Wild_Cat
asked on
The system restarts after some time frequently
the system for windows 2000 server restarts frequently with automatic shutdown, microsoft states that there are shares mentioned in the registry key and that i have checked all shares are system shares the error is
The system process 'c:\winnt\system32\service s.exe' terminated unexpectedly with status code 128. The system will now shutdown and restart.
The system process 'c:\winnt\system32\service
ASKER
where to start antivirus gave me 4 files with virus namesd i have nod32 installed on my server
the virus names are as follows
BAT/TrojanDownloader.Agent
IRC/SdBot trojan
file name: dot3cfg.exe, smlogsvcc.exe
The server reboots after every 45 minutes and the microsoft solution reffers to a reg key that is totally empty and the server has following shares
C$
D$
E$
F$
G$
H$
Admin$
IPC$
the virus names are as follows
BAT/TrojanDownloader.Agent
IRC/SdBot trojan
file name: dot3cfg.exe, smlogsvcc.exe
The server reboots after every 45 minutes and the microsoft solution reffers to a reg key that is totally empty and the server has following shares
C$
D$
E$
F$
G$
H$
Admin$
IPC$
ASKER
If it is a virus than what should be the solution you recomend?
ASKER
the server removed files like aaa.bat, run.vbs from the root of the system
The virus detected as IRC/SdBot trojan is a backdoor Trojan, so I would start with disconnecting the server from the network completely.
Symantec has removal instructions for this here: http://www.symantec.com/se curity_res ponse/writ eup.jsp?do cid=2002-0 51312-3628 -99&tabid= 3 . Since this is an old Trojan it might have mutated and the instructions might not be valid anymore, but try.
To be completely sure that its gone, you should also scan the drives for viruses on another computer if possible, ergo insert the drives as secondary drives in a working, updated and isolated test computer and scan them. If system files have been infected, it might be impossible to remove the virus while the server is running. Another possible solution is to run the virus scan from a bootable cd/dvd.
If this doesnt fix the problem let me know.
Symantec has removal instructions for this here: http://www.symantec.com/se
To be completely sure that its gone, you should also scan the drives for viruses on another computer if possible, ergo insert the drives as secondary drives in a working, updated and isolated test computer and scan them. If system files have been infected, it might be impossible to remove the virus while the server is running. Another possible solution is to run the virus scan from a bootable cd/dvd.
If this doesnt fix the problem let me know.
ASKER
All the reffered system registry entries are not there only nod32kui.exe service running from Eset folder and algs.exe missing and its disabled which is applicatio layer gateway service i guess
Virus software like to disguise themselves as system processes, but if the scans came back clean it's probably OK. If it's still restarting, try running process explorer to find out which services are running. Services.exe is a generic process for launching services, and one instance can run multiple services hidden in the background.
Download process explorer from http://technet.microsoft.c om/en-us/s ysinternal s/bb896653 .aspx , it will show which services are running behind services.exe. It is normal to have multiple services.exe instances running.
Download process explorer from http://technet.microsoft.c
ASKER
ok my system crashed and i had to reinstall it because it was not loading the OS any more and crashing while booting can you just tell me how to protect system files and any tool that can monitor system files so that they can not be termpered i will accept your answer
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I have seen similar problems caused by some viruses, so I recommend a full scan of the system.