ZBrushCentral

Help with a computer problem

I need some help and really don’t know where to turn too. I keep getting this window. It seems to only happen when I am online.

I am running WindowsXP and this happens with both IE and Netscape

Thanks in advance.

MTB

Hi MTB,
seems to me you have an active backdoor on your computer :frowning:
Try to catch it with antivirus or with a personal firewall (like Zone Alarm).

cameyo

The first step is always to check Microsoft Update and see if anything is new there. If that fails, take a look in your event viewer for more information about the error. You can then search the Microsoft Knowledge Base.

Good luck! :slight_smile:

EDIT:

Cameyo may be quite right, take a look at this: Computer reboots itself.

I’m afraid you’re computer may have been hacked through the recent DCOM exploit of windows.

For some reason a vital process seems to be getting killed. RPC in your case.

What you could try to prevent your pc from rebooting when that window pops up , is to go to the command prompt. (Start->Run->cmd)

and go to C:\WINDOWS\system32\

and type svchost -k rpcss

This starts the service that just died on u , maybe windows notices this and skips the reboot.

There is also an unstable way to maybe fix it.

Right click on your “This Computer” on your desktop.

Select “Manage” , go to the services , locate that RCP service (it’s alphab. listed) , then right click it , properties , then third tab from the left. “System recovery” , it has 3 options , all of them are set on “reboot” default , change them to “Take no action”;

I might be wrong about some of the commands , because I am using a dutch version of windows , just guessing what they would be in english :stuck_out_tongue:

I hope any of this helps

greets ,
Kevin

Hi MTB,

I don’t know much about innerworks of XP, but here is a link that discusses exactly that in depth, with suggested fixes. Have a look at:

Geek on Windows

Sven

— update —

MTB: Here also a related link to Steve Gibson’s site where you can perform a port vulnerability test.

Gibson Research Corp.

Thank you all sooo much for your help.
I believe I am on the right track now and will be back up and running later tonight! :+1:

I would also like to share this site with you. It is by an excellent gentalman whos understanding of windows allows him to set up system tweeks for various user types…go check it out. Before this RPC exploit, my system was running in top shape.

Enjoy and thanks again.

Black Viper

MTB , I have to talk to you on the chat , your problem is more severe than you think…

Anyone using Windows 98 or later should apply all available Security Patches from the Windows Update web site ASAP – the RPC/DCOM security flaw is definitely being exploited

Hi MTB

My brother just had the exact same symptoms and found they were caused by the MSblast worm.

See Havran’s thread in this forum for how to remove it.

Good luck.

PS: In the same vein, I would like to come to Monday night chat some time but I have concerns about using mIRC in that often IP addresses are open to view by anyone (or are even broadcast) and some servers don’t work with my firewall (Zone Alarm) up.

Does anyone know if the ZB channel/mIRC server allows the use of Zone Alarm?

Some servers supply hidden hosts , so you cant DNS the host to get the IP , but I dont think sorcery.net has such a thing.

You would need to register your user on IRC somewhere and set /mode nickname x.

But I have no clue what services run on the Sorcery server.