Archived from groups: microsoft.public.win2000.general (More info?)

Hello All,

Our Win2K server, SP4 and all related hotfixes/patches installed, has now
decided to reboot itself periodically with the error "services.exe
terminated unexpectedly with error code 128." The machine will boot to the
login screen, notifying me that one of the services failed to start, and
then, at intervals I'm guessing are around 3-5 minutes, the machine gives
the error code 128 message and then reboots.
I've tried checking the shares mentioned in the registry (and currently,
they're only the NETLOGON and SYSVOL shares) and they all seem okay.
I can boot into safe mode, but now explorer fails to load, and I boot into a
blank screen with access only through Ctrl-Alt-Delete, then starting "new
process" using the task manager.
Any help would be appreciated.

RD

Archived from groups: microsoft.public.win2000.general (More info?)

From: "R.D." <rd@mailinator.com>

| Hello All,
|
| Our Win2K server, SP4 and all related hotfixes/patches installed, has now
| decided to reboot itself periodically with the error "services.exe
| terminated unexpectedly with error code 128." The machine will boot to the
| login screen, notifying me that one of the services failed to start, and
| then, at intervals I'm guessing are around 3-5 minutes, the machine gives
| the error code 128 message and then reboots.
| I've tried checking the shares mentioned in the registry (and currently,
| they're only the NETLOGON and SYSVOL shares) and they all seem okay.
| I can boot into safe mode, but now explorer fails to load, and I boot into a
| blank screen with access only through Ctrl-Alt-Delete, then starting "new
| process" using the task manager.
| Any help would be appreciated.
|
| RD
|

Dump the contents of the IE Temporary Internet Folder cache (TIF)
Start --> Settings --> Control Panel --> Internet Options --> Delete Files

Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools --> Options --> Privacy --> Cache --> Clear


Download CLEAN.EXE from the URL --
http://www.ik-cs.com/programs/virtools/clean.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
{ http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
(.lnk) files and a PDF instruction file.

GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
to allow the FTP utility to download the needed files

CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
to scan again at a future date, run this batch file. It will automatically check the date
of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
signature files and install them before performing the scan.

DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
you have booted from an Emergency Boot Disk or DOS disk and have already executed;
c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
http://www.bootdisk.com/bootdisk.htm

I need you to perform the following...

Execute; CLEAN.EXE
Choose; Unzip
Choose; Close

Execute; c:\mcafee\GetFiles.BAT
{ or Double-click on 'GetFiles Link' in c:\mcafee }

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Execute; c:\mcafee\CLEAN.BAT
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Archived from groups: microsoft.public.win2000.general (More info?)

David H. Lipman wrote:
> From: "R.D." <rd@mailinator.com>
>
> | Hello All,
> |
> | Our Win2K server, SP4 and all related hotfixes/patches installed, has now
> | decided to reboot itself periodically with the error "services.exe
> | terminated unexpectedly with error code 128." The machine will boot to the
> | login screen, notifying me that one of the services failed to start, and
> | then, at intervals I'm guessing are around 3-5 minutes, the machine gives
> | the error code 128 message and then reboots.
> | I've tried checking the shares mentioned in the registry (and currently,
> | they're only the NETLOGON and SYSVOL shares) and they all seem okay.
> | I can boot into safe mode, but now explorer fails to load, and I boot into a
> | blank screen with access only through Ctrl-Alt-Delete, then starting "new
> | process" using the task manager.
> | Any help would be appreciated.
> |
> | RD
> |
>
> Dump the contents of the IE Temporary Internet Folder cache (TIF)
> Start --> Settings --> Control Panel --> Internet Options --> Delete Files
>
> Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
> Tools --> Options --> Privacy --> Cache --> Clear
>
>
> Download CLEAN.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/clean.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
> { http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
> (.lnk) files and a PDF instruction file.
>
> GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
> Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
> to allow the FTP utility to download the needed files
>
> CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
> to scan again at a future date, run this batch file. It will automatically check the date
> of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
> signature files and install them before performing the scan.
>
> DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
> you have booted from an Emergency Boot Disk or DOS disk and have already executed;
> c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
> http://www.bootdisk.com/bootdisk.htm
>
> I need you to perform the following...
>
> Execute; CLEAN.EXE
> Choose; Unzip
> Choose; Close
>
> Execute; c:\mcafee\GetFiles.BAT
> { or Double-click on 'GetFiles Link' in c:\mcafee }
>
> Reboot the PC into Safe Mode [F8 key during boot]
>
> Shutdown as many applications as possible !
> It would also help for you to read - "How to perform a clean boot in Windows XP"
> http://support.microsoft.com/kb/310353
>
> Execute; c:\mcafee\CLEAN.BAT
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
> end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
> It is suggested that you move the report out of c:\mcafee before performing another scan.
> It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
> report for each session.
>
>
> * * * Please report back your results * * *
>
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm

Archived from groups: microsoft.public.win2000.general (More info?)

We had a machine get hopelessly corrupted with the "W32MyToB" virus and
I beat my head against the wall trying to find a solution to this one.
A colleague pointed out that it may be a startup item and suggested
using msconfig from Windows XP Pro on the Win2k workstation.

Note: This works if you can get into safe mode. (I am not sure how to
fix this if you cannot it is FUBAR and it may require a back up and
full reinstall)

Here is how I fixed this on a Win2k Pro Workstation using msconfig as a
troubleshooting tool:

1. Boot into safe mode and copy msconfig to the affected workstation
2. Run msconfig
3. Check on the box for selective startup
4. Uncheck all boxes under the selective startup box
5. Reboot
6. The machine "should" let you log in booting normally
7. Re-Run msconfig and Re-check the boxes one by one and keep rebooting
until you find the set of *.ini files that are causing the issue
8. Keep repeating steps 5 through 7 until you get the error
9. If you get the error you will have to reboot in safe mode
10. Make note of which box you last checked and then under its tab
check on the boxes one by one until you get the error.
11. If you can uninstall the program associated with the process or
file or contact the software vendor on how to remove it

In my case it was the Symantec Service that was causing the machine to
keep rebooting it was not fully uninstalled and the virus had
hopelessly corrupted the anti-virus program and its uninstaller "OUCH"

Hope this helps.

Dan