Virus Removal

[Guest]

I have Winodws One Crae and thought I was covered... but I kept getting
Firewall alerts aboout a program that was wanting to access the internet, but
the Firewall blocked it. I would select "keep blocking'.. the dialog box
would appear again 30 seconds later... and would continue doing so, every 30
seconds, forever.

I went to safety.live and ran the scan... it found a virus
Exploit:Win32/RpcDcom.gen

I removed the virus and the messages stopped.. until I restarted.. and now
they are back... and upon scanning again, I find the same virus again. It
has re-installed itself.

Any ideas on how I can get it permanently removed?.... and why didn't the
virus scan on OneCare find it?

 

[Malke]

I have Winodws One Crae and thought I was covered... but I kept getting
Firewall alerts aboout a program that was wanting to access the internet,
but
the Firewall blocked it. I would select "keep blocking'.. the dialog box
would appear again 30 seconds later... and would continue doing so, every
30 seconds, forever.

I went to safety.live and ran the scan... it found a virus
Exploit:Win32/RpcDcom.gen

I removed the virus and the messages stopped.. until I restarted.. and now
they are back... and upon scanning again, I find the same virus again. It
has re-installed itself.

Any ideas on how I can get it permanently removed?.... and why didn't the
virus scan on OneCare find it?

OneCare ranks pretty low in antivirus solutions. Use a better antivirus such
as Kaspersky, NOD32, or even AVG or Avast. I use F-Prot on my Windows
machines.

Do the preparatory work here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Then run either Sysclean or Multi_AV and Ewido (links at the page above).
Finish up with the rest of the malware removal steps, including the
end-work. Then get a decent av.

Malke

 

[David H. Lipman]

From: "FrogDoc" <[email protected]>

| I have Winodws One Crae and thought I was covered... but I kept getting
| Firewall alerts aboout a program that was wanting to access the internet, but
| the Firewall blocked it. I would select "keep blocking'.. the dialog box
| would appear again 30 seconds later... and would continue doing so, every 30
| seconds, forever.
|
| I went to safety.live and ran the scan... it found a virus
| Exploit:Win32/RpcDcom.gen
|
| I removed the virus and the messages stopped.. until I restarted.. and now
| they are back... and upon scanning again, I find the same virus again. It
| has re-installed itself.
|
| Any ideas on how I can get it permanently removed?.... and why didn't the
| virus scan on OneCare find it?

Get a second opinion....


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *