xp shuts down

M

milt

OS XP few minutes after boot, a box comes up and says sytem will be shut
down in 60 seconds and counts down. Says there's an error in NT system
authority.
Did a complete xp restore and it still does that.
Any help will be really appreciated.
Thanks, Milt
 
G

Galen

In milt <[email protected]> had this to say:

My reply is at the bottom of your sent message:
OS XP few minutes after boot, a box comes up and says sytem will be
shut down in 60 seconds and counts down. Says there's an error in NT
system authority.
Did a complete xp restore and it still does that.
Any help will be really appreciated.
Thanks, Milt
Click to expand...

You're probably infected with a bit of malware. Trojan? Spyware? Virus?
Which specifically I can't say. The following should get you started:

Virus:
www.grisoft.com - AVG
www.antivir.com - AntiVir
http://www.my-etrust.com/microsoft/index.cfm - CA eTrust

Spyware:
www.lavasoft.de - AdAware
http://security.kolla.de/ - Spybot
http://www.microsoft.com/athome/security/spyware/software/default.mspx -
Microsoft Anti-Spyware Beta

Trojan:
www.emsisoft.com/en/software/free/ - a Squared
http://swatit.org/ Swat It

Before cleaning download this:

LSP-Fix - a free program to repair damaged Winsock 2 stacks:
http://www.cexx.org/lspfix.htm

Use that should cleaning out your PC remove or damage your in-place winsock
and you can't connect to the internet.

From the virus and trojan category pick one application, they're all free,
download it and install it. Make sure that you update it. From the spyware
category pick all three, download them and update them to the latest
definitions. Reboot, press the F8 key over and over again, from the menu
select Safe mode without networking. Do your cleaning in there. Reboot to
regular mode and run the scans again. This isn't going to be quick or easy
but it might just solve your problems and it should prevent you from further
problems so long as you keep them updated and scan often. Most of them can
be enabled to update and scan automatically.

Galen
 
T

T. Waters

Windows must now restart because the Remote Procedure Call
(RPC) Service terminated unexpectedly.

From Wikipedia, the free encyclopedia.
The Blaster worm (a.k.a. Lovsan or Lovesan) was a computer worm that spread
on computers running the Microsoft operating systems, Windows XP and Windows
2000, during August 2003.

The worm was first noticed and started spreading in the wild on August 11.
The rate that it spread increased until the number of infections peaked on
August 13. Filtering by ISPs and wide spread publicity about the worm curbed
the spread of Blaster.

The worm was programmed to start a SYN flood on August 15 against port 80 of
windowsupdate.com, thereby creating a denial-of-service attack (DoS) against
the site. The damage to Microsoft was minimal as the site targeted was
windowsupdate.com instead of windowsupdate.microsoft.com to which it was
redirected. Microsoft temporarily shut down the targeted site to minimize
potential effects from the worm.

The worm spread by exploiting a buffer overflow in the DCOM RPC service on
the affected operating systems...

This worm is going to be celebrating its second birthday soon.

Wonder what I should get it for a gift?
 
G

Galen

In T. Waters <@$%$%#^@jdjgkl.com> had this to say:

My reply is at the bottom of your sent message:
This worm is going to be celebrating its second birthday soon.

Wonder what I should get it for a gift?
Click to expand...

An unpatched and unprotected AMD 3700+ with a decent broadband connection?
<g>

I don't know if that's the ONLY one that causes that symptom so I just gave
generic advice. By now there's probably other bits of trash that cause
similar problems. Two years? Someone has to have copied it by now. Or are
they copyrighting viruses yet? <g>

Galen
 
T

T. Waters

I think you are right and it is a copycat virus.
I picture viruses "burning out," just like a virulent epidemic.
In any case, good manners call for them to step aside and let a new virus
take a turn!
 
K

Kelly

Hi Milt,

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.
Or go to Start/Run/CMD and type in: shutdown -a.

Close Windows Explorer, run the edit on line 257 which includes the prompt
for the patch once your system has been cleaned.

This script removes all variants of the W32.Blaster.Worm (original, B, C, D,
E and F) and will inform you whether or not the patch is already installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

However, it can be one of two:

W32.Sasser Removal Tool (Line 321) Right hand side)
http://www.kellys-korner-xp.com/xp_tweaks.htm

W32.Blaster.Worm
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

MS Blaster Tool: http://tinyurl.com/3h8kw

Good luck and keep us posted!

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

RCP error 5
automatic shutdown by (RPC) 1
XP shuts down when Ad-Aware SE starts 7
Windows shuts down 1
xp home edition shutting down automatically 1
HELP-Windows Shuts down! 7
Windows XP Shuts down 1
xp shuts down 6

Top