Solved

Error message on startup of Win 2000 server (CMOS)

Posted on 2004-04-27
15
389 Views
Last Modified: 2010-04-13
Does any know what the error message-The CMOS update control service failed to start due to the following error:
The system cannot find the file specified.  would mean?

It is reported in the event viewer and reproted at startup.

The computer is a Windows 2000 server used as a file server - not a domain.
0
Comment
Question by:Fridkis
  • 8
  • 7
15 Comments
 
LVL 4

Expert Comment

by:averyb
ID: 10934660
Not sure.

Look in the Services Applet to see which service is set to Automatic but isn't running.  That should be the service that generated the error.

Look at the properties for the server and see if the path referenced actually exists.

Looks like something was uninstalled but some remnants remained.

What hardware are you running this on?
0
 

Author Comment

by:Fridkis
ID: 10935397
I have looked a the services and don't see anything that fits the bill.

There wasn't anything uninstalled from the server.  

This is a Gateway server.

Help!!
0
 
LVL 4

Expert Comment

by:averyb
ID: 10939785
Can you post the text from Event Viewer for the error message?
Be sure to include the source and Event ID.

Has this server be running for a while or was it recently brought back online?  Had it been shut down for a while?

The CMOS battery might be bad? Need more info on what Gateway machine it is to be sure.

Try booting into the BIOS and see if any errors are listed.  Do not save any changes unless you are sure about them.  You could render the machine inoperable.  Unplug the machine for several minutes, boot to BIOS, and check the clock.  Is it correct?
0
 

Author Comment

by:Fridkis
ID: 10940421
I manage this server mostly off site so here is all the information I have on the error messages.
Thanks for the reply

I get two.  The fires is Event ID:  7000  
The Service Loaders service failed to start due to the following error:
The system cannot find the file specified.

The second is Event ID:  7000  also -
The CMOS update control service failed to start due to the following error:
The system cannot find the file specified.

I just found the "CMOS" update control service which is set to automatic that can not be started because of the same error " can not find the specified file".  I will have to wait to be on site to boot to the bios but I can tell you that the clock is working fine and the time is correct.

The device manager looks fine- no errors.
0
 

Author Comment

by:Fridkis
ID: 10940440
By the way, this server has been up and running since it was purchased about 1 year ago
0
 
LVL 4

Expert Comment

by:averyb
ID: 10941995
Look at the properties of the service in question.  It will list a Path to an executable on the General tab.

Post the full path and executable name.

Don't worry about booting to BIOS.  I think we're on the right path.

Thanks
0
 

Author Comment

by:Fridkis
ID: 10945222
Right On!!!

Path is c:WNNT\system32\cdrss.exe.  I did a search and found one with that name in C:\WNNT\temp.

Would the next step be to copy the file to the system32 directory?
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 4

Expert Comment

by:averyb
ID: 10945690
Ugh,  Is the exe name correct?

I can't find anything on that exe.

Two options.  
1) Set the service in question to manual.  No more error messages, but this is really avoiding the problem instead of fixing it.
2) Copy the one from the Temp folder to c:\winnt\system32 and start the service

Warning: if cdrss.exe is missing then other files might also be missing.  If cdrss.exe calls a certain .dll file that is also missing the service still won't start.  This could the first of several files that are missing.

Copying it over won't hurt anything.  If the service starts great.

This is a long shot but look in your deleted items folder.  Maybe this file is there.  If so, look for any files deleted on the same day. Chances are they will also be needed.  Before restoring any files, you need to make sure nothing bad will happen.  If ugh.dll was deleted the same day as cdrss.exe, but there is already an ugh.dll in system32 you'll need to decide which file to keep.  Hopefully it won't come to that.

0
 

Author Comment

by:Fridkis
ID: 10945917
Placing the *.exe file in the system32 folder and starting the service didn't work.

I looked in the deleted folder and found only temp files from the Administrators document and settings folder.

I would like to know what it does and if there is any way to extract to get the service functioning again.  What do you think?

MF
0
 
LVL 4

Expert Comment

by:averyb
ID: 10948299
Was there a different error message in Event Viewer on the failed start after copying the exe file.

I searched and can't find any references for that file anywhere.

You could look through device manager and see if any of the system devices refer to this file.  I doubt any will.
If you find one you could remove the device and reboot.
On reboot W2K will detect new hardware and install the needed files for it--make sure you have a W2K CD available.
The file might be replaced during the process.

If there are other files in the TEMP folder you could change the path in the service to point the Temp folder.  It is a temp measure only but it'll let the service run so you can find out more info about it.

0
 

Author Comment

by:Fridkis
ID: 10954557
Well there are new things going on on the server and I think it has a virus or trogen.  Symantec did quarantinethe a backdoor.Sdbot
As of right now, no one is able to browse the network or reach the internet.

I am unable to open the registry.  It keeps dissappearing.

I loaded HijackThis and ran a scan.  I am enclosing the results.

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\APC\PowerChute Business Edition\agent\pbeagent.exe
C:\Program Files\APC\PowerChute Business Edition\server\pbeserver.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\PROGRA~1\SAV\DefWatch.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\cba\pds.exe
C:\WINNT\System32\llssrv.exe
C:\PROGRA~1\SAV\Rtvscan.exe
C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\ams_ii\hndlrsvc.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\system32\cba\xfr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\PROMon.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\csrsss.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\PROMon.exe
C:\WINNT\system32\csrsss.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
D:\Downloads\Utils\HijackThis.exe


What do you think?

0
 
LVL 4

Accepted Solution

by:
averyb earned 500 total points
ID: 10955301
Looks like you got nailed.
Go to this link.  It has instructions on how to rid yourself of the trojan.  It looks like it is one of the svchost.exe is the culprit.

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.html

You should ccnsider reinstalling this server.  No telling what happened to this server.

Update Anti-Virus Scan all other machines and scan them right away.

Look over the link, find the entry in the registry that is to blame, look at the file referenced to see when it was created.  It might give you an idea of how long it has been infected.

0
 

Author Comment

by:Fridkis
ID: 10956368
Hi,

I did a scan over the internet using Symantec using the on-line virus and security check and it came back with "Youe computer is Safe!  Your computer is free of known viruses and Trojan horses.  So I am confured now.  

I think I need to go in and boot to safe mode and see what is going on.  

If you think of anything, let me know.  I will be back in a few days.


0
 

Author Comment

by:Fridkis
ID: 10973642
Well,  I think I've found out what the story is on this computer (Server).  The Trojan, backdoor.sdbot.html did get in and although most of it was removed at the original eradication, it left some services in place.  One of them was The CMOS update control service.  Symantec doesn't give the information to help find these erant services.

Is there a list of appropriate services that could be used to match the list on a server?  Of course if you added extra origrans like Backup Exec, for example, there would be added services.

0
 
LVL 4

Expert Comment

by:averyb
ID: 10977218
You could boot into safe mode.

That will give you a list of services that the server needs, albeit only a partial one.

When you boot regularly the extra services listed would need to be investigated.

I compared your services to mine and these are the ones that I don't have:
C:\WINNT\system32\ams_ii\hndlrsvc.exe
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\cba\xfr.exe

Note: I have 2 of C:\WINNT\system32\csrss.exe, but you have 2 of C:\WINNT\system32\csrsss.exe.  I used pslist from Winternals.com to get the list, so it might just be a tool issue.
I am assuming that you installed everything listed in Program Files.
Also, the svchost ones could be a virus or they could be legit.  It's hard to know.


0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Owning a franchise can be the dream of a lifetime. It provides a chance for economic growth. You can be as successful as you want.  To make your franchise successful, you need to market it successfully. Here are six of the best marketing strategies …
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video discusses moving either the default database or any database to a new volume.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now