I get remote proceedure call and system shuts down.

Question

I have nt authourity remote proceedure call and system shuts down. All I have read says blaster worm. I have scanned and find nothing. I have xp media center with sp3. Microsoft patch is already installed. Any Ideas? Here is my Hijack log.   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:54:38 AM, on 9/29/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16705)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exeC:\Program Files\Creative\Shared Files\Module Loader\DLLML.exeC:\Program Files\Trend Micro\Internet Security 14\pccguide.exeC:\Program Files\Microsoft IntelliType Pro\itype.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\WINDOWS\CTHELPER.EXEC:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exec:\Program Files\Microsoft IntelliPoint\dpupdchk.exeC:\WINDOWS\SYSTEM32\CTXFISPI.EXEC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Executive Software\Diskeeper\DkService.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\NVIDIA Corporation
Tune
TuneService.exeC:\WINDOWS\system32
vsvc32.exeC:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exeC:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exeC:\WINDOWS\system32\dllhost.exeC:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portal.tds.net/index.phpR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [VolPanel] 'C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe' /rO4 - HKLM\..\Run: [AudioDrvEmulator] 'C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe' -1 AudioDrvEmulator 'C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll'O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe'O4 - HKLM\..\Run: [itype] 'c:\Program Files\Microsoft IntelliType Pro\itype.exe'O4 - HKLM\..\Run: [IntelliPoint] 'c:\Program Files\Microsoft IntelliPoint\ipoint.exe'O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXEO4 - HKLM\..\Run: [DiskeeperSystray] 'C:\Program Files\Executive Software\Diskeeper\DkIcon.exe'O4 - HKLM\..\Run: [RivaTunerStartupDaemon] 'C:\Program Files\RivaTuner v2.06\RivaTuner.exe' /SO4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe'O4 - HKCU\..\Run: [NVIDIA nTune] 'C:\Program Files\NVIDIA Corporation
Tune
TuneCmd.exe' clearO4 - HKUS\S-1-5-21-1220945662-1614895754-1801674531-1003\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' (User '?')O4 - HKUS\S-1-5-21-1220945662-1614895754-1801674531-1003\..\Run: [NVIDIA nTune] 'C:\Program Files\NVIDIA Corporation
Tune
TuneCmd.exe' clear (User '?')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195121271531O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cabO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exeO23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exeO23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation
Tune
TuneService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exeO23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - Unknown owner - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XIIc\RpcSandraSrv.exe (file missing)O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exeO23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exeO23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe --End of file - 7920 bytes

Bugbatter · Answer

I doubt that you have Blaster if you have kept up with Windows updates and anti-virus updates.

Have you tried disabling the service?
Here is some reading.
http://www.blackviper.com/WinXP/Services/Remote_Procedure_Call_(RPC)_Locator.htm

Other than an outdated version of Java, I do not see any serious issues in your log.
Older versions of Java have vulnerabilities that malware can use to infect your system.
You can go here to verify if you need to update Java:
http://www.java.com/en/download/installed.jsp

Please follow either the automatic or manual Java removal and installation instructions here:
http://aumha.net/viewtopic.php?f=31&t=34354

chronman · Answer

How do you dissable RPC? I have it set for take no action. Is that the same thing or are they saying to eliminate the process?

Bugbatter · Answer

Dell forum software did not format that link correctly. You will need to copy/past the link for Black Viper's site.

No, do not delete the service, just configure it differently. See the suggestion at BV's page.
* Automatic ~ With a service in this state, it will start at boot time. Some services, when no longer required, will also automatically stop when not needed. However, this is very rare. If you find you do not need a service, place it into Manual or Disabled.
* Manual ~ Manual mode allows Windows to start a service when needed. However, very few services will start up when required in Manual mode. If you find you need a service, place it into Automatic.
* Disabled ~ This setting will stop a service from starting, even if needed. Errors in the Event Viewer will show up complaining of that fact. Some services, while Disabled, will constantly complain. However, this situation is taken care of if placed in Manual. The service descriptions identifies those that should be in Manual vs. Disabled.

You can make these changes in Services:
Go to Start > Run and type: services.msc
Press "OK".
In Services, click the "Extended tab" and scroll down the list to find RPC.
When you find it, double-click on it.
In the Properties Window > General Tab that opens, make sure the service is stopped.
From the drop-down menu next to "Startup Type", click on "Manual" or "Disable".
Now click "Apply", then "OK" and close the Services window.

Virus & Spyware

I get remote proceedure call and system shuts down.

Was this post helpful?