Interestingly, we have clear examples of boxes which were not infected but on
which RPC services did crash. This may suggest that the worm also takes
advantage of the unrelated RPC DOS vulnerability (2000 and XP) which I believe
MS has still not patched.
John
I've seen similar behavior. I patch immediately and religiously, and on
two of my patched boxes I've seen unusual svchost crashes yesterday and
today. But no infection, knock on wood.
Bob German
Sr Systems Engineer
Irides, LLC
Forwarded from isp-tech:
Those of you having the issues of restarts, do the following:
Go to Control Panel, then Administrative Tools, then Services. Under
Services find the Remote Procedure Call option, and right click then go to
Properties.
Under Properties, go to the Recovery Tab, and you'll see the "At first
failure..." "At Second Failure..." issue. Change those to "Take No Action"
or "Restart The Service" instead of the the default "Reboot the Computer"
option, and you should be able to stay on for the patch.