Re: Windows 2000 (Pro and Server) having services.exe error and rebooting

Tech-Archive recommends: Fix windows errors by optimizing your registry

In news:1171561187.977378.302030@xxxxxxxxxxxxxxxxxxxxxxxxxxxx,
Alex <samalex@xxxxxxxxx> after much thought,came up with this jewel:
Hey Everyone,

I have a strange dilemma. I'd say probably a quarter of our Windows
2000 systems (Server and Professional) have started giving the
following error and rebooting:

Window Title: System Shutdown
Message: This system is shutting down, Please save all work in
progress and log off. Any unsaved changes will be lost. This
shutdown was initiated by NT AUTHORITY\SYSTEM
Time before shutdown: 00:00:60 (sixty second countdown)
Message:The system process 'C:\WINNT\system32\services.exe' terminated
unexpectedly with status code 128. The system will now shut down and
restart.

Each system has all the latest updates and on Service Pack 4, plus the
virus scanner in each system was updated just yesterday. We're not
sure why this is affecting only a few systems and not all of them as
we have many Win 2K systems working fine.

Some things to note. I have reviewed
http://support.microsoft.com/kb/318447 and this KB does not refer to
2K Pro, only Server. But I have checked
the key it suggests HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Services\Lanmanserver\Shares - but there are no shares setup on most
of the systems so there's no entries in this key. This isn't the
problem.

What's odd is when we disconnect the system form the network, it does
not reboot. I've seen a few folks mention this when having the same
issue, but no one has submitted a resolution.

Any suggestions? We're about to contact Microsoft support, but it
sucks paying that kinda money for a bug in their software.

Thanks for your time and help, and any ideas on how to resolve all
this.

Alex

Could be an infection. No reboot when disconnected sounds like a worm.
Have you scanned with a different AV than your main AV?

max
--
Playing Nice on Usenet:
http://oakroadsystems.com/genl/unice.htm#xpost
My Pages:
Virus Removal Instructions
http://home.neo.rr.com/manna4u/
Keeping Windows Clean
http://home.neo.rr.com/manna4u/keepingclean.html
Windows Help and Tools
http://home.neo.rr.com/manna4u/tools.html
Change nomail.afraid.org to gmail.com to reply.
nomail.afraid.org is setup specifically for use in USENET
Feel free to use it yourself.


.

Relevant Pages

  • SecurityFocus Microsoft Newsletter #154
    ... MICROSOFT VULNERABILITY SUMMARY ... ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi... ... Roger Wilco Remote Server Side Buffer Overrun Vulnerability ... available for Microsoft Windows operating systems. ...
    (Focus-Microsoft)
  • Blaster worm virus
    ... Whenever your computer attempts to shutdown or reboot, ... "Windows must restart because the Remote Procedure Call ... Turn on your Internet Connection Firewall ...
    (microsoft.public.windowsxp.security_admin)
  • Virus with RPC
    ... Whenever your computer attempts to shutdown or reboot, ... "Windows must restart because the Remote Procedure Call ... Turn on your Internet Connection Firewall ...
    (microsoft.public.windowsxp.security_admin)
  • NT Authority/RPC VIRUS !!!!
    ... Whenever your computer attempts to shutdown or reboot, ... "Windows must restart because the Remote Procedure Call ... Turn on your Internet Connection Firewall ...
    (microsoft.public.windowsxp.security_admin)
  • SecurityFocus Microsoft Newsletter #49
    ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
    (Focus-Microsoft)