What is this virus?

I faced a strange problem. After connecting with internet with my laptop [not connected to any network - plain personal computer], in a few moment, I receive a message saying "Your computer will be shut down in 0:60 min. RPC (Remote Procedure Call) error. Close all applications." And the machine restarts itself. After scanning the drive with AVG Antivirus, I found that VBS/Redlof is present. AVG couldn't heal the virus, but removed the infected file to a different location with renaming it.

However, even after that I faced same problem!! When the closing dialog box appears, I tried to close it from Windows (XP Home) task manager, even though I can see the application, I couldn't kill it.

Is it due to same virus or some other virus??

Please help... :confused:

PS: I also tried to remove any setting from Registry which runs any program automatically eg. HKLM, HKU/ Microsoft/Windows/CurrentVersion/Run, RunOnce etc.

I think it is msblast

http://www.startribune.com/stories/389/4038065.html

It sure is, and your ****ed.

You can download a removal tool here:

http://www.symantec.com/

Stephan

You have been hax0red! :p
Im so glad I am firewalled at home.

Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/tre...n/MS03-026.asp

Which is a good personal firewall? Is ZoneAlarm free good?

Quote:

---

Originally posted by sbasak
I faced a strange problem. After connecting with internet with my laptop [not connected to any network - plain personal computer], in a few moment, I receive a message saying "Your computer will be shut down in 0:60 min. RPC (Remote Procedure Call) error. Close all applications." And the machine restarts itself. After scanning the drive with AVG Antivirus, I found that VBS/Redlof is present. AVG couldn't heal the virus, but removed the infected file to a different location with renaming it.

However, even after that I faced same problem!! When the closing dialog box appears, I tried to close it from Windows (XP Home) task manager, even though I can see the application, I couldn't kill it.

Is it due to same virus or some other virus??

Please help... :confused:

PS: I also tried to remove any setting from Registry which runs any program automatically eg. HKLM, HKU/ Microsoft/Windows/CurrentVersion/Run, RunOnce etc.

---

It's caused by a worm, exploiting the RPC protocol.

If you don't have a window's password(or a simple one), you'll also be vunerable to people getting administrative privleges on your box.

I got this very same problem.
So what is the cure for it? My PC keeps on rebooting after connecting to the internet after every 5 - 10 minutes. I guess its infected, but my Anti-Virus is really really old.

How did you fix your problem?

Cheers!
Abhijit

Start>run Type in "services.msc"

Go down to RPC (The abbreviation will be in parenthasies)

Double click, go to recovery and select take no action in the 3 drop down boxes, hit apply.

Now you can fix it without being shut down.

ALso you can go into command prompt and type in "shutdown -a" which will abort the shutdown.

This exploit has been out for about a year, Microsoft patched it early June but so many people are getting hit, this should be a wakeup call to everyone.... PATCH YOUR OPERATING SYSTEM

Thanks for your help guys. I patched up my PC. Its all okay now.

:) Abhijit