RPC Exploit or Virus ?

  • Thread starter Thread starter Robertus
  • Start date Start date
R

Robertus

My friend's win2k adv server has the following problems :

a. RPC services cannot be started / stopped
( start, stop, resume, pause, restart
buttons are greys )
b. when rpc services properties is clicked,
the pop-up property windows doesn't open.
c. When I try to close the services console,
it always pops up a message saying,

Title "Micorosft Management Console"
"Close all property pages before closing Services."

but I do not see any property pages.

d. Cannnot Paste after copy, because the
paste button is grayed (inactive)
e. besides rpc services property windows, all
others property windows do not appear also
f. I have use the latest antivirus from symantec,
mcafee, AVG, and others, but they do not
detect anything.

This just happened within these past few days.

Anybody has ever experience this before?

Any suggestions / help would be greatly
appreciated.


TIA

Robertus
 
I have not personally experienced that but I would check Event Viewer for any
clues as to what is going on - failed services, etc. You say latest anti virus. I
assume you have updated virus definitions as of today. Try running netdiag on it to
see what it reports and dcdiag if it is a domain controller. Run Security
Configuration and Analysis Tool against setup security .inf template to see what it
finds and you may want to configure to match setup security.inf template if nothing
else helps . Two other things that may help are to run System File Checker -sfc
/scannow and/or reapply the last service pack. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;222471
http://www.lokbox.net/SecureXP/secAnalysis.asp
 
Open Taskmanager and look for the msblast.exe- or mspatch.exe-proces. Kill
it and go to www.sophos.com to get the removaltool. After that install
ms03-026 from microsoft to prevent from happening again.

Marina
 
Back
Top