NT Authority/System reboot?

Kalisperas

Member
Sep 28, 2002
67
0
0
I've had a strange occurance a couple of times in the past couple days. I'm not sure if it's related, but it began after signing up for a new ISP, and it's never happened before. What happens is this: ZoneAlarm pops up a window asking if I want to allow "Trivial File Transfer Protocol" to access the internet. Well, I've never seen that before, and I haven't requested any file transfers, so I say "No". A minute or two later, a window pops up in the middle of my screen saying that my system is going to shut down in one minute, and I should close all open files. It says the reboot is being initiated by "NT Authority/System" because the "Remote Procedure Call (RPC) service terminated unexpectedly". The window sits on top of all other windows, and there's no way to cancel it. I tried the Task Manager, but it won't allow me to cancel the process. When the countdown finishes, the computer reboots.

Can someone tell me what is happening here, and more importantly, how I can stop it? This is incredibly disruptive, and while it seems to be a process of Windows and not a 3rd party app (as far as I can tell), I can't see why Windows would ever be REQUIRED to reboot, without my consent or input. Any ideas?
 
Aug 27, 2002
10,043
2
0
virus, possibly the good 'ol msblaster.exe virus
edit: ok I'll tell you how to remove it.
boot into safe mode. turn off system restore, do a search for *blaster.* , delete the file(s). run antivirus w/latest updates, update the critical updates through windows update, shutdown. wait 5 sec, and turn computer back on, then run viruscan again just to be sure/paranoid.
 

InlineFive

Diamond Member
Sep 20, 2003
9,599
2
0
Yes that is definately the W32.Blaster.Worm virus. If you don't have a anti-virus program download Symantec's free tool here.

Hope this helps! :)

-Por