Test Note: Disable and enable the RPC service

Recently, RPC vulnerabilities have become increasingly severe, such as the "Shock Wave" worm and its variants. WindowsNT/2000/XP/2003 users are under attack, blue screen, restart, clipboard error, automatic shutdown, and so on are common. Currently, solution 1: Install Microsoft official patch; 2: Use network firewall or TCP/IP filter, screen closed ports such as TCP135, 4444, and UDP69; 3: Disable the RPC service. We recommend that you use both solutions 1 and 2. The 3rd methods are the most thorough but not desirable.

Today, because of testing and disabling the RPC service. worm infection, but this article mainly refers to the problem of disabling the RPC service on a Windows 2000 Server and recovery: disabling RPC-management tools-services-Remote Procedure Call, the default startup category is automatic. You can use the attributes to modify the Startup type. In addition, we can find many other services that depend on Remote Procedure Call from the dependency relationship.

After the RPC service is disabled, an error is reported in the system logs after the system is restarted. You cannot view the properties of the event, close the Event Viewer, and prompt to close all property pages, but you cannot see the page... after you finish the task, start to restore the RPC service. If you are dizzy, you cannot restore the property from the property. (You cannot open the property page.) try other restoration methods, such as security mode and CMD, the Registry is not backed up. It is really troublesome. I had to open the registry. It took N minutes to find "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRpcSs ", after the value of "Start" is changed from 0x00000004 to 0x00000002, restart the computer. OK, everything is back to normal.

The test result is that no worm infection is detected in the system after the RPC service is disabled.

Reference: Buffer Overflow in RPC interfaces may allow code execution (823980) asp "> http://www.microsoft.com/china/technet/security/bulletin/MS03-026.asp
Reference: symantec w32.blster. Worm Virus data vcenter/venc/data/w32.blaster.worm.html "> http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html