I found this while dissinfecting numerous sasser varients(and others) on a friends computer.It says it is 'Microsoft Windows Secure Server' I've searched my own registry and it does not occur in mine. Any idea what it is? Tt Lanfire nf7-s v2.0 XP-m 2500@210x11 SP 97 512mb pc3200 Jou Jye 550w psu FX5600 WDCaviar 60gb Seagate Barracuda 80gb ;~}

Search Google. Got several hits showing a guys Hijack log. In German, but has translation button.

Did not know about the translation button. Bitdefender recognised it as a sdbot backdoor.Housecall and pandasoftware did not. Tt Lanfire nf7-s v2.0 XP-m 2500@210x11 SP 97 512mb pc3200 Jou Jye 550w psu FX5600 WDCaviar 60gb Seagate Barracuda 80gb ;~}

Yeh i have it too...i rebooted my computer (to get rid of all the spyware) and it came up straight away, and im really desperate to get it away. I think it causes the internet connection to stop and slow down...it definatley does something to Internet Explorer, because when i connected through LAN on the laptop (internets on this computer then through to laptop) it works perfectly fine. So when i deleted the "rpcxWindows.exe" out of the "Task Manager" the internet came back. Its definatley something bad, but i cant find anything on it. Aparently its part of the Windows Secure Server. I googled it and it didnt come up with any links from Microsoft. So its DEFINATLEY something. i dont think none of the ANIT-VIRUS companies know about it.

Its related to RBOT, Forbot, and SDBOT, probably infects the same way using the known LSASS vulnerabilities. Most likely there are a dozen other files running at startup that are part of the infection. LOOK IN YOUR REGISTRY AT: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Look for any Microsoft Sounding Names in the Value, the files will be located in your windows\system32 directory - you will need to do some searching, since in the registry the files will be listed without directory path. If the name looks legitimate but is 1 or 2 letters off, like scvhost.exe (rather than svchost, its a good bet its a worm.