csrss.exe unable to locate DLL

[Mike Bayly]

Hi all

I have an interesting problem that occurred simultaneously on two domain
controllers within my domain that I remotely manage with Terminal Services
(admin mode). Both servers run Windows Server 2000 SP3 and have been running
fine up until now. When attempting a remote desktop or terminal services
client connection to either of these machines, an application popup appears
on the server screen with title "csrss.exe - Unable to Locate DLL" and with
the popup box showing "The dynamic link library winsrv could not be found in
the specified path Default Load Path".

I've checked the server environmant variables and "Path" includes
"C:\WINNT\System32" and have also verified that C:\WINNT\System32\WINSRV.DLL
exists.

The only significant event for the domain was that a new Domain controller
was installed 6 days ago - Windows Server 2000 SP4, with otherwise identical
configuration to the other servers. In all there are 5 domain controllers in
the domain, all separated by 16K CIR (128K access) frame relay links. There
have been no other issues with the new server installed last week.

I've exhausted support.microsoft.com and really have no idea what the
problem could be, so any help or advice at all would be greatly appreciated.

Thanks

Mike

 

[Mike Bayly]

Here's an update which may help someone else at some time...

I spent a few hours on the phone to Microsoft Support
and based on the fact that 4 servers suffered the exact same issue in the
space of 48 hours, they suspected a trojan or malware. I ran the MS
malicious software removal tool which found nothing though so the cause is
still unclear. In the end, I rebooted all servers which then began to
function normally, applied SP4 to the SP3 machines, and then installed the
Update Rollup 1 for Windows 2000 SP4 patch on the advice from MS. They
seemed to think that the Event Log errors were the result of some kind of
registry corruption, which also meant that (using regedt32 to check) the
registry key HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion
couldn't be read properly and hence why the patches thought it was a checked
version of the OS.

So, I still don't really know the cause of the problem, and in particular
how it was replicated across the domain, but at least the magical reboot
seems to have fixed it for now.

Mike

 

[Mike Bayly]

Further to this, Microsoft have advised me:

"The issue you were seeing is caused when winsrv.dll goes into a state from
too much activity where it stops responding to csrss.exe. There are a
variety of different causes for this issue in Windows 2000, the good thing
is that all of the known causes are ressolved by updates included in SP4 and
the SP4 roll-up."

 

[Mike Bayly]

An update on this issue. Not sure why since I'm apparently the only one in
the world having it.

Microsoft recommended SP4 and the Update Rollup 1 for SP4 be installed which
I have done, but the problem has now recurred.on 2 servers. A reboot seems
to have supressed the problem for now (like it did last time) but it's back
to the drawing board for a solution.

If anyone else has any ideas, I'm all ears!

Mike