Solved

Windows restarts because "DCOM Server Process Launcher service terminated unexpectedly"

Posted on 2007-03-28
7
47,895 Views
Last Modified: 2013-11-22
Dell Precision 340 running XP Pro and Norton Anti-Virus Corporate Edition.  Installed PCTools SpyDoctor (full version) two days ago.  Got rid of my spyware problems (I think) but now whenever I turn on the machine about a minute or so after windows loads i get a timed shutdown message that says:

"Windows must now restart because DCOM Server Process Launcher service terminated unexpectedly. " The shutdown is initiated by NT AUTHORITY\SYSTEM

This occurs in safe mode as well.  If I can manage to log in to windows quick enough, I can stop the shutdown by issuing "shutdown /a" from the command line.  Once that is done I don't seem to have any problems. . .

Thanks in advance for your help. . .
0
Comment
Question by:a2hIT
7 Comments
 
LVL 39

Expert Comment

by:PUNKY
ID: 18813641
Run msconfig and stop SpyDoctor see if it stops error.
0
 
LVL 4

Expert Comment

by:Soutie
ID: 18814267
that sounds like a sasser/blaster variant.
when you scanned your machine for malware did you find anything? if so and it was removed did you disable system restore?  Not disabling system restore first could lead to reinfection.
What version of corporate are you running.  Versions before 9 (I think it was) wern't very good at removing malware.  Upgrade to 10.1 if possible.
0
 

Author Comment

by:a2hIT
ID: 18815640
PUNKY: "Run msconfig and stop SpyDoctor see if it stops error"
Unchecked everything in msconfig that listed Spyware Doctor.  No result.  Uninstalled SpyDoctor Completely -- still no change.

Southie: "when you scanned your machine for malware did you find anything? if so and it was removed did you disable system restore?"  -- YES
"What version of corporate are you running."  -- Older than 9  :-(  Upgrade is not really "in the budget"

Thank you both for your responses.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 4

Accepted Solution

by:
Soutie earned 500 total points
ID: 18815741
@ a2hIT
you definitly have some form of malware.  Maybe try running stinger and see if it picks anything up.

vil.nai.com/vil/stinger/

you are going to need to clear the offending virus off the machine and uptate to the latest microsoft patches. If i recall correctly there was a patch a while ago to stop the DCOM exploitation, but i could be down to correction.
0
 
LVL 23

Expert Comment

by:phototropic
ID: 18819995
Steve Gibson has produced a tool to disable DCOM:

http://www.grc.com/freeware/dcom.htm

This may help...

0
 

Author Comment

by:a2hIT
ID: 18820027
Thanks all.  Stopping Monitoring of this issue.  Thanks again.
0
 

Expert Comment

by:emoor
ID: 26503646
I get the error message that states that the system shutdown is being initiated by NT Authority/System and that Windows must now restart because the DCOM service process launch service terminated (which means I either have to use shutdown -a or reboot) BUT a McAfee scan picks up no virus, the stinger application picked up no virus and when I used Steve Gibson's tool I was told I have no DCOM service becausse I am running XP service pack 2.

Help?
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video discusses moving either the default database or any database to a new volume.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now