Help???W32.Randex.H worm

[Michaelz]

This worm has the same symptoms as the blaster worm but
instead runs spoolsrv.exe. I have just accidentally ended
a process srv something or other.exe which has terminated
the RPC. Now i cannot load up windows properly and only
in safe mode. Neither system restore or last known good
configuration works.Any help???

 

[neil]

From McAfee website
"When run, the worm creates the following registry key to load itself at
Windows startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"superslut" = msslut32.exe "
found at http://vil.nai.com/vil/content/v_100443.htm
Neil

 

[Bruce Chambers]

Greetings --

Did you follow the simple removal instructions on Symantec's web
site?

W32.Randex.d
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.d.html

Backdoor.Roxy
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.roxy.html


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH