RPC Viruus

[macampbell]

Hi
I have E-trust virus monitor from computer associates running, and its kept my machine fairly clean so far, but now a prblem.
last night I D/L and installed the MS patch for RPC attack, this morning my e-trust is showing me that I have an infection of
DcompRPC.exploit and it is in Dr. Watson folder, yet it gives no option to clean it. Could it be mistaking the patch for the virus?. your opinions please.













:confused:

[BipolarBill]

You'll have to be more specific. What is the offending file's actual filename?

[Baddog]

Important Note: Do not install security update MS03-026 before installing SP4. The security update must be applied after SP4 has been installed on computers. Once you have successfully installed SP4, you should then install MS03-026, which protects against vulnerabilities caused by the Blaster worm. For more information about the Blaster worm, see What You Should Know About the Blaster Worm and Its Variants. http://www.microsoft.com/security/incident/blast.asp

[Ol'Tunzafun]

If you have the required minimum of SP2 for W2K, download and install the patch from MS. The patch must be in place in order to effectively use the removal tool from SYMANTEC (http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html).

[macampbell]

The message is as follows:

"C:\Document and settings\all users\Application Data\Microsoft\Dr. Watson\user.dmp-DcomRpc.exploit infection".

My e-trust keeps flashing this message every now and again, but does not offer to clean it, the computer seems to be working OK.

I do not know if SP4 is installed, I have been d/loading updates and think that I am up to date.

[macampbell]

Thanks for your efforts chaps, I did as Ol'tunzafun suggested, d/loaded and run the symantec removal tool, even while running it, my resident AV flashed me the warning, but symantec reported that blast was not found on the 'puter, much relieved thanks again:)

[rraehal]

It looks like your computer may have been attacked (or attempted attack was made) and in the .DMP file (C:\Document and settings\all users\Application Data\Microsoft\Dr. Watson\user.dmp-DcomRpc.exploit infection) that Dr. Watson created, you AV software see the related file name (msblast.exe). It is obvious that you do not have the virus, but it may have been on your PC and the file name is recorded in that text file. You can go to the location shown and delete the Memory Dump file. It is a file that is only needed to help in computer debugging mostly.

That may get rid of the error.

[macampbell]

Rraehal wow I did have the virus and cleaned it before I installed the patch, just found the dump file and deleted it, now my AV is showing clean now. Thanks again lads.