BleepingComputer.com: NT Authority System / DCOM Server Process???

Hello!

I have been researching a problem with my sister's computer ALL DAY and keep hitting walls with suggested fixes.

She initially came to me because she couldn't get onto the internet and had been told by her ISP that it was something on her end, not theirs. She then added in that the computer was giving her an error message and then restarting itself constantly.

When I looked at it, the error message said something along the lines of NT Authority/System and DCOM Server Process launcher service terminated unexpectedly and that the computer would restart in 60 seconds, which it did.

When I looked up some of the words in that message I was first directed to a worm removal for msblast.exe. It offered a download for a removal tool, and suggested that I end the msblast process before continuing. When I looked in the task manager, there was no msblast process listed as running, not even in safe mode. That particular site did offer one helpful tip that has worked so far though. It mentioned to run the command 'shutdown -a' when that error pops up to prevent it from the restart. That has worked everytime to stop it and continue on.

I then continued to look and was directed to try running Hijack This and checking it on their site. I did that, found a couple of items it suggested to remove, removed them, but no fix for the random restarts. That site also suggested running malwarebytes, which I did, and removed 40-some objects. Still no fix.

I also tried a suggestion of running GMER and "deleting everything in red", but there was nothing in red, and I wasn't familiar enough with that program to do anything else.

I can honestly say it has improved, but it's not "right" yet.

I ran AVG Free and nothing was found by it. I tried to use avast, but it wouldn't install so I gave up on that one. I also tried the new Microsoft Security Essentials and it found nothing.

Can anyone direct me on what to do next? I really have no clue what this 'bug' is?

MUCH THANKS!!!!!!!

Hi and Welcome to BleepingComputer,

Sounds like the same thing someone else posted about, if it is, the second post in this thread MIGHT help....

http://www.bleepingcomputer.com/forums/topic291352.html

Have you reran Malwarebytes after having it remove the things it found? If not you should do that and it would also be good to scan with SuperAntiSpyware from SuperAntiSpyware.com.

If you are no longer infected, then it might just be the effects from being infected but if you find that you are still infected, this topic can be moved to the Am I Infected section of the forum to get you some help cleaning it up.

This post has been edited by Stang777: 29 January 2010 - 01:06 AM