Page 1 of 2

RPC Virus...FML

Posted: Wed Jan 11, 2012 4:32 am
by Brina927
So I'll give all the info I can:
Two days ago I was on mxs and my whole computer crashed 4 laps into a race. I restarted my computer and tried mxs again and to watch the demo and it crashed again right when the gate dropped. I consulted with locomotive peter and I found that my avg stopped working and I reinstalled another, newer version of it and I also updated my graphics drivers. I had absolutely no problems yesterday. Then today I noticed this flag with an x on it on the bottom right(don't know what its called) and I clicked it and it gave these messages:
View Firewall Options(important)
Address a problem with skype
Remove RPC Virus Virus
Troubleshoot a problem with your computer
I clicked Remove RPC Virus Virus(Like a dummy) and then quickly relized it wasn't legit so I cancelled out of it. I then did an AVG full computer scan (with a business version of avg) and nothing was found.I updated windows updates and downloaded what it said to. Then I looked on google and couldn't find much,(at least not much that would help me. I tried a few things I found that were suggested but nothing was there that the suggestions said would be there.) I downloaded Malwarebites and did a full computer scan. My computer crashed twice when it reached the 5 minute mark at a path C:/program files/avg/something(not sure)so I uninstalled avg and ran the scan again. 2 threats were found and removed. I also downloaded SUPERantispyware and ran a full computer scan through that as well. 649(most were adware) threats were found and all were removed. I restarted my computer again and the message was still there. I installed avg again and ran a full computer scan as well as a specific file scan and no threats were found. I have no idea what else to do. I keep looking on google and at all these forums but half the stuff doesn't make sense to me. If anyone knows a simple way or can explain how to get rid of this. I'm begging you :cry:

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 4:37 am
by macb300
Try booting in safe mode with networking. (Hold down F8 while booting up) Then use a Malwarebytes scan.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 4:39 am
by Hi Im Skyqe
She is very much female in the listening department...

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 4:42 am
by Brina927
Oh I forgot to mention I was in safe mode a few times when my pc crashed while running the malwarebites scan. (Not sure if that was why it crashed or if it was avg)But that wasn't with networking I think. I will try again.

To the locomotive: I DID EVERYTHING YOU SAID AND IT IS STILL THERE. I am just slightly retarded in the protecting my computer department :oops:

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 4:48 am
by JB323
reformat


that is all.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 4:59 am
by Brina927
You must have missed the part about me being slightly retarded when it comes to this lol. Explain please :D

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 5:00 am
by rgaede
remove your hardrive, connect it to another pc as an external drive (do not boot your infected drive). After connected scan it like you would a flash drive, if that doesn't fix it then reformat.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 5:55 am
by Brina927
Reformat....the computer...the hard drive....what?

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:04 am
by rgaede
the hard drive, but you may be able to clean the virus off by removing it and then scanning it with another computer first, then no reformatting is necessary!

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:10 am
by DJ99X
http://www.ehow.com/how_5790013_fix-rpc-virus.html

Definitely do the part where you look at the processes running

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:29 am
by Brina927
That's the exact thing I was reading earlier, I found none of those in the processes.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:32 am
by Brina927
Oh and for step 4 I looked in the registry and didn't see any EXE type things althought there was alot to look through. And for step 5 I didn't restore as I could only restore up until yesterday but I know this started earlier then that.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:39 am
by JB323
reformat... google or youtube.


that means wipe your HD and start fresh, most likely will improve your computers performance too.

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 6:56 am
by DJ99X
You dont need to re-format every time you get a virus, thats just silly. I guarantee you that there is a way to get it off without going through all that hassle.


Could you get a screenshot of all the processes running? I'll see if any of them look funny

Re: RPC Virus...FML

Posted: Wed Jan 11, 2012 7:27 am
by Brina927
Crap, didn't realize how small this is.
Image
Also showing the rpc virus message. But I also did this.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:26:52 AM, on 1/11/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Alienware\Command Center\AlienFusionController.exe
C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Brina\Downloads\hijackthis.