I Think I Might Have a Virus. Any Ideas on what it is?

Printable View

Aug 5th, 2003, 10:24 AM
VBD

I Think I Might Have a Virus. Any Ideas on what it is?

Well, I was viewing the website "Computer Stupidities", and suddenly a little box came up that said: "The RPC Service has exited. your machine will reboot in 60 seconds", Then the seconds part counts down and restarts my computer at zero. So, the second time, and third time i'm viewing this website, it does that. I know the reboot part is part of Windows XP, but the RPC Service Exiting could be a virus. Next, After about 3 of these reboots, and I stop using that website. The reboots stop. Then, on start up, it says: "Windows does not know what program to load TFTP98 with". I never installed anything new, so I have no idea how that even got there. I disable it with MSConfig, reboot, and when the computer starts up again, TFTP98 tries to load again. This time, I try to run msconfig. As sxoon as msconfig comes up, it dissapears as if somethihng is trying to shut it down. The same with Ctrl+Alt+Delete, or any other file that controls proccesses. I tried Avast 32(my virus scanner) and it didn't pick up anything. Does anybody have any idea what could be wrong and how to fix it?
Aug 5th, 2003, 10:50 AM
DiGiTaIErRoR

There was a bug in IE and RPC that let a malicious webpage or even a remote user get Admin privleges on your box.

I'd go get the windows updates.

Then scan your start-ups for trojans.
Aug 5th, 2003, 10:51 AM
DiGiTaIErRoR

Check out this thread:

http://www.vbforums.com/showthread.p...hreadid=255977

Another user had a similar problem.

Near the bottom is a list of start-up locations.
Aug 5th, 2003, 11:46 AM
VBD

Thanx

I'll check it out.
Aug 5th, 2003, 11:53 AM
VBD

Closes Regedit.exe when I try to run that too./

I'm gonna test out safe mode...
Aug 15th, 2003, 12:08 AM
Kasracer

Quote:

Originally posted by DiGiTaIErRoR
There was a bug in IE and RPC that let a malicious webpage or even a remote user get Admin privleges on your box.

I'd go get the windows updates.

Then scan your start-ups for trojans.

There is NO BUG in IE that allows this to be done, it is a bug in the RPC service itself.
Aug 15th, 2003, 02:08 AM
DiGiTaIErRoR

Quote:

Originally posted by kasracer
There is NO BUG in IE that allows this to be done, it is a bug in the RPC service itself.

There was a bug, which a patch fixes, which would allow a malicious website to execute code on your machine. There is also an exploit to make you download a file, which then can be executed.
Aug 15th, 2003, 02:25 AM
BodwadUK

You can download a fix from antivirus places :) :) :)
Aug 15th, 2003, 06:49 AM
parksie

The RPC bug is remotely exploitable.
Aug 15th, 2003, 08:46 AM
Kasracer

Quote:

Originally posted by DiGiTaIErRoR
There was a bug, which a patch fixes, which would allow a malicious website to execute code on your machine. There is also an exploit to make you download a file, which then can be executed.

The RPC exploit and anything with IE are NOT related.
Aug 15th, 2003, 10:14 AM
Radames

Sounds like you have the blaster worm friend. Go to
http://www.microsoft.com/technet/tre.../msblaster.asp
Aug 16th, 2003, 06:05 PM
VBD

Yup thats exactly what it was.
Aug 17th, 2003, 02:12 AM
wrack

If you have a good antivirus and firewall then this would have never happened.
Aug 17th, 2003, 07:25 AM
parksie

Even without them, just patching with the patch that was released at least a week in advance would have saved you.
Aug 17th, 2003, 12:51 PM
VBD

Bad Luck

I'd just formatted my PC cause I hadn't since 2001 when I bought it. I got it before I had time to downlaod all the updates. I probably should have download the Virus patches before SP1...
Aug 17th, 2003, 04:04 PM
Kasracer

Quote:

Originally posted by parksie
Even without them, just patching with the patch that was released at least a week in advance would have saved you.

That makes me laugh. A week in advanced? Try 2 months ago. The patch for the RPC exploit was released over 2 months ago