[gust0208]

Hey everyone,

I have been having occasional errors with the Remote Procedure Call which forces a reboot in 1 minute (running Windows XP SP2 with all updates). I searched online and found information linking it with a few viruses, most namely the old MSBlaster worm. I did a full scan with Symantec Anti-virus and found one virus and removed it. Further scans are clean. The system is also clean when scanning for adware/spyware with SpyBot and Adaware. The error seems to occur randomly and not connected with any certain activity and can happen anywhere from once a day to around once a week. It can be cancelled with the "shutdown -a" command.

Any ideas on where to look for the ghost in the machine? I had similar errors around 1.5 years ago and cleared up on its own.

Cheers,
Tom

[Advertisements]

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

It is also possible to disable RPC from shutting down the computer, it's the kind of thing i would do, but probably not recommended to keep disabled

start>run> SERVICES.MSC /S
Click properties for Remote Procedure Call (not Remote Procedure Call Locater)
Then locate the Recovery tab, you will see.

Edited by Sintic, 22 April 2006 - 12:10 PM.

[Sintic]

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

It is also possible to disable RPC from shutting down the computer, it's the kind of thing i would do, but probably not recommended to keep disabled

start>run> SERVICES.MSC /S
Click properties for Remote Procedure Call (not Remote Procedure Call Locater)
Then locate the Recovery tab, you will see.

Edited by Sintic, 22 April 2006 - 12:10 PM.

[gust0208]

Thanks for the reply and I wasn't clear in my first post. The virus found was not the MSBlaster bug, but something named "HackTool" or "HackerTool". I searched on them and did not find much information. I have kept my Symantec up to date, so I was frankly suprised to find anything when doing the initial scan.

Cheers,
Tom

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

[gust0208]

Hey Sintic,

Thanks for the tip on the changing what it does on failure in the services tab! That was awesome! Now I can fidget it with it, and if nothing else change the number of minutes to restart to some arbitrary large number or have it run "shutdown.exe -a" in response.

Thanks again,
Tom

Tried running the actual MSBlaster removal tool, if of course it is that?

http://securityrespo...moval.tool.html

It is also possible to disable RPC from shutting down the computer, it's the kind of thing i would do, but probably not recommended to keep disabled

start>run> SERVICES.MSC /S
Click properties for Remote Procedure Call (not Remote Procedure Call Locater)
Then locate the Recovery tab, you will see.