I got the same problem on my very freshly installed Windows 2003.
SVCHOST.EXE crashes, whitch results in a reboot.
I know I can cancel the shutdown by shutdown /a and I know I can disable the reboting by setting it in the RPC service.
The question is not how to prevent the rebooting, but how the hell can I fix this problem?
I've installed Win2k3, and reinstalled it to be sure that it wasn't Win2k3. also tried several virus scanners to be sure it wasn't a virus.
My system is always connected to Internet via a LAN & router.
Event log:
Quote ...
Faulting application svchost.exe, version 5.2.3790.0, faulting module rpcss.dll, version 5.2.3790.0, fault address 0x0002eb3c.
Try running Stinger-- it detects and removes both viruses, along with about 40 others
You might also want to check your system for spyware/adware/malware if you haven't already. Read through some of the posts in our Security forum for instructions on downloading and using a few of the useful (and free) detection/removal utilities:
Reply to alc6379: My system was clean, no virus found
Reply to DMR: I don't have any spyware installed, unless by some magical reason it got my system within 10 minutes. I had just installed my computer with Windows 2003 when the SVCHOST started to crash (and the computer started to reboot).
I changed the RPC-service settings for when it crashes. It no longer reboots now. Also I downloaded all updates from the M$ site.
I don't know if the service had crashed today, since I'm not home to log in and look at the event log.
I do know that the system is up and running the whole day now, but that's all I know at the moment.
It is definitely the blaster or sasser worm. These are worms, not viruses that you have to download. Worms just run around in the net looking for vulnerable machine then sneak in, no install or download required. I installed Windows in a couple of systems and got the same error after being connected to the internet for only 10 minutes. Now, I always install a firewall and turn on Windows firewall before I put a system on the net. In addition, keep your system updated. If all you did was turn of your RPC then you still could be infected and are hosting the worm to the rest of the world, Thankz.
It is definitely the blaster or sasser worm. These are worms, not viruses that you have to download. Worms just run around in the net looking for vulnerable machine then sneak in, no install or download required. I installed Windows in a couple of systems and got the same error after being connected to the internet for only 10 minutes. Now, I always install a firewall and turn on Windows firewall before I put a system on the net. In addition, keep your system updated. If all you did was turn of your RPC then you still could be infected and are hosting the worm to the rest of the world, Thankz.
Sasser is indeed a worm, but I don't think it was a worm. I tried the latest virus removal tools from symantec and mcaffee. Those tools should also kill the sasser worm, if it was on my system, but the tools didn't found anything.
I didn't turn off the RPC, I just configured in a way that it would not reboot when the service crashed.
I still should see an entry in the event-viewer when that service crashes, but my event-log is clean. (read: No wierd things)
No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Previous Thread in Windows NT / 2000 / XP Forum Timeline:F1 to continue
Next Thread in Windows NT / 2000 / XP Forum Timeline:Log off problems?
Unsolved 
Offline 
