system shutdown rpc service terminated unexpectedly; can't keep system up long enough to scan

Or you could try booting with a network cable in.

without*

Sorry

click Start, Run type:

 shutdown -a

and press <Enter>

Safe mode gives same result; computer is disconnected from network; will try shutdown -a. thx

shutdown -a did not stop the reboots. A small DOS window flashes up but restarted a couple of minutes later. Still can't get enough time to do anything.

You can turn off the automatic reboot on error option without even getting into Windows if you can get into what is called the Advanced Options Menu:  as your computer boots up (before you get to the Windows logo), keep pressing and releasing the F8 function key (don't just hold it down as you are likely to get a "stuck key error" from the BIOS).  Then, when that menu comes up, choose the option called "Disable automatic restart on system failure".

Then boot from your XP install CD, go to Recovery Console, and run a chkdsk c: /f

Thx LeeTutor. I can get to that menu so I'll give it a try. steveb2009

chkdsk c: /r or /p were the only options given. I am running /r. Looks like it will take a while. I'll post when I get a result. back soon, steveb2009

Next best bet would be to get a laptop 2.5" hdd adapter and slave it to a PC, and scan the hdd for viruses that way.. Plus it will give you a chance to get the data off of it.....

Thx for the suggestion johnb6767. I have found one at a store in my neighborhood. The checkdisk keeps re-setting to 50% completed. Perhaps I'll go get the enclosure while it works out. back soon, steveb2009

chkdsk fixed some errors but still getting the shutdown. Off to get an enclosure. steveb2009

Enclosure didn't fit the Toshiba drive. Back at it tomorrow. Thanks for the suggestions, steveb2009

Start>run>services.msc

scroll down to the properties of the below services

"DCOM Server Process Launcher"

"Remote Procedure Call (RPC)"

for each of those services >right click>properties>recovery & in the first 3 drop down lists choose "Take no action" where it mentions what actions to be done in case of service failure.

this should take care of the reboots for the time being.

also I would strongly suggest to check for windows updates, this message could mean that your machine is lacking an important or critical update .

if you are unable to perform the above steps in normal mode , then try to boot into safe mode , Last known good configuration or any other mode where the machine will stay running long enough.

Thx for the suggestions. All available modes produce the same result: shutdown within a couple of minutes. Computer is very slow to follow any commands. I have done the run>services.msc command many times but it always shutsdown before the command executes. Not my computer so I don't know how much startup load is being done. Tried run>msconfig but can't get to that to clear the startup.

Buying an adapter cable for an external enclosure as soon as the stores open.

Thx again for the suggestions. Keep them coming! steveb2009

At this stage, the Original Recovery CD sounds good if there was one.

also this could indicate Malware infection of some sort.

try to boot up using Ultimate boot CD or any Antivirus bootable / live CD to scan for viruses

the process is usually the same, download , burn & boot using the CD.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Setup the Bitdefender Rescue CD. Couldn't update the signatures online altho I could reach the Bit Defender website. Scanned anyway but found nothing.
Will now pull out the HDD and scan with up to date signatures from my computer. More later. steveb2009

Drive is out and accessible in an enclosure.

Scanned with updated Bit Defender and Avira Anti-Vir. No infection found. Scanning now with TrendMicro on-line scanner. Any thoughts today?

thx, steveb2009

Here are the only results of scanning with Bit Defender, Anti Vir, Trend Micro and Malwarebytes. The latter found this:
Malwarebytes' Anti-Malware 1.33
Database version: 1713
Windows 5.0.2195 Service Pack 4

2/1/2009 1:02:57 PM
mbam-log-2009-02-01 (13-02-57).txt

Scan type: Full Scan (E:\|)
Objects scanned: 76359
Time elapsed: 3 hour(s), 14 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
E:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8LCF39D1\gu[1].htm (Adware.Agent) -> Quarantined and deleted successfully.
E:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8LCF39D1\gu[2].htm (Adware.Agent) -> Quarantined and deleted successfully.
E:\Program Files\eMusic Download Manager\winamp_plugin.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP75\A0012607.dll (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\cpnprt2.cid (Adware.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\cpnprt2.cid (Adware.Agent) -> Quarantined and deleted successfully.

I deleted the 6 files noted. Reassy'd the computer and tested. Same result. Still shuts down.

Any thoughts? Steveb2009

Perhaps a HijackThis logfile might shed some insight...

http://www.hijackthis.de

Or........

Might even be worth trying to uninstall SP3 from the recovery console. That way you wont get shutdown in the middle.....

Once your booted into the recovery console type the fopllowing.....

cd $ntservicepackuninstall$\spuninst

batch spuninst.txt

When it is done, type exit to restart... Lets see how SP2 works for you.....

No time to review anything. steveb2009

I did a repair installation (not via the Recovery Manager but via Install, repair existing) to try to keep the applications intact, managed to get to services and changed both RPC and DCOM to "take no action". I'm still getting the failures but now I can see this:
Application Error
Exception EAccessViolation in AVGTOO~1.dll at 0002D8C8
Access violation at address 01DED8C8 in Module AVGTOO~1.DLL write address of 00000000

This occurs whenever I try to access the file system. I click "OK" the machine waits 10sec or so, all the icons disappear, come back and all looks fine. Click anything and the error re-appears.

I can get to Event Viewer. The application and system logs are long and have errors and warnings. If I could copy them I would post them here. However, any access to Documents results in the error above.

Any thoughts? thx, steveb2009

can you start>run>control appwiz.cpl, and remove your AVG Antivirus?

I'll try. I just disabled 2 services referencing AVG. THx, steveb2009

The add/remove window was initially blank. The access settings window was set to "custom". When I changed it back to Computer Manufacturer, the add/remove window filled up. I cannot remove AVG because it is an "unsupported version". Apparently somebody loaded a Win 2000 version somehow or maybe the Hdd was copied over.

Any other way to remove it that doesn't use the file system?

thx, steveb0009

Revo Uninstaller Freeware - Uninstall Software, Remove Programs ...
http://www.revouninstaller.com/

Personally, never used it, but very highly referenceed here at EE by a lot of folks.....

I pulled the Hdd out and deleted the AVG directory and all the references in Docs and Settings and that I could find in Windows. Boots with no error messages.

Services start ok, I have access to the file system! chkdsk c: /r completes ok; will defrag overnight. Map is a mess.

Thx, more tomorrow! steveb2009

Working but...drive access is slow. Event log shows wmiaprpl timeout errors. steveb2009