
|
View Full Version : Windoze 2003 RPC Failure
CSD_Hosting 07-28-2004, 02:38 PM Ok, heres the problem, i just built a brand new server for work, and i had it connected to a router, it was working perfect, then i brought it to the store down the street, and connected it to their static IP dsl (cayman 3546 ADSL Router) and set it up, about 5 mins later, an error comes up:
The Remote Procedure Call (RPC) has terminated unexpectedly, computer will reboot in 60 seconds.
I didnt have a clue what was wrong, so, i brought it home, and connected it to my network, same setup, and it was on all night long, and i had it do heavy network transfers, to see if it would crash, it was perfect.
so, i bought it back to work, connected it, it was all good. hour later, rpc failed. i have no idea what is wrong with the computer, i have 2 computers with the same setup in my house, no problems whatsoever.
if anyone can fix the error ( i can stop the reboot, but i want the problem fixed), it would be much appreciated
CSD_Hosting 07-28-2004, 02:42 PM forgot to add, it crashes with any network activity, IE, pinging IT, or pinging another server on it.
System Specs
Intel P4 2.4GHZ
512MB RAM
Soyo Motherboard,
Windows Server 2003 Enterprise Edition
NICs:
1 integrated into mobo
1 DLINK PCI card
(1 other DLINK PCI card, but i took it out, so it matches my other computers perfectly)
ATI Radeon 7000 AGP 32MB i think, its some cheezy GFX card, its a server, not a workstation
admin0 07-28-2004, 06:29 PM Hi,
2 things:
on services, locate RPC, click dependencies, and on 1st, 2nd and 3rd failure, change all from Reboot The Compuer to change to Restart the Service.
Then windowsupdate :)
After you install all the updates, this issue will go away :)
Cheers,
Steven 07-28-2004, 06:46 PM This sounds like the rpcdcom exploit.
CSD_Hosting 07-28-2004, 06:53 PM i donnt have a worm, i built the computer 2 days ago, i just connected it to the network.
2uantuM 07-28-2004, 07:06 PM it sounds like blaster
CSD_Hosting 07-29-2004, 12:30 PM hrm, well, it could be the worm/blaster, because the router shows someone is doing portscans on 135, 139, 445, and a few others, bah, damn lamers
CSD_Hosting 07-29-2004, 12:37 PM ok, so in the routing and remote access there is a packet filter, ive got
Protocol
Source Port
Destination Port
the source port, i leave blank, and set Destination port to 135 on TCP, that will block all blaster things right? i need to put it in dest, not source?
TechSolution 07-29-2004, 01:01 PM You don't have a worm.
It's standard Windows 2003 activity to reboot if RPC fails. Make sure any dependencies of RPC are running
CSD_Hosting 07-29-2004, 01:02 PM alright, i fixed it, heres what it was, it was blaster or worm, i setup a packet filter on 135/445 and no more rpc errors. sweet
TechSolution 07-29-2004, 01:06 PM I don't think a worm actually got on your system, sounds like the server was being attacked though.
Why did you have those ports being fowarded to the Windows server anyways (if you were behind your DSL router)?
CSD_Hosting 07-29-2004, 01:19 PM it was being attacked by another computer. i have all ports sent to the machine, its a static ip dsl, and i turned NAT off on the router, so the computers can have real IPs assigned to them.
concept 07-29-2004, 02:25 PM Originally posted by CSD_Hosting
i donnt have a worm, i built the computer 2 days ago, i just connected it to the network.
For future installs, I would recommend keeping a cd-rw around with all the critical updates on them, and add the new ones as they come out. That way your machine can be patched without hitting a network.
This summer I have been setting up servers for Purdue Indianapolis, and within 2 minutes of any non-patched windows machine being hooked to the network, it is infected, and you need to completely reinstall.
CSD_Hosting 07-29-2004, 05:09 PM yea, well, thanks for the help guys, i really appreciate it, that was driving me insane
Steven 07-29-2004, 06:10 PM Originally posted by TechSolution
I don't think a worm actually got on your system, sounds like the server was being attacked though.
Why did you have those ports being fowarded to the Windows server anyways (if you were behind your DSL router)? ]
Im not a windows admin BUT, i did run windows 2k3 on my home box for a while and it does reboot in somecases because of blaster worm if your not patched which he wasent, just like xp reboots.
CSD_Hosting 07-29-2004, 06:24 PM ay. that was the problem, because, at my house, i have COX, and they block the blaster ports on their side, so, i never 'blocked' them, and i never had this problem at home. thats why it made me nuts.
|