Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

NT AUTHORITY\SYSTEM shutdown


  • This topic is locked This topic is locked
10 replies to this topic

#1 Virus Prone

Virus Prone

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:42 PM

Posted 04 June 2011 - 08:31 PM

Hi, I was instructed by my moderator to post here for further help. My previous thread was http://www.bleepingcomputer.com/forums/topic400312.html/page__gopid__2276285

I've followed the Prep Guide, but my computer won't allow me to run any new programs. Everytime I try to execute one, I get a pop-up with a black screen and white writing that says "Program too big to fit in memory". So I don't have any logs I'm able to produce and send you. Please help! Thank you!

Here's my original post with the problem:
My computer keeps getting a popup that says, "System Shutdown This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM Message: Window must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly."
It then counts down 60 seconds and restarts. When it restarts, I often get a black screen with the cursor still visible. I have to push the power button to completely shut it down and then turn it back on. I've pulled the internet cable out, and that hasn't helped. I type in "shutdown -a" and that helps until the screen pops up again. I tried putting the DDS program and DeFogger onto a flash drive and installing it on the computer, but it won't allow me to. I was able to run Ad-Aware, and that come up clean. I can't run my normal Anti-Virus (CA Internet Security Suite). The whole strip at the bottom of the screen with the start button is and the running programs are has disappeared, so I have to Control-Alt-Delete to get to the Task Manager to attempt to open anything. I'm trying desperately to open and backup (it's been about a month since I've done so) my QuickBooks and photos. Any suggestions on how to get my computer back to normal?!

BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 11 June 2011 - 07:36 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks :thumbup2:
Posted Image
m0le is a proud member of UNITE

#3 Virus Prone

Virus Prone
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:42 PM

Posted 11 June 2011 - 11:26 PM

I am here and watching the topic. Thank you!

#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 12 June 2011 - 03:41 AM

Did you recently download the Visual Studio .NET product installation file?

Can you also let me know which operating system you are running?
Posted Image
m0le is a proud member of UNITE

#5 Virus Prone

Virus Prone
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:42 PM

Posted 12 June 2011 - 04:11 PM

I'm running Windows XP Pro. I don't believe I've downloaded that file. It's not allowing me to download/run anything right now.

#6 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 12 June 2011 - 07:05 PM

Let's try another tool to attempt to grab a log. This can be transferred via a USB device fine.

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Posted Image
m0le is a proud member of UNITE

#7 Virus Prone

Virus Prone
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:42 PM

Posted 12 June 2011 - 07:30 PM

When I copy it (or any other program) onto my desktop and try to run it, a black screen with white writing pops up and briefly flashes "Program too big to fit in memory" and then disappears.

#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 12 June 2011 - 07:44 PM

Right click on "My Computer" and select "Properties." Then on the "Systems Properties." window that opens press on the "General" tab. Here you will view the physical memory installed on your computer. The amount indicated is the total RAM installed on your computer. It is measured in MB or GB.

Check the amount of memory in use currently. To know this, open the taskbar or press "Ctrl + Alt + Delete" to open a pop up window.

Click on "Task Manager". Press the "Performance" button. You can view the amount of memory currently used by each program running on your PC.

Please let me know the RAM total from the first task and the amount of memory in use from the second.
Posted Image
m0le is a proud member of UNITE

#9 Virus Prone

Virus Prone
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:42 PM

Posted 12 June 2011 - 10:55 PM

1 GB of RAM, and while sitting idle, the CPU Usage is at 1%. Commit charge: 58M/ 4000M. PF Usage 59 MB. Physical Memory (K): Total: 1048064, Available: 840800, System Cashe: 175580

#10 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 13 June 2011 - 05:18 PM

This might be a RAM problem and outside of this forum. The information you gave shows that there is no problem but we need to check this information by using Memtest86 - a bootable disk. Link here

Either way, due to the inaccessibility of your system at present you should post in the XP forum giving them the link to the first post you made. Only after the memory issue has been solved can we look at any other problems.

I will hold this topic open for five days and after that PM me if you have any problems
Posted Image
m0le is a proud member of UNITE

#11 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:12:42 AM

Posted 19 June 2011 - 05:22 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Posted Image
m0le is a proud member of UNITE




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users