Help please server keeps on restarting

[edgarv]

Hello,

I am very new at this, I have a windows 2000 server that keeps restarting. right before it restars a small grey window appears with this information

Services.exe Terminated Unexcectedly with Status Code 128

I should mention that when the grew window with the message comes up it does a 60 second count down. when it gets to 0 it restarst the server, I ununplug it form the internet and it still does the same thing, cannot even log in the DOS screen. It seems to me like it is a virus.
how can I run a scan from my cd-room, the hard drives are SCSI.?
any suggestions



Thank you so very much
any help is greatfully apreciated

 

[Davetoo]

Sounds like Blaster....

http://www.microsoft.com/security/incident/blast.mspx

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[edgarv]

that is what I thought but I would have to have a connection to the internet in order for the virus to bring up the grey window and the server is not connected to anythong

 

[Davetoo]

Follow the steps to stop the shutdown, then check for the virus.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[edgarv]

the problem is that I cannot even login in any mode (Safe, Normal or with Command Prompt) as soon as the login window comes up this other window shows up I tried to log in but the log in takes longer than 60 seconds so the server shuts down and re-stars

 

[sab4you]

Just for giggles, can you disconnect any network connection and then try booting up?

If it works, then we know its the blaster
If it still doesnt work then we can move on and suggest other things

 

[edgarv]

I tried it, the server is not plugged in to anything (network or other computers)

 

[edgarv]

still the same thing. it comes up and restars the server

 

[sab4you]

http://support.microsoft.com/?kbid=318447

 

[edgarv]

I appreciate the link, but I already tried that and the problem is that I cannot login because of the grey window that appears and only gives me 60 seconds to do anything.

I really apreciate all the help, I am still looking, and the link that sab4you gave me is the only relevant link that I have found. Argggggggg, going a bit crazy with this thing.

 

[lb63640]

Edgarv, did you solve your booting from CD problem? You can go into BIOS/system setup during bootup and change the order of the boot devices so that your CD ROM hits before the drives--SCSI or otherwise.

It certainly sounds like you have a virus, my friend. On the McAffee site, there is an excellent tool called Stinger that might be of help to you--and it's a free download.

 

[edgarv]

Hey Ib63640 it is not a booting problem, It boots up and I could redo the whole thing, but It is a server that has data we need and of course it is not backed up anywhere else. I will look into the McAffee site.

Thanks for all the help, I really appreciate it.

edgar v

 

[mikeny961]

Although this may be a virus, did anyone actually read the error message? Blaster gives a NT Authority\System shutdown message and can usually be resolved, this sounds more like an issue with a corrupt registry:

See the following articles:

http://support.microsoft.com/default.aspx?scid=kb;en-us;318447

http://www.experts-exchange.com/Operating_Systems/Win2000/Q_21069975.html

http://support.microsoft.com/default.aspx?scid=kb;en-us;315105

Good Luck


1/2 of the troubleshooting is done by reading the error message

 

[edgarv]

again thank you so very much for all your help, he systems engineer got here and redid all the system. WEll I tried.


I really, really appreciate the help.

cheers


e.v.

 

[dmw]

Hey folks, we are having the same issue where I work. So far I have seen this happen to 3 diffent servers. The only thing in common with the servers is that they all have windows 2000 SP4. Some are on blades, and others normal rack mount servers. some had applications installed, some just windows.

You can't even press CTL+ALT+DeL or go into safe mode.

any other thoughts???

 

[edgarv]

unfortunatelly, I had to reinstall windows and one of my hard drives was bad so we ended up buying bigger hard drives. Sorry this is not much help, but look in the answers above and the links that might be helpful

 

[ITSTOAST]

SASSER?

Only the good die young, me I'm here forever

 

[edgarv]

No, not Sasser, I looked into that and the registry appeared to be clean, did a complete scan and nothing came up.

Thaks for the thought thoug

 

[ITSTOAST]

Have you got all the latest service packs installed?

Only the good die young, me I'm here forever

 

[dmw]

Yes, SP4. We even went into the recovery console, and changed out all the registry hives with the ones that NTBackup makes from an earlier date before we saw the issue. Still did the same thing. Then we replaced the hives with the empty ones that get made when you build the server, still happens..

I am wondering if replacing the services.exe may help - perhaps it got corrupted???