I'm gettin hit like crazy...

[yehti6969]

Every nite (seems to be mainly in the evenings) I've been getting pop up window from my antivirus stating it just blocked an attempt on my pc. The nasty thats hittin me is... MS_RPC_DCOM_BUFFER_Overflow My antivirus seems to be catching it effectively, but this happens every night at least a dozen times and it's gettin frustrating. I copied down IP address and contacted my internet provider, but I dont know if they can do anything about it. What is this thing, is there anything I can do to lessen the attacks, or should I be worried? I'm lost here and I feel I've run out of options...

 

[Spike]

This tool should help by disabling DCOM. Most people have no use for it, and if it's not there, it can't be exploited.

http://www.grc.com/dcom/

You can also run a WHOIS on the IP adress to find information about it.

Please note that this post is more suitable for the WindowsOS or Misc. Software forums

 

[yehti6969]

just as I thought...

I ran the IP address through the site you sent me, and as i thought, it came back stating it originated from my IP.....any suggestions?

 

[yehti6969]

and.....

I downloaded that tool you sent me (haven't run it yet) I noticed it said something tp the effect that if you have downloaded service pack 2, you won't have this problem. I have downloaded service pack 2, but I'm still gettin hit. Maybe I'm not understanding something....I'm not too computer savy......

 

[RealBlackStuff]

Downloading alone is not enough, you also need to INSTALL SP2....

 

[Masque]

Downloading alone is not enough, you also need to INSTALL SP2....

:haha:

Sorry....some days his humour seems to hit home.

 

[yehti6969]

reply to realblackstuff...

Maybe I'm missin something, I've allready installed service pack 2 several months ago, I double checked under add/remove programs, it's there. I still havent run DCOMBOB program yet (got someone who wants to check it out first) Last nite i got hit with a new one... MS RDC LSASS DS Request (TPC). What are these things, worms? trojans?

 

[Spike]

It does sound like two different worms trying to find theiir way on to your macjine, but rest assured - if you're seeing these essages, then you're not getting the worms.

I can assure you that the DCOMBOB program is perfectly safe, and 'does exactly what it says on the tin', and no more. I've used it myself, and it was actually recommended to me a long time back by one of the more experienced members here on Techspot (I just can't remember which!)

 

[yehti6969]

back at ya spike...

I'm confused, I opened that DCOMBOB tool and started to read, says if I have service pack 2, I am not vunerable. I have service pack 2 yet I'm still gettin hit nightly. I went to add/remove programs and I see Windows XP service pack 2. If I click on it, it asks me if I wanna remove it, I'm thinkin if it's askin me if I wanna remove it, it must allready be in there. I downloaded service pack 2 quite awhile ago, so I'm not sure whats goin on. I appreciate the info, and sorry, I'm a little slow at this and am not very computer savy.... Any sugestions? Don't quite understand if it says Windows XP service pack 2 is not vunerable, and I have service pack 2, why I'm still gettin hit?

 

[Mictlantecuhtli]

If your computer is not on a network where you want to share your files and/or printers with others (or vice versa), you could disable services related to sharing, making the machine less vulnerable.

So, run services.msc and stop & disable the following:

Computer Browser
Server
TCP/IP NetBIOS Helper
Workstation

If your firewall / antivirus service can deal with (ie. block) such attacks, can't you set it not to nag about them all the time?

You're still getting hit because there are other computers in the Internet. (well, I know it's a generalization)