Server on the blink? on/off esktop, and Authorty shutdown w code 128

[Walt Smith]

Hello,

My Win3K server suddenly is most likely infected with a virus with following
behaviour:

1) When you login on the server, the desktop cycles on and off.
2) After running Trendata Housecall (found 30 infected files), it now
shutsdown with Authority\System\services with status code 128.

Tried SAFE mode, same problems!

Any suggestions????

Anyway I can safe this system before I go to a backup image??

ps: Ran Norton Anti Virus, and ad-aware pro.

 

[Bill Swan]

Walt, how did this happen? What infections were found, hopefully this will
help narrow down security hole.

Can you rely on backup ?

--
Thinking of upgrading .. COOL... http://www.sbsmigration.com

www.smallbizserver.net (2000 and 2003)

microsoft.public.backoffice.smallbiz2000 (2000 NG)

microsoft.public.windows.server.sbs (2003 NG)

http://groups.google.com/groups?hl=en&safe=off&group=microsoft.public.backoffice.smallbiz2000

http://groups.google.com/groups?hl=...off&group=microsoft.public.windows.server.sbs

http://www.sbslinks.com/

 

[Walt Smith]

Hello Bill,

It is mail and file ever , and only accessed periodically (every 3 to 5
five days) to check status.

It had Norton Anti Virus and email anti server installed, an dat least every
month I made sure there were no ad-ware added.

The symptons came up suddenly.

Trenddata house cleaned 30 viruses, including Troyan horses. (using to
access it via network).

 

[Bill Swan]

Ok, here is what I would do. Need to make sure totally clean of viruses.
What disk configuration do you have? Can you put the hard drive in a pc to
scan it. Ensure pc has fully updated virus checker. Intersting to know
results here.

Can give a chance to see if boots if found viruses and cleaned them.

If can, make a ' ghost copy ' of hard drive.

Put back in server and boot from cd to enter recovery console and run
chkdsk.

If still doesn't boot properly then run cdrom again this time run repair.

If have a different hard drive configuration then need to take different
approach. Normally be chkdsk and then repair if have raid 5 config but
always good to have ghost copy first.

--
Thinking of upgrading .. COOL... http://www.sbsmigration.com

www.smallbizserver.net (2000 and 2003)

microsoft.public.backoffice.smallbiz2000 (2000 NG)

microsoft.public.windows.server.sbs (2003 NG)

http://groups.google.com/groups?hl=en&safe=off&group=microsoft.public.backoffice.smallbiz2000

http://groups.google.com/groups?hl=...off&group=microsoft.public.windows.server.sbs

http://www.sbslinks.com/