Why does the error message Remote Procedure Call (RPC) Service is ended abnormally appear and the computer restarts or shutdown for Windows® XP and Windows® 2000 Operating Systems?

The computer starts to behave abnormally after receiving the following error messages:
(The error messages may differ depending on the conditions.)

Err Msg:
For Windows® XP Home and Windows® XP Professional Editions
* Generic Host Process for Win32 Services . Due to problem occurs, Generic Host Process for Win32 Services is closed. Sorry for your inconveniences.
* Remote Procedure Call (RPC) Service is ended abnormally. You need to reboot your computer.

For Windows® 2000 Professional Edition
* Due to an error, closing scvhost.exe

This symptom is caused by the exploitation of Microsoft Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) Interface Buffer Overrun Vulnerability.

To resolve this symptom, W32.Blaster.Worm or W32/Lovsan.worm must be removed and Blaster Worm: Critical Security Patch has to be installed.

1. Execute the removal of this worm.
For more information on how to remove this worm, please visit the respective website for the removal instructions.
Mcafee
Trend Micro
Symantec
CERT® Advisory

2. Download the respective Blaster Worm: Critical Security Patch.
Windows® 2000
Windows® XP

3. Disconnect from any network connections.

4. Execute the respective patch file and follow the instructions displayed for patch installation.

5. Restart the computer.

For more information, please refer to the following Microsoft article.
Article ID: 823980
Title: MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution.
Last reviewed: 29th July 2003