Nachi worm(?)

[Karl]

I've encountered a big problem with a friend's machine
which may have been infected with the Blaster/Nachi worm.
It was definitely infected with the Blaster worm when it
was first spread (on a pirated copy of XP), so I enacted
the firewall and removed the worm's files. Around this
past January it started to periodically act up with the
same old RPC error and automatic shutdown, and eventually
the machine got unusable. I had her buy a copy of XP and
do a legitimate install so she could have the patches,
but the problem still persists. Has anyone else
encountered this problem? I'm pretty stumped.

Also, I don't know if this is related, but the registry
editor automatically closes a few moments after I open
it. Has anyone seen this?

Thanks for your help!

Karl

 

[Taurarian]

The regedit closing soon after opening definitely sounds
like a virus infection. Suggest you run an online scan
either from Symantec or one of the other anti virus sites.
If you need to edit using regedit, rename it regedit.com
or go here
http://www.dougknox.com/xp/utils/xp_emerutils.htm

Good luck on getting rid of the virus/viruses.

 

[Taurarian]

Just to add:

Virus Alert About the Nachi Worm
http://support.microsoft.com/default.aspx?kbid=826234
Courtesy of Carey Frisch
Microsoft MVP