Welcome, Guest. Please login or register.
Amiga Kit Amiga Store Iridium Banner AMIStore App Store A1200/A600 4xIDE Interface

AuthorTopic: "Remote Procedure Call terminated" problem  (Read 3365 times)

0 Members and 1 Guest are viewing this topic.

Offline Vincent

"Remote Procedure Call terminated" problem
« on: August 11, 2003, 10:11:10 PM »
My cousin runs Windows XP and connects to the netusing BTOpenworld.

Today she has run into problems with it.  She can connect for about five minutes before getting an error message:

Remote Procedure Call terminated unexpectedly

Then the PC has to reset.

Anyone know how to fix this?  This hasn't happened before and she's not the type to go into settings and stuff if she doesn't know what she's doing.

Thanks. :-)
Xbox360
"Oh no. Everytime you turn up something monumental and terrible happens.
I don\'t think I have the stomach for it." - Raziel
 

Offline duesi

Re: "Remote Procedure Call terminated" problem
« Reply #1 on: August 11, 2003, 10:26:08 PM »
Maybe I'm wrong.. but in the network options
The only thing needed is TCP/IP
- no Microsoft Client
- no QoS Planner
- no other Protocol
A4000D CS060/MKII with SCSI, CV64/4MB, 128MB Fast, ACARD AEC-7720U SCSI-IDE,80GB Samsung HDD, Yamaha CDRW, XSurf2, OS3.9BB2
A500,1MB Chip Kick1.3/3.1,GVP A500+ 540MB HDD and 8MB Fast,GVP DSS 8Bit Sampler
 

Offline Vincent

Re: "Remote Procedure Call terminated" problem
« Reply #2 on: August 11, 2003, 10:33:08 PM »
I honestly have no experience at all with networking stuff, so I don't know what you mean.  This is the first time I've ever heard of this Remote Procedure Call.

In this topic treat me like I'm technically illiterate :-D
Xbox360
"Oh no. Everytime you turn up something monumental and terrible happens.
I don\'t think I have the stomach for it." - Raziel
 

Offline Merc

Re: "Remote Procedure Call terminated" problem
« Reply #3 on: August 11, 2003, 11:00:00 PM »
Wow, I got a support call at work about this exact problem just before leaving today!  Same symptoms, same OS.  Don't know what the cause is though, we support our own software running under windows, not windows itself...  But I'll let you know if I find out what the problem was.. sounds almost like something broken at m$ or something (XP talking with m$ on a regular basis and all...)
 

Offline Turambar

Re: "Remote Procedure Call terminated" problem
« Reply #4 on: August 11, 2003, 11:07:53 PM »
There is a patch available to fix this problem, its a security hole discovered by some l33t h4x0rs... you can get ithere
 

Offline Blomberg

Re: "Remote Procedure Call terminated" problem
« Reply #5 on: August 11, 2003, 11:12:59 PM »
Hmm, not entirely sure what it is, but I know the RPC port (135, IIRC) is often exploited by script kiddies and the likes.

And with the recent warnings about a massive attack building up, I'd take precautions in that regard, eg. install a firewall or not use Windows  :-P

Offline bhoggett

Re: "Remote Procedure Call terminated" problem
« Reply #6 on: August 11, 2003, 11:19:00 PM »
@Turambar

Well done that man. I've been attacked in the same manner over the past 24-36 hours a few times, with it getting critical a few hours ago. I finally figured the workaround of enabling the firewall, but hadn't got round to checking the MS site to see if it was a well known problem (then again, I wasn't sure if the problem was local or not at first).

You've saved me some time searching.  ;-)
Bill Hoggett
 

Offline Floid

Re: "Remote Procedure Call terminated" problem
« Reply #7 on: August 11, 2003, 11:20:33 PM »
Above link looks right.

See:
Slashdot article
SANS article linked from Slashdot
CERT: Patched Win2k still has a denial-of-service vulnerability

Probably be all over the news tonight, anyhow.
Applying the RPC DCOM patch or firewalling TCP port 135 incoming should provide safety from infection by this particular worm; with Win2k, sounds like only the second can avoid potential DoS from hammering of the port.  Once one machine is infected, it can of course spread to other machines on its local segment (cable modem subscribers - enjoy another Code Red)...  Patching with the existing MS patch will not deactivate the payload - for that, you'll have to find the MSBlast.exe file, and delete it and the autorun reference in the registry as placed on a successful infection; quoting SANS:

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, name: 'windows auto update'

(Presumably you can distinguish this from any actual services by reference to the MSBlast.exe file?)

Remember, this information may become obsolete as the code is studied more closely.
 

Offline Vincent

Re: "Remote Procedure Call terminated" problem
« Reply #8 on: August 11, 2003, 11:24:37 PM »
@Merc

I've just read on another forum someone asking about the same thing, no answers there yet though.

@Turambar

I've just had a quick look at that link, but I have no idea where I should go from there to get the patch.  Could you give me a direct link to it?  Also, do you know how big the patch is?

@Blomberg

I don't think they have a firewall installed yet - they (well, me really) were going to install WinXP again as they are having a few problems with it, but I don't have the time to do that just yet.

Edit: just seen Floid's post, very helpfull indeed :-D

Edit2: how do you find out if you have the 32-bit or 64-bit version of XP?  (I think it's Home Edition she has btw)
Xbox360
"Oh no. Everytime you turn up something monumental and terrible happens.
I don\'t think I have the stomach for it." - Raziel
 

Offline KennyR

Re: "Remote Procedure Call terminated" problem
« Reply #9 on: August 11, 2003, 11:37:15 PM »
This worm has been plagueing my chosen IRC server all day.

The message is:

ALERT!!! a worm has been released which is targeting vulnerable windows systems on port 135. This will explain users who's pc's suddenly reboot. see http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp for more details

 

Offline Floid

Re: "Remote Procedure Call terminated" problem
« Reply #10 on: August 11, 2003, 11:41:20 PM »
Unless it's an Itanium, it's 32-bit.  And no, it's not an Itanium.

Scrolling through the Slashdot thread shows a few related worms taking advantage of the vulnerability, some nastier than the presently-virulent one.  As always, take Slashdot advice with a grain of salt, and Google until you find confirmation from something resembling a reputable source (CERT, SANS, McAffee, Norton, etc.).

As noted in some of the comments, XP has a software firewall that can be thrown up as defense from reinfection while applying the patch and trying to clean up the mess.  If you aren't confident, you may want to find someone more deeply Windows-familiar to deal with the registry editing and associated hair-pulling.
 

Offline KennyR

Re: "Remote Procedure Call terminated" problem
« Reply #11 on: August 11, 2003, 11:41:55 PM »
Oh, and let me add this: Windows users should always be using a firewall at all times, preferably a hardware or linux one but a personal firewall will do. Your systems are desperately vulnerable, and not only that, can be used as a platform to attack other users and sites, and to spread malicious code. Please install a firewall ASAP, preferably with port filtering on both sides of the firewall.
 

Offline Vincent

Re: "Remote Procedure Call terminated" problem
« Reply #12 on: August 11, 2003, 11:46:20 PM »
@Floid

I'm confident enough to go through the registry to fix this (I've been through a registry before) so I'll hopefully be able to fix it tomorrow.

@KennyR

After applying the patches (which I'm d'ling now) I'll be installing a firewall for her :-D

Edit: I didn't expect to get this many replies this quick !  Cheers guys :-D
Xbox360
"Oh no. Everytime you turn up something monumental and terrible happens.
I don\'t think I have the stomach for it." - Raziel
 

Offline Coder

Re: "Remote Procedure Call terminated" problem
« Reply #13 on: August 12, 2003, 12:39:52 AM »
Hi,

The minute I saw this thread the same message came on to my screen too. I just want to quickly check my mail and then this. It really made me angry. I wonder how it got on my machine since I use Norton and it is up to date.

Anyway thnx to Floid who wrote here about the registry and the file I was able to stay online. Now I am getting the fix and all.

Anyway, if you ever see me, collect your free beer Floid.

Coder
Check it out - I found the ass-end!
 

Offline Vincent

Re: "Remote Procedure Call terminated" problem
« Reply #14 on: August 12, 2003, 01:06:17 AM »
To quote Calen on IRC just now:

Quote
[00:39:25] its time like this u love windows even more huh


:lol:
Xbox360
"Oh no. Everytime you turn up something monumental and terrible happens.
I don\'t think I have the stomach for it." - Raziel