lsass 128 rpc probs!!!

[Nick]

Alrite,

I think I have a worm on a computer. I am getting the pop-
up that says that Remote Procedure Call has terminated
unexpectedly and was authorised by NT blah,blah,blah...

This usually happens when u have a worm, but the thing
that is confusing me is that it is not happening when
online, it is doing it offline!!! Also, when that RPC pop-
up pops up the usual countdown from 60 to turn off the
computer occurs and it says something about lsass and 128
(think it said port 128).

I thought it was Sasser, but I have run the Symantec
removal tool for Sasser and Blaster with no luck.

Does anyone know what worm it is, or is it a new one.

Thanks

Nick

 

[Steven L Umbach]

Hard to say exactly what it is, but you should run a full virus scan with
the latest virus definitions. You can try "shutdown -a" in the run box after
logging on which hopefully will give you more time or using Task Manager to
find the process and end it. You may also want to try the free Stinger tool
from McAfee. Be sure to read the second link on steps to secure your
computer to reduce chances of a future infection and make sure you configure
your virus protection to scan all your emails. --- Steve

http://vil.nai.com/vil/stinger/
http://www.microsoft.com/security/protect/