unplaned restart!!

[thesnake]

Hi... i have a question about a forced automaded restarts that i used to have

with my old pc  and now i got it happening again with my new p4 pc :

well i get a small  window pumping up telling me that the generic host made an error and that the system will shot down after a count down then the system restart am sorry i dont remeber the exact message but here is some system and security logs at 22/12/2:37  :

system logs:

_the terminal service failed to start due to the  following error the pipe has been ended

_ the process winlogon.exe has initiated the restart of  os  for the following reson no title for thiss reason could be found minor reason oxff

shutdown type reboot

comment windows must now restart because dcom server process launcher service terminated unexpectedly

_The dcom  server process luncher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in  60  seconds:

reboot the macine.

i did a command promot  order :

sc query dcom

sc enumqueryservicesstatus:openservice failed 1060

the specified service dose not exist as installed server

application logs:

faulting application svchost.exe v 5.1 fulkting module  rpcrt.dll version 5.1 fult address oxooo55009

-the application c:windowssystem32svchost.exe generated an application error the error accurred on 12/22/14:37  the exception generated was c0000005 at address 77ec5009(rpcrt4!rpcmgmtsertauthorizationfn)

no user action required   

olso i noticed that generic host c:windowssystem32svchost.exe 

on my firwall  (zone alarm have no permition to access internet on the server

tabby defult zone alarm settings .

well i just copyed and past that data i dont realy understand what is going on

and not realy intrested in tech analyzation  what i need to know is is there somthing i should do? like in fire wall or somthing? is that a normal thing to happen?  thats all thank you.

[Andrew]

I remember a virus that automatically shut down windows after a certain amount of time with a timer. Or maybe it wasn't a virus, but I remember someone having that type of problem before.

Try searching nortons virus vault(?) online and search using some things that happen. I would but I'm on an old computer.

Does this happen randomly when you boot windows? Does it only happen when you are trying to connect or are connected to the internet (if you have the connection cord unplugged, does it show up?)?

[thesnake]

it happen randomly and i had it for the first time on my new pc but i had it befor a lots of times on my old pc  i thought i got rid of it with the old pc but here it pup up again  :(

here is a reply i got from posting on a pc help form:

A tool is available to remove Blaster worm and Nachi worm infections from computers that are running Windows 2000 or Windows XP

http://support.microsoft.com/kb/833330/en-us

__________________

so is it that nachi worm ??? can i get rid of it with formating??

[thesnake]

haw about the fire wall i noticed its bloacking the geniric  host cvchost.exe  internet server access

i did a command promot order :

sc query dcom

sc enumqueryservicesstatus: openservice failed 1060

the specified service dose not exist as installed server

is that related?

i just scanned with the microsoft malicious software removal tool  and nachi scan was not infected

[erjin999]

Ok, most likely a virus type program.

the real program should be called SVChost.exe, not CVChost.exe...

There was a virus that restarted windows, it killed the RPC service I believe.

You can always do a free online scan and clean from the wonderful people at trend micro.

Go here for the scan. It requires IE.

To stop the restart issue, find the service that is actually causing the restarts, in services, and in the recovery tab at the top set the action for each failure to "Do Nothing". Alternatively try going to command prompt (start > Run > "cmd") and type shutdown -a to abort the shutdown.

Good luck with that.

[thesnake]

  lol as for the geniric exe file it is  SVChost.exe  i made mistac

as for the trend micro  virus test am  updating java and on my way to do it...

do you still think its virus???  i will try to do the recovery you recomended erjin but would

formating do the same job? if i reinstalled  would that recover the file olso?? anyway my processor

will install  winxp in few minuts.. sound eazyer than the recovery method.. thank  you

[erjin999]

hmm, the recovery thing is just a setting. Reinstalling XP is a job !

Do the trend micro thing. I cant say for shure it is a virus but it sounds like one from the info so far.

Do you have normal antivirus installed ? Remember, reinstall XP but you could get struck down (assuming it is a virus or somesort now) again.

[thesnake]

i cant do the trend micro  house call  coz it say i need 2:5 hours to complete it

on a dial up con......

ill format and run a clean insall  .... my p4 processor can install winxp profetional

  in 6 min  .......lol  amazing

i have loads of shilds:

avg  anty virus  home edition

zone alarm fire wall

windows anty spyware progra,

previx u know what to loack the hole thing up

all up to date

i wounder from were sutch thing may pass throu?

ill be happy to format if it will correct the pro i wanted to do it a while ago to make a general clean up so am to do it now....

[thesnake]

i went to services most of them are set to do nothing at recovery tab by defult and i dont know

what is the exact name of the service cosing the restart as for the command promot i dont see

why its usfull to stop the restart after the error happen...  i prefer to let the system restart to recover and focus on stopping the error better than stopping the restart...

[gryphon]

the viri that rebooted Windows after 60 seconds can simply be made inert by typing shutdown -a in a console screen. A simple solution for a simple viri which for some reason caused mayor havock.

Any other shutdown giving you a timer for reboot an also be stopped with that command.

For the service errors. Disable the ones in start - administration tools - services (or something like that).

Disable your firewall compleately (yes compleately !!!, unhook it from the internet if you like) and reboot.

Don't recover Windows, if that takes you 6 minutes (default install from a Windows CD) you are doing something wrong. It's technically impossible.

Last, and please answer this hounest. Do you have a legit Windows version ? The reason for that question.

1) you are installing it in 6 minutes, which due to installation wizards and waith timers for detecting new hardware is impossble.

2) MS has a new verry neat feature in the Windows server OS. If you are using an illegal version your computer will randomly reboot. There is a patch against that. Although it's classified wrongfully. (I can personally ganrantee that it has nothing to do with policy errors like the MS site suggest), and as second you get a 2 weeks expiring password to download and use the hotfix. First ever hotfix/patch I have seen using that system.

[thesnake]

_ if i disable the reboot viri befor it countdown to zero dose that disable it one time? or it will suspend it for good?

if its only for that single shot down i dont realy care what i wanted is to fix the reason

_as for the services tab i see most of them are are disabled from restarting the pc i dont know what to mess with

_what i said about the winxp install well i dont realy mean 6 min but  belive me my cpu do it real fast record not 40 min at all  .. but not 6 either

_ i told befor i do use a pirated copy of win and here were i live no budy buy real o/s cds coz there as expensive as the pc

_about the secound part of ure comment i dont understand it realy should i get that patch? from were?

[gryphon]

_ if i disable the reboot viri befor it countdown to zero dose that disable it one time? or it will suspend it for good?

if its only for that single shot down i dont realy care what i wanted is to fix the reason

Just ones. And if you think it's not needed try to run your virusscanner within a minute to remove the viri.

I doubt you can find the reason within a minute of shutdown timer.

_ i told befor i do use a pirated copy of win and here were i live no budy buy real o/s cds coz there as expensive as the pc

_about the secound part of ure comment i dont understand it realy should i get that patch? from were?

The second part. MS is dealing with pirated software more then ever right now. One of the things they have done is letting Windows 2003 servers randomly reboot if they have an internet connection. I have not heard of a WindowsXP professional computer doing the same although they might have started with those clients to.

As a normal - home customer you can not get that patch. It's only for corporate support contracts with Microsoft. (and you need to validate your Windows Linsence)

as for your problem, try to reinstal it compleately. And secure it with antivirus programs from the start.

Fro using a pirated windows version I am affraid to say any support ends here. besides the fact that we cannot say the install is flawfless to start with you should use a legit version.

[thesnake]

you mean that little window that actuly restart my pc in 60 second is a virus by it self??

viri= virus?

i thought its a system warring alert.. i mean if it was a virus i allready formated.. should be dead now.

[gryphon]

it doesn't matter what it is. The 60 second count down. If you want to know what it is you will need to investigate your computer. Which I doubt you can do in 60 seconds. So that's why you can cancel it. But then, if you don't want to don't do it and reboot.

[erjin999]

Basically, spicy, if you cant fix it in 60seconds the first priority is to get more time, by stopping that service (which isnt the virus) from restarting.

But if you think it is better to reinstall, then thats cool. Its just not a long term solution becuase same thing can happen again.

[thesnake]

i allready formated...maybe i will het lucky no to be hit again if it was a virus..

next time if it happen i will try to memorise what service exaclty it is and try to stop it

from the tab like u said ..if it happen again