Hi This may have been covered in another thread, so I am sorry in advance. My dads pc, everytime he connects to the internet, he gets a shutdown message about " RPC protocol etc etc... NT etc etc " ( you know what I mean ). Warning says to save everything and gives you a minute to do it in before rebooting. This seems only to happen on connection to the internet. I have done a bit of research, and this points to either lsass or blaster worms. I have donloaded the blaster amd sasser removal tools but no luck. Gone into safe mode, disabled system restore etc etc. No virus found using AVG. Any ideas anyone. I had this on my pc once, but forgot how to sort it out. Oh yes before the RPC box comes up I get a lsass.exe shell error box then the RPC box comes on. Sorry for waffling. Andy
I had a similar problem on someone's PC this week as it happens. I didn't bother trying to remove it, as I can't guarantee finding all the viruses and it takes too long. It was a worm, and I backed up the data and did a system restore - using the Toshiba disk. Rebooted and strangely enough it was still there. I then had to use an XP disk, remove the partition, then recreate the partition and then used the restore disk, that cleared the worm. Not sure why ghosting the image back did not cure the problem. Not sure if that helps.
I am going to spend all day tomorrow trying to get rid of this problem. Got the removal tools, but they find nothing. Going to update the adaware and spy subtract files onto disc and transfere to my dads pc and try that. Then if that fails, i am going to get a hammer and hit the living daylights out of it. One of these are bound to work.
Right, I have scanned with AVG, Spysubtract, spybot s+d, adaware6, and Grisoft vcleaner that searches for 191 virus and there spin offs, but still no joy. Still getting RPC message and a reboot. Tried ctrl+alt+del to get processes and nor msblast.exe as described in microsoft help pages. Any other ideas??? RPC only happens after about 30 seconds connection to the net. Ok whilst off line
This is exactly the same symptoms I had as referred to above - It was a worm, can't remember which one. As said, I ended up having to delete the partition and re-create it.
did you try this link mentioned in 1 of the posts in this thread???http://forums.afterdawn.com/thread_view.cfm/45541
I have been on the microsoft website, downloaded the security patch and installed it on my dads pc, but still things are not right. Still get Rpc. Tried one of the links to get a tool of microsoft to detect infected pc's. but the page has been removed.....next solution please.