Results 1 to 4 of 4
  1. #1
    Star Lounger
    Join Date
    Apr 2003
    Location
    Edinburgh, Midlothian, United Kingdom
    Posts
    93
    Thanks
    0
    Thanked 0 Times in 0 Posts

    NT/AUTHORITY/SYSTEM.EXE

    We have a disaster at the moment - we have 160 staff and no one is working. This started yesterday when all the pcs started getting an error message and were automatically shutdown - including our servers. The error is NT/Authority/System.exe - the error is Status Code 128.

    We have scanned all the pcs and servers overnight with Symantec and restarted the servers and 2 pcs and they have both got this error again.

    Some of the scans came back with the Skybot worm but the pcs we tried this morning did not.

    Any ideas?

  2. #2
    Bronze Lounger
    Join Date
    Feb 2001
    Posts
    1,424
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: NT/AUTHORITY/SYSTEM.EXE

    Since you've asked for "any ideas", here's what I've found on the web when I googled for C:WINNTsystem32services.exe terminated unexpectedly with status code 128. Most of the stuff that comes up about this error seems to be about Win2000 but since this was built on NT maybe some information from these two posts in the MS Discussion Groups could shed a bit of light - here and and here. And this error message is discussed in this JSI tip. Good luck in sorting this out!

  3. #3
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    20,623
    Thanks
    2
    Thanked 627 Times in 560 Posts

    Re: NT/AUTHORITY/SYSTEM.EXE

    Since this started happening to 'everyone' at once it probably means you are infected with a version of the Sasser worm. See Microsoft Security Bulletin MS04-011: Security Update for Microsoft Windows (835732) first. Then W32.Sasser Removal Tool - Symantec.com.

    Joe

  4. #4
    Star Lounger
    Join Date
    Apr 2003
    Location
    Edinburgh, Midlothian, United Kingdom
    Posts
    93
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: NT/AUTHORITY/SYSTEM.EXE

    Thanks for all your help. We have now discovered that we have a new strain of the Blaster virus. Symantec have now given us a fix and everyone seems to be working ok again.

    Pretty scary stuff - we were off for more than 24 hours.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •