Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

rpc

Feb 12, 2004 9:34PM PST

I'm pretty sure I have that blaster worm in my pc... I had just got my pc back from my tech after being formated. I went to the windows update site, and now my pc is acting up Sad. I get that message that my pc is going to shutdown because of some rpc or something. How can I remove this? I've tryed downloading the patch from microsoft... But half way through, It just closes. My nortons wont work to, it just closes like the updates. I realllllly don't want to pay a tech to get the damn thing removed. I also downloaded the remover tool from the norton site, and it didn't detect nothing Sad.

Pleaseeeeeeeeeee, I'm beggin you, I need help badly, lol.

Thanks in advance.

Discussion is locked

- Collapse -
Re:rpc
Feb 12, 2004 11:35PM PST

Here is Microsoft's removal tool:

Blaster Worm Removal Tool for Windows XP and Windows 2000 (KB833330)

click here

- Collapse -
Re:Re:rpc
Feb 12, 2004 11:40PM PST

Tryed that about 300 times... Once I download it, and click "I Agree" about 5 seconds later it just closes Sad

- Collapse -
You need the patch first !
Feb 12, 2004 11:55PM PST

Do you have someone who could download the patch??

WindowsXP:DCOM/RPC Exploit Patch

How Can I Remove the MSBLAST worm?

Follow these steps in removing the MSBLAST or MSBLASTER worm.

1) Disconnect your computer from the local area network or Internet

2) Terminate the running program

Open the Windows Task Manager by either pressing CTRL+ALT+DEL, selecting the Processes tab or selecting Task Manager and then the process tab on WinNT/2000/XP machines.
Locate the following program, click on it and End Task or End Process
MSBLAST.EXE

Close Task Manager
3) Install the patches for the DCOM RPC Exploit, you can download the patches from the links below before disconnecting

more next post

- Collapse -
You need the patch first ! -cont.-
Feb 12, 2004 11:56PM PST

4) Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:

TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"
5) Remove the Registry entries

Click on Start, Run, Regedit
In the left panel go to
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Current Version>Run

In the right panel, right-click and delete the following entry
"windows auto update"="msblast.exe"

Close the Registry Editor
6) Delete the infected files (for Windows ME and XP remember to turn off System Restore before searching for and deleting these files to remove infected backed up files as well)

Click Start, point to Find or Search, and then click Files or Folders.

Make sure that "Look in" is set to (C:\WINDOWS).

In the "Named" or "Search for..." box, type, or copy and paste, the file names:
msblast*.*

Click Find Now or Search Now.

Delete the displayed files.

Empty the Recycle bin, the worm can reinfect even if the files are in the recycle bin.
7) Reboot the computer, reconnect the network, and update your antivirus software, and run a thorough virus scan using your favorite antivirus program.

Cool Now check for the worm again, if it returns, complete these steps once more until the virus is gone. With the patch in place, the virus wont be able to exploit the system, but sometimes it is difficult to remove the files for good.

http://www.leadclub.net/blasterworm.html

- Collapse -
Re:rpc. Judy please try this.
Feb 13, 2004 1:33PM PST

Start> Control Panel> Performance and Maintenance> Administrative Tools> Component Services> Local Services.

Once there change the tab from 'extended' to standard.

This will give you a screen with all your local services running.

Scroll down to Remote Procedure Call [RPC] and review them.

The first one which will be called 'local' should be set to 'automatic.

The second one which will be called 'system' should be set to manual.

if either one of these has a different setting, right click on it> properties> and now find the tab that will allow you to change it to the settings as above.

re-boot, disable your system restore and re-scan.

to disable system restore you need to go to my computer> right click> click on properties and then the system restore tab. change it to 'disable' and scan.

once done go back to 'my computer' and reverse the process.

david williams