homepage Welcome to WebmasterWorld Guest from 50.19.206.49
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Visit PubCon.com
Home / Forums Index / WebmasterWorld / Webmaster General
Forum Library, Charter, Moderators: phranque

Webmaster General Forum

    
Windows Error Message
Computer keeps shutting down...
jtmoney77




msg:347380
 1:46 am on Dec 2, 2003 (gmt 0)

Hi,
My computer has been shutting down by itself lately. I did not find any viruses. When I send report...I got this info back....

Analysis:
A device driver installed on your system caused the problem, but we cannot determine the precise cause.

I also recieve this message about a "Remote Procedure Call". Does anyone know what this is about? I need to fix this soon!

I appreciate your help.

Jeremy

 

liketoseeyoutry




msg:347381
 1:48 am on Dec 2, 2003 (gmt 0)

Sounds to me like you're being hit with a Blaster worm or variant ... are you using windows 2000 or XP?
If you're using XP then you can usually just protect your connection with the built in firewall ... if you're using win2k then you'll have to install a third party firewall like zone alarm.

jtmoney77




msg:347382
 2:29 am on Dec 3, 2003 (gmt 0)

I am using a Windows XP...Do you know what Remote Procedure Call is?

Would Norton be able to find the virus if I scanned for it?

Thanks
Jeremy

jim_w




msg:347383
 4:58 am on Dec 3, 2003 (gmt 0)

>>Remote Procedure Call<<

What was the exact error message? A friend of mine, yes I have a few, was working on his XP trying to get all the crap installed by HP off, and he turned that service off. Because of this, he got an eror message. Also check and make sure you do not have the computer set to go to sleep after 1 minute of use or something.

jtmoney77




msg:347384
 1:33 am on Dec 4, 2003 (gmt 0)

I never wrote the whole message down...I will try next time it appears...Im sure it wont be long before I see it again.

Jeremy

Stefan




msg:347385
 1:51 am on Dec 4, 2003 (gmt 0)

Wrt Blaster worm... it sounds like it might be the problem. This is quoted from an anonymous site:

One message you could receive with W32.Blaster.Worm is:

Windows must now restart because the remote procedure call (RPC) service terminated unexpectedly.

The computer reboots itself in 60 seconds

Another message is:

Generic Host Process for Win32 Services

Then: Remote Procedure Call (RPC) service terminated unexpectedly.

The main symptom is that your computer keeps rebooting every 60 seconds or so.

The following is our experience with this worm and there are no guarantees that this will for sure cure your computer of its worm. We are not responsible for anything that happens to your computer as a result of this information. Please be sure to read through all the following documentation before trying any of this on your computer and visit both the Microsoft site and the Symantec site for their help.

1. Kind of tricky to get rid of this worm, seeing how your computer keeps rebooting! So first of all try activating the Windows XP firewall. This may allow you to download and install the patch without your computer rebooting every 60 seconds.

If that doesn't work for you, try running this command when the shutdown notice comes up to abort the shutdown your computer is trying to do:

Start Menu
Run
Shutdown -a

To enable the Internet Connection Firewall in Windows XP:
1. In the Start Menu, click on My Network Places.
2. Click on View Network Connections (on the left side).
3. Click the Internet connection that you want to protect. Then click Change settings of this connection (on the left side).
4. On the Advanced tab, under Internet Connection Firewall, select the following:
- Protect my computer and network by limiting or preventing access to this computer from the Internet. And click OK.

If you have any problems with the above, try entering the word "Firewall" in the Help Menu.

2. Secondly, there is a Microsoft Patch that you must install. The patch is located here:

[microsoft.com...]

(Note: If you don't have a clue which version of Windows XP you are running, download the patch for Windows XP (32 bit) and try to install it. If it is not the correct version, it will not install and tell you it is the wrong version.)

Also if you are trying to install the patch and your computer still keeps rebooting, disconnect from the internet and try again to install the patch.

3. Thirdly, Symantec has a removal tool for this worm that you can find here:

[securityresponse.symantec.com...]

Symantec's W32.Blaster.Worm Removal Tool deletes the blaster worm files and deletes the registry values that the worm added for you. You do need to install the Microsoft Patch also. That is the most important step!

ADDED: oilman, sorry for the horizontal scroll as a result of that copy and paste.

coopster




msg:347386
 2:27 am on Dec 4, 2003 (gmt 0)

Your computer may be restarting because of a Windows Startup and Recovery Setting:
  1. Right click on My Computer and select Properties.
  2. Click the Advanced tab.
  3. Under Startup and Recovery, click the Settings button.
  4. You'll notice under System failure, there is a checkbox to Automatically restart to specify whether Windows will automatically reboot whenever the system stops unexpectedly.

I'm not sure if this is your problem, but this wonderful piece of MS ingenuity came about I believe in Windows 2000. I always disable it (call it ignorance if you will, but I've not found any good use for the option). At least if you get the blue screen of death, you'll be able to identify the culprit driver and make some adjustments.

Best of luck ;) -- coopster

jtmoney77




msg:347387
 4:03 pm on Dec 4, 2003 (gmt 0)

Thank you everyone for your help. It seems that it has all the symptoms of the BlasterWorm because I do receive both error messages that the BlasterWorm displays when it is present. Two things though:

(1) My computer shuts down only once in a while...most people say their computer shuts down every few seconds when infected with the worm. But I do realize that there are different variants of this worm so that might be the case.

(2) I downloaded the fix worm tool from Symantec...after running it, it said "No worm found" Is it possible that it simply could not find it? Or maybe it fixed it, and it meant now there is no worm present? If that were the case, I figure it would read, "Worm terminated or deleted"

Well, it did not shut down yesterday...but sometimes it wont for a day or two. If anyone has any more ideas, please let me know!

Thanks,
Jeremy

Stefan




msg:347388
 4:46 pm on Dec 4, 2003 (gmt 0)

I believe that Symantec was telling you that it didn't find it. However, as you note it might be a variant that it doesn't know of. Have you looked for updated removal tools/scans etc? It might be an idea to spend some time with the SE's hunting down the newest fixes while your computer is still working... just in case it's going to come back. I vaguely remember reading somewhere that not all variants cause the constant shut downs like you're getting, just occasional.

McAfee has a free virus scan at [us.mcafee.com...]
if you haven't already tried that.

Macro




msg:347389
 4:57 pm on Dec 4, 2003 (gmt 0)

Why don't you just turn off RPC in Services?

jtmoney77




msg:347390
 7:34 pm on Dec 4, 2003 (gmt 0)

How will turning of the RPC Services affect my computer? I mean, what does the RPC services do? If it is not a big deal, I would be happy to turn it off if it would eliminate the problem.

Jeremy

Macro




msg:347391
 8:33 pm on Dec 4, 2003 (gmt 0)

It won't break your PC :-)

You could always turn it back on again later if you wish.

jim_w




msg:347392
 10:12 pm on Dec 4, 2003 (gmt 0)

I think you will find that you need it to connect to the internet, just for openers, as I recall.

jtmoney77




msg:347393
 5:32 pm on Dec 5, 2003 (gmt 0)

I recently change my RPC settings to:
Restart Program at first failure
Restart Computer at second failure

Now, when computer reboots, I no longer have my tool bar at the bottom of the screen. I want to get back into the RPC service settings, but I do not know how to. I cant get the Start...Run...SERVICES/ M because there no longer is a toolbar. I try hitting the Windows button next to CTRl button and nothing happens either. I also hear my computer making beeping noises.

Im stuck....please advise...by the way I have Windows XP if that helps.

Thanks,
Jeremy

Macro




msg:347394
 6:47 pm on Dec 5, 2003 (gmt 0)

"Windows button + E" opens Windows Explorer. You can get into control panel from there.

I also hear my computer making beeping noises

That's another matter. PCs have a different beep at boot to tell you when something is wrong. There are several types of beeps. Your motherboard manual may tell you whether the beep you're getting means faulty RAM, incorrectly seated video card, or something else altogether.

jim_w




msg:347395
 8:06 pm on Dec 5, 2003 (gmt 0)

Press Ctl-Alt-Del to bring up Task Manager

Under File, select New Task (Run...)

jtmoney77




msg:347396
 9:24 pm on Dec 6, 2003 (gmt 0)

I cant get my RPC to be enabled again. When I hit start a error message states that it is disabled or cant find device. When I hit properties nothing happens. Now what?

Thanks in advance...........

garry




msg:347397
 10:04 pm on Dec 6, 2003 (gmt 0)

Could be time to make sure you have partitions on the hard drive with important stuff on the d e & f drives.......so you can wipe your C drive with a format. (using other back up measures too, of course)

Nothing like a good clean out to bring back confidence in your PC.

Stefan




msg:347398
 10:14 pm on Dec 6, 2003 (gmt 0)

jtmoney77, you could stickymail the poster who originally suggested disabling the RPC...

Macro




msg:347399
 11:10 am on Dec 7, 2003 (gmt 0)

jtmoney77, you can start RPC manually by running "svchost -k rpcss" in the Run Dialog box (without the qutoes).

That file resides in the Windows/system32 folder and you can start it from there as well. Or you could sticky me if you need more help.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Webmaster General
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved