As of May 1, 2004, there are now 2 viruses that can make your computer reboot. This page discusses the Blaster worm in detail. The new worm, the Sasser worm, has all the same features as Blaster. Both worms exploit relatively new holes in Windows and both frequently cause computers to reboot.

If you have problems with your computer rebooting itself after May 2004, chances are you have the Sasser worm. Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.B.Worm. This is the easiest way to remove this threat and should be tried first. Here is the Symantec page for the Sasser Worm:

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html

If removing the Sasser Worm doesn't work for you, you may have the Blaster Worm. Follow the instructions below for the Blaster worm. And good luck!

------------------------------------

BLASTER WORM

If you are running Windows 2000 or Windows XP and your computer has started rebooting itself, and continues to reboot itself, you may have the W32.Blaster.Worm.

Here is reference material to aid in getting rid of this blaster worm. (Your virus software will NOT fix this problem -you will have to download a patch from Microsoft to get rid of it)

One message you could receive with W32.Blaster.Worm is:

Windows must now restart because the remote procedure call (RPC) service terminated unexpectedly.

The computer reboots itself in 60 seconds

Another message is:

Generic Host Process for Win32 Services

Then: Remote Procedure Call (RPC) service terminated unexpectedly.

The main symptom is that your computer keeps rebooting every 60 seconds or so.

The following is our experience with this worm and there are no guarantees that this will for sure cure your computer of its worm. We are not responsible for anything that happens to your computer as a result of this information. Please be sure to read through all the following documentation before trying any of this on your computer and visit both the Microsoft site and the Symantec site for their help.

1. Kind of tricky to get rid of this worm, seeing how your computer keeps rebooting! So first of all try activating the Windows XP firewall. This may allow you to download and install the patch without your computer rebooting every 60 seconds.

If that doesn't work for you, try running this command when the shutdown notice comes up to abort the shutdown your computer is trying to do:

Start Menu
Run
Shutdown -a

To enable the Internet Connection Firewall in Windows XP:
1. In the Start Menu, click on My Network Places.
2. Click on View Network Connections (on the left side).
3. Click the Internet connection that you want to protect. Then click Change settings of this connection (on the left side).
4. On the Advanced tab, under Internet Connection Firewall, select the following:
- Protect my computer and network by limiting or preventing access to this computer from the Internet. And click OK.

If you have any problems with the above, try entering the word "Firewall" in the Help Menu.

2. Secondly, there is a Microsoft Patch that you must install. The patch is located here:

http://www.microsoft.com/security/incident/blast.asp

(Note: If you don't have a clue which version of Windows XP you are running, download the patch for Windows XP (32 bit) and try to install it. If it is not the correct version, it will not install and tell you it is the wrong version.)

Also if you are trying to install the patch and your computer still keeps rebooting, disconnect from the internet and try again to install the patch.

3. Thirdly, Symantec has a removal tool for this worm that you can find here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Symantec's W32.Blaster.Worm Removal Tool deletes the blaster worm files and deletes the registry values that the worm added for you. You do need to install the Microsoft Patch also. That is the most important step!

-------------------------------------------------------------------

ONLINE HELP

Symantec has a page for the Blaster Worm as follows:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

-------------------------------------------------------------------

Microsoft's pages for "What You Should Know About the Blaster Worm" with the patch you will need to download:

http://www.microsoft.com/security/incident/blast.asp

-------------------------------------------------------------------

And a 2nd Microsoft page where you can download the patch in case you can't get into the above:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

--------------------------------------------------------------------

Whatever you do - do not disable your RPC - Remote Procedure Call. This service must be running for your computer to function properly.

If you have unfortunately already disabled your RPC service, try this solution before you reinstall Windows:
http://www.annoyances.org/exec/forum/winxp/r1059659764

No guarantees that the above will work, but it would be better to try those first before having to reinstall your Windows. Note those links are only for those people who have already disabled their Remote Procedure Call (RPC) service and now need to fix this new problem! If you disable your RPC service it can take a long time to start windows, and the start menu button won't be available and a lot of things on the computer won't work. AND you won't be able to re-enable the service -p roperties won't open for any of the services. System restore won't work either. Try one of the 2 links above if this has already happened to you.

--------------------------------------------------------------------

If the Microsoft patch hangs up while you are installing it, try rebooting and installing it again.

Good Luck!