DEP Error & 60 Sec Reboot

[Akadai]

This one has stumped me so far, and it's extreamly annoying and preventing me from fully accessing the net.

It started with some nasty spyware that I quickly worked on getting rid of. I've run many programs to do so, and have also gone through my system manually. During this, I had unhooked my LAN cable to prevent any of the programs accessing the net. Once I believe that everything is gone and everything will work again, I plugin my LAN cord, and shortly after I get an error stating that it will reboot in 60 seconds initiated by NT Authority\System

I tried to go into task manager to close it and hope to prevent the reboot, but it was under the winlogon service, so there was no hope there. After the reboot, I unhooked my LAN cord once again, and then got a DEP error

Data Execution Prevention - Microsoft Windows

To help protect your computer, Windows has closed this progrom.

Name: Services and Controller app
Publisher: Microsoft Corporation

I have scanned I don't know how many times with many different programs, and can find no spyware or viruses on my pc. I have looked through all the processes in process explore and can't find much there either, though I'm not entirely sure what I'm looking for

I CAN run safe mode with net enabled without getting either errors. I was going to try and do a windows update, but it seems I can't do that in safe mode because it requires activex enabled to scan my pc of what upgrades I may need

I've been trying to work on this all day and my mind is fragged at the moment. Can someone please help me?

 

[linney]

WinXP Connectivity Issues
Lost Connectivity after Registry or Malware Cleanup
faq779-4625

If you type Shutdown /a in Start Run you can Abort any automatic shutdown and continue working.


I quote next from a missing thread about DEP issues and then include some general issues for you to look at.

"DEP Issues:
If still no joy Start the computer with the XP CD and run Recovery Console:

You can then use the following commands. The BOOT.INI file is write-protected, so you have to remove the read-only attribute first:

ATTRIB -S -H -R C:\BOOT.INI
NOTEPAD BOOT.INI
Carefully edit the /NoExecute=OptIn string and change OptIn to AlwaysOff. This part at the end of the line should now read: /NoExecute=AlwaysOff
Close the editor and resave the BOOT.INI file back to where it was.
ATTRIB +S +H +R C:\BOOT.INI

Contact tech support from the manufacturer about the issue, as this is a BIOS issue."

Courtesy of Bcastner.

 

[Akadai]

It's not that I'm having internet problems really, it's just the moment I hook up the lan cord it soon after brings up the 60 reboot error. During those 60 seconds, I can access network and the internet just fine. Also in safe mode, I get no errors and can access the network and internet

I wasn't aware of the /a command though, so I'm sure that will be helpful. I already read up about the boot.ini thing, though somehow I didn't feel it was too related. It's not really the DEP error that's screwing me over, it's the 60 sec reboot one when I'm connected to the internet

Without the /a command however, I've managed to stop it from rebooting my pc somehow if I just unhooked the lan cord once again before the 60 seconds was up. After this however, things slowly went down hill. I couldn't access any video files using different programs to run them, and soon after folders froze, explore would shutdown, then alt ctrl del would no longer work to bring up task manager

As of now, the pc has been handed over to someone else. I'll suggest what has been posted thus far

 

[paulha]

Sounds rather like the Blaster worm ?

Does

http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=36265

look familiar ?

Paul

 

[Akadai]

Indeed it does. Searching through the net about NT Auth/System errors, I could only find information that is about 1-2 years old, and most are refering to the blaster worm. Though with SP2 installed, I would think it wasn't that, but perhaps something trying to mimic it?

Though unlike the blaster worm, it's not effecting the Remote Procedure Call (RPC) service. Instead, it's effecting the system32/service.exe file and then reboots after the countdown. I managed to copy down the long code it gives at the end of this error, which is 1073741674

I'll try and copy the exact error word for word next time so I can post it here

 

[Sympology]

Maybe it is DEP stopping something running correctly.

Goto

System Properties> Advanced > Performance > Settings >advanced > Data Execution Provention.

Check it's set to the Default (Top Option) reboot and try again.

Stu..

Only the truly stupid believe they know everything.
Stu.. 2004

 

[Akadai]

I've already looked there more than once, it's currently on the default setting. I've tried different settings as well. The DEP error only comes up when I reboot with the lan cable disconnected. I don't even know where this Services and Controller app is

Here's the error in a bit more detail

System Shutdown

This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

Time before shutdown: ###

Message
The system process C:\WINDOWS\system32\services.exe terminated unexpectedly with status code -1073741674

There was a couple more words after that, but I couldn't copy it down in time

 

[linney]

Still seems that you have missed some malware.

Try these from Safe Mode and Normal Mode.

Removing adware & spyware
faq608-4650

Microsoft (GIANT Antispyware) Beta available
Thread779-979113

Try the free version of "Ewido"

http://www.ewido.net/

HijackThis log file analysis ( a rough guide only )

http://www.hijackthis.de/index.php

I saw this which might be worth a try?

"SERVICES.EXE Terminated Unexpectedly with Status Code 128" Error Message When You Start Windows 2000

http://support.microsoft.com/?id=318447

 

[Akadai]

Most of that is suggested were the first basic steps made. There is nothing out of the norm that is found in Hijackthis but the basics that should be there. Anything that shouldn't have been there is already gone.

The Microsft antispyware has always been running 24/7 and even missed most of what was loaded on the pc until it was too late. It reported what had happened about 1-2 minutes after it had already happened, which was the first time I've ever seen it delayed like that. I haven't tried Ewido yet, but I have feeling it's not going to find anything, seeing that we've already gone through the entire system manually

 

[paulha]

Go to

http://vil.nai.com/vil/stinger/

, download an run Stinger, I am moderately confident that this will so the trick.

Cheers

Paul

 

[linney]

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

What other machines are on your LAN, is the cause of the problem coming from one of them?