XP New Virus????

[Rudi]

Hi,
I am running WinXP Home SP1, and I am experiencing the following
problems.
1)NT\Authority RPC message comes up on bootup with 60 secs to
shutdown.
Overcame this with the "shutdown -a" command.
2)Network Connections is empty.(Running the "net start netman" command
reinvokes the NT\Authority RPC message and 60 sec shutdown starts
again.
3)Start\Search\ For Files or Folders nothing happens no dialogue box
comes up.
4)Administration\Services\Extended Tab is blank. Standard Tab is OK
but right click Properties doesn't work.
5)Copy/Paste doesn't work.
6)System Restore is blank.
I have searched the c:\ and Register for Msblast.exe and ran a week
old copy of
AVG but cannot find any sign of it.
Have run the Msblast and Welchia fixes from symantec,they came up
clean.
Cannot see anything sinister in Processes, Startup, Win.ini or
Sys.ini.
Have run "Sfc /scannow" command ,didn't fix anything.
Installed NAV AFTER the event but NAV is closed about 3 secs after it
is opened. The Autoprotect feature is diabled at startup with a
message saying it is unstable.
I have searched the net and Google Groups but no-one seems to similar
symptoms.
As soon as RPC is mentioned everyone assumes Msblast and maybe it is,
I just can't find any sign of it.
Regards
Rudi

 

[Joseph Conway [MSFT]]

Anything odd looking in the run key for Windows?

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Thats where a lot of viruses will put themselves. I havent seen any new
viruses lately though, maybe its a blaster variant.

 

[Guest]

-----Original Message-----
Hi,
I am running WinXP Home SP1, and I am experiencing the following
problems.
1)NT\Authority RPC message comes up on bootup with 60 secs to
shutdown.
Overcame this with the "shutdown -a" command.
2)Network Connections is empty.(Running the "net start netman" command
reinvokes the NT\Authority RPC message and 60 sec shutdown starts
again.
3)Start\Search\ For Files or Folders nothing happens no dialogue box
comes up.
4)Administration\Services\Extended Tab is blank. Standard Tab is OK
but right click Properties doesn't work.
5)Copy/Paste doesn't work.
6)System Restore is blank.
I have searched the c:\ and Register for Msblast.exe and ran a week
old copy of
AVG but cannot find any sign of it.
Have run the Msblast and Welchia fixes from symantec,they came up
clean.
Cannot see anything sinister in Processes, Startup, Win.ini or
Sys.ini.
Have run "Sfc /scannow" command ,didn't fix anything.
Installed NAV AFTER the event but NAV is closed about 3 secs after it
is opened. The Autoprotect feature is diabled at startup with a
message saying it is unstable.
I have searched the net and Google Groups but no-one seems to similar
symptoms.
As soon as RPC is mentioned everyone assumes Msblast and maybe it is,
I just can't find any sign of it.
Regards
Rudi
.
Try installing zone alarm firewall (free) this cured my

nt/ shutdown problem

 

[Sophie]

YES

nt/ shutdown problem

 

[Rudi]

Anything odd looking in the run key for Windows?

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Thats where a lot of viruses will put themselves. I havent seen any new
viruses lately though, maybe its a blaster variant.

--
Joseph W. Conway, MCSE
Windows 9x/NT/2000/XP/2003 Server Group

This posting is provided "AS IS" with no warranties, and confers no rights.

Joseph
The following are listed under the "run" key
(Default)
Cmaudio
EssSpkPhone
NAV DefAlert
NeroCheck
NPS Event Scheduler
NvCplDaemon
nwiz
Windows Backup configuration

Doesn't seem to be anything strange here.
Do you think a reformat and clean install is the answer (or easy way out).
I hate not knowing what the problem was.
Regards
Rudi.

 

[Rudi]

YES

Hi all,
Worked out the computer had been hacked using the same vulnerability
on XP
that msblast uses.
If, on a good machine, you "end process" on all instances of svchost
you get the same NT//authority RPC warning with 60 sec shutdown.
Hooked up hard drive to another computer as secondary slave and saved
Documents
and Settings. Then,
Re-installed XP, setup dialup connection, firewalled, installed
NSW2003,updated
NSW2003,Activated XP all in 45mins. 2.4GHZ PentIV CPU with 256MB Ram.
Not too bad i thought.
Thanks for your help
Regards
Rudi.