The system process 'C:\WINDOWS\system32\services.ex

[onlineapps]

Hi,

I'm running two HP Compaq nc6000s that I bought from work. Recently, I've

been getting the following message on both:

The system process 'C:\WINDOWS\system32\services.exe' terminated

unexpectedly with status code -1. The system will now shut down and restart.

After that, it pops up a window with the infamous 60 second countdown to

shutdown.

I heard it could be a virus, but I checked with the Norton Sasser tool: no go.

Any ideas?

[ɹəuəllıʍ ʇɐb]

Welcome to the Windows Forum.

I have a couple of questions.

• were you doing anything in particular when these error messages occur?
  
• Are you sure the error code is -1? I cannot find any reference to this error code.
  

Can you open the Event Viewer (Start -> Run -> eventvwr.msc [Enter]), and check if there are any entries (Applicaions and System) at the time when it occurred?

I don't know the "Norton Sasser tool", but it sounds like it would check only for one specific virus.

• Do you have any full-scale anti-virus software installed?
  
• Do you have any other anti-malware software installed?
  

[onlineapps]

have a couple of questions.

• were you doing anything in particular when these error messages occur?
  
• Are you sure the error code is -1? I cannot find any reference to this error code.
  

It just pops up sporadically. No rhyme or reason (it's not like it pops up if I run a program).

Nope, it was definitely -1. I was a little surprised myself, as Windows 2000 users got an error similar to this with a different code (then again, I am on XP Pro).

Can you open the Event Viewer (Start -> Run -> eventvwr.msc [Enter]), and check if there are any entries (Applicaions and System) at the time when it occurred?

As soon as it happens again, I'll post the results. Would a HijackThis log help too?

I don't know the "Norton Sasser tool", but it sounds like it would check only for one specific virus.

• Do you have any full-scale anti-virus software installed?
  
• Do you have any other anti-malware software installed?
  

ClamWin AV is installed, but only after the error message showed up. I also have Webware Spy Sweeper on one. Should I do an online scan, like one from Kaspersky?

[Scarecrow Man]

Yes. you should do an online scan.

http://housecall.trendmicro.com/

http://www.pandasoftware.com/products/ActiveScan.htm

http://www.kaspersky.com/virusscanner

are all good.

As soon as you see the shutdown dialog box, go to

start > run > shutdown -a

This should stop the computer from shutting down. If it does not, boot into safe-mode with networking and run one of the scans I mentioned above. All 3 would be best.

[-pops-]

Would be worthwhile running Stinger click here to check for relations of the Sasser-type worm.

[onlineapps]

Can you open the Event Viewer (Start -> Run -> eventvwr.msc [Enter]), and check if there are any entries (Applicaions and System) at the time when it occurred?

When I opened it, I got a

---------------------------

Event Viewer

---------------------------

Unable to complete the operation on "Application".

The RPC server is unavailable.

---------------------------

[onlineapps]

On the other computer I got 5 informations for Service Control Manager at 2:58. Event 7036. Then 4 errors for W32Time, 2 for 3:34 and 2 for 5:34. Then 1 information for Tcpip at 8:06. Then 3 informations for Application Popup at 9:33. Finally, 2 for W32Time at 9:34 (its now 9:39).

Also, at 2:58, there was something for information about Diskeeper Lite under the applications category.