1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

RPC and lsass problems

Discussion in 'All other topics' started by retro72, Mar 12, 2005.

  1. retro72

    retro72 Member

    Joined:
    Mar 12, 2005
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Hi
    This may have been covered in another thread, so I am sorry in advance. My dads pc, everytime he connects to the internet, he gets a shutdown message about " RPC protocol etc etc... NT etc etc " ( you know what I mean ). Warning says to save everything and gives you a minute to do it in before rebooting. This seems only to happen on connection to the internet. I have done a bit of research, and this points to either lsass or blaster worms. I have donloaded the blaster amd sasser removal tools but no luck. Gone into safe mode, disabled system restore etc etc. No virus found using AVG. Any ideas anyone. I had this on my pc once, but forgot how to sort it out. Oh yes before the RPC box comes up I get a lsass.exe shell error box then the RPC box comes on. Sorry for waffling.

    Andy
     
  2. djscoop

    djscoop Active member

    Joined:
    Feb 6, 2003
    Messages:
    4,051
    Likes Received:
    0
    Trophy Points:
    66
    have you scanned the system with adaware and spybot?
     
  3. retro72

    retro72 Member

    Joined:
    Mar 12, 2005
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    scanned everything with everything. But still no cure.
     
  4. safc_66

    safc_66 Regular member

    Joined:
    Aug 27, 2003
    Messages:
    321
    Likes Received:
    0
    Trophy Points:
    26
    4th line down from the top of this forum page, it works too :)
     
  5. haymarket

    haymarket Regular member

    Joined:
    Aug 31, 2004
    Messages:
    141
    Likes Received:
    0
    Trophy Points:
    26
    I had a similar problem on someone's PC this week as it happens.

    I didn't bother trying to remove it, as I can't guarantee finding all the viruses and it takes too long.

    It was a worm, and I backed up the data and did a system restore - using the Toshiba disk. Rebooted and strangely enough it was still there. I then had to use an XP disk, remove the partition, then recreate the partition and then used the restore disk, that cleared the worm.

    Not sure why ghosting the image back did not cure the problem.

    Not sure if that helps.

     
  6. retro72

    retro72 Member

    Joined:
    Mar 12, 2005
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    I am going to spend all day tomorrow trying to get rid of this problem.
    Got the removal tools, but they find nothing. Going to update the adaware and spy subtract files onto disc and transfere to my dads pc and try that. Then if that fails, i am going to get a hammer and hit the living daylights out of it. One of these are bound to work.
     
  7. haymarket

    haymarket Regular member

    Joined:
    Aug 31, 2004
    Messages:
    141
    Likes Received:
    0
    Trophy Points:
    26
    Good luck
     
  8. retro72

    retro72 Member

    Joined:
    Mar 12, 2005
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Right, I have scanned with AVG, Spysubtract, spybot s+d, adaware6, and Grisoft vcleaner that searches for 191 virus and there spin offs, but still no joy. Still getting RPC message and a reboot. Tried ctrl+alt+del to get processes and nor msblast.exe as described in microsoft help pages. Any other ideas??? RPC only happens after about 30 seconds connection to the net. Ok whilst off line

     
  9. haymarket

    haymarket Regular member

    Joined:
    Aug 31, 2004
    Messages:
    141
    Likes Received:
    0
    Trophy Points:
    26
    This is exactly the same symptoms I had as referred to above - It was a worm, can't remember which one. As said, I ended up having to delete the partition and re-create it.
     
  10. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,153
    Likes Received:
    134
    Trophy Points:
    143
    did you try this link mentioned in 1 of the posts in this thread???http://forums.afterdawn.com/thread_view.cfm/45541
     
  11. retro72

    retro72 Member

    Joined:
    Mar 12, 2005
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    I have been on the microsoft website, downloaded the security patch and installed it on my dads pc, but still things are not right. Still get Rpc. Tried one of the links to get a tool of microsoft to detect infected pc's. but the page has been removed.....next solution please.
     
  12. safc_66

    safc_66 Regular member

    Joined:
    Aug 27, 2003
    Messages:
    321
    Likes Received:
    0
    Trophy Points:
    26
    Yeah, do as i said 2 days ago !!
     

Share This Page