Event ID 1014; Cannot load unknown illegal module

[Guest]

Recently, an application terminal server has begun reporting "Cannot load
illegal module: C:\WINNT\system32\Drivers\.SYS" when people login to the
server.

Upon logoff, connectionns named "Down (655xx)" remain and need to be reset
within terminal services manager.

The server is running Windows 2000 sp4. The full error message is as follows:

Event Type: Error
Event Source: TermService
Event Category: None
Event ID: 1014
Date: 1/2/2006
Time: 6:36:21 PM
User: N/A
Description:
Cannot load illegal module: C:\WINNT\system32\Drivers\.SYS.

Is this correctable?

Thank you.

John Grogan

 

[Vera Noest [MVP]]

This sounds serious!

Note that the EventID is supposed to list the search path to a dll
in C:\WINNT\system32\Drivers\
In your case, it lists a file called ".SYS". That sounds suspicious
to me.
Have you inspected the \Drivers folder? Is there such a file? If
yes, when was it created? Who owns the file?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"=?Utf-8?B?Sm9obiBHcm9nYW4=?=" <John
(e-mail address removed)> wrote on 03 jan 2006 in
microsoft.public.win2000.termserv.apps:

 

[Guest]

No. No such file exists.
- j

This sounds serious!

Note that the EventID is supposed to list the search path to a dll
in C:\WINNT\system32\Drivers\
In your case, it lists a file called ".SYS". That sounds suspicious
to me.
Have you inspected the \Drivers folder? Is there such a file? If
yes, when was it created? Who owns the file?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"=?Utf-8?B?Sm9obiBHcm9nYW4=?=" <John
(e-mail address removed)> wrote on 03 jan 2006 in
microsoft.public.win2000.termserv.apps:

 

[Vera Noest [MVP]]

For me, this would be a reason to re-image the server.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

"=?Utf-8?B?Sm9obiBHcm9nYW4=?="