edwalt's - Things I Wish I'd known about SBS 2003.... Blogs - edwalt's - Things I Wish I'd known about SBS 2003.... - Site Home - TechNet Blogs

Blogs

Server Boots to Grey Screen in any Mode....

  • Comments 11
  • Likes

1. Are you using etrust anti-virus? - Yes <See Below>

2. If you are NOT using etrust - Most likely LASSRV.B -http://www.symantec.com/security_response/writeup.jsp?docid=2006-082409-3922-99&tabid=3

If the answer is yes to etrust, then most likely the issue is with the latest etrust update....  The issue lies with a signature file that was released this morning that has some issues. 

Here are some of the symptoms:

  • Once the signature is installed the server reboots.
  • Boots to a grey screen immediately after the splash screen.
  • Happens in every mode
  • Directory Services Restore Mode - allows you to logon but you do not ee any icons or a start menu.
  • Unable to open Taskmanager.
  • Unable to Terminal Serve into the box.
  • Last known good does not work

Please follow these steps at your own risk!!!!!

Workaround: 

Boot into Recovery Console - If this is a Dell server using OEM media most likely Recovery Console will not be available.  If this is the case please boot to Recovery Console using an XP CD.

Copy LSASS.EXE  back onto the \windows\system32 and \windows\system32\dllcache

(Get lsass.exe from SBS CD #1 i386 folder using a different machine, you have to expand the file (expand <cd>\i386\lsass.ex_ a:\lsass.exe)

(You can also get lsass.exe from another working system).

Once you have LSASS.EXE back in the required locations, you need to disabled Etrust AV before rebooting.

  • Type Disable "eTrust Antivirus Job Server"
  • Disable "eTrust Antivirus Realtime Server"
  • Disable "eTrust Antivirus RPC Server"

After you are up, you need to get the latest signature files before enabling the AV services.

http://www3.ca.com/support/vicdownload/SignDownload.aspx?CID=49737

CA states that their signature 303.3056 is fixed.

>edwalt

Comments
  • I had a similiar probelsm a few weeks ago. I do run etrust. When I went to the server screen all I had was a mouse. Couldn't Ctl-Alt-Del nothing. I could terminal server into the box and it seemed ok, nothing in the logs. I could not however shut it down. I therefore rebooted and it seemed ok. After the screen saver kicked in it went back to just having a mouse. I left it 24 hours and again rebooted it. After that it all seemed fine so I thought nothing of it. I had a feeling it was an etrust issue.

    I have not however seen the issue since then so I don't know if it is indeed related.

  • ZJ85Xa r u crazzy? I told u! I can't read!

  • nCm9Cp r u crazzy? I told u! I can't read!

  • Wm73la r u crazzy? I told u! I can't read, man!

  • ks9uV6 r u crazzy? I told u! I can't read!

  • v5r1hs r u crazzy? I told u! I can't read!

  • wdznkA r u crazzy? I told u! I can't read!

  • N9sx9f r u crazzy? I told u! I can't read!

  • sqdoEI r u crazzy? I told u! I can't read!

  • LrJLXH r u crazzy? I told u! I can't read!

  • H98omH r u crazzy? I told u! I can't read!

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment