Topic: Family Tech Support: No Good Deed Goes Unpunished! (Read 8700 times)

NJAntman · « **on:** December 10, 2003, 09:42:34 am »

Yes, this is the ever continuing saga of attempting (and sometimes succeding) to fix the PCs of the older generation.

Case File: Father-in-Law
Having previously been relieved of the pain of a Dell-Hell system by the delivery of a Dell upgrade/replacement, Dad was cruising along nicely for some months. Then his ISP (Verizon) shot him a message about upgrading from 4.X to 5.X and the nightmare began anew as the result of repeated failed upgrades (Verizon/Dell/MS denying responsibilty) was that his browser would not show secured pages. No more banking or shopping which was the reason he got the PC.

So after I wiped and re-installed just the basics (XP & Verizon) this past Sunday, he seemed to be picking up the pieces. Until Monday afternoon when he appearantly picked up the wrong piece. Not sure if it was AOL 9.0 (found the its' Uninstall loaded) or Verizon (its' Configuration/Connection program seems stuck mid-step). He gets rather confused when he starts calling Verizon, then Dell, then MS for tech support so he no longer can tell me who said what or had him do what.

In a nutshell, his system is seiously scewed up again. Upon loading up to the XP desktop the very first program to apear is the Verizon Configuration/Connection routine box which is at the Connect/Verify Account step and has that lovely message across the top menu bar "Not Responding" (Odd, since I had installed, configured, and used Verizon Sunday with re-boots between each succesive visit to the net). Can't proceed or close it but can Ctrl-Alt-Del to kill it off. Also, the printer now has a connection error (tried PrntScrn to document the next occurence, bear with me).

Whatever I do, about 3 minutes after first loading to the XP desktop a nasty little message appears stating to the effect "...program not reponding... RCP (remote connection protocol?) error... system to be shut down... NT/Administrator.." and then a one minute countdown clock. Cannot Ctrl-Alt-Del to kill this off or do anything except watch the system go through a very prolonged shutdown after which it immediattely re-boots and the whole porcess starts again, and again, and again. The only thing I can do is Shut-Down the PC myself before the message apears, thus no re-boot and repeat. Just a big silicon paper-weight on the desk.

Now the only "help" he received from Verizon/Dell/MS was the advice to use command "shutdown a" from the run line, which did nothing. And also a claim that this is the result of some known virus and that the cure can be had at the MS site; interesting advice since the PC is stuck on ISP configuration (no longer able to connect) and has only about less than 3 minutes to visit and download from MS.

So, here I am. Not sure what the command "shutdown a" is supposed to do. Any help?

So, here I sit dazed and aggrevated again. Going to visit the MS site and look for a mention of this virus. Waste of time?

I sit here contemplating how this problem started. A 60+ year old whose sole experience with a computer was the ballsitics box on an M-60 shouldn't be allowed near the net. But I can't tell dad-in-law to give it up. Can't even explain to him why he doesn't need Verizon, AOL, & MSN all at the same time despite what those pop-ups say he must do.

May have to wipe and re-install again and leave him with just a limited user account, not even sure if he wouldn't get things screwed up again in under 24 hours. What to do?

Sirgod · « **Reply #1 on:** December 10, 2003, 09:48:41 am »

I do recall there was a virus, that operated in the Remote Procedure call on win XP, But I can't remember exactly how to turn It off. I know you could have It take no action as one of the choices.

Sounds like your going to have alot of fun doing tech Support Bro.

Stephen

Sirgod · « **Reply #2 on:** December 10, 2003, 09:50:41 am »

Here you go.

http://www.faqs.org/rfcs/rfc1831.html

Attention: Are you looking for info about the cause of "Remote Procedure Call (RPC)", initiated by NT Authority\System error message that shuts down Windows (you might also see svchost.exe error occasionally)?
It is a virus that started spreading very quickly on August 11, 2003. It works by exploiting unpatched Windows 2000/XP computers. It's been named Lovesan (LovSan, LuvSan) or Blaster.

Use McAfee VirusScan Online to scan your PC for viruses now and prevent such future problems.

Here is additional info about the virus from McAfee: ** MEDIUM VIRUS ALERT - 'LovSan' Worm**

Here is Microsoft's security patch for Windows XP that fixes this dangerous vulnerability allowing anyone to execute any program on your computer across the Internet. Here it is for Windows 2000. If you have a slower connection, you may not be able to download it before your computer shuts down. In this case, look at other options below or use another computer to download it and then copy it over and run it on your computer. Here is more info from Microsoft. You should also regularly use Windows Update.

There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

Symantec has made available a virus removal tool (more info here).

Another removal option for more advanced users is:

1. Delete msblast.exe (usually found at c:\windows\system32\msblast.exe).
2. Delete the Windows Registry key: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\windows auto update" containing "msblast.exe". This is what causes the virus to start on reboot. To edit the Registry, go to Start->Run and put in "regedit".

Make sure to get some sort of anti-virus software, such as McAfee VirusScan to prevent future problems. Where can I get the latest Anti-Virus software?

The remainder of this page describes how Remote Procedure Call (RPC) works, not how the Lovesan virus works.

- - - - - -

more on the page

stephen

Norrin_Radd · « **Reply #3 on:** December 10, 2003, 10:04:59 am »

Just seconding Sirgod's post.

You have the MBlaster worm.

Download and run the removal tool from symnatec, preform all windows updates, and then run a deep scan with your anti-virus software (just to make sure).

MBlaster is a pain in the butt, but is pretty easy to fix.

762 · « **Reply #4 on:** December 10, 2003, 10:15:38 am »

It's AOL's fault.

All computer problems have their root in AOL.

NJAntman · « **Reply #5 on:** December 10, 2003, 10:42:26 am »

Quote:

It's AOL's fault.

All computer problems have their root in AOL.

I agree AOL is the root of all evil. That AOL was involved somewhere along the line is no coincidence.

Thank you Sirgod, dude, you rock!! Who needs Goolge links or Ask Jeeves when questions here are answered so well! That is what I like about this forum, its a 24/7 sea of experience and info.

Now, I just need to figure out how to explain over the phone to dad where the "/" key so he can quickly type "shutdown/a"....

Who am I kidding? With our luck he'll type "format c".

I think a complete clean re-install of XP, Verizon, and visit to MS for the lates security patch is the best way out of this mess. I'll be making that house-call on the way home from work Thursday.

DreadlordGW · « **Reply #6 on:** December 10, 2003, 10:54:21 am »

Download the patches to YOUR machine, and burn them to CD.

MSBlaster et al are notoriously able to hit you before you can complete windows update.

At work we're banned from reinstalling Win2k and XP while plugged into the network jacks. We're to patch using CD Rom, then go on the network, and get the rest

Sirgod · « **Reply #7 on:** December 10, 2003, 10:56:02 am »

that's a pretty good idea actually Dread Lord, and thanks for the compliment there Antman, Alot of others could have answered It probably better than I, I just got to the thread first is all.

Later,
Stephen

Sethan · « **Reply #8 on:** December 10, 2003, 12:13:38 pm »

Antman -

1) Get a copy of Ghost or DriveImage.
2) Buy a 2nd hard drive, and install it as a slave drive (can also do this by partitioning a single drive)
3) Reload the machine, and get everything configured to use the 2nd drive as the data drive.
4) Make an image of the system drive (or partition). You will need to update this when he makes major changes to the system.
5) Set up a boot disk to automatically reload the system drive from that image CD.

End of problem.

If he has anything like this again, have him stick in the boot disk and the image CD, and restart the machine. 20 minutes later, the problem is fixed.

Reverend · « **Reply #10 on:** December 10, 2003, 12:18:49 pm »

nah, Sirgod, its feedback.... I have messed with my in-law's computer for them, an ancient Gateway with a whopping 128 MB of RAM... they use gAOL too, and due to many errors it had, I had to just format it for them and I had to install gAOL for them, for fear of them not doing it right...
.... I felt.... so unclean, like I was 12 again and furiously pounding at the naughty parts in the bathroom to have uncle unexpectedly come barging in... it felt blasphemous to have to poison my hands and eyes with that decadent and prostrating gAOL.....
but, it sort of cured it... until they installed some Gateway-made 'Repair Disk', which had unnessecary drivers that self-installed.... now they get more little red error windows, and have the audacity to ask me what I did wrong, even though I told them do not install tha wretched little Repair Disk...
ah well, sometime I am going to find a good 1 GB processor motherboard and put on some good RAM, and get them my old copy of XP.... that way they can fiddle with gAOL all they like, and XP will generally be albe to take it.

NJAntman · « **Reply #12 on:** December 22, 2003, 06:14:39 pm »

And the saga continues......

Finished getting over the last bug, reloading and getting the most recent updates. Aside from an annoying 4 minute shutdown time, everything was OK till yesterday. The Dell All-In-One A940 printer stopped working. Father-in-law disconnected, re-connected USB line, threw in install CD, ran it. No go.

I do the same, WinXP immediattely picks up on newly installed device, correctly IDs it as Dell All-In-One A940, then displays message "Hardware Error, check USB connected properly". Now if I plug in a USB device and the WinXP OS can ID it as a specific model then how can the USB not be Connection?

Several disconnects and reconnects did lead to one instance of the Setup Wizard kickin in, and after placing the Dell All-In-One A940 install CD in and running through for a few minutes I'm derailed by the following message, "An error has occured during the installation of the device. The handle is invalid." Huh?

Any thoughts? (other than cramming this beast through a chipper and catapaulting it to Dell HQ)

JMM · « **Reply #13 on:** December 22, 2003, 06:24:42 pm »

Dell Hell is right! I'm using Vicky's Dell Dimension L933r and I HATE IT WITH A PASSION! I guess it wasn't enough for Michael to totally ruin Round Rock, TX. He has to create crap computers as well. Why do people buy this crap? I guess it is true, there IS a sucker born every minute!

I'll be glad to get back to Austin and have use of the Sony VAIO! I know we all have favorite P/Cs, but I can definitely vouch for the Sony VAIO P4s!

JMM · « **Reply #15 on:** December 22, 2003, 06:45:12 pm »

What would we do without Kortez and Sethan? I know the two of you have helped me a lot. I really do miss yáll. To be honest, I'll be glad to come home in Jan and see the green hills of Austin and be able to chat all I want.

BTW, you guys need to learn espanol, can you believe lil ole me was the one that got the cable modem running? I noticed it on the Sony VAIO, whenever you have multiple USB connected, it sometimes confuses the P/C to detect new hardware, so after mi sobrino and the cable guy tried everything, I disconnected all USB devices and connected the modem to a different port, and presto! Cable modem accepted! That is a simple thing that Seth and Kortez would have recognized in a heartbeat.

BTW, T1 lines run 200 a month here, BUT, I'm signed up for 256 Kbs line, and sometimes is not that fast, I miss my roadrunner, beep beep!

NJAntman · « **Reply #17 on:** December 10, 2003, 09:42:34 am »

Yes, this is the ever continuing saga of attempting (and sometimes succeding) to fix the PCs of the older generation.

Case File: Father-in-Law
Having previously been relieved of the pain of a Dell-Hell system by the delivery of a Dell upgrade/replacement, Dad was cruising along nicely for some months. Then his ISP (Verizon) shot him a message about upgrading from 4.X to 5.X and the nightmare began anew as the result of repeated failed upgrades (Verizon/Dell/MS denying responsibilty) was that his browser would not show secured pages. No more banking or shopping which was the reason he got the PC.

So after I wiped and re-installed just the basics (XP & Verizon) this past Sunday, he seemed to be picking up the pieces. Until Monday afternoon when he appearantly picked up the wrong piece. Not sure if it was AOL 9.0 (found the its' Uninstall loaded) or Verizon (its' Configuration/Connection program seems stuck mid-step). He gets rather confused when he starts calling Verizon, then Dell, then MS for tech support so he no longer can tell me who said what or had him do what.

In a nutshell, his system is seiously scewed up again. Upon loading up to the XP desktop the very first program to apear is the Verizon Configuration/Connection routine box which is at the Connect/Verify Account step and has that lovely message across the top menu bar "Not Responding" (Odd, since I had installed, configured, and used Verizon Sunday with re-boots between each succesive visit to the net). Can't proceed or close it but can Ctrl-Alt-Del to kill it off. Also, the printer now has a connection error (tried PrntScrn to document the next occurence, bear with me).

Whatever I do, about 3 minutes after first loading to the XP desktop a nasty little message appears stating to the effect "...program not reponding... RCP (remote connection protocol?) error... system to be shut down... NT/Administrator.." and then a one minute countdown clock. Cannot Ctrl-Alt-Del to kill this off or do anything except watch the system go through a very prolonged shutdown after which it immediattely re-boots and the whole porcess starts again, and again, and again. The only thing I can do is Shut-Down the PC myself before the message apears, thus no re-boot and repeat. Just a big silicon paper-weight on the desk.

Now the only "help" he received from Verizon/Dell/MS was the advice to use command "shutdown a" from the run line, which did nothing. And also a claim that this is the result of some known virus and that the cure can be had at the MS site; interesting advice since the PC is stuck on ISP configuration (no longer able to connect) and has only about less than 3 minutes to visit and download from MS.

So, here I am. Not sure what the command "shutdown a" is supposed to do. Any help?

So, here I sit dazed and aggrevated again. Going to visit the MS site and look for a mention of this virus. Waste of time?

I sit here contemplating how this problem started. A 60+ year old whose sole experience with a computer was the ballsitics box on an M-60 shouldn't be allowed near the net. But I can't tell dad-in-law to give it up. Can't even explain to him why he doesn't need Verizon, AOL, & MSN all at the same time despite what those pop-ups say he must do.

May have to wipe and re-install again and leave him with just a limited user account, not even sure if he wouldn't get things screwed up again in under 24 hours. What to do?

Sirgod · « **Reply #18 on:** December 10, 2003, 09:48:41 am »

I do recall there was a virus, that operated in the Remote Procedure call on win XP, But I can't remember exactly how to turn It off. I know you could have It take no action as one of the choices.

Sounds like your going to have alot of fun doing tech Support Bro.

Stephen

Sirgod · « **Reply #19 on:** December 10, 2003, 09:50:41 am »

Here you go.

http://www.faqs.org/rfcs/rfc1831.html

Attention: Are you looking for info about the cause of "Remote Procedure Call (RPC)", initiated by NT Authority\System error message that shuts down Windows (you might also see svchost.exe error occasionally)?
It is a virus that started spreading very quickly on August 11, 2003. It works by exploiting unpatched Windows 2000/XP computers. It's been named Lovesan (LovSan, LuvSan) or Blaster.

Use McAfee VirusScan Online to scan your PC for viruses now and prevent such future problems.

Here is additional info about the virus from McAfee: ** MEDIUM VIRUS ALERT - 'LovSan' Worm**

Here is Microsoft's security patch for Windows XP that fixes this dangerous vulnerability allowing anyone to execute any program on your computer across the Internet. Here it is for Windows 2000. If you have a slower connection, you may not be able to download it before your computer shuts down. In this case, look at other options below or use another computer to download it and then copy it over and run it on your computer. Here is more info from Microsoft. You should also regularly use Windows Update.

There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

Symantec has made available a virus removal tool (more info here).

Another removal option for more advanced users is:

1. Delete msblast.exe (usually found at c:\windows\system32\msblast.exe).
2. Delete the Windows Registry key: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\windows auto update" containing "msblast.exe". This is what causes the virus to start on reboot. To edit the Registry, go to Start->Run and put in "regedit".

Make sure to get some sort of anti-virus software, such as McAfee VirusScan to prevent future problems. Where can I get the latest Anti-Virus software?

The remainder of this page describes how Remote Procedure Call (RPC) works, not how the Lovesan virus works.

- - - - - -

more on the page

stephen

Norrin_Radd · « **Reply #20 on:** December 10, 2003, 10:04:59 am »

Just seconding Sirgod's post.

You have the MBlaster worm.

Download and run the removal tool from symnatec, preform all windows updates, and then run a deep scan with your anti-virus software (just to make sure).

MBlaster is a pain in the butt, but is pretty easy to fix.

762 · « **Reply #21 on:** December 10, 2003, 10:15:38 am »

It's AOL's fault.

All computer problems have their root in AOL.

DreadlordGW · « **Reply #23 on:** December 10, 2003, 10:54:21 am »

Download the patches to YOUR machine, and burn them to CD.

MSBlaster et al are notoriously able to hit you before you can complete windows update.

At work we're banned from reinstalling Win2k and XP while plugged into the network jacks. We're to patch using CD Rom, then go on the network, and get the rest

Sirgod · « **Reply #24 on:** December 10, 2003, 10:56:02 am »

that's a pretty good idea actually Dread Lord, and thanks for the compliment there Antman, Alot of others could have answered It probably better than I, I just got to the thread first is all.

Later,
Stephen

Sethan · « **Reply #25 on:** December 10, 2003, 12:13:38 pm »

Antman -

1) Get a copy of Ghost or DriveImage.
2) Buy a 2nd hard drive, and install it as a slave drive (can also do this by partitioning a single drive)
3) Reload the machine, and get everything configured to use the 2nd drive as the data drive.
4) Make an image of the system drive (or partition). You will need to update this when he makes major changes to the system.
5) Set up a boot disk to automatically reload the system drive from that image CD.

End of problem.

If he has anything like this again, have him stick in the boot disk and the image CD, and restart the machine. 20 minutes later, the problem is fixed.

Reverend · « **Reply #27 on:** December 10, 2003, 12:18:49 pm »

nah, Sirgod, its feedback.... I have messed with my in-law's computer for them, an ancient Gateway with a whopping 128 MB of RAM... they use gAOL too, and due to many errors it had, I had to just format it for them and I had to install gAOL for them, for fear of them not doing it right...
.... I felt.... so unclean, like I was 12 again and furiously pounding at the naughty parts in the bathroom to have uncle unexpectedly come barging in... it felt blasphemous to have to poison my hands and eyes with that decadent and prostrating gAOL.....
but, it sort of cured it... until they installed some Gateway-made 'Repair Disk', which had unnessecary drivers that self-installed.... now they get more little red error windows, and have the audacity to ask me what I did wrong, even though I told them do not install tha wretched little Repair Disk...
ah well, sometime I am going to find a good 1 GB processor motherboard and put on some good RAM, and get them my old copy of XP.... that way they can fiddle with gAOL all they like, and XP will generally be albe to take it.

NJAntman · « **Reply #29 on:** December 22, 2003, 06:14:39 pm »

And the saga continues......

Finished getting over the last bug, reloading and getting the most recent updates. Aside from an annoying 4 minute shutdown time, everything was OK till yesterday. The Dell All-In-One A940 printer stopped working. Father-in-law disconnected, re-connected USB line, threw in install CD, ran it. No go.

I do the same, WinXP immediattely picks up on newly installed device, correctly IDs it as Dell All-In-One A940, then displays message "Hardware Error, check USB connected properly". Now if I plug in a USB device and the WinXP OS can ID it as a specific model then how can the USB not be Connection?

Several disconnects and reconnects did lead to one instance of the Setup Wizard kickin in, and after placing the Dell All-In-One A940 install CD in and running through for a few minutes I'm derailed by the following message, "An error has occured during the installation of the device. The handle is invalid." Huh?

Any thoughts? (other than cramming this beast through a chipper and catapaulting it to Dell HQ)

JMM · « **Reply #30 on:** December 22, 2003, 06:24:42 pm »

Dell Hell is right! I'm using Vicky's Dell Dimension L933r and I HATE IT WITH A PASSION! I guess it wasn't enough for Michael to totally ruin Round Rock, TX. He has to create crap computers as well. Why do people buy this crap? I guess it is true, there IS a sucker born every minute!

I'll be glad to get back to Austin and have use of the Sony VAIO! I know we all have favorite P/Cs, but I can definitely vouch for the Sony VAIO P4s!

JMM · « **Reply #32 on:** December 22, 2003, 06:45:12 pm »

What would we do without Kortez and Sethan? I know the two of you have helped me a lot. I really do miss yáll. To be honest, I'll be glad to come home in Jan and see the green hills of Austin and be able to chat all I want.

BTW, you guys need to learn espanol, can you believe lil ole me was the one that got the cable modem running? I noticed it on the Sony VAIO, whenever you have multiple USB connected, it sometimes confuses the P/C to detect new hardware, so after mi sobrino and the cable guy tried everything, I disconnected all USB devices and connected the modem to a different port, and presto! Cable modem accepted! That is a simple thing that Seth and Kortez would have recognized in a heartbeat.

BTW, T1 lines run 200 a month here, BUT, I'm signed up for 256 Kbs line, and sometimes is not that fast, I miss my roadrunner, beep beep!

NJAntman · « **Reply #34 on:** December 10, 2003, 09:42:34 am »

Yes, this is the ever continuing saga of attempting (and sometimes succeding) to fix the PCs of the older generation.

Case File: Father-in-Law
Having previously been relieved of the pain of a Dell-Hell system by the delivery of a Dell upgrade/replacement, Dad was cruising along nicely for some months. Then his ISP (Verizon) shot him a message about upgrading from 4.X to 5.X and the nightmare began anew as the result of repeated failed upgrades (Verizon/Dell/MS denying responsibilty) was that his browser would not show secured pages. No more banking or shopping which was the reason he got the PC.

So after I wiped and re-installed just the basics (XP & Verizon) this past Sunday, he seemed to be picking up the pieces. Until Monday afternoon when he appearantly picked up the wrong piece. Not sure if it was AOL 9.0 (found the its' Uninstall loaded) or Verizon (its' Configuration/Connection program seems stuck mid-step). He gets rather confused when he starts calling Verizon, then Dell, then MS for tech support so he no longer can tell me who said what or had him do what.

In a nutshell, his system is seiously scewed up again. Upon loading up to the XP desktop the very first program to apear is the Verizon Configuration/Connection routine box which is at the Connect/Verify Account step and has that lovely message across the top menu bar "Not Responding" (Odd, since I had installed, configured, and used Verizon Sunday with re-boots between each succesive visit to the net). Can't proceed or close it but can Ctrl-Alt-Del to kill it off. Also, the printer now has a connection error (tried PrntScrn to document the next occurence, bear with me).

Whatever I do, about 3 minutes after first loading to the XP desktop a nasty little message appears stating to the effect "...program not reponding... RCP (remote connection protocol?) error... system to be shut down... NT/Administrator.." and then a one minute countdown clock. Cannot Ctrl-Alt-Del to kill this off or do anything except watch the system go through a very prolonged shutdown after which it immediattely re-boots and the whole porcess starts again, and again, and again. The only thing I can do is Shut-Down the PC myself before the message apears, thus no re-boot and repeat. Just a big silicon paper-weight on the desk.

Now the only "help" he received from Verizon/Dell/MS was the advice to use command "shutdown a" from the run line, which did nothing. And also a claim that this is the result of some known virus and that the cure can be had at the MS site; interesting advice since the PC is stuck on ISP configuration (no longer able to connect) and has only about less than 3 minutes to visit and download from MS.

So, here I am. Not sure what the command "shutdown a" is supposed to do. Any help?

So, here I sit dazed and aggrevated again. Going to visit the MS site and look for a mention of this virus. Waste of time?

I sit here contemplating how this problem started. A 60+ year old whose sole experience with a computer was the ballsitics box on an M-60 shouldn't be allowed near the net. But I can't tell dad-in-law to give it up. Can't even explain to him why he doesn't need Verizon, AOL, & MSN all at the same time despite what those pop-ups say he must do.

May have to wipe and re-install again and leave him with just a limited user account, not even sure if he wouldn't get things screwed up again in under 24 hours. What to do?

Sirgod · « **Reply #35 on:** December 10, 2003, 09:48:41 am »

I do recall there was a virus, that operated in the Remote Procedure call on win XP, But I can't remember exactly how to turn It off. I know you could have It take no action as one of the choices.

Sounds like your going to have alot of fun doing tech Support Bro.

Stephen

Sirgod · « **Reply #36 on:** December 10, 2003, 09:50:41 am »

Here you go.

http://www.faqs.org/rfcs/rfc1831.html

Attention: Are you looking for info about the cause of "Remote Procedure Call (RPC)", initiated by NT Authority\System error message that shuts down Windows (you might also see svchost.exe error occasionally)?
It is a virus that started spreading very quickly on August 11, 2003. It works by exploiting unpatched Windows 2000/XP computers. It's been named Lovesan (LovSan, LuvSan) or Blaster.

Use McAfee VirusScan Online to scan your PC for viruses now and prevent such future problems.

Here is additional info about the virus from McAfee: ** MEDIUM VIRUS ALERT - 'LovSan' Worm**

Here is Microsoft's security patch for Windows XP that fixes this dangerous vulnerability allowing anyone to execute any program on your computer across the Internet. Here it is for Windows 2000. If you have a slower connection, you may not be able to download it before your computer shuts down. In this case, look at other options below or use another computer to download it and then copy it over and run it on your computer. Here is more info from Microsoft. You should also regularly use Windows Update.

There are several options to avoid the system shutdown:

Go to Start->Control Panel->Administrative Tools->Services->Remote Procedure Call (RPC)->Recovery Tab and choosing "Take No Action" for all three choices.

Go to Start->Run, type in shutdown/a, and press Enter.

Change the system time back by several hours.

Disconnect from the Internet.

Symantec has made available a virus removal tool (more info here).

Another removal option for more advanced users is:

1. Delete msblast.exe (usually found at c:\windows\system32\msblast.exe).
2. Delete the Windows Registry key: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\windows auto update" containing "msblast.exe". This is what causes the virus to start on reboot. To edit the Registry, go to Start->Run and put in "regedit".

Make sure to get some sort of anti-virus software, such as McAfee VirusScan to prevent future problems. Where can I get the latest Anti-Virus software?

The remainder of this page describes how Remote Procedure Call (RPC) works, not how the Lovesan virus works.

- - - - - -

more on the page

stephen

Norrin_Radd · « **Reply #37 on:** December 10, 2003, 10:04:59 am »

Just seconding Sirgod's post.

You have the MBlaster worm.

Download and run the removal tool from symnatec, preform all windows updates, and then run a deep scan with your anti-virus software (just to make sure).

MBlaster is a pain in the butt, but is pretty easy to fix.

762 · « **Reply #38 on:** December 10, 2003, 10:15:38 am »

It's AOL's fault.

All computer problems have their root in AOL.

DreadlordGW · « **Reply #40 on:** December 10, 2003, 10:54:21 am »

Download the patches to YOUR machine, and burn them to CD.

MSBlaster et al are notoriously able to hit you before you can complete windows update.

At work we're banned from reinstalling Win2k and XP while plugged into the network jacks. We're to patch using CD Rom, then go on the network, and get the rest

Sirgod · « **Reply #41 on:** December 10, 2003, 10:56:02 am »

that's a pretty good idea actually Dread Lord, and thanks for the compliment there Antman, Alot of others could have answered It probably better than I, I just got to the thread first is all.

Later,
Stephen

Sethan · « **Reply #42 on:** December 10, 2003, 12:13:38 pm »

Antman -

1) Get a copy of Ghost or DriveImage.
2) Buy a 2nd hard drive, and install it as a slave drive (can also do this by partitioning a single drive)
3) Reload the machine, and get everything configured to use the 2nd drive as the data drive.
4) Make an image of the system drive (or partition). You will need to update this when he makes major changes to the system.
5) Set up a boot disk to automatically reload the system drive from that image CD.

End of problem.

If he has anything like this again, have him stick in the boot disk and the image CD, and restart the machine. 20 minutes later, the problem is fixed.

Reverend · « **Reply #44 on:** December 10, 2003, 12:18:49 pm »

nah, Sirgod, its feedback.... I have messed with my in-law's computer for them, an ancient Gateway with a whopping 128 MB of RAM... they use gAOL too, and due to many errors it had, I had to just format it for them and I had to install gAOL for them, for fear of them not doing it right...
.... I felt.... so unclean, like I was 12 again and furiously pounding at the naughty parts in the bathroom to have uncle unexpectedly come barging in... it felt blasphemous to have to poison my hands and eyes with that decadent and prostrating gAOL.....
but, it sort of cured it... until they installed some Gateway-made 'Repair Disk', which had unnessecary drivers that self-installed.... now they get more little red error windows, and have the audacity to ask me what I did wrong, even though I told them do not install tha wretched little Repair Disk...
ah well, sometime I am going to find a good 1 GB processor motherboard and put on some good RAM, and get them my old copy of XP.... that way they can fiddle with gAOL all they like, and XP will generally be albe to take it.

NJAntman · « **Reply #46 on:** December 22, 2003, 06:14:39 pm »

And the saga continues......

Finished getting over the last bug, reloading and getting the most recent updates. Aside from an annoying 4 minute shutdown time, everything was OK till yesterday. The Dell All-In-One A940 printer stopped working. Father-in-law disconnected, re-connected USB line, threw in install CD, ran it. No go.

I do the same, WinXP immediattely picks up on newly installed device, correctly IDs it as Dell All-In-One A940, then displays message "Hardware Error, check USB connected properly". Now if I plug in a USB device and the WinXP OS can ID it as a specific model then how can the USB not be Connection?

Several disconnects and reconnects did lead to one instance of the Setup Wizard kickin in, and after placing the Dell All-In-One A940 install CD in and running through for a few minutes I'm derailed by the following message, "An error has occured during the installation of the device. The handle is invalid." Huh?

Any thoughts? (other than cramming this beast through a chipper and catapaulting it to Dell HQ)

JMM · « **Reply #47 on:** December 22, 2003, 06:24:42 pm »

Dell Hell is right! I'm using Vicky's Dell Dimension L933r and I HATE IT WITH A PASSION! I guess it wasn't enough for Michael to totally ruin Round Rock, TX. He has to create crap computers as well. Why do people buy this crap? I guess it is true, there IS a sucker born every minute!

I'll be glad to get back to Austin and have use of the Sony VAIO! I know we all have favorite P/Cs, but I can definitely vouch for the Sony VAIO P4s!

JMM · « **Reply #49 on:** December 22, 2003, 06:45:12 pm »

What would we do without Kortez and Sethan? I know the two of you have helped me a lot. I really do miss yáll. To be honest, I'll be glad to come home in Jan and see the green hills of Austin and be able to chat all I want.

BTW, you guys need to learn espanol, can you believe lil ole me was the one that got the cable modem running? I noticed it on the Sony VAIO, whenever you have multiple USB connected, it sometimes confuses the P/C to detect new hardware, so after mi sobrino and the cable guy tried everything, I disconnected all USB devices and connected the modem to a different port, and presto! Cable modem accepted! That is a simple thing that Seth and Kortez would have recognized in a heartbeat.

BTW, T1 lines run 200 a month here, BUT, I'm signed up for 256 Kbs line, and sometimes is not that fast, I miss my roadrunner, beep beep!

News:

Topic: Family Tech Support: No Good Deed Goes Unpunished! (Read 8700 times) var addthis_config = {"data_track_clickback":true};

NJAntman

Sirgod

Sirgod

Norrin_Radd

762

NJAntman

DreadlordGW

Sirgod

Sethan

NJAntman

Reverend

DreadlordGW

NJAntman

JMM

Kortez

JMM

Warden

NJAntman

Sirgod

Sirgod

Norrin_Radd

762

NJAntman

DreadlordGW

Sirgod

Sethan

NJAntman

Reverend

DreadlordGW

NJAntman

JMM

Kortez

JMM

Warden

NJAntman

Sirgod

Sirgod

Norrin_Radd

762

NJAntman

DreadlordGW

Sirgod

Sethan

NJAntman

Reverend

DreadlordGW

NJAntman

JMM

Kortez

JMM

Warden

Topic: Family Tech Support: No Good Deed Goes Unpunished! (Read 8700 times)