SBS 2003 does not let me logon


Hi guys,

I have a couple of question.  I have restarted my sbs2003 server. and now users are not longer able to log in.   the server pop up a message.. One or more services are not running.....
I went to services and the only services that is not running is the manager center, in the description for this service, I can read  

 "On domain controllers this service enables users to log on to the network using the Kerberos authentication protocol. If this service is stopped on a domain controller, users will be unable to log on to the network. If this service is disabled, any services that explicitly depend on it will fail to start".

when I start the services I got a error 32:  the services can not access the file because it is being used by another process.

I appreciate your help.
nttechAsked:
Who is Participating?
 
earl7Commented:
Firstly make sure you have good backups - Make additional image backups as well. You may have to restore back to an earlier time
Get a list of current services running - best to use Process explorer
http://technet.microsoft.com/en-us/sysinternals/bb896653
rather than typing net start at a command prompt
Then you should use a livecd anti-virus scanner to check the system i.e. boot from your updated  anti-virus disk or create one from sites like Panda or AVG. Of course you'll need to schedule downtime for this.
Once you are sure that the system is free of viruses and anomalies, you need to reset ALL passwords especially the administrators in case they were stolen.

Let us know how you go.

E
0
 
AustinComputerLabsCommented:
Before spending to much time chasing the error, you may want to try another restart and see if the issue is persistant.
0
 
nttechAuthor Commented:
I restarted the computer, still having the manager center services  is down.  
the services name is:  oypokernx.  
display name: Manager center
0
Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
AustinComputerLabsCommented:
In the event viewer click the copy button and paste the error here.
0
 
AustinComputerLabsCommented:
Oh yea, why did you reboot?
What changes have been made since the last reboot?
0
 
AustinComputerLabsCommented:
None of the services you mention are on the SBS services list at:
http://support.microsoft.com/kb/829623
0
 
AustinComputerLabsCommented:
Sounds like it might be related to your previous question:
http://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_26846882.html
Exchange is popping up asking for crediantials
0
 
nttechAuthor Commented:
yes, I didn't find any information about this messages.
nothing has changed, we suffered a power outage and the server was restarted.
 error
0
 
nttechAuthor Commented:
AustinComputerLabs  this is a different computer.  the other is a windows 2008 standard.
0
 
morticcioCommented:
Can you see any reference for oypokernx if you search the registry using regedit?
0
 
nttechAuthor Commented:
yes I can.
local machine, software, microsoft, windowsnt, currenversion, svchost and then netsvcs
0
 
nttechAuthor Commented:
also I found another register in the following path
local machine, system, controset001, enum, root, legacy oypokernx.
I can't delete this key.... I think I could be a virus.

suggestions
0
 
morticcioCommented:
Run CCleaner on the box, ensuring you back up the registry first!

As a precaution make sure any essential data is also backed up.
0
 
royshantanu20001Commented:
Restart
Login Safe Mode
Restart Again
0
 
djpazzaCommented:
Not a SBS 2003 service and the fact it has poker in the name I would assume its an infection of some sort.  Run 'Autoruns' and take a look through and disable the entry relating to this.  Make sure you have a backup / registry backup before making any changes.
0
 
djpazzaCommented:
0
 
nttechAuthor Commented:
I was infented by conficker. I have followed your instrucion and it was removed successful.

Many thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.