rpcdoom virus

[wallaby1]

this is my first time on ao, whenever i log on to the net, i get a windows text box appear that says i have the rpc doom virus??? have done a norton scan in safe mode and found nothing. I am running windows 2000 xp and habve also got system mechanic4 proffesional. Any help that you can offer would be fantastic, oh and my computer is also getting slower and slower

[Soda_Popinsky]

try housecall.trendmicro.com, and update your NAV. I'm not familiar with the virus, but give adaware and spybot a shot. Could be a prank prog? Maybe post a hijack this log so we can see more about your computers processes and startup, but don't do anything with it just yet.

[Tedob1]

you might post a screen shot and make it easy!

[gizmofreak]

If ur really amateur.Get a small program called hijack this and take a shot of ur pc and post the log here.The processes running and other info might help us to get u outta trouble

[annihilator_god]

This sound a lot like ms blaster. I know that the virus is still flying around because I had my laptop (un-protected as it was) at a hotspot and got infected.

I remember the virus caused the rpc (remote procesure call) service to terminate, thus forcing the user to re-boot their pc.

Press ctrl+****+exc to open the windows task manager, or press ctrl+alt+del and select "task manager" from the menu. Then check the processes tab for msblast.exe. If you find it, select it and press the "end task" button. Now, go into c:\winnt\system32 and find msblast.exe, delete the file. Finally, open regedit and navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run
MSblast will be in this list. Check the data field for c:\winnt\system32\msblast.exe. Delete the registry key.
This would be the best time to update your copy of windows. then reboot your system and open the task manager again. msblast should no longer be running under the processes tab.

hope this is right

EDIT: Ok wait... are you running XP or 2k? you are saying windows 2000 xp... if it is XP then rather than looking in c:\winnt\system32 it would be in c:\windows\system32

[bucket]

I don't think that is a virus/worm.
Wonder if Spybot S&D will solve the problem ?

[valhallen]

its a browser hijack

There was a baloon on the left containing ?.
The title bar had an X button on the right to exit. The text of the message was

Virus Warning!!!
RPC Doom Virus Detected!
CLICK on OK
to Disinfect Now

Below that were two buttons: OK and Cancel

taken from here

its just firing up a pop-up to try and get you to download more stuff prolly.

this link may help LINK

most places say that SpyBot S&D should be enough to remove it

thanks

v_Ln

[Tedob1]

without knowing what he means by a "text box" you could run all the anti-hijacking software around and it might just be windows messanger service left running. i also think its adware but wouldn't a picture be so much easier?

[the_JinX]

yup a picture tells a thousand words..

And I would like to see what "windows 2000 xp" looks like

I can't think of any solutions not presented above.. but would still love to see the screenshot..