Hi All,
In order to recover from a RALEKA.B worm, couple of days ago when I connected to internet, I disabled RPC Services and RPC Locator Services from Services MMC Console. When I was doing it, "Remote Procedure Call (RPC)" window mentioned that a group of dependent services will also be disabled.
Not knowing that RPC is a very essential service for Windows to function normally, I said Yes. I had problems restarting from that point on. However, I was able to tweak the registry settings for the "Remote Procedure Call (RPC)" and "Remote Procedure Call (RPC) Locator" and made sure they are set to Automatic and Manual respectively.

I am able to start "Remote Procedure Call (RPC) Locator" service from Services window. But when I try to start "Remote Procedure Call (RPC)", it complains :

"Could not start the Remote Procedure Call (RPC) Service on the local computer. Error 1058: The Service cannot be started, either because it is disabled or because it has no enabled devices associated with it."

When I try starting other services which are dependent on RPC, obviously, they would not start either. They say "Error 1068: The dependency service or group failed to start."

Everytime I start the machine (Laptop), after windows load up, it gives me "System error &H800706BA (-2147023174). The RPC Server is unavailable."

How can I come out this mess? What do I have to do to restore all my services normally, as I had before? I cannot connect to Internet, cannot browse files.

Please Help.

P.S. From all this, I learnt one basic rule: "NEVER DISABLE RPC SERVICES".

Srikanth

I got this from the ExpertsExchange forum:

Copy and paste the following into Notepad save the file and make the file extension .reg. Then go to where you saved it and then double click on it this should get the RPC place back into the registry and should hopefully get your RPC back.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs]
"Description"="Provides the endpoint mapper and other miscellaneous RPC services."
"DisplayName"="Remote Procedure Call (RPC)"
"ErrorControl"=dword:00000001
"Group"="COM Infrastructure"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,20,00,2d,00,6b,00,20,00,72,00,70,00,\
63,00,73,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\
00,02,00,00,00,60,ea,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Security]
"Security"=hex:01,00,14,80,a8,00,00,00,b4,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,78,00,05,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,18,00,8d,00,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,\
02,00,00,00,00,14,00,9d,00,00,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,\
18,00,9d,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,00,\
00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs\Enum]
"0"="Root\\LEGACY_RPCSS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Worth a try but I would back up my registry first if I were you.

Sorry, i thought everyone knew that they should back it up before doing any major changes.

When you used MMC console did you save the MMC file? If you did, and in that MMC console you clicked on it to disable RPC, it may be disabling it over the top of the normal computer management. I use the feature all the time to set up a fast internet firewall while using the web. Try this Start/Run type mmc and then enter, click the top CONSOLE and see if you saved a separate console. If you did just click on Add/Remove snap in then highlight the snap in and remove it.
You should be able to start and stop services easily through the standard MMC. If you cannot, its likly that either you have another MMC loading and running or you have goofed up your registry. If you do not know what your doing stay out of the registry, as a general rule.

Thanks for your replies.

I will try the registry option mentioned today. Thanks everybody. Specially Nemus.

My system blue screened then after a slow boot-up I was in the GUI with a non-responsive start-bar, no audio, no networking. Just a couple 3rd party services loaded. I tried to start the usual ones and it failed. I couldn't get to the properties windows to check out more because no property windows would open on the system except for file/folder properties.

The base essential processes were loaded(csrss,smss,services.exe...) sans the usual collection of svchost.exe's.

I hopped into the cmd shell and checked for malware and ran across a nasty in my root and a collection of .exe files in my internet cache mascarading as .txt's and other types. I removed them all then rebooted and still nothing. I hopped into the registry and looked for odd services and found a few non-standard ones then deleted them then checked out my devices and found a malware hidden there so I deleted it too. Rebooted, still nothing...

I scanned all the .exes in the system folder looking for the system file checker and couldn't find it so I skipped that.

So I went back into the registry and deleted rpcss, more services; removed more drivers and still nothing worked.

I checked the file dates/sizes of svchost.exe, explorer.exe and a collection of other files that were under my magnifying glass and the dates were all fine but I had some bloated sizes so I hopped into my dllcache folder and used the copies there to overwrite the other ones. Still not working. I manually tried launching rpcss using net.exe and it failed so I tried launching it using svchost.exe and still nothing. I used one of my other systems to google this prob and nothing good was coming up but I found my system file checker (sfc.exe duh)

I set it to run on reboot and then rebooted and while it was scanning I opened compmgmt.msc and created a new user but couldn't open the properties to set it up so I hopped into my i386 folder and expanded the explorer.ex_ and svchost.ex_ and copied them over the existing copies. I then tried to start rpcss using net.exe and svchost.exe again (net start rpcss, svchost -k rpcss). When I looked at my other monitor at the task manager svchost was there! I then opened services.msc and turned on dns, dhcp, network connections and zero wireless and now here I sit I haven't rebooted yet but it working now and thats good enough for me.

These are the last things I did before it started to work:

1) Logged in, opened taskmgr (ctrl+alt+del)
2) Shelled to cmd and run (File menu, run, type cmd, clicked ok)
sfc /purgecache (type it and press enter)
sfc /scanonce (type it and press enter)
3) Reboot (Thru shutdown menu in taskmgr. You can also type shutdown -r)
4) Logged in, opened taskmgr
5) Opened cmpmgmt.msc (File menu, run, type cmd, clicked ok)
6) Opened Local Users and Groups, right clicked Users, chose create a new user...
7) Shelled to cmd and did these
cd c:\i386 (I can't find my xp install cd)
expand explorer.ex_ explorer.exe
copy explorer.exe %systemroot% /y
expand svchost.ex_ svchost.exe
copy svchost.exe %systemroot%\system32 /y
net start rpcss
svchost -k rcpss
start services.msc
8) Turned on dns, dhcp, network connections and zero wireless.

I hope this recipe for repairing it works for other ppl with the same problem.

Jeck Lamnent

SK V, have you figured out your problem yet? If not tell me and I'll help you.

I ran some of Jeck Lamnent items.. thanks Jeck!

Booted into windows
Opened DOS prompt
Via DOS, copied Explorer & SVChost from another xp pc, to a temp folder
Using Task Manager stopped the Explorer & SVChost processes
quickly copy the 2 files to the appropriate windows folders, using DOS to perform copy.
system auto rebooted


After reboot, issue still not resolved.

ran these via DOS...

sfc /purgecache
sfc /scanonce (system needs reboot to run)


I then ran this via DOS...

secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose


Issue resolved!! Not sure if all the above had a role in fixing the issue?!?!
I also reapplied the service pack.