[steve2267]

Help Me!

Sorry, j/k.

Problem Description:

May laptop, a Sony VAIO PCG-V505EX, running Win XP Pro SP2 is hosed. It is spontaneously rebooting with the following message in a popup window:

System Shutdown
the system is shutting down. Please save all
work in progress and log off. any unsaved
'changes will be lost. This shutdown was
initiated by NT AUTHORITY\SYSTEM

Time before shutdown:

Message: 00:00:60

Windows must now restart because the
Remote Procedure Call (RPC) service
terminated unexpectedly

"shutdown -a" will abort the shutdown.

I have been running AVG Free edition, ZoneAlarm Pro Suite, Windows AntiSpyware (Beta) with no issues for several months now.

Background:

Yesterday, while connected via 100baseT hardline to my corporate LAN, I decided I would finally install/upgrade to the latest version of Zonealarm Pro / Suite. Without disconnecting from the LAN (stupid?), or shutting down Microsoft AntiSpyware (Beta), or shutting down ZoneAlarm Pro, I simply double clicked on zaSuiteSetup_61_744_001_en.

Somewhere along the way, either the install went horribly wrong, or something went horribly wrong with the system whilst the install was underway... Went horribly wrong in that a number (3-6?) of popup windows appeared: < Application > has encountered a problem an needs to close. We are sorry for any inconvenience. To be honest, I do not recall if these popup windows occurred immediately after I clicked on [ OK ] in the window saying the system needed to reboot, or if they appeared and I went ahead and clicked [ OK ] figuring the system reboot would clear everything out.

Status:
System will boot. However, either while the Login screen is appearing or immediately after logging in, the popup window System ShutdownThe system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM. Time before shutdown: 00:00:60 Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly.. Start -> Run -> "shutdown -a" terminates the shutdown attempt.

The first thing I did was Google for the above shutdown message. Since then, I have downloaded the MSBLASTER fixer program from Symantec. It did not detect MSBLASTER anywhere. Then I downloaded the latest Micro$oft Windows Malicious Software Removal Tool (Windows-KB890830-V1.16.exe), burned it to a CDR on a different system, and ran it on my laptop. A full scan of the system revealed NOTHING.

I am guessing something went horribly wrong during the ZoneAlarm upgrade...

I have since:

• Uninstalled ZoneAlarm Pro
• attempted to uninstall M$ AntiSpyware (Beta)... but it fails:
  

  
  The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if
  the Windows Installer is not correctly installed. Contact your support personnel for assistance.
  

• Attempted to run System Restore. But this won't run either: System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again. [ OK ]
• System restore does not run from the command line:
  > %systemroot%\system32\restore\rstrui.exe ->> nothing
  try it a second time...
  > %systemroot%\system32\restore\rstrui.exe ->> get a blank window; window background 100% white
• sfc /scannow fails...
  > sfc /scannow
  Windows File Protection could not initiate a scan of protected system files.
  
  The specific error code is 0x000006ba [The RPC server is unavailable.]
  
  I even manually started RPC via: "services.msc /s" -> click on Standard tab -> right click "Remote Procedure Call (RPC)" and selected "Start"
• running system restore from the cmd.exe prompt yields a blank, 100% white window

I'm stumped... anyone have any advice on how I might resurrect this system? Should I try a Windows Repair install? I'm at the point where I think I purchase another hard disk, install from scratch, and copy over all my user files...

I do NOT have a current good backup. With the size of disks these days... how do you guys backup your BIG 40-80GB disks? Purchase another hard disk? Multiple DVDs? (A pain in the arse if you ask me.) Tape? Seems slow... Samba server with RAID at home, maybe?

Edited by steve2267, 24 May 2006 - 10:56 AM.

[Advertisements]

Did you click run to install or save the Zone alarm file to the drive?

[Retired Tech]

Did you click run to install or save the Zone alarm file to the drive?

[steve2267]

I had double clicked on the ZoneAlarm update file. I had previously saved the ZoneAlarm update file to my hard disk when I had previously been prompted by ZoneAlarm that an update was available. It had probably been sitting on my hard disk for a month or more before I got around to trying to update it.

Question: Does this sound like a case of a Windows installer going horribly wrong? For example, I can no longer uninstall MS AntiSpyware (Beta). I am *guessing* that perhaps MS AntiSpyware (Beta) was fighting with ZoneAlarm update/install procedure. I do recall getting several popup windows from MS AntiSpyware (Beta) to which I had always clicked [Allow] or [OK] to let the ZA update proceed...

[Retired Tech]

I have just installed zone alarm without cancelling other programmes

You can double click it now and then choose clean install, click yes when it shows the security check and see if it installs and runs any better

[steve2267]

I have re-installed ZoneAlarm Pro Suite from scratch and ... I have set the RPC to "restart service" rather than "restart computer" and rebooted... waiting for my personal settings to load...

[Retired Tech]

The start up type for remote procedure call can be automatic, the start up type for remote procedure call Locator can be manual, with both started

[steve2267]

System has rebooted... ZoneAlarm appears to be running... but things still aren't right.

The Start menu bar at the bottom of the screen is acting "wierd". Previously it was almost 100% hidden at the bottom of the screen. Right now, no program icons are showing up along the toolbar at the bottom of the screen, and the "Start" button itself is chopped off at the bottom... it's like the "Start" button is too big, or the toolbar at the bottom is not high enough.

sfc /scannow seems to want to run now. At least it is asking for a CDROM.

Other notes...

I cannot find a DLLcache folder in c:\windows\system32\ directory. When I try to "search" by clicking on "Search" button in an explore window... the left side of the window comes up blank -- all blue. Clicking "Search" a second time gets me the "System Tasks" and "File and Folder Tasks" subwindows... but if I click on "Search for files or folders" the left pane turns solid blue (and blank) again...

[Retired Tech]

Reboot when the scan finishes, see how it is

If you right click the taskbar, untick lock the taskbar, can you move it up a bit

Has the screen resolution changed

[steve2267]

[quote name='Keith' date='May 24 2006, 12:34 PM' post='680568']
Reboot when the scan finishes, see how it is
Awaiting scan to finish... it keeps popping up a window requesting the CDROM. I keep clicking <Retry>.

[quote name='Keith' date='May 24 2006, 12:34 PM' post='680568']
If you right click the taskbar, untick lock the taskbar, can you move it up a bit
[/quote]
Negative. Lockbar was not locked. Tried locking/unlocking, hiding/unhiding... no change. Still doesn't look right. Task icons still not displayed across the bottom of the taskbar.

[quote name='Keith' date='May 24 2006, 12:34 PM' post='680568']
Has the screen resolution changed
[/quote]
No, screen resolution is 1024x768x32 as before. Screen looks ok. Desktop icons got re-arranged at somepoint by some process -- I did not request it.

Question: Is it true that sometimes you could end up with a poisoned DLLcache... and you need to remove ALL files from the DLLcache before running sfc /scannow? If so, where should I find the DLLcache folder? (I could not find anything remotely resembling dllcache in c:\windows\system32\...

[Retired Tech]

sfc should replace any incorrect files, you may need to open my documents, click tools, folder options, view, put the dot in show hidden files, click apply then look for the folder