Windows Error Message

Computer keeps shutting down...

[jtmoney77]

Hi,
My computer has been shutting down by itself lately. I did not find any viruses. When I send report...I got this info back....

Analysis:
A device driver installed on your system caused the problem, but we cannot determine the precise cause.

I also recieve this message about a "Remote Procedure Call". Does anyone know what this is about? I need to fix this soon!

I appreciate your help.

Jeremy

[liketoseeyoutry]

Sounds to me like you're being hit with a Blaster worm or variant ... are you using windows 2000 or XP?
If you're using XP then you can usually just protect your connection with the built in firewall ... if you're using win2k then you'll have to install a third party firewall like zone alarm.

[jtmoney77]

I am using a Windows XP...Do you know what Remote Procedure Call is?

Would Norton be able to find the virus if I scanned for it?

Thanks
Jeremy

[jim_w]

>>Remote Procedure Call<<

What was the exact error message? A friend of mine, yes I have a few, was working on his XP trying to get all the crap installed by HP off, and he turned that service off. Because of this, he got an eror message. Also check and make sure you do not have the computer set to go to sleep after 1 minute of use or something.

[jtmoney77]

I never wrote the whole message down...I will try next time it appears...Im sure it wont be long before I see it again.

Jeremy

[Stefan]

Wrt Blaster worm... it sounds like it might be the problem. This is quoted from an anonymous site:

One message you could receive with W32.Blaster.Worm is:

Windows must now restart because the remote procedure call (RPC) service terminated unexpectedly.

The computer reboots itself in 60 seconds

Another message is:

Generic Host Process for Win32 Services

Then: Remote Procedure Call (RPC) service terminated unexpectedly.

The main symptom is that your computer keeps rebooting every 60 seconds or so.

The following is our experience with this worm and there are no guarantees that this will for sure cure your computer of its worm. We are not responsible for anything that happens to your computer as a result of this information. Please be sure to read through all the following documentation before trying any of this on your computer and visit both the Microsoft site and the Symantec site for their help.

1. Kind of tricky to get rid of this worm, seeing how your computer keeps rebooting! So first of all try activating the Windows XP firewall. This may allow you to download and install the patch without your computer rebooting every 60 seconds.

If that doesn't work for you, try running this command when the shutdown notice comes up to abort the shutdown your computer is trying to do:

Start Menu
Run
Shutdown -a

To enable the Internet Connection Firewall in Windows XP:
1. In the Start Menu, click on My Network Places.
2. Click on View Network Connections (on the left side).
3. Click the Internet connection that you want to protect. Then click Change settings of this connection (on the left side).
4. On the Advanced tab, under Internet Connection Firewall, select the following:
- Protect my computer and network by limiting or preventing access to this computer from the Internet. And click OK.

If you have any problems with the above, try entering the word "Firewall" in the Help Menu.

2. Secondly, there is a Microsoft Patch that you must install. The patch is located here:

[microsoft.com...]

(Note: If you don't have a clue which version of Windows XP you are running, download the patch for Windows XP (32 bit) and try to install it. If it is not the correct version, it will not install and tell you it is the wrong version.)

Also if you are trying to install the patch and your computer still keeps rebooting, disconnect from the internet and try again to install the patch.

3. Thirdly, Symantec has a removal tool for this worm that you can find here:

[securityresponse.symantec.com...]

Symantec's W32.Blaster.Worm Removal Tool deletes the blaster worm files and deletes the registry values that the worm added for you. You do need to install the Microsoft Patch also. That is the most important step!

ADDED: oilman, sorry for the horizontal scroll as a result of that copy and paste.

[coopster]

Your computer may be restarting because of a Windows Startup and Recovery Setting:

1. Right click on My Computer and select Properties.
   
2. Click the Advanced tab.
   
3. Under Startup and Recovery, click the Settings button.
   
4. You'll notice under System failure, there is a checkbox to Automatically restart to specify whether Windows will automatically reboot whenever the system stops unexpectedly.

I'm not sure if this is your problem, but this wonderful piece of MS ingenuity came about I believe in Windows 2000. I always disable it (call it ignorance if you will, but I've not found any good use for the option). At least if you get the blue screen of death, you'll be able to identify the culprit driver and make some adjustments.

Best of luck ;) -- coopster

[jtmoney77]

Thank you everyone for your help. It seems that it has all the symptoms of the BlasterWorm because I do receive both error messages that the BlasterWorm displays when it is present. Two things though:

(1) My computer shuts down only once in a while...most people say their computer shuts down every few seconds when infected with the worm. But I do realize that there are different variants of this worm so that might be the case.

(2) I downloaded the fix worm tool from Symantec...after running it, it said "No worm found" Is it possible that it simply could not find it? Or maybe it fixed it, and it meant now there is no worm present? If that were the case, I figure it would read, "Worm terminated or deleted"

Well, it did not shut down yesterday...but sometimes it wont for a day or two. If anyone has any more ideas, please let me know!

Thanks,
Jeremy

[Stefan]

I believe that Symantec was telling you that it didn't find it. However, as you note it might be a variant that it doesn't know of. Have you looked for updated removal tools/scans etc? It might be an idea to spend some time with the SE's hunting down the newest fixes while your computer is still working... just in case it's going to come back. I vaguely remember reading somewhere that not all variants cause the constant shut downs like you're getting, just occasional.

McAfee has a free virus scan at [us.mcafee.com...]
if you haven't already tried that.

[Macro]

Why don't you just turn off RPC in Services?

[jtmoney77]

How will turning of the RPC Services affect my computer? I mean, what does the RPC services do? If it is not a big deal, I would be happy to turn it off if it would eliminate the problem.

Jeremy

[Macro]

It won't break your PC :-)

You could always turn it back on again later if you wish.

[jim_w]

I think you will find that you need it to connect to the internet, just for openers, as I recall.

[jtmoney77]

I recently change my RPC settings to:
Restart Program at first failure
Restart Computer at second failure

Now, when computer reboots, I no longer have my tool bar at the bottom of the screen. I want to get back into the RPC service settings, but I do not know how to. I cant get the Start...Run...SERVICES/ M because there no longer is a toolbar. I try hitting the Windows button next to CTRl button and nothing happens either. I also hear my computer making beeping noises.

Im stuck....please advise...by the way I have Windows XP if that helps.

Thanks,
Jeremy

[Macro]

"Windows button + E" opens Windows Explorer. You can get into control panel from there.

I also hear my computer making beeping noises

That's another matter. PCs have a different beep at boot to tell you when something is wrong. There are several types of beeps. Your motherboard manual may tell you whether the beep you're getting means faulty RAM, incorrectly seated video card, or something else altogether.

[jim_w]

Press Ctl-Alt-Del to bring up Task Manager

Under File, select New Task (Run...)

[jtmoney77]

I cant get my RPC to be enabled again. When I hit start a error message states that it is disabled or cant find device. When I hit properties nothing happens. Now what?

Thanks in advance...........

[garry]

Could be time to make sure you have partitions on the hard drive with important stuff on the d e & f drives.......so you can wipe your C drive with a format. (using other back up measures too, of course)

Nothing like a good clean out to bring back confidence in your PC.

[Stefan]

jtmoney77, you could stickymail the poster who originally suggested disabling the RPC...

[Macro]

jtmoney77, you can start RPC manually by running "svchost -k rpcss" in the Run Dialog box (without the qutoes).

That file resides in the Windows/system32 folder and you can start it from there as well. Or you could sticky me if you need more help.