Good morning angels from above...

I have problems with w32/krepper.aa and internet optimizer, so I am trying to proceed step-by-step to get to hijackthis.

I have finished "cleanup", worked well.

I have downloaded and configured ad-aware and when I start running it, after about 15-20 seconds, a pop-up window appears: "This system is shutting down. Please save all work.... This system shutdown was initiated by NT Authority/system". There is another box that reads: "Windows must now restart because the remote procedure call (RPC) service terminated unexpectedly" and I have about 45 secs before the PC shuts down.

I have tried again to ensure the appropriate checks in config are done and same thing happens again.

What now? Do I move on to the next step and forget about this one?

Thanks for doing what you do, you may be saving my sanity...

This post has been edited by FrankGreg: May 28 2005, 06:31 AM

Hi FrankGreg and welcome to the forum,

It sounds to me like you have the blaster virus.

Here is a link for information, please try to read it. I realize it is quite technical.
Information about blaster

Here is a removal tool for it. It should remove blaster, then you should be able to use ad-aware.

Blaster removal tool.

I hope this helps.

Once you have done that, please post you results of the blaster removal and an ad-aware scan log.

This post has been edited by prab: May 30 2005, 06:30 PM

Another reason could be that SE is bumping into DCOM on certain systems. You can use this tool to disable/enable DCOM. <http://www.grc.com/dcom/>

To stop the error countdown

Click on Start then select Run, type in this bold but do not click OK yet.

shutdown -a

Now start Ad-Aware SE and click on the global icon to run a web update to make sure you have the latest definitions file. Now start the scan running and return to that run command you opened above.

As soon as you see that shutdown message appear click on OK to launch the shutdown -a command. This will abort the shutdown.

Let Ad-aware SE continue its scan and then please post your full system scan logfile here.



Please use Prab's advice of checking for the Blaster worm

Hi,

Thanks for the advice with the shutdown -a. It worked and I could run through the whole ad-aware and all the rest. I'm now going to proceed with Hijackthis log.

Much MUCH appreciated.

FrankGreg

Did your Ad-aware SE Scan logfile show anything?

Are you running Ad-aware SE 1.06r1?

With the latest definition file?



If possible could you post a log.... before HJT!


Thanks