rpc shutdown (MSBLAST) behaviour I haven't seen before, please help

G

greenzy

Hello all,

I have dealt with the blaster worm virus and it's variants several times
recently on friends computers etc. and have been able to remove it without
too much difficulty.

However the computer I am currently working on is perplexing me.

on startup get the following error which continues to pop-up
intermittently:
"Microsoft Visual C++ runtime library runtime error" in
c:\windows\system32\svchost.exe

I then get the rpc shutdown screen associated with the blaster worm that
counts down till the pc shuts down, the odd thing is that I get this whether
the pc is connected to the network or not.

If I use shutdown -a it keeps the pc from shutting down but only for a
minute or so, the start menu doesn't load and I cannot move files, view
properties or change settings, all I can really do is use the run box to run
programs

If I attempt to patch the computer I get the runtime error mentioned above
and the installer hangs.
If I run a blaster removal tool (I have tried several) it scans the computer
(for which I have to sit there to constantly shutdown the "rpc countdown
screen", fun on a 120GB HD) and reports that it found no virus

safe mode gives the same results

I mounted the HD on another pc and scanned it, it found several copies of
the "chemserv" virus and deleted them along with a trojan. I then put the HD
back in the original pc, booted it and am observing the exact same behavior

So basically I am completely unable to find a way to patch this or even
determine what is wrong at this point

While I am getting the rpc countdown screen, which I associate with blaster,
the other problems I am seeing are not ones I have run into when dealing
with blaster before

Any help very greatly appreciated

Jim Greenz
 
G

greenzy

I would like top be able to do that, but I am unable to do any basic windows
tasks such as copying files by dragging them or viewing properties windows,
hence I am unable to view or change the rpc service settings, anyone know
how to do this frim the command line?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top