View Full Version : 1 min then XP restarts !!!
Web Rhino 08-11-2003, 08:41 PM Any one knows what's going on, i have many ppl (XP users) calling and telling me their PC gives them a msg saying it will restart in 1 min, then it automatically restarts.
this happens times and times again, anyone knows what’s going on?
i remember that a strange msg today appeared asking to download an ICQ update, and it downloaded itself automatically with giving no choice to decline this update.
is this related?!!
Acroplex 08-11-2003, 08:43 PM Interesting. That ICQ update automatically downloaded itself on Win2000. I haven't started up ICQ on XP right now - maybe I should wait :D
thedavid 08-11-2003, 08:44 PM This may be the reason:
http://www.webhostingtalk.com/showthread.php?s=&threadid=174797
New worm...
-David
Steven 08-11-2003, 08:48 PM fix by me
How To Secure From RPC and MSBLAST worm:
By thelinuxguy
1.)
Go to start -> search and search your entire computer for msblast.exe. Most likly it will be hiding in winnt/system32. Delete that file!
2.)
open regedit, and backup!
browse to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DELETE the entry windows auto update"="msblast.exe
3.)
Close Regedit and install one of these patches:
windows xp
http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe
windows 2000
http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe
currently there is no patches for windows 2003
3.)
in windows xp & 2003:
go to your cmd prompt and do:
sc config RpcLocator start= disabled
in windows 2000 you have to go to administrative tools an then to services and disable the service
remore procedure call (RPC) locator
4.)
restart your pc
thedavid 08-11-2003, 08:49 PM Or...
Just download/run this thing:
http://vil.nai.com/vil/stinger/
:D
Then the patches of course...
-David
ChrisTech 08-11-2003, 09:34 PM I would of loved to be on IRC today around 1.30 pm CDT when it first started happening, seeing loads of ppl just disconnect all at once.
Acroplex 08-11-2003, 09:35 PM I wonder wtf was that ICQ update; their website shows January 2003 as the latest release.
StarGate 08-11-2003, 11:18 PM ICQ.. pffff
www.trillian.cc - why bother with the "real" ICQ :D
fromage 08-12-2003, 01:09 AM Originally posted by Vamp22
I would of loved to be on IRC today around 1.30 pm CDT when it first started happening, seeing loads of ppl just disconnect all at once.
* ChanServ has quit IRC (*.net *.split)
dreamrae.com 08-12-2003, 10:12 AM rofl
mrl14 08-12-2003, 11:11 AM heh..I'm just glad I use a Mac ;) ;P
alapo 08-12-2003, 02:25 PM Its not a windows vs. mac thing... it's more of a why dont you update your home computer thing.
ciqala 08-12-2003, 02:54 PM my pals dad just gave me a bottle of rosé moet & chandon champagne for wiping it off his pc... :D
thedavid 08-12-2003, 03:33 PM Originally posted by ciqala
my pals dad just gave me a bottle of rosé moet & chandon champagne for wiping it off his pc... :D
You're lucky. I'm doing it for 'free' and got nothing.
-David
(free=leverage for later favors...)
XTStrike 08-12-2003, 04:00 PM i think its gifts galore for IT people, ive been paid by people, people bought me beer, sung my praises, etc...
its wonderful to be in IT at the moment !! :)
Web Rhino 08-12-2003, 04:06 PM GOD bless the kiddies........blah
creedance, your not the only one, 180,000 are having the same problem.
- http://www.msnbc.com/news/951393.asp?0cv=CB20
ChrisTech 08-12-2003, 09:24 PM In the past two years, just about every machine sold has xp on it. Out of those, prolly 75% of them dont update.
So far, I have made some money, and I got a nice dinner @ the Outback coming to me next week. :)
anlene 08-12-2003, 09:34 PM Originally posted by thelinuxguy
fix by me
How To Secure From RPC and MSBLAST worm:
By thelinuxguy
1.)
Go to start -> search and search your entire computer for msblast.exe. Most likly it will be hiding in winnt/system32. Delete that file!
2.)
open regedit, and backup!
browse to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
DELETE the entry windows auto update"="msblast.exe
3.)
Close Regedit and install one of these patches:
windows xp
http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe
windows 2000
http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe
currently there is no patches for windows 2003
3.)
in windows xp & 2003:
go to your cmd prompt and do:
sc config RpcLocator start= disabled
in windows 2000 you have to go to administrative tools an then to services and disable the service
remore procedure call (RPC) locator
4.)
restart your pc
hey, can anyone tell me whether this works on win98??? My friend just ask me about what's remote procedure call and luckily I drop by this thread which might probably save him.
His system is 98 and yes, he does have ICQ.
JackMitchell 08-12-2003, 11:55 PM It wont work on anything under Win2k..
oh.. and ChanServ being disconnected.. funny :P
Web Rhino 08-13-2003, 03:43 AM Originally posted by Axi
creedance, your not the only one, 180,000 are having the same problem.
- http://www.msnbc.com/news/951393.asp?0cv=CB20
i wasn't infected, i think it's because i have a firewall installed.
but everyone i know was.
so i had to fix many boxes "for free" :(
| 