Remote procedure Call ( RPC )異常終止解決方案
 

請先下載下方聯結修正程式!

裡面有說明文件跟修正檔案!

http://myweb.hinet.net/home4/boofey/files/RPC/RPC.rar

補充上方說明.

XP 英文版修正檔下載連結:

http://download.microsoft.com/downlo...P2_x86_ENU.exe

如要更詳細說明請到下方微軟官方網頁:

http://support.microsoft.com/?kbid=331953

我剛好有遇到這種問題真的好煩阿一直給我重開機謝謝不飛兄提供

真是太感謝您了.....我也遇到這個問題

謝謝大大了~這幾天我也遇到這個快煩死了><

謝謝大大了~這12個小時我快煩死了><

呼!今天一整天都在搞這個問題,感謝您們

看來用NT系列的網友都遇到了相同的問題,現在終於解決了

感謝感謝^^||

不飛老師真行，因為RPC這個問題差點瘋掉，
找了一台沒有受影響的電腦連線到史版就看到不飛老師解決方法
感謝不飛老師

目前還沒遇到~趕緊來更新~不然遇到就來不及嚕!
謝謝各位提供教學資訊以及更新檔. :)

請問一下這病毒是最近這2天的事嗎

沒錯...

雖然我還沒有裝xp不過先下載下來預防萬一 謝謝不飛大了

除了Q331953修正檔，為了防止疾風病毒WORM_MSBLAST.A，請務必一併更新KB823980修正檔。下載點請參考：
http://www.slime2.com.tw/forums/show...threadid=59438

謝謝大大的告知@@@
我已經成功了!!!
不過要把MSBLAST.EXE刪掉要到安全模式下吧,因為在正常模式刪不掉
我是這樣啦!!!

非常感謝啊
害我灌好幾次原來是這個原因啊

哇~~快瘋了

危機解除了~~非常非常感謝啊~~:cool:

各種版本修正檔

Win XP
中文版
http://download.microsoft.com/downlo...eaaa3-380b-450 7-9ac2-6cec324b3ce8/WindowsXP-KB823980-x86-CHT.exe

英文版
http://download.microsoft.com/downlo...cfad8-afbc-458 f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

Win 2000
中文版
http://download.microsoft.com/downlo...8fa7161-8db3-4 af4-b576-0a56b0a9d8e6/Windows2000-KB823980-x86-CHT.exe

英文版
http://download.microsoft.com/downlo...1fdd40f-efc5-4 33d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe

Win 2003
中文版
http://download.microsoft.com/download/0/7/5/0758a3ff- ed88-4928-b960-0d08ffc11034/WindowsServer2003-KB823980-x86-CHT.exe

我也解決我的危機了.....真是謝謝ㄚ.....^^

<a href="http://tw.news.yahoo.com/2003/08/12/leisure/bcc/4168210.html">奇摩新聞--疾風病毒</a>

恩~~3q

終於有救ㄌ
謝謝分享
感恩阿..........

我現在一直在交人掃毒
我自己掃完後又救ㄌ10多人ㄌ

安裝防火牆似乎可以大幅降低中這個病毒的機率...
大家可以試試!反正多一道防護!
別認為個人電腦用家就不重要!
就算不是為了避免洩漏重要機密，只為這個病毒而安裝也好阿...
我有安裝防火牆，我的電腦安然無恙!
光昨今兩天就有兩個朋友向我求救了(都沒裝防火牆).....
這個病毒果然有夠猛....

謝謝....

雖然我自己早就用好了...

但是看到這會比較瞭解一點..

我推...謝謝

感謝BETA大大的提供,可是這裡提供的是winxp的更正方式,那請問在win2000中又如何做更新呢,因為我的電腦出現了"svchost.exe"已經產生錯誤的訊息,他們說這是疾風病毒,請問如何解呢?

疾風病毒自動掃瞄移除工具---不止疾風病毒含其他蠕蟲病毒


疾風病毒自動掃瞄移除工具---不止疾風病毒含其他蠕蟲病毒
及變種

此程式FOR所有版本 NT/2000/XP/2003

程式
ftp://ftp.kaspersky.com/utils/clrav.com

用法說明及參數


****************************************************************************
Utility for cleaning infection by:
I-Worm.BleBla.b
I-Worm.Navidad
I-Worm.Sircam
I-Worm.Goner
I-Worm.Klez.a,e,f,g,h
Win32.Elkern.c
I-Worm.Lentin.a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p
I-Worm.Tanatos.a,b
Worm.Win32.Opasoft.a,b,c,d,e,f,g,h
I-Worm.Avron.a,b,c,d,e
I-Worm.LovGate.a,b,c,d,e,f,g,h,i,j,k,l
I-Worm.Fizzer
I-Worm.Magold.a,b,c,d,e
Worm.Win32.Lovesan
Version 10.0.5.2 Copyright (C) Kaspersky Lab 2000-2003. All rights reserved.
****************************************************************************
Command line:
/s[n] - to force scaning of hard drives. Program will scan hard
drive for I-Worm.Klez.a(e,f,g,h) infection in any case.
n - include scaning of mapped network drives.
/y - end program without pressing any key.
/i - show command line info.
/nr - do not reboot system automatically in any cases.
/Rpt[ao][=<Report file path>] - create report file
a - add report file
o - report only (do not cure/delete infected files)
Return codes:
0 - nothing to clean
1 - virus was deleted and system restored
2 - to finilize removal of virus you shold reboot system
3 - to finilize removal of virus you shold reboot system and start
program the second time
4 - programm error.
****************************************************************************

I-Worm.BleBla.b
---------------
If program find HKEY_CLASSES_ROOT\rnjfile key in registry it:
delete registry keys
HKEY_CLASSES_ROOT\rnjfile
HKEY_CLASSES_ROOT\.lha
repair registry key to default value
HKEY_CLASSES_ROOT\.jpg to jpegfile
HKEY_CLASSES_ROOT\.jpeg to jpegfile
HKEY_CLASSES_ROOT\.jpe to jpegfile
HKEY_CLASSES_ROOT\.bmp to Paint.Picture
HKEY_CLASSES_ROOT\.gif to giffile
HKEY_CLASSES_ROOT\.avi to avifile
HKEY_CLASSES_ROOT\.mpg to mpegfile
HKEY_CLASSES_ROOT\.mpeg to mpegfile
HKEY_CLASSES_ROOT\.mp2 to mpegfile
HKEY_CLASSES_ROOT\.wmf to empty
HKEY_CLASSES_ROOT\.wma to wmafile
HKEY_CLASSES_ROOT\.wmv to wmvfile
HKEY_CLASSES_ROOT\.mp3 to mp3file
HKEY_CLASSES_ROOT\.vqf to empty
HKEY_CLASSES_ROOT\.doc to word.document.8 or wordpad.document.1
HKEY_CLASSES_ROOT\.xls to excel.sheet.8
HKEY_CLASSES_ROOT\.zip to winzip
HKEY_CLASSES_ROOT\.rar to winrar
HKEY_CLASSES_ROOT\.arj to archivefile or winzip
HKEY_CLASSES_ROOT\.reg to regfile
HKEY_CLASSES_ROOT\.exe to exefile
try to delete file
c:\windows\sysrnj.exe

I-Worm.Navidad
--------------
If program find HKEY_CURRENT_USER\Software\Navidad,
HKEY_CURRENT_USER\Software\xxxxmas or HKEY_CURRENT_USER\Software\Emanuel key
in registry it:
delete registry keys
HKEY_CURRENT_USER\Software\Navidad
HKEY_CURRENT_USER\Software\xxxxmas
HKEY_CURRENT_USER\Software\Emanuel
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32BaseServiceMOD
repair registry key to default value
HKEY_CLASSES_ROOT\exefile\shell\open\command to "%1" %*
try to delete file
winsvrc.vxd
winfile.vxd
wintask.exe

I-Worm.Sircam
-------------
If program find HKEY_LOCAL_MACHINE\Software\SirCam key in registry,
"@win \recycled\sirc32.exe" in autoexec.bat or \windows\run32.exe and
\windows\rundll32.exe was created on Delphi it:
delete registry keys
HKEY_LOCAL_MACHINE\Software\SirCam
Software\Microsoft\Windows\CurrentVersion\RunServices
Driver32
repair registry key to default value
HKEY_CLASSES_ROOT\exefile\shell\open\command to "%1" %*
try to delete file
%Windows drive%:\RECYCLED\SirC32.exe
%Windows directory%\ScMx32.exe
%Windows system directory%\SCam32.exe
%Windows startup directory%\"Microsoft Internet Office.exe"
%Windows drive%:\windows\rundll32.exe
try to rename files
%Windows drive%:\windows\Run32.exe to
%Windows drive%:\windows\RunDll32.exe
try to repair files
autoexec.bat

In case program can not delete or rename any files (it may be used at
that moment) it set these files to queue to delete or rename during bootup
process and offer user to reboot system.

I-Worm.Goner
------------
If gone.scr process exist in memory, program will try to stop it.
if file %Windows system directory%\gone.scr exist on hard drive,
program will try to delete it.
If program find %Windows system directory%\gone.scr key in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run of system
registry, it will delete this key.

I-Worm.Klez.a,e-h, Win32.Elkern.c, I-Worm.Lentin.a-p, I-Worm.Tanatos.a-b,
-------------------------------------------------------------------------
Worm.Win32.Opasoft.a-h, I-Worm.Avron.a-e, I-Worm.LovGate.a-l, I-Worm.Fizzer,
----------------------------------------------------------------------------
I-Worm.Magold.a-e, Worm.Win32.Lovesan
-------------------------------------
If program find next processes in memory:
Krn132.exe
WQK.exe
or any processes, infected by these viruses, it will try to
unhook virus hooks and patch needed processes to stop reinfection and then
stop them and delete/cure their files on hard drive and delete links to their
files from system registry and other startup places.
If program find that WQK.DLL library has been loaded by any processes
it will rename file of this library and will remove it after system reboot.
In case program find such library in memory of your PC you should reboot your
PC when program finish and start it the second time after reboot to clean your
system registry.
If program find any infected processes in memory it will start scan of
your hard drive (and all mapped network drives if you specify /netscan in
command line). It will check only infection by these viruses.
If you specify /s key in command line program will scan your hard drive
(and all mapped network drives if you specify /sn) in all cases.
If Win32.Elkern.c virus create memory mapping, program will disinfect
this memory area.
Program can restore next startup links used by viruses:
autoexec.bat
win %virus file path and name%
win.ini section [Windows]
run=<virus file>
registry keys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
values
AppInit_DLLs
Run
HKEY_CLASSES_ROOT\txtfile\shell\open\command (txt association)
restoring to link to notepad.exe program
HKEY_CLASSES_ROOT\exefile\shell\open\command (exe association)
restoring to "%1" %*
HKEY_CLASSES_ROOT\comfile\shell\open\command (com association)
restoring to "%1" %*
HKEY_CLASSES_ROOT\batfile\shell\open\command (bat association)
restoring to "%1" %*
HKEY_CLASSES_ROOT\piffile\shell\open\command (pif association)
restoring to "%1" %*
HKEY_CLASSES_ROOT\scrfile\shell\open\command (scr association)
restoring to "%1" %*
installed NT services
mIRC start scripts
<Program Files folder>\Mirc\script.ini
<Program Files folder>\Mirc32\script.ini
Pirch start scripts
<Program Files folder>\Pirch98\events.ini



用法：
1. copy clrav.com 到你的windows\system32目錄下
2. 開始--->執行----->鍵入clrav.com /s----> 確定

到下方微軟官方網頁猜考並下載修正程式:
http://support.microsoft.com/?kbid=331953

大飛哥哥,您能不能像描述winxp更正方式,來描述一下詳細的win2000更正方式給我們參考呢?因為您提供的微軟網站,小弟才疏學淺,真的看不懂,拜託啦,感恩呀!
* 如果你的電腦動不動就跟你說要重新開機 (60 秒)
* 或是:
[開始]->執行->Taskmgr.exe [ENTER] 後, 看一下有沒有 MSBLAST.EXE 這個
程式正在運作, 如果有, 也表示你已經中毒!
!! 中毒解毒程序: (目前就我知道的來解)
0 . 開始->執行->CMD.EXE [ENTER] (開啟Command line 視窗)
若系統跟你說要重新開機了, 請輸入shutdown -a [enter] 取消重新開機指令.
1 . 刪除 MSBLAST.EXE 這個 Process (直接在上面按右鍵, 選結束處理程序即可)
2 . 到微軟官方網站抓 DCOM RPC 的漏洞 Patch, 先存到硬碟去.
w2k 裡面的 CHT 表示中文版本, EN 表示英文版本
xp 也是一樣的.
3 . 拔掉網路線
4 . 用檔案總管, 到 Windows\System32 這個目錄下面找到 MSBLAST.EXE,
按右鍵選內容將唯讀取消掉, 然後把這個程式幹掉.
5 . 開始->執行->regedit.exe , 並且到:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 下面
將右邊的 "windows auto update" 這個鍵值直接砍掉, 砍掉後關閉登陸編輯程式.
6 . 執行你剛剛所抓下來的 Patch
7 . 重新開機
8 . 接上網路線, 大功告成.

詳情請參閱下方微軟公告:

http://support.microsoft.com/?kbid=331953

感謝不飛大大的提供,已經安裝了微軟提供的修正檔案WindowsXP-KB823980-x86-CHT可是我的電腦出現又出現了"svchost.exe"已經產生錯誤的訊息,他們說這是疾風病毒,請問如何解呢?

下載之後....
關機....拔除網路線...關閉檔火牆...
重新執行修正程式看看!

執行完畢...重新開機...再插上網路線...開啟檔火牆!