XP Home - can't complete boot - NT Authority Shutdown

[rob2]

XP Home Edition - HELP can not Boot

Hello,

I am new to Techspot but this looks like a great site.

I have XP Home Edition with latest critical Windows UPdates and Norton AntiVirus updates installed. I used dial up to access the internet.

When I attempt to boot I get the following popup message after it says Windows is Starting up:

System Shutdonw intiated by NT AUthority
WIndows/System32/services.exe terminiating unexpcetedly
status code 1073741818

in 60 seconds.. it shuts down and reboots over and over again.
I can not gain access to the system.

I am not sure if this is a virus (variant to Master Blaster) or if something is corrupted on my PC. I did do a abnormal shutdown late lates night.

A few months ago I did have the master Blaster worm but which I successfully removed (at least I though)and plugged up the Windows hole for RPC calls and have been virus free since.

WHat is different about this is that I am not on the internet when I get the shutdown notice.

SO I am NOT sure whether this problem is due to a virus or Windows OS corruption.

I think I am going to have do a fresh install from my orginal XP CDROM but I have been bad about backing up and I am so afraid of losing important data.


I have my orignal XP CD ROm and I got in to the System Repair Console. I chose the Repair option and got the list of functions like LISTSVC, COPY etc. I am hoping to be able to copy to diskette some important files However I got an Access Denied message when I tried to Change DIrectories.


I read that I may not lose data if I chose XP Setup but want to be sure before I proceed.

ANyone out there who has any ideas as to what is going on?


THANK YOU SO MUCH,

Robin

 

[Mictlantecuhtli]

Welcome to TechSpot Forums

Have you read NT AUTHORITY shutting down my PC thread?

If I remember correctly, somewhere there are instructions on how to disable that automatic shutdown process.

 

[rob2]

Thanks for the reply. I read the NT AUthority thread but it does not seem to give me a way to apply the fix if I cant gain access to the system.

It appears that I have an unusual variant of the Blaster RPC SHutdown worm because it initiates before I have fully started Windows XP. Thus I have no access to apply fixes, run scans etc.
I need a back way in.

I have also been diligient in the last few months in apply all the Critical Windows Updates and Using LIve Update from Symantec so I do not understand how the worm got in???!??






Microsoft is exclating this to Level 2 BUT they will take form 3-5 days to call me back.

 

[Goalie]

If you boot into a safemode, does it keep the problem from occuring?

 

[rob2]

Hi,

Even in Safemode the Shutdown Message pops up before I gain access.

 

[partypooper]

This is a virus!!!!

It is a virus !!!. Try rebooting the pc in safe mode. If this is possible then you have a virus in your windowsfolders before i try to really explain it all and then that not being the answer try this first. P.S. Write This Down :- Click on start. Click on run. Type in the line "msconfig". Click on Boot ini. Check the box "safeboot". Click on Apply. Computer will ask you to restart. Click on yes. When computer rebootes click on yes. If it completely boots up then i know how to get over the problem. To come out of safe mode just reverse the procedure. I will watch 4 ur reply

 

[Mictlantecuhtli]

partypooper, did you read the two previous replies?

rob2: You can repair XP by following the instructions given in HOW TO: Repair Windows XP/2000 if you are unable to boot into Windows.

 

[rob2]

Hi,

Thanks for following up on this.
The instructions fon How to Repair Win XP if you are unable to boot , were exactly what I did. However I did not see this in time and wound up going through the free Microsoft hotline for viruses 1-866-PC SAFETY. This does not seem to be well advertised but the people are helpful (at least when I got to level 2 support)

They walked me through the EXACT same instructions and I am now up and running and did not lose any data. Although I lost 4 days of PC productivity and a lot of sleep!

I am still not sure how I got the virus when I was up to date with NAV 2003 and all windows updates. I have now added two more things to my list : Ad-Aware and Spybot Search and Destroy.

Thanks again for your follow up,

Robin