Services.exe code 128 abort

[Paul Lady]

I have the exact symptoms described in:

SERVICES.EXE Terminated Unexpectedly with Status Code 128" Error Message
When You Start Windows 2000
Article ID : 318447
Last Review : July 2, 2003
Revision : 1.0

This article was previously published under Q318447

I have completed all the remedy steps described without success.

More thoughts, please?

TIA, pjl

 

[Dave Patrick]

Possibly msblast/ sasser or variants.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I have the exact symptoms described in:
|
| SERVICES.EXE Terminated Unexpectedly with Status Code 128" Error Message
| When You Start Windows 2000
| Article ID : 318447
| Last Review : July 2, 2003
| Revision : 1.0
|
| This article was previously published under Q318447
|
| I have completed all the remedy steps described without success.
|
| More thoughts, please?
|
| TIA, pjl
|
|
|

 

[Paul Lady]

as in virus, I'm guessing?

Thx, pjl

 

[Paul Lady]

Another thought, this problem is on my laptop, and it seemed to occur as I
was installing Panda Titanium antivirus. I had also very nearly
concurrently added a wireless router, but it had worked with this new
hardware, except for maybe installing the print sharing.

Any more light?

Thx, pjl

 

[Paul Lady]

Virus scan says it's clean. Now what?

Thx, pjl

 

[Dave Patrick]

These may help.

http://www.trendmicro.com/vinfo/virusencyclo/default2.asp?m=q&virus=MSBLAST&alt=MSBLAST
http://www.trendmicro.com/vinfo/virusencyclo/default2.asp?m=q&virus=SASSER&alt=SASSER

http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| as in virus, I'm guessing?
|
| Thx, pjl

 

[Dave Patrick]

Permissions may be damaged. This article may help.

How to Restore the Default NTFS Permissions for Windows 2000
http://support.microsoft.com/?id=266118

The article is a little deceptive. At step 7 create a new database.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Virus scan says it's clean. Now what?
|
| Thx, pjl

 

[Paul Lady]

Tried the NTFS permissions routine, but I don't seem to have any databases
to use to import a template in steps 6 and 7.

Have discovered that if I disconnect from the network, both cat 5 cable and
the wireless card, the system will boot into W2K, albeit slowly, with pauses
at the network setup and then at a plain blue screen after security and
personal prefs flash.

More ideas please?

Thx, pjl

 

[Dave Patrick]

A very common symptom of the blaster/sasser virus. You'll want to use the
tools available at symantec.com, trendmicro.com to remove the virus, then
apply the patches I mentioned earlier.


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Tried the NTFS permissions routine, but I don't seem to have any databases
| to use to import a template in steps 6 and 7.
|
| Have discovered that if I disconnect from the network, both cat 5 cable
and
| the wireless card, the system will boot into W2K, albeit slowly, with
pauses
| at the network setup and then at a plain blue screen after security and
| personal prefs flash.
|
| More ideas please?
|
| Thx, pjl

 

[Paul Lady]

More bad news. Ran the Symantec sasser removal tool, got no indication of
removal and report that the system was clean. Guess I'll check for a
msblast removal tool.

I think that something else must be a play. I like the damaged file
suspicion because the problem started after installing Panda.

Any thoughts based on this scenario?

TIA, pjl

 

[Paul Lady]

Did the msblast routine, and there is no infection.

Now I'm in a box, no direction! HELP PLEASE!

Thx, pjl

 

[Paul Lady]

More grief!

I tried to open add and remove programs in control panel and all I get is a
blank screen with title bar and no active commands for the programs
installed.

pjl

 

[Dave Patrick]

As always check Event Viewer for errors. These may also help.

How to Perform an In-Place Upgrade of Windows 2000
http://support.microsoft.com/support/kb/articles/Q292/1/75.ASP

What an In-Place Windows 2000 Upgrade Changes and What It Does Not Change
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q306952

Be sure to apply these to your repair install before connecting to any
network.

http://download.microsoft.com/download/E/6/A/E6A04295-D2A8-40D0-A0C5-241BFECD095E/W2KSP4_EN.EXE
http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| More grief!
|
| I tried to open add and remove programs in control panel and all I get is
a
| blank screen with title bar and no active commands for the programs
| installed.
|
| pjl

 

[Paul Lady]

Event manager shows errors from the service control manager, nums 7000,
7001, 7022, 7026 and 7031.

Should I pursue these before going to the in place upgrade of W2K?

TIA, pjl

 

[Dave Patrick]

When you view the logged events in Event Viewer in the upper right corner,
third button down is a copy to clipboard, then you can paste in the body of
a reply message.

Please do so for each of the different System Log events since last boot so
we can see all of the event detail.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Event manager shows errors from the service control manager, nums 7000,
| 7001, 7022, 7026 and 7031.
|
| Should I pursue these before going to the in place upgrade of W2K?
|
| TIA, pjl

 

[Paul Lady]

Problem here! I'm in safe mode on my laptop with the event log, and even
the normal display of the event description under properties does not work
in safe mode. Also, the lap is isolated because I have no connectivity to
my network and the web. Maybe I could copy to a file on the lap then export
by burning a CD and using the CD to get to my desktop and the web. Is that
worth the effort or should I just go for the upgrade fix?

I have a CD with W2K service pack 4. Will that do the upgrade?

Thx, pjl

 

[Dave Patrick]

As far as I know you can't do a repair install with an integrated install
CD-Rom. It may be time to backup your data and do a clean install. If you go
this route then be sure to apply these to your new install before connecting
to any network.

http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Problem here! I'm in safe mode on my laptop with the event log, and even
| the normal display of the event description under properties does not work
| in safe mode. Also, the lap is isolated because I have no connectivity to
| my network and the web. Maybe I could copy to a file on the lap then
export
| by burning a CD and using the CD to get to my desktop and the web. Is
that
| worth the effort or should I just go for the upgrade fix?
|
| I have a CD with W2K service pack 4. Will that do the upgrade?
|
| Thx, pjl

 

[Paul Lady]

ERROR_CTX_WINSTATION_NAME_INVALID for code 7001
ERROR_CTX_WINSTATION_NOT_FOUND for code 7022

These are the only two code meanings I can find.

pjl

 

[Mark V]

ERROR_CTX_WINSTATION_NAME_INVALID for code 7001
ERROR_CTX_WINSTATION_NOT_FOUND for code 7022

These are the only two code meanings I can find.

Jumping late and JMO, but these are kernel errors. _Possibly_ due to
a kernel driver in the Panda software (guessing).

I suggest serious consideration of backing up data and doing a clean
fresh installation is in order.
2 cents worth.

Have you un-installed Panda from Safe Mode already? Any BSOD
information naming a Panda file?

When you view the logged events in Event Viewer in the upper
right corner, third button down is a copy to clipboard, then you
can paste in the body of
a reply message.

Please do so for each of the different System Log events since
last boot so
we can see all of the event detail.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Event manager shows errors from the service control manager,
| nums 7000, 7001, 7022, 7026 and 7031.
|
| Should I pursue these before going to the in place upgrade of
| W2K?
|
| TIA, pjl

 

[Paul Lady]

Running fast repair did not fix the problem. I still have no connectivity,
cat 5 or wireless, and the remove programs panel is inactive. In other
words, things are still screwed up.

The system will run in normal but "troubled" mode till I connect the cat 5,
in which case it goes into shut down. I'm still getting services manager
error codes and the description will not display with properties.

Does it make sense to post in the network group, or am I in reformat and
reinstall mode? That really hurts to go there!

pjl