PC won't startup correctly and NT Authority keeps shutting me down

jfitts
jfitts used Ask the Experts™
on
My daughter was on Barbie dot com and clicked on a video and then my computer locked up.  I rebooted and then the computer wouldn't start up correctly anymore (Win XP).  First it gives errors about various services not being able to start up plus the task bar doesn't appear.  At varying times during the starup process, it will say that the NT Authority is shutting down the computer in 1 minute because RPC has terminated unexpectedly.  (Sometimes it says that DCOM Server Process Launcher is causing it to shut down.)  I have learned enough to use CMD to type "shutdown -a" to stop the shutdown... but I haven't been able to fix the system.

I have tried safemode, but the shutdown still kicks in.  I have tried to run system restore to a previous good configuration and it churns on that and eventually says it can't complete it.  I have got the system running enough to run Norton virus scans and it doesn't find anything.  I have run Microsoft's recent KB890830 malware fix and it says it doesn't find any malware.  I have used msconfig to keep all non-MS services from starting up, and to keep all items under STARTUP from starting up (and sometimes not run system.ini or win.ini).  The computer will work in that lilmited way and include a task bar, but the NT Authority shutdown still kicks in.  I also can't get the PC back on the internet except to activate the 56K modem.

I have not yet used MSCONFIG to deactivate any Microsoft services.  Should I?  Is RPC a real problem, or do I have some kind of undetected virus?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
It could be a bad case of virus (maybe even rootkit) infection. Is the computer fully patched? Do you have the latest Norton Antivirus definitions? You may want to try a couple of more advanced antivirus tools.

Please download and run ComboFix on the computer to fully examine your system. Let me know what you find...

http://www.combofix.org/download.php
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

This used to be the Klez virus and may still be what is causing your issue.  Can you get into task manager (ctrl+alt+del) and see what processes are running?  If you can find that process, then end task on it and it should keep it from shutting down.  Then, you can run a check with your antivirus.  If you don't have an antivirus, you can get good free ones like Malwarebytes and AVG at http://www.cnet.com    Let me know if you need further assistance.
Dennis JohnsonIT technician

Commented:
Maybe it sounds silly but try a chkdisk /f... Since you say that all this started after a "click on a video", it might be a bad sector on the disk and, after that, the disk has gone crazy... Just a theory, but you don't lose anything trying it.

Author

Commented:
That worked thank goodness.  The system is stable again, the taskbar is there, and it doesn't keep shutting down.  It doesn't tell me what type of virus or malware it found, but it deleted a bunch of files, such as:

lib.sig, bszip.dll, crt4.dll, kbdata4.dll, kboem32.dat, kbupdate.dll, sdra64.exe, unins000.exe and everything in a directory called c:\windows\system32\lowsec

When it was done I had to use MSconfig to get all the services going again, then re-activate my firewall, and then had do a little work to get the internet connection going again, but I'm back to normal.

Thanks a ton!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial