Unexpected Shutdown

yikes.
imho sounds like you have broken internet. or virus/backdoor.
i think rpc is remote procedure call. windows uses rpc to talk to another pc. and vice versa. hence the yikes!!?
if i were there i would try to see what part of internet looked broken. if you had outlook express for email, i would see if email worked ok.
then i would ask you:
do you have a firewall?
did you immediately apply windows service packs critical updates to current version upon reinstalling?
do you have anti-virus? which you installed and updated also immediately?
can netscape surf?
what kind of stuff is Ad-Aware finding?
did you call your ISP about this?
if you answered no to first 3, i would flesh install again. with repartition and reformat.
if internet can surf and your security and anti-virus are in place, then sounds like windows error. i would try this stuff:
what is in event log?
can netscape surf?
can i repair or reinstall ie?
i would run system file checker maybe(start/run/sfc
i would post exact error message and circumstances here. tell us about how you connect to the internet. dial up? broadband? do you have AOL?
ditto for events in event log if any

Ya' got Blaster. Sounds like the box is not completly patched.

If you reinstall,make sure you put up the firewall and then download the patches.

That sounds exactly like the symptoms of Blaster. You shouldn't have to do a full reinstall. On another PC, go to www.sarc.com and click the link for 'removal tools', download and follow instructions for the blaster removal tool. Once that is clean, enable XP's firewall, then uninstall/reinstall your Antivirus software (some viruses 'break' antivirus software, I don't remember specifically if Blaster does, but chances are if you were unprotected against Blaster then you were also unprotected against others and may be infected with multiple viruses), download the latest signature updates, and run a full scan. Finally, make sure you run Windows update and install all critical updates.

Blaster seems to be making a comeback, however it's arriving via a very different route (not totally unforseen, but very unpatched). The arrival and infection method is via the MSN Instant Messenger...I had a fully patched system that showed no problems even using the MSN Security Scan, all patches & service packs were not only present, but they all verified out properly using multiple checkers. the Blaster removal tool from Symantec said Blaster wasn't present as an infection, but I later found port 135 open, an RPC Client running on it using the DCOM checking tool from www.grc.com called DCOMBobulate, disabled DCOM using the tool, restarted and bam, no more restarts & shutdowns.

Did a bit more investigating and found that the customers teenager had a friend that was added to her IM that she eventually blocked (over a simple disagreement), while they were connected and chatting and the port was stuck wide open and his machine was broadcasting the Blaster Worm and attempting infection enough to cause the error, causing the constant restarting of the machine (a simple RPC error).

I asked her to contact the friend by phone and to bring in his machine, he did and it had Blaster (among a few other nasties. All clean now, and the port was closed after he removed his puter from the net, on my customer's machine).

I'm not looking forward to a whole new round of these latest viruses coming through the IM's, I have barely recovered from the high volume of work (though I'm not complaining about the workload-feast or famine in this business), from the latest virus wars. Just want to get rested up again first.

This question was closed by the author