Expert: Doug Woodall - 3/27/2007

Question
hello please help ... i have a 2003 hp pavilion with norton antivirus, which is outta date but resurfaces when i do a full restore..... my pc is slow . however ill be on the computer for a few hours and this box comes up , it ok on it or close it out and it starts a countdown fromm 60 sconds and at 0 it restarts my pc ... i have done numerious sytem restores , but still comes back can you help me get rid of this ?  

Answer
Hi Chuck,
I remember this one.
Heres a post from http://www.thisisgoingtobebig.com/2004/10/well_i_just_had.html

This is a known issue and microsoft has a patch for this. it is basically a problem with windows messenger(not MSN) and its alerter service or the blaster worm(W32Blaster). Now the first thing you can do is whenever it shows the message that you have 60 sec before windows shutdown go to start-run-and type "shutdown -a" without the quotes. that should stop it for a while. now disable system restore.now go to control panel-administrative services-and find a service called alerter. right click alerter and select properties. in the properties window click the stop button to stop the service and then select startup type as Disabled. Now go to Remote Procedure Call service (There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.)Right-click the Remote Procedure Call (RPC) service, and then click Properties. Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.

Alternatively
Try downloading the Security Update KB835732 from http://www.microsoft.com/downloads

Alternatively(If you are infected by Blaster worm)
Click Start, and then click Run. (The Run dialog box appears.)
Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:
"avserve2.exe"="%Windir%\avserve2.exe" also delete any values which refer to these files
MSBLAST.EXE
PENIS32.EXE
TEEKIDS.EXE
MSPATCH.EXE
MSLAUGH.EXE
ENBIEI.EXE
Exit the Registry Editor.
Run Norton to remove the blaster worm.

The first step should resolve the issue if you are not affected by W32 Blaster and the 2nd or 3rd should be helpful if you have the blaster worm.

I know this is a lot of work.
If you are not up to it, head over to
Major Geeks Help Forum
Register and log in and dnload Hijack This,
Run it and post the results logs and they will help you.
They are good people and will help you.
I frequent there myself.

Hope this helps.