rpcdoom virus
Results 1 to 9 of 9

Thread: rpcdoom virus

  1. #1
    Junior Member
    Join Date
    Apr 2004
    Posts
    1

    Exclamation rpcdoom virus

    this is my first time on ao, whenever i log on to the net, i get a windows text box appear that says i have the rpc doom virus??? have done a norton scan in safe mode and found nothing. I am running windows 2000 xp and habve also got system mechanic4 proffesional. Any help that you can offer would be fantastic, oh and my computer is also getting slower and slower

  2. #2
    try housecall.trendmicro.com, and update your NAV. I'm not familiar with the virus, but give adaware and spybot a shot. Could be a prank prog? Maybe post a hijack this log so we can see more about your computers processes and startup, but don't do anything with it just yet.

  3. #3
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    you might post a screen shot and make it easy!
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  4. #4
    If ur really amateur.Get a small program called hijack this and take a shot of ur pc and post the log here.The processes running and other info might help us to get u outta trouble

  5. #5
    This sound a lot like ms blaster. I know that the virus is still flying around because I had my laptop (un-protected as it was) at a hotspot and got infected.

    I remember the virus caused the rpc (remote procesure call) service to terminate, thus forcing the user to re-boot their pc.

    Press ctrl+****+exc to open the windows task manager, or press ctrl+alt+del and select "task manager" from the menu. Then check the processes tab for msblast.exe. If you find it, select it and press the "end task" button. Now, go into c:\winnt\system32 and find msblast.exe, delete the file. Finally, open regedit and navigate to
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run
    MSblast will be in this list. Check the data field for c:\winnt\system32\msblast.exe. Delete the registry key.
    This would be the best time to update your copy of windows. then reboot your system and open the task manager again. msblast should no longer be running under the processes tab.

    hope this is right

    EDIT: Ok wait... are you running XP or 2k? you are saying windows 2000 xp... if it is XP then rather than looking in c:\winnt\system32 it would be in c:\windows\system32
    You are so bored that you are reading my signature?

  6. #6
    Senior Member
    Join Date
    Feb 2002
    Posts
    253
    I don't think that is a virus/worm.
    Wonder if Spybot S&D will solve the problem ?

  7. #7
    Flash M0nkey
    Join Date
    Sep 2001
    Posts
    3,447
    its a browser hijack

    There was a baloon on the left containing ?.
    The title bar had an X button on the right to exit. The text of the message was

    Virus Warning!!!
    RPC Doom Virus Detected!
    CLICK on OK
    to Disinfect Now

    Below that were two buttons: OK and Cancel
    taken from here

    its just firing up a pop-up to try and get you to download more stuff prolly.

    this link may help LINK

    most places say that SpyBot S&D should be enough to remove it

    thanks

    v_Ln

  8. #8
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,786
    without knowing what he means by a "text box" you could run all the anti-hijacking software around and it might just be windows messanger service left running. i also think its adware but wouldn't a picture be so much easier?
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  9. #9
    Leftie Linux Lover the_JinX's Avatar
    Join Date
    Nov 2001
    Location
    Beverwijk Netherlands
    Posts
    2,535
    yup a picture tells a thousand words..

    And I would like to see what "windows 2000 xp" looks like

    I can't think of any solutions not presented above.. but would still love to see the screenshot..
    ASCII stupid question, get a stupid ANSI.
    When in Russia, pet a PETSCII.

    Get your ass over to SLAYRadio the best station for C64 Remixes !

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides