Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

services.exe terminated unexpectedly: status code of 1073741571


  • Please log in to reply
25 replies to this topic

#1 lanzd

lanzd

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 05 August 2011 - 08:01 PM

Hello all, thank you for any help in advanced.

The computer I'm running has Windows XP Professional 32 bit running. I do know there are 2 250gig hard drives in the computer but I don't think they had a raid setup. Motherboard is nVidia n force 4 7900 GTX SLI Intel and the processor is an Intel Pentium® D LGA775 socket type. I'm unsure about the video cards but I believe they are some type of nVidia.

The first point at which I noticed something was wrong was after a long day of working I go to turn off my computer using the start menu and, I get what seems to be a windows popup stating the computer will restart in 60 seconds and a code which goes like this:

C:\system32\services.exe terminated unexpectedly with a status code of 1073741571

I thought it was weird but dismissed it as nothing since it was the end of the day and I wanted to go home. I figured it would have been a one time thing. So now it seems it happens every time I turn off the computer. The computer eventually restarts "Since this error the restart process takes about 20 min until I can use it again." So I havne't been able to turn it off without holding the power button down for 5 or so seconds. I got frustrated and since everything on the computer wasn't important I decided to reinstall Windows XP Professional 32 bit. I have a copy of windows 7 64 bit upgrade version which I was going to use since I was going through the process anyway (I havn't gotten there yet but I'd figured I tell you my plans in case it would change anything) So I go to reinstall by booting from disk. I don't think this will matter but The computer has 2 cd/dvd drives and with the first drive I used when I got to the select/delete partition page it showed there were no partitions on the hard drive and restarted after 5 or so seconds of reaching that screen. I tried this process about 3 more times to rule out a random account and opened up the case to check the connections on the hard drives. For the next Hour and a half I was dealing with the blue screen of death and I forget exactly what it said but, I'm afraid to try to recreate it. It seemed after resetting the bios settings and trying the other cd/dvd drive as a last resort everything seemed to proceed as normal. Now I start to go to try to install the recommended driver for my motherboard as the nVidia site recommends and I get a error such as this:

Title = NVIDIA Windows Software - InstallShield Wizard
content = An error (-5006 : 0x8000ffff) has occurred while running the setup.
Please make sure you have finished any previous setup and closed other applications.
If the error still occurs, please contact your vendor: Nvidia Corporation.
Button options = Report, Detail >>, OK

I searched the web for this error all night till 2am and it seems a decent amount of people get this and the common solution is to either delete or rename your C:\Program Files\Common Files\InstallShield folder. I tried both with and without a restart (but I'll get this in a minute) and no luck. So I haven't been able to get my motherboard drivers installed and haven't gone forward with others. So heres 2am and I say screw it, I'll deal with this tomarrow and goto turn off my computer. And there is the same 60 sec error with the services.exe as before the reformat. So again I can't properly turn off my computer so that may be why the Installshield error-fix didn't work(I don't know) The Installshield folder came back after a forced restart so I have that folder back now. I also found others on this forum with the same services.exe status code but it seemed to be triggered with an application being opened or some other event, I haven't seen anything with it happening on restart or shutdown. Any insight would be greatly appreciated.

Dan

Edited by hamluis, 06 August 2011 - 10:37 AM.
Moved from XP to Am I Infected.


BC AdBot (Login to Remove)

 


#2 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 06 August 2011 - 10:23 AM

One thing I left out, I didn't have this information at the time of my original post. But, the services.exe error - The message came from NT AUTHORITY\SYSTEM. There may or may not have been a space between NT and AUTHORITY, I can't tell from the way I wrote it down. And if there is a post about this same issue (the services.exe error upon restart/shutdown) please direct me to it. Like I said I looked but did not find the same problem anywhere.

#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,406 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:05 PM

Posted 06 August 2011 - 10:39 AM

Moved to AII for a closer look, possible malware, IMO.

Louis

#4 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 06 August 2011 - 12:05 PM

Okay, So I suddenly got a change in behavior. I'm about to try to look it up right after this post but I figured I would update this right away in case someone starts to read it.

I had the computer running today while I was reading tutorials on here and tried a few things out. Nothing invasive just using netstat and tracert commands from the command prompt. I didn't download any tools or anything like that. Anyway, I go to turn the computer off and I didn't get the services.exe error and it completely turned off (without a forced shutdown). While the process still took a while and the display on the screen was odd it did shut off. So I figured I would turn it back on and see If I could install my motherboard drivers, still no luck the same InstallSheild error. Then I renamed the InstallSheild folder to InstallSheildOLD as I did before and tried to install the drivers, no luck. Then I tried a restart and THEN I got the services.exe error when I restarted. There was only one difference, the status code was not the same as it had been before. This time it read as

C:\system32\services.exe terminated unexpectedly with a status code of 1073741819

instead of the old

C:\system32\services.exe terminated unexpectedly with a status code of 1073741571

I don't know what this means but while I'm looking this up I am going to try another shutdown and see if it bypasses the error. Maybe It only happens on a restart now and no longer on a shutdown. Again, I don't know how important this is, I'm just keeping this updated.

#5 EyesIsMine

EyesIsMine

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:05 PM

Posted 06 August 2011 - 03:17 PM

C:\system32 and not C:\Windows\System32\? That is very suspicious.

#6 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 06 August 2011 - 05:13 PM

I just went to check and see if it said c:\\Windows\System32... or just c:\\System32... but as I said a natural shutdown doesn't generate that message box anymore so I did a restart since last time it triggered the message. However, the restart did not trigger the message this time around. It would make sense for the error to read
c:\\Windows\System32...

Since that is the normal file structure. I may have missed that as I was trying to write everything down in those 60 seconds, sorry about that. So now it seems I don't get the services.exe error anymore but my shutdowns and restarts are extremely long. between 15-20 min range. It seems the only constant is the InstallShield error and the long shutdowns/restarts. Before I did this previous restart which did not generate the services.exe error. I did downlaod/update/run Malwarebytes Anti-Malware and did a quick scan. It stated nothing was found. I do have the log if it would help at all, just let me know if I should and where to post it.

#7 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 06 August 2011 - 05:44 PM

I just did a restart as a result of installing some windows updates and I got the old services.exe error, the one with a code of 1073741819. None of this is consistent, I really don't see a pattern here at all.

On a side note I was able to see the error again and can confirm the path was C:\\Windows\System32... and not what I originally posted. I'm downloading spybot search and destroy as described in one of the tutorials on here, hopefully that finds something.

#8 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 07 August 2011 - 08:38 AM

Hello all, So I ran Spybot S&D once and it picked up 3 things that seemed to be trivial based on the description on the right and I hit fix selected problems. I couldn't do 2 of them because they were using memory at the moment and asked if it could run Spybot S&D upon next start up, so I hit yes and rebooted. A long shutdown and bootup later it runs and successfully fixes those two issues. I fell asleep shortly after so the computer was on the whole night (connected to the internet) and I think I forgot to re-enable windows firewall after letting it run spybot S&D and Malwarebytes AntiMalware. I decided to run spybot S&D a second time when I woke up to make sure everything was gone and now there are 168 problems. Some spyware, hijackers, dialers, trojans, and malware. I disconnected the computer from the internet until I need it. I'm going to type out the issues it found and fix the issues. Then I'm going to run Malwarebytes Antimalware and then run each of them a 2nd time to check if everything is gone. Hopefully this does something, either way now I have somewhere to start looking. Before I was lost. Here are all the issues spybot S&D found.

180Solutions.SearchAssistant - 1 entries Spyware
ABetterInternet - 1 entries Malware
Bestsearch.Scvhost - 8 entries Hijackers
Citofarera - 9 entries Dialer
CoolWWWSearch - 3 entries Hijackers
CoolWWWSearch.BadZoneMap - 36 entries Hijackers
CoolWWWSearch.Googlems - 6 entries Hijackers
CoolWWWSearch.WinRes - 3 entries Hijackers
IPFW - 2 entries Trojans
MediaMotor - 9 entries Malware
Mirar - 2 entries Malware
SearchSquire - 3 entries Spyware
Sfonditalia - 3 entries Dialer
Sgrunt - 3 entries Dialer
Smitfraud-C - 45 entries Malware
TNS-Search - 10 entries Hijackers
Win32.Agent.hjo - 18 entries Trojans
^^^^^-----(this is weird because I reformatted the computer when I received it at work and I don't look at adult content while I'm at work)
Win32.Dialer.jw - 3 entries Trojans
XPreload - 3 entries Trojans

#9 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 07 August 2011 - 10:03 AM

Title was: XPreload Trojan Does spybot effectivly fix this? ~ OB

I didn't see a tutorial for deleting this Trojan. I'm using Spybot S&D to "Fix" it as I type this but it seems there are specific ways to get rid of various Malware type programs. I was wondering if this is fixed with Spybot S&D alone or if I need to do more. This seems to be the root of my problems because it downloads other Malware.

Edited by Orange Blossom, 07 August 2011 - 11:05 AM.
Merged topics. ~ OB


#10 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 07 August 2011 - 10:41 AM

After running Spybot S&D and Malwarebytes AntiMalware, and then running them a second time after the 1st. Malwarebytes AntiMalware picks up nothing but Spybot S&D picks up the same exact programs the same amount of times except for

Win32.Agent.hjo which it picked up 19 times instead of 18.

If Spybot S&D and Malwarebytes AntiMalware doesn't do anything, then from what I've read on the forums and tutorials is I'm going to have to go into the registry and take these programs out manually. I don't feel experienced enough to do that on my own. Some of the descriptions in Spybot S&D tell me where these programs attach themselves but I don't know if that is all I have to delete, or if they attached to an important file and if I delete it I mess up the computer.

Please help

#11 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:05 PM

Posted 07 August 2011 - 11:56 AM

Welcome aboard Posted Image

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Users, Partitions and Memory size
Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#12 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 07 August 2011 - 12:46 PM

Okay, so In distress I tried reinstalling Windows again, this was before you post. And while I had My ethernet cable unplugged I was fine and then I plugged it back in and the same issues started coming up.

So do you want me to do SecurityCheck.exe only or go in order and do MiniToolBox, Malwarebytes, and GMER also? Also, do these work offline? The computer in question won't allow me to connect to the internet. At least not with IE.

Edited by lanzd, 07 August 2011 - 12:55 PM.


#13 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:05 PM

Posted 07 August 2011 - 01:08 PM

I tried reinstalling Windows again

Was it clean installation including hard drive formatting?

Try to reset your router. If the issue still exist go ahead with my previous instructions.

Go Start>Run (Start search in Vista), type in:
cmd
Click OK (Vista and Windows 7 users: while holding CTRL, and SHIFT, press Enter).

In Command Prompt window, type in following commands, and hit Enter after each one:
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew
net stop "dns client"
net start "dns client"


Turn the computer off.

On your router, you'll find a pinhole marked "Reset".
Keep pushing the hole, using a pencil, or a paperclip until all lights briefly come off and on.
NOTE. Simple router disconnecting from a power source will NOT do.
Restart computer and check for redirections.

NOTE. You may need to re-check your router security settings, as described HERE

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#14 lanzd

lanzd
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:05 PM

Posted 07 August 2011 - 01:16 PM

I booted from disc with my Windows XP Professional 32 bit cd in the drive and deleted all partitions between my two HDD's. Then continued with installation. As of right now I'm still waiting on the logging off screen. I clicked on the Start -> shutdown button before my last post at 12:46 pm. This is normal with the recent behavior of the computer. Should I force shutdown but holding the power button down?

#15 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:05 PM

Posted 07 August 2011 - 01:20 PM

Before you reconnected Ethernet cable did you have Windows firewall up already?

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users