raulises 0 Posted June 24, 2004 hi there! a friend is having a problem with is computer getting the message "This system is shutting down. Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly" u wouyld get this when infected with sasser but he doesnt have in his system any symptom produced by the virus. no virus is running and no entry has been made to the registry key run. my question is if it is not a virus what else could it be? background: hes running xp home. i did a fresh installation form a formated HD. he has not swith it on apart from a couple of time. he started to get the problem when he tried to create a internet connection and conection to his ISP(which make virus infection possible). connection is 56k. when i tried to connet to another isp in the UK being the computer phisicaly in London ( the other connection is made from spain) no problem arises and im able to donwload sp1. any ideas? Share this post Link to post
Ali 0 Posted June 25, 2004 As far as my experience goes w32.balster.worm, and sasser could do that. there were a few more, that i wish i could remember cause i'm having the exact same problem here. Usually after you find the worm and remove it, you can install windows critical updates and it won'r happen again!!! (the reason i have it is because i installed some Beta version of the SP2 updates that some how messed everything up ;( ). in my case my antivirus software is not picking anything up!!! Even thou it should! I'll be installing windows updates manually to see if that could help. (if i don't format it first :x ) i'll post whatever more i learn to see if it could apply to your problem. Good Luck. Edit: actually it could be the actual server from the ISP is infected. I use high speed internet and in Canada infected servers are epidemic!!! I know My ISP's servers are infected (Bell Sympatico High-speed DSL), and i know Rogers servers are infected. but just some of them, not all of them!!! and my lucky day, i ran into an infected one!!! (i think they must switch to Linux! it's not like they would wanna play games on the server, but again what do i know!!! something should explain crappy service and tech support!) Share this post Link to post
Ali 0 Posted June 25, 2004 Originally posted by Sampson: Quote: Look at this url: http://www.pestpatrol.com/Search/default.asp?qu=RPC&sc=%2F&Action=Go You asked what other ones give this "RPC" message? Here are ten to start with 1. PestPatrol Pest Info - Exploit.Win32.DCom.e http://www.pestpatrol.com/pestinfo/e/exploit_win32_dcom_e.asp size 11068 bytes - 6/24/2004 4:07:03 PM GMT 2. PestPatrol Pest Info - Rpc-cmsd.c http://www.pestpatrol.com/pestinfo/r/rpc-cmsd_c.asp size 10138 bytes - 6/21/2004 8:00:51 PM GMT 3. PestPatrol Pest Info - RPC portmapper set/unset http://www.pestpatrol.com/pestinfo/r/rpc_portmapper_set_unset.asp size 10895 bytes - 6/21/2004 8:01:03 PM GMT 4. PestPatrol Pest Info - Rpc Bind 1.1 http://www.pestpatrol.com/pestinfo/r/rpc_bind_1_1.asp size 13136 bytes - 6/21/2004 8:00:54 PM GMT 5. PestPatrol Pest Info - Sadmind Solaris RPC tiny Scanner http://www.pestpatrol.com/pestinfo/s/sadmind_solaris_rpc_tiny_scanner.asp size 10740 bytes - 6/21/2004 8:02:45 PM GMT 6. PestPatrol Pest Info - RPC Program Scanner http://www.pestpatrol.com/pestinfo/r/rpc_program_scanner.asp size 10091 bytes - 6/21/2004 8:01:04 PM GMT 7. PestPatrol Pest Info - Rpc scanner by console http://www.pestpatrol.com/pestinfo/r/rpc_scanner_by_console.asp size 10496 bytes - 6/21/2004 8:01:04 PM GMT 8. PestPatrol Pest Info - Prout.c abuse of pcnfs RPC program (version 2 only) http://www.pestpatrol.com/pestinfo/p/prout_c_abuse_of_pcnfs_rpc_program__version_2_only_.asp size 10864 bytes - 6/21/2004 7:48:28 PM GMT 9. PestPatrol Pest Info - Pscan2.c TCP/UDP/NIS/RPC scanner http://www.pestpatrol.com/pestinfo/p/pscan2_c_tcp_udp_nis_rpc_scanner.asp size 10735 bytes - 6/21/2004 7:48:41 PM GMT 10. PestPatrol Pest Info - Unknown Flooder http://www.pestpatrol.com/pestinfo/u/unknown_flooder.asp size 16544 bytes - 6/21/2004 9:07:42 PM GMT Here is a good list of few things that could do it! research by Sampson (thank you). I think these guys should not work after you install all XP patches. Hope this helps. this reply was posted Here: http://www.ntcompatible.com/thread27630-1.html Share this post Link to post
