Expert: James Filmer - 2/13/2011

Question
QUESTION: I'm using Windows XP Professional with Symantec Endpoint Protection.  

I'm suddenly getting this error message from Symantec: MSRPC Server Service BO detected", every 10 minutes or so.  

Recent changes:  I used my computer for 2 years on a wireless router with no problems. I moved recently and for a few weeks returned to the home with the router to use my laptop to go online, but my laptop was unable to access the internet most of the time.  I got a caution from Symantec that my virus definitions were out of date, so I updated.  As soon as I got internet hooked up in the new place, I started getting these Symantec alerts.  I ran a full scan and Symantec found only tracking cookies, which it deleted.  Windows and Firefox are fully updated. The only advice I can find at Symantec is to "download vendor patches that address this issue".  Hoping you can help me -- those little balloons every 10 minutes is annoying!

ANSWER: Hi Shannon,

Check this post: http://www.symantec.com/connect/forums/sid-23179-msrpc-server-service-bo-detecte

If you've already read this post (and tried everything), let me know.

James



---------- FOLLOW-UP ----------

QUESTION: Yes, I had read that but it seemed to deal with networks with multiple computers.  The IP addresses that are being blocked are not mine and are different each time.  I notice they mention downloading a particular Windows security patch.  Is this something I have to do in addition to the regular Windows updates?  (I have Windows, Symantec, and Firefox all set to automatic updates.)  Frankly, I don't understand a great deal of what they say in the forum, and am not sure how much of it applies to a single computer.

ANSWER: http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?a
has a reference link at the bottom with a link to:

http://www.securityfocus.com/bid/31874/solution

The problem is, it's an issue with Symantec only. You may need to contact them directly. However, it appears you do need to install a Microsoft patch.

Find your system link, download to desktop, install.

You may also wish to check Windows updates again. Open IE, go to Updates and click "Custom", to see was else is available. It may already be available, but not considered critical.
If not there, OK, but, it you see Root certificates Updates, download, install -  and consider anything else there you might want (sometimes there are system Driver updates).

Let me know.


---------- FOLLOW-UP ----------

QUESTION: Hi James,

Thanks for your reply.  It seems I may have inadvertently solved my problem.  When I came home from work last night, Windows had installed a security update and restarted my computer. The update didn't help, but since my computer had restarted, I noticed it had automatically connected to my neighbors wi-fi network.  In the process of trying to figure out how to tell my computer not to do that, I discovered that my Windows firewall was not enabled.  I enabled that, and also deleted the address of my neighbors wi-fi along with a bunch of other miscellaneous ones left over from hotels I've stayed in.  I don't know whether it was the Windows firewall or stopping the connection to wi-fi (I'm on a LAN), but the messages have disappeared.  I'm still going to install the security patch you pointed me to, just to be safe, but I think I'm in the clear now.  

Now, if you could just help me to fix the motion sensor light outside my front door, I could stop banging my head against the wall for awhile!  

Thanks again,
Shannon

Answer
HI Shannon,

That's great news! Sounds like problem might have been related to Windows Firewall. Not sure what removing the wi-fi connections has anything to do with it, but that's possible too.

I'm a little concerned about enabling the Firewall though.

According to Symantec, your protection is part of a suite (is it?), that includes a Firewall.
(Antivirus, antispyware, firewall, intrusion prevention, device and application control).

If so, Windows Firewall is usually automatically disabled, when another Firewall is enabled -  otherwise conflict, and can create system and Internet connection instabilities.

Let me know how things are working when you get the chance.

James