This really doesn't have to do with Declude, however I just got done working on a friends PC who was infected with this worm today. After doing everything it said on Symantec's and Mcafee's site, I still had another problem.
I was getting a RPC error window popping up and would shutdown the PC in 60 seconds. You could not stop it. Well after looking at the registry again, I noticed an entry in the run section that launched Directx.exe.....That look kinda weird to me so I went to the c:\Windows\system32 dir and launced the program (note NAV 2003 did not detect this with a full system scan, neither did Mcafee Online scanner). Sure enough that was the culprit. When it was running , it was very difficult to shut down and then it would just going into it's 60 second shutdown cycle. I also did a netstat -a and noticed it was listening for ftp connections... I stopped the process, renamed the file and remove the entry from the registry...This seems to have solved it...I hope. Anyway I am not sure if that was left there today by the worm or is part the worm (it had a date of 8-10-03), but I have two more people who have called me tonight with the same problem. I also notice some posts showing up in the newsgroups with the same problem... Hopefully this will help others that have friends who call them when they are infected by this. Don Hickey --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
