DcomRpc.exploit infection

I am having trouble figuring out how to clean the above
infection from my computer. I was infected with the
Blaster worm which I have successfully removed but my
computer still has the DcomRpc.exploit infection on it.

I think this is also part of the blaster worm but need
your help in removing it!!! PLEASE!

Thanks in advance
Jaime

Pavan
Fri Aug 15 18:30:10 CDT 2003

Hello Jaime,



Here are some of the links for the virus removal tools.



http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

§ http://vil.nai.com/vil/stinger

§ http://www.trendmicro.com/download/tsc.asp





This posting is provided "AS IS" with no warranties, and confers no
rights

Please note I cannot respond to e-mailed questions.
Please use these newsgroups to let me know if the suggestions resolved the
issue.

Pavan





"Jaime" <maljai@optusnet.com.au> wrote in message
news:038901c36383$67ad6bb0$a601280a@phx.gbl...
> I am having trouble figuring out how to clean the above
> infection from my computer. I was infected with the
> Blaster worm which I have successfully removed but my
> computer still has the DcomRpc.exploit infection on it.
>
> I think this is also part of the blaster worm but need
> your help in removing it!!! PLEASE!
>
> Thanks in advance
> Jaime

Jaime
Sat Aug 16 00:56:08 CDT 2003


PS I have since noticed that whenever I shutdown or
reboot my computer, a small window pops up for a split
second. It shows up so quickly that I can't even see what
it is. I think it is similar to the window that popped up
with the MBlast worm but I have no idea.
Jaime

Sandi
Sat Aug 16 04:21:30 CDT 2003

Check out this link Jaime; MVPs have been working on this problem and have
put together advice/scripts to help you get your system cleaned up:
http://www.mvps.org/inetexplorer/darnit_2.htm#rpc

--
Hyperlinks are used to ensure answers remain current.
________________________________________
Sandi Hardmeier - Microsoft MVP since 1999
http://www.mvps.org/inetexplorer

"Jaime" <lilmagic76@hotmail.com> wrote in message
news:011101c363b0$91260dd0$a001280a@phx.gbl...
> Hi Pavan
>
> Thanks for your help...it didn't work though. I went to
> the Symantec link you suggested and used the removal tool
> but afterward it said that no blaster worm was found. My
> problem is that when I do a virus check, my computer says
> that a file in docs and settings
> (allusers\applicationdata\microsoft\Drwatson\user.dmp) is
> infected with DcomRpc.exploit. I dont know how to remove
> this infection. I have already removed the blaster worm
> infection from my computer, but this is what seems to
> be 'leftover'.
>
> Thanks again
> Jaime

Torgeir
Sat Aug 16 19:06:50 CDT 2003

Jaime wrote:

> Thanks for your help...it didn't work though. I went to
> the Symantec link you suggested and used the removal tool
> but afterward it said that no blaster worm was found. My
> problem is that when I do a virus check, my computer says
> that a file in docs and settings
> (allusers\applicationdata\microsoft\Drwatson\user.dmp) is
> infected with DcomRpc.exploit. I dont know how to remove
> this infection. I have already removed the blaster worm
> infection from my computer, but this is what seems to
> be 'leftover'.

Hi

For that file, it's most likely a false hit from your virus scanner. To get rid
of the problem, delete the file (it's only a log file from a previous system
crash anyway), and hold the shift key down while you delete it to avoid just
putting it in the "Recycle Bin".


--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter