Term.exe and RPC?

[RobK]

Hello
My AntiVirus(Symantec) found on Win2000 serv(domain controller) a virus
called: Backdoor in a file term.exe situated in System32 directory.
Term.exe is running as a service and can't end this process.
My question is: What it is a file: term.exe (because on other servers
Win2000 there is no this file) ?
Can I delete it (in safe mode for example)?

Has it something in common with problem with replicating between two domain
controllers. When i try to click on 'Replicate now'
i have a message: Can't replicate because RPC server is busy.
What to do with this?

Regards
RobK (Poland)

 

[Richard McCall [MSFT]]

I would terminate the term.exe and then go into
HKLM\System\Currentcontrolset\service and look for a ervice called term it
should reference the term.exe. If you delete the whole term key this will
remove the service entry that starts it. Then you can remove the fill after
a reboot. The RPC error could be related to getting this virus