System shutdown - DCOM

Hello,
The computer shuts down a few minutes after I log onto WindowsXP. I get following error message. Can you please help me with this

System Shutdown.
The shutdown was initiated by NT Authority/System
Message:
Windows must now restart becasue the DCOM Server Process Launcher service terminated unexpectedly
johnkainnAsked:
Who is Participating?
 
SAM1Commented:
you can try the following to recover from this error
1.  Do virus / spyware / malware scan
2.  Perform a system restore, to revert back to working state

3.  Try to check if the DCOM server process launcher service is running on the computer.

You must be logged on as an administrator to perform these steps.

1. Open Administrative Tools by clicking the Start button, and then clicking Control Panel. In the search box, type administrative tools, and then click Administrative Tools.
2. Double-click Services. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Right-click the DCOM server process launcher service, and then click Properties.
4. On the General tab, next to Startup type, make sure that Automatic is selected.
5. If the service is not already running, under Service status, click Start, and then click OK. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
 
If the above step fails I would suggest that you check in the event viewer to know the cause and post back with details from the event viewer.

1. Open Event Viewer by clicking the Start button, clicking Control Panel, clicking System and Maintenance, clicking Administrative Tools, and then double-clicking Event Viewer. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
2. Click on  event log in the left pane.
3. Double-click an event to view the details of the event.

What information appears in event logs? (Event Viewer)
http://windows.microsoft.com/en-US/windows-vista/What-information-appears-in-event-logs-Event-Viewer 

0
 
greg_vanderCommented:
hi
check for virus in safe mode.
0
 
JonveeCommented:
Looks as though you may have a Malware infection, as intimated above.   This previous thread should prove useful>

Windows restarts because "DCOM Server Process Launcher service terminated unexpectedly":
http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Q_22479062.html

One of the best Malware scanners around at present is Malwarebytes.  So i highly recommend downloading & updating Mdwarebytes anti-Malware, from here:
http://www.malwarebytes.org/mbam.php
When updated, reboot into Safe Mode by depressing F8 and run a scan.

Tutorial available, if you require >
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t169669.html

If you cannot run mbam, try downloading a new mbam and rename it *before* saving it to your desktop, then try again.
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
greg_vanderCommented:
you are just the first has been attacked by a mc afee false positive :
http://vil.nai.com/vil/5958_false.htm
0
 
johnkainnAuthor Commented:
Thank you all. I think this is the error Greg Vander mentioned.
Mcafee provides some fix that one should download to the infected machine.
The infected machine can no longer connect to internet, so I downloaded the patch to another machine and then to a cd.  But now I cannot paste the file to my infected computer from the external drive.
Any suggestion what I should do?


0
 
B HCommented:
well, copy/paste will be broken without svchost.exe working...

mcafee's fix will only install the "fixed" pattern file and won't replace the critical file they killed.

here's a link, with potential fixes:
http://isc.sans.org/diary.html?storyid=8656

rather than copy/paste, you'll probably need to use dos
start > run > cmd
d:  
(or whatever the external disk is)
copy filename.ext c:\windows\system32  (or wherever it belongs, depending on the file)

0
 
greg_vanderCommented:
the solution I would use is to boot with a live cd to copy the file svchost.exe.
0
 
johnkainnAuthor Commented:
Thanks. Can you please explain what you mean by booting with a live cd?
0
 
B HCommented:
there are 2 new fixes posted today, including a utility created by mcafee to fix it:
http://vil.nai.com/vil/5958_false.htm

note:  please consider uninstalling mcafee after you get a working machine :)


0
 
greg_vanderCommented:
download knoppix  or ubuntu or an other linux distrib :

http://www.knopper.net/knoppix/index-en.html
http://www.ubuntu.com/GetUbuntu/download

then burn the iso image to a cd/dvd-rom
reboot your machine for booting on the CD drive.
you'll be on linux without disturbing your hard drive. everything turn on the cd.
then you'll be able to move/copy the file you need.
hope this helps
0
 
johnkainnAuthor Commented:
I would like first to try to use run to copy.
The name of my drive is D
The name of the file on it is 5959xdat.exe I tried to copy but it did not succeed. Probably I have not done it correctly. It would be great if you could write exactly what I should write in RUN command as I have never used it before.

0
 
johnkainnAuthor Commented:
I am afraid I did a big mistake. I installed ubunto.  Now I cannot reboot the computer.
Did I overwrite everything?
0
 
johnkainnAuthor Commented:
I was able to run Windows again.
It would be great if you could help copying the files to the infected computer.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.