Dheeraj said:
Over the past week everytime i connect to the web after
about 10 mins i get a message stating:- "Remote Procedure
Call Terminated Unexpectedly"-then my system shuts down
after a 1 min countdown!
Why the hell is this happening?!
Please help guys!
=====================================================
Unfortunately you have been infected by the MSBLAST worm
http://www.microsoft.com/technet/tr...=/technet/security/virus/alerts/msblaster.asp
1. Restart computer
2. The NTAUTHORITY\SYSTEM 60 second timer window appears
3. Start > Run > type in "shutdown -a" (without quotes) <Enter>
(You have to do this quickly, before the 60 second timer elapses)
4. Enable the built in firewall such as Internet Connection Firewall (ICF)
in Windows XP:
http://support.microsoft.com/?id=283673
In Control Panel, double-click Networking and Internet Connections,
and then click Network Connections.
Right-click the connection on which you would like to enable ICF,
and then click Properties.
On the Advanced tab, click the box to select the option to
Protect my computer or network.
If you want to enable the use of some applications and services through
the firewall,
you need to enable them by clicking the Settings button, and then
selecting the programs,
protocols, and services to be enabled for the ICF configuration.
5. Download the MS03-026 security patch from Microsoft:
http://www.microsoft.com/security/incident/blast.asp
Windows XP (32 bit) Most customers have this edition.
WindowsXP-KB823980-x86-ENU.exe
Should you get this error when trying to install the patch:
"Setup Could Not Verify the Integrity of the File"
Then use this procedure:
Click Start, and then click Run.
In the Open box, type cmd, and then click OK.
At the command prompt, type the following commands, pressing ENTER after
each line:
cd\
net stop cryptsvc
ren %systemroot%\system32\catroot2 oldcatroot2
net start cryptsvc
(click OK after each of the following commands succeed)
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll <------ this one will take a little longer
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 cryptdlg.dll
exit
Right click on My Computer > click on Explore
Expand the C:
If found, delete the WUTemp folder
Close Windows Explorer
Restart computer
If the RPC NTAUTHORITY\system countdown starts you will again need to be
ready to
Start > Run > shutdown -a <Enter>
(If that 60 second countdown does start again then make sure you have
enabled the XP firewall)
Try to install WindowsXP-KB823980-x86-ENU.exe again.
6. Then, download the worm removal tool from your antivirus vendor.
Be sure to follow all instructions.
For additional details on this worm from anti-virus software vendors
participating in the Microsoft Virus Information
Alliance (VIA) please visit the following links:
Network Associates:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547
Trend Micro:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A
Symantec:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265
For more information on Microsoft's Virus Information Alliance please visit
this link:
http://www.microsoft.com/technet/security/virus/via.asp
Please contact your Antivirus Vendor for additional details on this virus.
7. Install or update your antivirus signature software
8. Download and install any critical updates from Windows Update site:
http://v4.windowsupdate.microsoft.com/en/default.asp
=========================================================
