Re: RPC shutdown (not msblast)

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 02/01/05 

Date: Tue, 1 Feb 2005 12:05:25 -0500

Suggestions:

#1)

Obtain McAfee's virus and worm removal tool, Stinger: http://vil.nai.com/vil/stinger/

1) Disable System Restore
            http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Reboot the infected PC into Safe Mode
3) Using Stinger, perform a Full Scan of your platform and clean/delete any
            infectors found
4) Restart the infected PC and perform a "final" Full Scan of your platform
5) Re-enable System Restore and re-apply any System Restore preferences,
            (e.g. HD space to use suggested 400 ~ 600MB),
6) Reboot the infected PC.
7) Create a new Restore point

* * * Please report back your results * * *

#2)

Since you indicated that this was caused by installing Adobe Acrobat Reader v7.0, I suggest
creating an account and posting this to Adobe's private News Server.

The following URL will take your default News Reader to the Adobe.Reader News Group on the
Adobe News server.

news://adobeforums.com/adobe.reader

The following URL will help you create an Adobe account since posting requires
authentication. Choose Register.

http://www.adobeforums.com/

The following is the Adobe Forums FAQ.

http://www.adobeforums.com/images/forumfaq.html 

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
-- 
Dave
"Brian J. Burnett" <brianjburnett@UKNOWWHATTODOWITHTHISbtinternet.com> wrote in message
news:ezp4K5GCFHA.3336@TK2MSFTNGP11.phx.gbl...
| Yesterday my daughter installed Microsoft AntiSpyware and at the same time
| updated to Acrobat Reader 7 on her dell laptop which runs XP2 pro SP2 on our
| W2k3 SBS2003, ISA2004 served home network.
|
| Her machine then went into a reboot cycle caused by the RPC process
| termianting.
|
| I've managed to gain some level of control over her PC by booting in safe
| mode however there is not much I can run that does not try to start the RPC
| process which then causes the auto reboot.
|
| Her Norton AV and all Windows Update were up to date.
|
| I've not found any trace of msblast or the other viruses that effect RPC as
| described on the symatec and MS KBs, including running the virus removal
| tools on the effeted PC.  So far I have not been able to run Norton since
| this occured as Norton says it does not run in safe mode.
|
| One observation.  The PC is really slow to boot.  Takes about 10 minutes
| even in Safe mode.  When it does boot there is no drag and drop or property
| sheets (e.g. I can't get in to the properties of the RPC service to change
| the recovery actions!).
|
| I'm really stuck.
|
| Help much appreciated.
|
|