For those experiencing an RPC error in Windows XP

[Buliwyf]

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

It may be this worm, which exploits the DCom service in XP

-ctrl-alt-supr for Task Manager
-kill process msblast.exe
-Start->run->regedit
HKEY_LOCAL_MACHINE->software->Microsoft->Windows->CurrentVersion->Run

Delete the entry pointing to msblast.exe

Delete msblast.exe from your system

Then download this patch from MS:
http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

[Killer Mike]

Thanks. Just did it. Seems to be working. Thanks for the important info.

[Jeffro]

OMG!!! THANK YOU A LOT!!!!


I HAVE BEEN GETTING THAT A LOT LATELY!!!


BULI=My god, hero, lover...er i mean...

thank you buli!!! i got that message every time i pulled up windows today before it even finsished booting, 4th try i got to install the program, seems to be working.



i did a system recovery cd...wahhhhhhhhhhhh, btw, thanks man, i owe you one

[Evan]

Funny.

Anyway, today I accidentally turned off SERVICES.exe, which is what the worm turns off, requiring a shutdown.

I though I had it before. Silly me.

[Jeffro]

32-bit patch or 64-bit...


I got the 32....hope that is in common with my xp

[Sidekick Floppy]

Thanx Buli! My server was infected and it was shutting down my client PC from time to time.

[Ryan]

Or see this thread here:

http://forums.powervs.com/showthread.php?s=&threadid=4454

buffff! thanks a lot guys I thought I got my computer crashed again and I would have to reformat my computer, since now I am running my pc from the hard disk second partition with win98.

I virus scanned, searched for msblast, then downloaded the updates, everything looks clear and I never got that shutdown thing but damn, atleast 5 or 6 people i know where having that issue just yesterday.

[Buliwyf]

Originally posted by Jeffro
32-bit patch or 64-bit...


I got the 32....hope that is in common with my xp

you 99.9% likely have 32 bit

[Ryan]

Originally posted by (>Tool<)
I virus scanned, searched for msblast, then downloaded the updates, everything looks clear and I never got that shutdown thing but damn, atleast 5 or 6 people i know where having that issue just yesterday.

I believe there was big exploit push yesterday.