lucky day, i ran into an infected one!!! (i think they must switch to Linux! it's not like they would wanna play games on the server, but again what do i know!!! something should explain crappy service and tech support!)
Originally posted by Sampson:
Quote:Look at this url: http://www.pestpatrol.com/Search/default.asp?qu=RPC&sc=%2F&Action=GoYou asked what other ones give this "RPC" message? Here are ten to start with
1. PestPatrol Pest Info - Exploit.Win32.DCom.e
http://www.pestpatrol.com/pestinfo/e/exploit_win32_dcom_e.asp
size 11068 bytes - 6/24/2004 4:07:03 PM GMT
2. PestPatrol Pest Info - Rpc-cmsd.c
http://www.pestpatrol.com/pestinfo/r/rpc-cmsd_c.asp
size 10138 bytes - 6/21/2004 8:00:51 PM GMT
3. PestPatrol Pest Info - RPC portmapper set/unset
http://www.pestpatrol.com/pestinfo/r/rpc_portmapper_set_unset.asp
size 10895 bytes - 6/21/2004 8:01:03 PM GMT
4. PestPatrol Pest Info - Rpc Bind 1.1
http://www.pestpatrol.com/pestinfo/r/rpc_bind_1_1.asp
size 13136 bytes - 6/21/2004 8:00:54 PM GMT
5. PestPatrol Pest Info - Sadmind Solaris RPC tiny Scanner
http://www.pestpatrol.com/pestinfo/s/sadmind_solaris_rpc_tiny_scanner.asp
size 10740 bytes - 6/21/2004 8:02:45 PM GMT
6. PestPatrol Pest Info - RPC Program Scanner
http://www.pestpatrol.com/pestinfo/r/rpc_program_scanner.asp
size 10091 bytes - 6/21/2004 8:01:04 PM GMT
7. PestPatrol Pest Info - Rpc scanner by console
http://www.pestpatrol.com/pestinfo/r/rpc_scanner_by_console.asp
size 10496 bytes - 6/21/2004 8:01:04 PM GMT
8. PestPatrol Pest Info - Prout.c abuse of pcnfs RPC program (version 2 only)
http://www.pestpatrol.com/pestinfo/p/prout_c_abuse_of_pcnfs_rpc_program__version_2_only_.asp
size 10864 bytes - 6/21/2004 7:48:28 PM GMT
9. PestPatrol Pest Info - Pscan2.c TCP/UDP/NIS/RPC scanner
http://www.pestpatrol.com/pestinfo/p/pscan2_c_tcp_udp_nis_rpc_scanner.asp
size 10735 bytes - 6/21/2004 7:48:41 PM GMT
10. PestPatrol Pest Info - Unknown Flooder
http://www.pestpatrol.com/pestinfo/u/unknown_flooder.asp
size 16544 bytes - 6/21/2004 9:07:42 PM GMT
Here is a good list of few things that could do it! research by Sampson (thank you).
I think these guys should not work after you install all XP patches. Hope this helps.
this reply was posted Here:
http://www.ntcompatible.com/thread27630-1.html
Quote:Look at this url: http://www.pestpatrol.com/Search/default.asp?qu=RPC&sc=%2F&Action=GoYou asked what other ones give this "RPC" message? Here are ten to start with
1. PestPatrol Pest Info - Exploit.Win32.DCom.e
http://www.pestpatrol.com/pestinfo/e/exploit_win32_dcom_e.asp
size 11068 bytes - 6/24/2004 4:07:03 PM GMT
2. PestPatrol Pest Info - Rpc-cmsd.c
http://www.pestpatrol.com/pestinfo/r/rpc-cmsd_c.asp
size 10138 bytes - 6/21/2004 8:00:51 PM GMT
3. PestPatrol Pest Info - RPC portmapper set/unset
http://www.pestpatrol.com/pestinfo/r/rpc_portmapper_set_unset.asp
size 10895 bytes - 6/21/2004 8:01:03 PM GMT
4. PestPatrol Pest Info - Rpc Bind 1.1
http://www.pestpatrol.com/pestinfo/r/rpc_bind_1_1.asp
size 13136 bytes - 6/21/2004 8:00:54 PM GMT
5. PestPatrol Pest Info - Sadmind Solaris RPC tiny Scanner
http://www.pestpatrol.com/pestinfo/s/sadmind_solaris_rpc_tiny_scanner.asp
size 10740 bytes - 6/21/2004 8:02:45 PM GMT
6. PestPatrol Pest Info - RPC Program Scanner
http://www.pestpatrol.com/pestinfo/r/rpc_program_scanner.asp
size 10091 bytes - 6/21/2004 8:01:04 PM GMT
7. PestPatrol Pest Info - Rpc scanner by console
http://www.pestpatrol.com/pestinfo/r/rpc_scanner_by_console.asp
size 10496 bytes - 6/21/2004 8:01:04 PM GMT
8. PestPatrol Pest Info - Prout.c abuse of pcnfs RPC program (version 2 only)
http://www.pestpatrol.com/pestinfo/p/prout_c_abuse_of_pcnfs_rpc_program__version_2_only_.asp
size 10864 bytes - 6/21/2004 7:48:28 PM GMT
9. PestPatrol Pest Info - Pscan2.c TCP/UDP/NIS/RPC scanner
http://www.pestpatrol.com/pestinfo/p/pscan2_c_tcp_udp_nis_rpc_scanner.asp
size 10735 bytes - 6/21/2004 7:48:41 PM GMT
10. PestPatrol Pest Info - Unknown Flooder
http://www.pestpatrol.com/pestinfo/u/unknown_flooder.asp
size 16544 bytes - 6/21/2004 9:07:42 PM GMT
Here is a good list of few things that could do it! research by Sampson (thank you).
I think these guys should not work after you install all XP patches. Hope this helps.
this reply was posted Here:
http://www.ntcompatible.com/thread27630-1.html
