services.exe causing server to reboot

[lee]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Major problems with our windows 2000 server which hosts
our Exchange and DNS services.

After we logon to the server, the taskbar appears to be
frozen, then, after around 2 - 3 minutes the windows
system shutdown window appears stating that a fatal error
in services.exe requires the system to be restarted,
countdowns to 0 then the server reboots - as you can
imaging, this is causing severe problems.

If we do not logon to the server and leave it at the
logon screen the system doesnt reboot, but because we
havn't logged on our exchange is not working.

Any help would be fantastic.

Lee.
..

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Check Event Viewer for errors. This sounds like sasser or msblast.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lee" wrote:
| Major problems with our windows 2000 server which hosts
| our Exchange and DNS services.
|
| After we logon to the server, the taskbar appears to be
| frozen, then, after around 2 - 3 minutes the windows
| system shutdown window appears stating that a fatal error
| in services.exe requires the system to be restarted,
| countdowns to 0 then the server reboots - as you can
| imaging, this is causing severe problems.
|
| If we do not logon to the server and leave it at the
| logon screen the system doesnt reboot, but because we
| havn't logged on our exchange is not working.
|
| Any help would be fantastic.
|
| Lee.
| .
|
|

 

[lee]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

This is what I think it may be. I have been advised that they use Microsoft
Baseline Security to patch the server, but they are not sure if any of the
IIS patches have been implemented. Does Sasser affect/targhet IIS services?

Also is it normal for users not being able to acces any exchange mailboxes
and also our web site appears to be down if we do not logon as administrator??

Any help appreciated.

"Dave Patrick" wrote:

> Check Event Viewer for errors. This sounds like sasser or msblast.
>
> --
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "lee" wrote:
> | Major problems with our windows 2000 server which hosts
> | our Exchange and DNS services.
> |
> | After we logon to the server, the taskbar appears to be
> | frozen, then, after around 2 - 3 minutes the windows
> | system shutdown window appears stating that a fatal error
> | in services.exe requires the system to be restarted,
> | countdowns to 0 then the server reboots - as you can
> | imaging, this is causing severe problems.
> |
> | If we do not logon to the server and leave it at the
> | logon screen the system doesnt reboot, but because we
> | havn't logged on our exchange is not working.
> |
> | Any help would be fantastic.
> |
> | Lee.
> | .
> |
> |
>
>
>

 

[lee]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Problem has got worse this morning... Server is now rebooting even when we
don't logon. Error code 128 ntauthority/system has caused a fatal error in
services.exe.

Any help appreciated.

"lee" wrote:

> This is what I think it may be. I have been advised that they use Microsoft
> Baseline Security to patch the server, but they are not sure if any of the
> IIS patches have been implemented. Does Sasser affect/targhet IIS services?
>
> Also is it normal for users not being able to acces any exchange mailboxes
> and also our web site appears to be down if we do not logon as administrator??
>
> Any help appreciated.
>
> "Dave Patrick" wrote:
>
> > Check Event Viewer for errors. This sounds like sasser or msblast.
> >
> > --
> > Regards,
> >
> > Dave Patrick ....Please no email replies - reply in newsgroup.
> > Microsoft Certified Professional
> > Microsoft MVP [Windows]
> > http://www.microsoft.com/protect
> >
> > "lee" wrote:
> > | Major problems with our windows 2000 server which hosts
> > | our Exchange and DNS services.
> > |
> > | After we logon to the server, the taskbar appears to be
> > | frozen, then, after around 2 - 3 minutes the windows
> > | system shutdown window appears stating that a fatal error
> > | in services.exe requires the system to be restarted,
> > | countdowns to 0 then the server reboots - as you can
> > | imaging, this is causing severe problems.
> > |
> > | If we do not logon to the server and leave it at the
> > | logon screen the system doesnt reboot, but because we
> > | havn't logged on our exchange is not working.
> > |
> > | Any help would be fantastic.
> > |
> > | Lee.
> > | .
> > |
> > |
> >
> >
> >

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

These may help you.

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lee" wrote:
| Problem has got worse this morning... Server is now rebooting even when we
| don't logon. Error code 128 ntauthority/system has caused a fatal error in
| services.exe.
|
| Any help appreciated.

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

These may help you.

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lee" wrote:
| Problem has got worse this morning... Server is now rebooting even when we
| don't logon. Error code 128 ntauthority/system has caused a fatal error in
| services.exe.
|
| Any help appreciated.

 

[lee]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Thanks for the info. Much appreciated.

After a long call with Microsoft Tech Support, we may have to rebuild as
they believe it to be McAfee Groupshield which is causing the server to fall
over with the 128 error code. Microsoft have now closed the call as it is a
third party software which is rebooting the server.

Lee

"Dave Patrick" wrote:

> These may help you.
>
> http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html
> http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
>
> http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
> http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx
>
> --
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "lee" wrote:
> | Problem has got worse this morning... Server is now rebooting even when we
> | don't logon. Error code 128 ntauthority/system has caused a fatal error in
> | services.exe.
> |
> | Any help appreciated.
>
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Tough break, Thanks for letting us know.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"lee"wrote:
| Thanks for the info. Much appreciated.
|
| After a long call with Microsoft Tech Support, we may have to rebuild as
| they believe it to be McAfee Groupshield which is causing the server to
fall
| over with the 128 error code. Microsoft have now closed the call as it is
a
| third party software which is rebooting the server.
|
| Lee