System Shutdown

Hi,
i always get this shutdown message on my nootbook.

(This system is shutting down. please save all work in progress and logg off. any unsaved changes will be lost. This shutdown was initiated by NT Authority/system.

Time before shutdown : 00:01:00
MESSAGE
the system process 'C:\windows\system32\services.exe' terminated unexpectedly with status code -1. The system will now shutdown and restart.)

I have Windows XP SP2 and i tried Notorn Anitvirus & Mircorsoft AnitSpyware with last update but the problem still exits.

Please help me coz it bother me alot.

Thanks,

Al-Rashdy
yaqoob_rashdyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sramesh2kCommented:
Al-Rashdy,

Usually worms cause this. Do you have Windows firewall Enabled?
Joshua234_1998Commented:
Are you getting any LSASS.exe errors?
sramesh2kCommented:
Reset all the XP firewall configurations/exceptions and then try enabling it again.
http://www.winxptutor.com/sp2/resetfw.htm

Type firewall.cpl in Start, Run dialog.
In the General tab, put a checkmark near "On" and click OK.

Next, try the Standalone scanner from Trend Micro (requires no installation)

Get Trend Micro Sysclean package (free)
http://aumha.net/viewtopic.php?t=10820
Why Diversity in Tech Matters

Kesha Williams, certified professional and software developer, explores the imbalance of diversity in the world of technology -- especially when it comes to hiring women. She showcases ways she's making a difference through the Colors of STEM program.

yaqoob_rashdyAuthor Commented:
Yes I have firewall Enabled. But i didn't any LSASS.exe errors.

Al-Rashdy
sramesh2kCommented:
This is written for Windows 2000, might worth a look.

"SERVICES.EXE Terminated Unexpectedly with Status Code 128" Error Message When You Start Windows 2000:
http://support.microsoft.com/?scid=kb;EN-US;Q318447

Check the event logs as well:

Click Start, Run and type eventvwr.msc
Select Application entry in the left pane
In the right-pane, look for the Error entry denoted by a Red X

Sort by date and track-down the entry based on what time the error exactly occurred. Locate and double-click the entry and you'll see more information in the resulting dialog. Click the copy button at the top and copy the whole event and paste it to a Notepad document and save it. Post the information here.
sramesh2kCommented:
Rashdy.
Repeat the same for "System" log as well.
yaqoob_rashdyAuthor Commented:
here you are the log for application event

(The Group Policy client-side extension Security failed to execute. Please look for any errors reported earlier by that extension.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.)
yaqoob_rashdyAuthor Commented:
and this is from system log

(The Norton AntiVirus Auto Protect Service service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.)


this is too

(Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.)
sramesh2kCommented:
Rashdy,

Looks like the NAV auto-protected has been tampered (by some virus may be ? ). I'd run a full scan using Trend Micro Sysclean package.

For more clarity, cackup and clear the System log once and reboot.
EdanCommented:
And, while you're dealing with the problem, if the system tries to shut down, you can abort the shutdown process. Create a batch file on your desktop and type the following in it:
shutdown -a
This is not a solution, but it will abort the countdown, assuming the system hasn't started the shutdown process, to enable you to carry on working.

jcwebholeCommented:
before dealing with all those detection procedures...
you must first deal with shutdown problems...
1. right click on my computer on your desktop and click on manage...
2. select services and set the properties of these to these
        on the advanced tab, you can set the actions of windows with each error(1st, 2nd, 3rd..)
       set to restart service instead of shutdown.
    -these are the services to be set:
       -rpc
       -services
3. open up msconfig: click run then type msconfig
4. on the startup tab uncheck all suspicious programs
5. restart
6. then you may go on to your detection and deletion of the virus that may have caused all this.

try spybot search & destroy

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
staticaticCommented:

  you have that worm, i think it is the blaster worm.  
yaqoob_rashdyAuthor Commented:
hi all,

I tried most of the solutions you've been provided. I will wait some time to see the affection.

Points will be distributed when I feel my issue has really solved.
yaqoob_rashdyAuthor Commented:
Dear All,

I had last solution which is format and install Windows again. I think it will work with me more smoothly.

Thanks to all of you for your help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.