For those with the Sasser Virus....

In WINDOWS XP, if you have been stricken with random rebooting lately...this message is for you. If I remember right the RPC subsystem is what shuts your computer down when stricken with the Sasser virus correct? There is a way to disable it while still keeping your system up and running long enough to download the patch and to fix stuff. I believe that this is the process, but I can't remember exactly, so somebody check me on this one ok? But I do believe it works.

FOR WINDOWS XP ONLY - I DONT KNOW IF THIS WORKS ON OTHER OPERATING SYSTEMS....

Go to start.

Go to Run.

Type in the Prompt box:
C:\windows\system32\services.msc
That should open up a new screen that displays all the services that your machine runs. It should be in alphabetical order.

Go down to where it says Remote
Procedure....There should be at least 2 that say Remote Procedure "something" ...One should be Remote Procedure CALL and the other should be Remote Procedure (RPC)Locator.

Double click the one that says Remote Procedure (RPC) Call. I believe it is the first one.This should pull up a properties box.

Click on the tab that is labelled "Recovery" and you should be able to see 3 dropdown boxes each with a category....those are labeled: first failure, second failure, and subsequent failures.

for EACH and EVERY dropdown box move the selection from "Restart the Computer." to "Take No Action"

Then click apply. Then click OK.

I believe this should override the RPC reboot phase, therefor giving you time to update and download the patch. Just remember that once you are finished with everything...updating your system to fix the problems...remember to move the selector back to the default option of "Restart the Computer". This is to protect your machine in emergency conditions.

I hope that helps everybody with this....I realize it is really annoying.


-Ryan