[incredigirl]

Hi! I'm a new to the forum and I've (naturally) got a bit of a problem. My friend has an XP system and had Norton AV on it. Norton expired sometime ago and he didn't get a new AV program until yesterday. He bought and installed Panda Titanium 2005. Now when the system boots and he clicks on any of the user accounts, it logs in, but the taskbar is gone and then in about a minute, it gives an error about "RPC terminated unexpectedly" and shuts down. It reminds me of how systems act when they have the MSBlaster worm, but I don't see any indication of the worm. He called me for help because his Quickbooks for his business are on the system and he needs to do his business taxes before he goes out of town on Saturday!

Without the task bar, there's no "start" button to click, and pressing the windows key doesn't bring up the start button either, so I can't even get a command prompt so I can abort the shutdown. Nothing works right--if you click the IE icon, it opens for a second and then immediately closes and then the shutdown window comes up saying its shutting down in 59 seconds. I can boot in "safe mode w/command prompt" and do a regedit, but if I boot in "safe mode" or "safe mode with networking", I can't do much. I've tried everything I can think of. Using the recovery console, I've copied the userinit.exe to wsaupdater.exe to see if that takes care of the login/logout loop problem, but it didn't. I checked Panda's website to see if there was a FAQ about this problem and I didn't see one. I'm assuming the system was infected with a worm before Panda was installed and now Panda and the worm are fighting it out. I checked the processes in Task Manager but I don't see anything that strikes me as unusual.

Because of the time crunch to get this working, I could really use your help. He does have his original Dell XP disk and I've been thinking about trying the Repair process, but I just want to make sure I'm not going to lose any of his settings or data. I know if he takes this to the local repair shop, they are just going to recommend a reinstall.

His system doesn't have HJT on it. I've got it on a USB key, but he doesn't have "My computer" on his desktop and I can't get the taskbar, so I can't get to windows explorer to even try to copy the program in. I brought the system home to work on tonight so it's not connected to the internet right now. I'm not sure if he has all of the current patches on the system or not and I can't check anything because it won't stay up long enough!

Any suggestions about how I can get the login problem, the taskbar problem and the reboot problem fixed? If I can get it to run normally, I can at least run Ad-aware and the other programs to clean up the system, but I'm kind of stuck right now. Thanks for your help!!!

Hope

[Advertisements]

hit CTRL-ALT-DEL

on APPLICATION tab, hit NEW TASK button

type in appwiz.cpl, then hit OK

use add/remove software to remove PANDA (and norton, too, if still there.

reboot....

better?

[gerryf]

hit CTRL-ALT-DEL

on APPLICATION tab, hit NEW TASK button

type in appwiz.cpl, then hit OK

use add/remove software to remove PANDA (and norton, too, if still there.

reboot....

better?

[incredigirl]

Hi, gerry. When I get the add/remove window open and try to remove panda, I get an error "Setup failed to launch installation engine: The RPC server is unavailable." It doesn't matter how quickly I do this, the shutdown message occurs during the time I'm trying to run the uninstall. I booted into "safe mode with command prompt" and created a batch file on the allusers\desktop that contains the command "shutdown -a" to abort the shutdown, and it will abort it for a few seconds when I run the batch file, but then the shutdown tries to run again. I can't uninstall panda even if I kill the shutdown before attempting to start the remove. I get the same message either way.

Norton isn't on the add/remove list anymore, by the way, so I guess he did remove it before installing Panda.

Since I can do a regedit, what do you think about removing the "APVXDWIN" key from hkey_local_machine\software\microsoft\windows\current version\run in order to stop Panda from running? I haven't done that yet because I wanted some advice before I dink with something that could make the problem worse (i.e. if windows won't boot at all).

I appreciate your time. Any additional advice? How do I repair the RPC process since it seems to be part of the problem?

Hope

Edited by incredigirl, 06 May 2005 - 08:18 AM.

[gerryf]

i don't see anything wrong with removing that setting, but I think we need a few more as well....let me see what i can find....

[gerryf]

yes, there is also a service...and the more likely cause.

start > run
services.msc
enter

scroll down and stop the panda antivirus service, then set the startup type to disabled

[incredigirl]

Since I can't do a Start--> Run (no taskbar), I did a ctrl-alt-del and selected applications -->New task and entered "services.msc". I immediately got the message about "The system needs to shutdown because Remote Procedure Call (RPC) terminated unexpectedly." I used the batch file to cancel the shutdown. The services window opened, and I clicked on the "Standard" tab. I scrolled down to the Panda services, but there are a number of them and I'm not sure which one to stop first. I selected "Panda Antivirus Service" and selected stop. After it stopped, I got another "The system needs to shutdown..." error and again I was able to abort the shutdown. But when I tried to stop any of the other Panda processes, I would get a message "Could not stop <service>. Error 1053: The service did not respond to the start or control request in a timely manner."

When I scroll down to Remote Procedure Call it shows "starting". The shutdown messages comes up again, but now I can't abort it. I also noted that the CPU Usage is 100% from the time I first get logged in until just shortly before the shutdown. As the shutdown counter gets down to 30 seconds, the CPU usage drops to 0%.

I also found an article on the Panda website about an incompatibility problem with some processors that causes "constant restarts, blue screens, blocks" which sounds similiar to what I'm seeing on this system, but the system has a Pentium 4 and Panda says this only affects 64-bit processors (AMD 64, Sempron, etc).

Almost forgot to mention that after I stop the Panda AV process, I can't get into properties and all other options are greyed-out, so I can't disable the process to keep it from starting on reboot.

Any other ideas?

Edited by incredigirl, 06 May 2005 - 06:08 PM.

[incredigirl]

It's been a few days and I'm still hoping someone can help. Any experts out there willing to jump in and help me figure this one out?? Please?

[SA_Max71]

the last time I saw something like this, there was a gaobot virus on the computer. This happend when the virus forced one of the "svchost.exe" to shut down. Because the virus was running, every time the computer would boot up I would have 60 seconds to do what ever I wanted to before the computer would reboot or shutdown. Although the computer has a 2.6ghz CPU chip in it, my old 166 mgz computer was running faster than it. This was due to the virus. So... Maybe you have a virus on your computer?

Also, you can get a new subscription for norton antivirus if you uninstall it and then reinstall it.

Edited by SA_Max71, 11 May 2005 - 12:50 PM.