MY COMP IS REBOOTING WHILE ONLINE. VIRUS?? PLEASE HELP!!!!!

[troyvcd1]

Ok I got windows XP with SP1. I am using juno internet service over a 56k modem. When I am online for about 5 to 10 minutes I get this popup message:

Generic host process for win32 services has encountered a problem and needs to close. etc.....

Then I get another popup window saying that my computer is shutting down and I should save all my data. The message starts as follows:

The system is shutting down. Shutdown initiated by NT AUTHORITY\SYSTEM.

I get this 60 second time down clock and am told to save my data and then bam my computer reboots. What the ******************* is going on. I am going crazy. PLEEEZZZZZZZZZE SOMEONE HELP ME. I BETTER TYPE THIS IN QUICK BEFORE MY COMPUTER AGAIN RESTARTS

[crazeplaya]

Could well be a virus or just a corrupted file. I had a similar problem when playing Tiger Woods 2003, but mine just restarted without any warning

Have you run a virus scan recently?
Also I think Windows XP has a way of checking the validaty of its own files, can't remember how though

[CaseyComb]

Not that this has anything to do with DVD-R or VCD's, but I sympathize. I had a similar problem happen to me the other week. Did anything in the warning messages contain "RPC" in it? If it did, it is the same problem I had. It's some sort of exploitable flaw in windows. Assuming that you have XP home, here is the patch that fixed my problem:

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C...displaylang=en

Hope this helps

[troyvcd1]

This is not just like windows crashes. Windows initiates the shutdown and gives me 60 seconds to save all my data. This sucks.

[somebodeez]

I don't know what's causing the problem but try this:

Go to -
Start
Settings
Control Panel
System
Advanced
Start Up & Recovery
Under System Failure, un-check "Automatically Restart" and click "ok"

That should stop your computer from restarting when you get an error message.

[Midget^]

omg!!!! i just started gettin the same thing as u! It says something about NT SYSTEM / AUTHENTICITY?!? WTF IS HAPPENING :'(, its happened 3 times already.

I turned my cable modem off for a while and it was fine... then i turned it back on and it happened again! Seems ok for the moment ........................... PLZ HELP!!!

[presto]

I don't know if this is the same because it has nothing to do with going on line but here it is:

When you start your computer, you may receive the following error message:

Generic Host Process for WIN32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.
If you click Click Here at the bottom of the message box, the following error signature information may appear:

App name App version Module name Module version Offset
---------------------------------------------------------------------
Svchost.exe 5.1.2600.0 Hpgtpusd.dll 1.1.0.56 00008d0d
When you click Start, and then click My Computer, or when you double-click My Computer on your Windows desktop, Windows may search, and a flashlight icon may appear, for a long time (for example, five minutes) before files appear. A list of files and folders may not appear.
CAUSE
This behavior may occur if use an old HP printer driver or an old HP scanner driver.
RESOLUTION
To resolve this problem, follow these steps:
Turn off the computer and the printer or the scanner.
Disconnect the printer or the scanner from the computer.
Restart the computer.
Install the compatible drivers and software for the printer or the scanner, and then reconnect the printer or the scanner to the computer.

[overloaded_ide]

Did you upgrade to patch the newest discovered BUG in windows?
Not to be an alarmist, but there has been talk of an empending hackers attack comming of some type. FBI issued a warning on it about a week ago I beleave. Did not give any info as what it mght try to do. Flood emails, delete drives, or just reboot systems? Who knows, but patch now if you haven't already

Are you having this problem offline as well as online?
I got 2k pro, so I don't know a thing about XP and plan to keep it that way

Also I run win 98se on my net connected machine because it is so safe and secure

[troyvcd1]

to presto: I get the same type of message :

Generic Host Process for WIN32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.

I have known about HP product drivers since I have an HP computer. When I did a clean install of windowsXP this time I did not even install my computer or any HP software so this is not the problem.

I have since ran internet cleanup and saw some spyware and this Alexia file info gathering service. I deleted them all. I have been online for 30 min with no problems so far. I will keep people informed if it still reboots.

[SrBrunox]

try this:

start-Run-"cmd"
"cd\"
"sfc scanonce" <--- this will checnk your XP files after you reboot...so reboot.

If that doesnt work:

start-Run-"msconfig"

click services tab:
check "hide all microsoft services"
Uncheck all boxes
Click on Startup tab:
Disable all

Trouble shoot for awhile by enabling things one at a time to see which one causes the problem.

Reason:
some program is running that is casuing your problems, diable and it should go away.

"but how do you know all this"

"i stayed at a Holiday INN"

[Dj Petro]

I don't know if this is similar or not but someone on one of the other forums I go to has had problems.

http://www.maxforums.org/forum/forum.asp?t=145459&r=8

_

[Bob W]

I would check for spyware on my computer by running "AdAware" and or SpyBot. http://www.safer-networking.org/index.php?lang=en&page=donations

[overloaded_ide]

Here is a qoute from a very reliable source on a PC forum I belong too.
Is this what is happening to you guys today?

ALERT!!!!! RPC Exploit Attacks Today!!!!!
I've had 3 clients and my own laptop have this problem today (I patched all my home systems a month ago but I forgot to patch my laptop).

This is a security hole in all flavors of Windows EXCEPT 98. All of the systems affected were using Earthlink for their ISP so I suspect some infected system is port scanning all of Earthlink's IP addresses.

On an NT, 2K, XP or 2003 system the computer will give you an error message saying that the "RPC Service has been terminated unexpectedly" (if you check the Event log it shows up as an event ID 7031) and the computer will shut down in 15 seconds. The computer shuts down and reboots.

This will happen while online (broadband or dialup) and if you have NOT installed the MS03-026 (Hotfix 823980) patch.

A mass mailing worm that already well established on thousands of infected systems is trying to use this exploit to hack into unpatched systems. The reboot apparently occurs because the worm is trying to disable your RPC service to hack into your computer and fails, causing the error.

If you haven't applied it yet, EVERYONE you MUST install the hotfix which you can get here:
www.microsoft.com/technet/treeview/...in/MS03-026.asp

It's a 1.2Mb patch and will fit on a floppy. Carry it in your briefcase - your friends will all be having problems with this.

You may have a problem downloading the patch since if your system is under attack it will be rebooting every few minutes while online.

Easy workaround is to block port 135 if you're using a firewall, or just turn on WinXP's built in firewall temporarily (it apparently blocks port 135).

IT'S IMPORTANT YOU INSTALL THIS PATCH EVEN IF YOU HAVEN'T BEEN AFFECTED! This is a serious security exploit that can leave you system wide open to attack.

Those of you using routers may not be seeing any problems because your router is probably blocking port 135, but you should install the patch anyway.

That's from a very good source that has helped me personaly with many various problems. Luckily I am running old 98se on my net connected system, though I do need to get my 2k systems patched right away! Occasionally they get used online, but rarely.

If that's your problem, glad I could help, if not, well you still need to install that patch anyway if you haven't already!!

[thayne]

Those of you using routers may not be seeing any problems because your router is probably blocking port 135, but you should install the patch anyway.

Anyone not behind a firewall or router running windows online is asking for trouble! You should get protected!

[Midget^]

CRAP!!!! ITS SKYNET... THATS WHO IS DISTRIBUTING THE VIRUS!!!!! SOON BOMBS WILL FALL AND JUDGEMENT DAY WILL COME........ RUN 4 THE HILLS, BUT HEY I AINT WORRIED... IM JOHN CONNER . JUDGEMENT DAY IS INEVITABLE!!!!!!!!!!!!!!!!!!

[Baldrick]

NAME: Lovsan
ALIAS: MSBlast, Poza, Blaster
SIZE: 6176


http://www.f-secure.com/v-descs/msblast.shtml

[thefox149]

My girlfried just got the same error she got it after trying to view an email

Exact same error messages Weird

I have told her to install the patch hopefully that sorts it out

[Doggiedaddy]

Could well be a virus or just a corrupted file. I had a similar problem when playing Tiger Woods 2003, but mine just restarted without any warning

Have you run a virus scan recently?
Also I think Windows XP has a way of checking the validaty of its own files, can't remember how though

Rebuilds all hidden and sys files as I recall, as stated above. I am not suggesting this, just pointing out the prompt I think crazeplaya was talking about.

CAUTION and you would need your windows cd

"if all else fails. goto cmd, and type" sfc /scannow

[andkiich]

I've seen cable modems cause this. It may also cause the computer to lock up when on the internet as well.

[thefox149]

Would deleting it the msbalst exe and the registry key solve this as i was also at my uncles place last night and notice msbalst exe in his systems process in the task manager?

[thayne]

Would deleting it the msbalst exe and the registry key solve this as i was also at my uncles place last night and notice msbalst exe in his systems process in the task manager?

Follow the instructions at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

[Dinu Bandyopadhyay]

CaseyComb, you just made my day (evening, actually). Within a few minutes of connecting to internet I had Windows shutting down citing something related to RPC. I used the link you provided, downloaded the patch just before the windows shut down again. After the re-start, I installed the patch, and since then the system is running fine. This may not be the right forum, but it did help me and now I am connected long enough to post this mail.

[jgcarp22]

I installed the patch, and since then the system is running fine. This may not be the right forum, but it did help me and now I am connected long enough to post this mail.

However, there is a good chance you are infected with this virus. Worse yet, it has probably infected your system restore, (If you use anyway). Do a system search for "msblast.exe". If found, you have the virus. Also, it is likely you have an added entry in your registry.

Run a check at:
http://housecall.trendmicro.com/

or see if your anti-virus software has updated yet to find this w32.blaster.a virus.

---

[yautja666]

This article on CNN.com refers to a virus that causes computers to restart:

http://www.cnn.com/2003/TECH/internet/08/11/internet.attack.ap/index.html

Hope this doesn't involve anyone here, but it pays to be sure what you're dealing with.

Dave
P.S. Regarding Midget's joke...type 'Skynet' into Google (yes, I get bored) and you'll find more than a few articles about similarly-named automation programs. It's kinda freaky actually, well, only after downing enough beer.

(edited for typo)

[troyvcd1]

I looked up the info at mcafee web site and found the virus.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\
Run "windows auto update" = msblast.exe

sure enough it was on my computer. I installed mcafee and downloaded the latest .dat and Blasted it off my computer. I dont know how it got there. I did download some music off kazaa but I did nothing stupid like open up email attachements. I think that this virus can just get on your computer just from being online. I guess the days of just being carefull online are over and you need a virus protection just to be online.

[troyvcd1]

Ok now that I got that out of the way. What is the best format - or +. Also what encoder is best TMPGEnc or CCE. LOL

[thayne]

Ok now that I got that out of the way. What is the best format - or +. Also what encoder is best TMPGEnc or CCE. LOL

You been here since june 2002 and you're asking this? Are you joking? LOL

[Dubber]

That's RPC (remote procedure call) exploit.

Here is what MS has to say:

http://support.microsoft.com/?kbid=823980

or another solution:

Administrative Tools > Component Services > Services(Local) > double-click Remote Procedure Call (RPC) > Recovery Tab > set everything to "take no action"

[barrybear]

A Big thank you to all that have replied to this topic. I had this problem and virus but was able to cure it as I have a second machine running ME that was not infected( i could download the MSoft patch). I have just posted a second floppy to friends who have had the same problem. thanks again

Barry

[Hardcoreruss]

This is a BIG thing, it is shooting round London at the moment. We have just had an e-mail from our IT dept saying that all 8000 !! of our terminals were infected but they have run the patch through windows update and it is now sorted. Apparently if you do this you will be okay.