"Remote Procedure Call terminated" problem

[Vincent]

My cousin runs Windows XP and connects to the netusing BTOpenworld.

Today she has run into problems with it.  She can connect for about five minutes before getting an error message:

Remote Procedure Call terminated unexpectedly

Then the PC has to reset.

Anyone know how to fix this?  This hasn't happened before and she's not the type to go into settings and stuff if she doesn't know what she's doing.

Thanks. :-)

[duesi]

Maybe I'm wrong.. but in the network options
The only thing needed is TCP/IP
- no Microsoft Client
- no QoS Planner
- no other Protocol

[Vincent]

I honestly have no experience at all with networking stuff, so I don't know what you mean.  This is the first time I've ever heard of this Remote Procedure Call.

In this topic treat me like I'm technically illiterate :-D

[Merc]

Wow, I got a support call at work about this exact problem just before leaving today!  Same symptoms, same OS.  Don't know what the cause is though, we support our own software running under windows, not windows itself...  But I'll let you know if I find out what the problem was.. sounds almost like something broken at m$ or something (XP talking with m$ on a regular basis and all...)

[Turambar]

There is a patch available to fix this problem, its a security hole discovered by some l33t h4x0rs... you can get ithere

[Blomberg]

Hmm, not entirely sure what it is, but I know the RPC port (135, IIRC) is often exploited by script kiddies and the likes.

And with the recent warnings about a massive attack building up, I'd take precautions in that regard, eg. install a firewall or not use Windows  :-P

[bhoggett]

@Turambar

Well done that man. I've been attacked in the same manner over the past 24-36 hours a few times, with it getting critical a few hours ago. I finally figured the workaround of enabling the firewall, but hadn't got round to checking the MS site to see if it was a well known problem (then again, I wasn't sure if the problem was local or not at first).

You've saved me some time searching.  ;-)

[Floid]

Above link looks right.

See:
Slashdot article
SANS article linked from Slashdot
CERT: Patched Win2k still has a denial-of-service vulnerability

Probably be all over the news tonight, anyhow.
Applying the RPC DCOM patch or firewalling TCP port 135 incoming should provide safety from infection by this particular worm; with Win2k, sounds like only the second can avoid potential DoS from hammering of the port.  Once one machine is infected, it can of course spread to other machines on its local segment (cable modem subscribers - enjoy another Code Red)...  Patching with the existing MS patch will not deactivate the payload - for that, you'll have to find the MSBlast.exe file, and delete it and the autorun reference in the registry as placed on a successful infection; quoting SANS:

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, name: 'windows auto update'

(Presumably you can distinguish this from any actual services by reference to the MSBlast.exe file?)

Remember, this information may become obsolete as the code is studied more closely.

[Vincent]

@Merc

I've just read on another forum someone asking about the same thing, no answers there yet though.

@Turambar

I've just had a quick look at that link, but I have no idea where I should go from there to get the patch.  Could you give me a direct link to it?  Also, do you know how big the patch is?

@Blomberg

I don't think they have a firewall installed yet - they (well, me really) were going to install WinXP again as they are having a few problems with it, but I don't have the time to do that just yet.

Edit: just seen Floid's post, very helpfull indeed :-D

Edit2: how do you find out if you have the 32-bit or 64-bit version of XP?  (I think it's Home Edition she has btw)

[KennyR]

This worm has been plagueing my chosen IRC server all day.

The message is:

ALERT!!! a worm has been released which is targeting vulnerable windows systems on port 135. This will explain users who's pc's suddenly reboot. see http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp for more details

[Floid]

Unless it's an Itanium, it's 32-bit.  And no, it's not an Itanium.

Scrolling through the Slashdot thread shows a few related worms taking advantage of the vulnerability, some nastier than the presently-virulent one.  As always, take Slashdot advice with a grain of salt, and Google until you find confirmation from something resembling a reputable source (CERT, SANS, McAffee, Norton, etc.).

As noted in some of the comments, XP has a software firewall that can be thrown up as defense from reinfection while applying the patch and trying to clean up the mess.  If you aren't confident, you may want to find someone more deeply Windows-familiar to deal with the registry editing and associated hair-pulling.

[KennyR]

Oh, and let me add this: Windows users should always be using a firewall at all times, preferably a hardware or linux one but a personal firewall will do. Your systems are desperately vulnerable, and not only that, can be used as a platform to attack other users and sites, and to spread malicious code. Please install a firewall ASAP, preferably with port filtering on both sides of the firewall.

[Vincent]

@Floid

I'm confident enough to go through the registry to fix this (I've been through a registry before) so I'll hopefully be able to fix it tomorrow.

@KennyR

After applying the patches (which I'm d'ling now) I'll be installing a firewall for her :-D

Edit: I didn't expect to get this many replies this quick !  Cheers guys :-D

[Coder]

Hi,

The minute I saw this thread the same message came on to my screen too. I just want to quickly check my mail and then this. It really made me angry. I wonder how it got on my machine since I use Norton and it is up to date.

Anyway thnx to Floid who wrote here about the registry and the file I was able to stay online. Now I am getting the fix and all.

Anyway, if you ever see me, collect your free beer Floid.

Coder

[Vincent]

To quote Calen on IRC just now:

[00:39:25] its time like this u love windows even more huh

:lol: