DCOM shutdown error

[Guest]

I'm at my wits end on this.

I am receiving the following shutdown message when I come off of standby
mode - "System shutdown initiated by NT Authority/system System must restart
because DCOM server process launcher terminated". I have run several scans
using Ad-aware SE, spybot, and Norton and I'm coming up clean for malware or
virus. I posted all my scan logs and hijack this logs in another forum and
was advised by the administrators that my pc was clean.

The only other item that appears new to me is an outlook express pop up that
regularly appears when there is no identity signed on the program asking for
an identity to sign on.

Obviously these two may not be related at all.

Has anyone seen anything like this?

Thanks
Dan

 

[Alec S.]

I'm at my wits end on this.

Take it easy, we'll help get you through this.

I am receiving the following shutdown message when I come off of standby
mode - "System shutdown initiated by NT Authority/system System must restart
because DCOM server process launcher terminated". I have run several scans
using Ad-aware SE, spybot, and Norton and I'm coming up clean for malware or
virus. I posted all my scan logs and hijack this logs in another forum and
was advised by the administrators that my pc was clean.

That message has been attributed to various viruses, trojans, and worms (oh my!) Do you have all the Windows patches? There is a
patch that is supposed to stop the exploit that causes it, but you need to disconnect from the Internet and reboot before applying
it to make sure that it is installed correctly. Here is the patch:
http://download.microsoft.com/downl...e-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

There are also specific removal tools that you can use to scan for the particular malware that causes it. Symantec has a variety of
removal tools: http://securityresponse.symantec.com/avcenter/FixBlast.exe - you'll want to try the one for Blaster. McAfee has the
Stinger: http://download.nai.com/products/mcafee-avert/stinger.exe Try these if you haven't already.

Another thing you should do is to check the event log (Run->eventvwr). Take a look in there to see what events where initiated
before and after your system went into and came out of standby. Is there anything suspicious (warnings or errors)? Do you see any
events that mention the DCOM service?

The only other item that appears new to me is an outlook express pop up that
regularly appears when there is no identity signed on the program asking for
an identity to sign on.

Obviously these two may not be related at all.

You're right, that's probably not related. It sounds like you're describing the MSN Messenger; it gets started automatically with
OE and demands to be logged in. It probably came back after OE was updated when you last used Windows Update. There's several
programs that can disable it so that it does not start with OE. The one I used is called Outlook Express 5.0 Tweak'r from Jefferson
San Juan http://home.sol.no/~jeffx/.

 

[Gerry Cornell]

Defos

Please check Event Viewer for Warning / Error Reports in the System
log for when the error occurs and post copies.

You can access Event Viewer by selecting Start, Administrative Tools, and
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&sd=tech

Part of the Description of the error will include a link, which you should
double click for further information. You can copy using copy and paste.
Often the link will, however, say there is no further information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double click
on the error you want to copy. In the window, which appears is a button
resembling two pages. Double click the button and close Event Viewer. Now
start your message (email) and do a paste into the body of the message. This
will paste the info from the Event Viewer Error Report complete with links
into the message. Make sure this is the first paste after exiting from Event
Viewer.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Gerry

I'm not sure I did this right. I get a warning and an error a minute before
I get the shutdown error.

The first warning is as follows -

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 10/1/2006
Time: 7:26:17 AM
User: N/A
Computer: (removed)
Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address (removed). The
following error occurred:
The semaphore timeout period has expired. . Your computer will continue to
try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 79 00 00 00 y...


The first error is as follows -

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1000
Date: 10/1/2006
Time: 7:26:17 AM
User: N/A
Computer: (removed)
Description:
Your computer has lost the lease to its IP address (removed) on the Network
Card with network address (removed).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

A minute later, here is the ervent before the shutdown error -

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 10/1/2006
Time: 7:27:03 AM
User: NT AUTHORITY\SYSTEM
Computer: (removed)
Description:
The process winlogon.exe has initiated the restart of(removed) for the
following reason: No title for this reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the DCOM Server Process Launcher
service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...

And here is the shutdown error -

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 10/1/2006
Time: 7:27:03 AM
User: N/A
Computer: (removed)
Description:
The DCOM Server Process Launcher service terminated unexpectedly. It has
done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Any help would be most appreciated.

Thanks
Dan

 

[Guest]

I'm not sure I did this right. I get a warning and an error a minute before
I get the shutdown error.

The first warning is as follows -

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 10/1/2006
Time: 7:26:17 AM
User: N/A
Computer: (removed)
Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address (removed). The
following error occurred:
The semaphore timeout period has expired. . Your computer will continue to
try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 79 00 00 00 y...


The first error is as follows -

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1000
Date: 10/1/2006
Time: 7:26:17 AM
User: N/A
Computer: (removed)
Description:
Your computer has lost the lease to its IP address (removed) on the Network
Card with network address (removed).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

A minute later, here is the ervent before the shutdown error -

Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 10/1/2006
Time: 7:27:03 AM
User: NT AUTHORITY\SYSTEM
Computer: (removed)
Description:
The process winlogon.exe has initiated the restart of(removed) for the
following reason: No title for this reason could be found
Minor Reason: 0xff
Shutdown Type: reboot
Comment: Windows must now restart because the DCOM Server Process Launcher
service terminated unexpectedly

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ff 00 00 00 ÿ...

And here is the shutdown error -

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 10/1/2006
Time: 7:27:03 AM
User: N/A
Computer: (removed)
Description:
The DCOM Server Process Launcher service terminated unexpectedly. It has
done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Any help would be most appreciated.

Thanks
Dan

 

[Guest]

Is it possible that this is caused when Norton LiveUpdate tries to connect
when the PC is in stand by?

Thanks
Dan

 

[Alec S.]

Is it possible that this is caused when Norton LiveUpdate tries to connect when the PC is in stand by?

Not likely, something (probably the aforementioned malware) is killing off the DCOM service which causes the system to reboot in an
attempt to fix it.

 

[jims405]

I am receiving the following shutdown message when I come off of standby
mode - "System shutdown initiated by NT Authority/system System must restart
because DCOM server process launcher terminated". I have run several scans
using Ad-aware SE, spybot, and Norton and I'm coming up clean for malware or
virus. I posted all my scan logs and hijack this logs in another forum and
was advised by the administrators that my pc was clean.

The only other item that appears new to me is an outlook express pop up that
regularly appears when there is no identity signed on the program asking for
an identity to sign on.

Obviously these two may not be related at all.

Has anyone seen anything like this?

Thanks
Jimmy

 

[jims405]

I am receiving the following shutdown message when I come off of standby
mode - "System shutdown initiated by NT Authority/system System must restart because DCOM server process launcher terminated". I have run several scans using Ad-aware SE, spybot, and Norton and I'm coming up clean for malware or virus. I posted all my scan logs and hijack this logs in another forum and was advised by the administrators that my pc was clean.

The only other item that appears new to me is an outlook express pop up that regularly appears when there is no identity signed on the program asking for an identity to sign on.

Obviously these two may not be related at all.

Has anyone seen anything like this?

Please Gimme a Perfect Solution as early as possible.

Thanks
Jimmy

 

[jims405]

I am receiving the following shutdown message when I come off of standby
mode - "System shutdown initiated by NT Authority/system System must restart
because DCOM server process launcher terminated". I have run several scans
using Ad-aware SE, spybot, and Norton and I'm coming up clean for malware or
virus. I posted all my scan logs and hijack this logs in another forum and
was advised by the administrators that my pc was clean.

The only other item that appears new to me is an outlook express pop up that
regularly appears when there is no identity signed on the program asking for
an identity to sign on.

Obviously these two may not be related at all.

Has anyone seen anything like this?

Thanks
Jims

 

[loka]

DCOM error - Event information

Hi,

I am facing the DCOM shutdown error and my laptop restarts. I have been reading the previous posts about the error and it was helpful in figuring out the events that occured. I am copy pasting the errors here with event ID..I would be glad if anybody could help me out on this...

1. DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event: 10005

Source: DCOM

User: SYSTEM

2. The server {7429F543-2A60-4CB7-8BC5-F27EA898FB44} did not register with DCOM within the required timeout.

Event: 10010

Source: DCOM

User: SYSTEM

Please let me know if you need any other information..I really need a fix for this..Thank you in advance

Kind Regards,
Loka