RPC Disabled (winXP)... need help

[Sarvis]

Ok, so RPC was crashing on my system every few minutes. I decided, in my infinite wisdom, to go and disable it. Since I couldn't just set it to manual start (should have been a big hint) I disabled it for my only hardware profile. Unforunately, this service appears to be essential for damn near half of WinXP's functionality... including the dialog box you need to re-enable it for a hardware profile!

So anyone know how I can re-enable it? Internet searches have turned up nothing... one other guy at some experts website had the same problem but no one proposed a valid solution.

I figure I can go into the hardware profile part in the registry and re-enable the service, but I don't know how the service is disabled or where. I've looked through the registry a bit and found things for hardware profiles, but they either don't list services or RPC looks like it is enabled.

Any thoughts?

[Sarvis]

Nevermind... I got it. Stupid, sneaky registry...

[Dalar]

delete msblast.exe

[Kuurg]

I was trying to post a reply with the steps to resolve this but for some reason my machine keeps telling me it's shutting down.

*shrug*

[Sarvis]

Heh... that sounds like the virus. There's actually a tool from symantec which will specifically destroy it, or you can maybe do it manually. The file msblast.exe is the actual virus, but it also puts something in the registry that needs to be removed.

Just don't go and disable your RPC service... you just have no idea how much of your computer depends on that thing. :shudder:

Actually, apparently it's a lot like some power plant in Canada. :(

[Stamm]

You can set your RPC service to restart if it fails rather than shutting the PC down.

Terminate the msblast.exe program (use task manager (ctrl-alt-del))
Delete msblast.exe from C:\WINDOWS\SYSTEM32
Start/run - Type regedit. Do a find for msblast.exe
You'll find it in a place named run under windows under software etc.

Delete that registry entry (just the msblast not the whole run folder!)

And go to windows update and get the fix for it.

Unless you fix windows you'll get it again very quickly.

This virus is a worm, you do not need to do anything to get it, just run an unpatched version of windows without a firewall.

[Kuurg]

I was trying to post a reply with the steps to resolve this but for some reason my machine keeps telling me it's shutting down.

*shrug*

awwww. nobody gets my bad jokes.

[Sarvis]

Sorry Kurrg, thought you were serious. Should have used a ;) or :lol:

Stamm:

Just setting the service to restart doesn't help a whole lot, as everything depending on that service becomes disabled every few minutes. Then it reboots the machine anyway... :(

The funny part is that I'm connected through a router with a firewall, but my roomate had his computer DMZ'd. This normally wouldn't affect me, but both of our computers died a few weeks ago and the one I borrowed from my mom decided to grab his IP address from the router with no one realizing. So I was DMZ'd while I thought I had a nice firewall up and running... :(

[Hyldryn]

I was trying to post a reply with the steps to resolve this but for some reason my machine keeps telling me it's shutting down.

*shrug*

awwww. nobody gets my bad jokes.

No, we get it. But responding only encourages more bad jokes.

[Stamm]

Sarvis... doing it on mine caused windows to, instead of rebooting, just crash certain things, remove taskbar, etc. You could still access the net and download the fix for it, and 'get by'... just really meant as a stop gap to let you get the patch.

I reformatted my hard drive. I installed Windows XP with SP1 integrated, and then I installed cable modem drivers.

I opened up IE, and then I enabled my cable modem and went straight to windows update. Blaster infected me and RPC failed shutting me down before I'd even got the list :P

[Sarvis]

Heh, part of the fun is that RPC is necessary for Windows Update to run. So it really isn't a good stop gap anyway.
I ran Symantec's Cleanup tool, then did the windows update thing without any problems. Not sure if I put myself back behind the firewall first though...