Services.exe terminated unexpectedly with status code 128.

If you’re using Windows 2000 and meet “”The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.”problem when you start the computer, try this KB:;en-us;318447

If you meet the same problem when you’re running Terminal Services and Gateway Services for NetWare, you can reference this article:;en-us;315105

81 thoughts on “Services.exe terminated unexpectedly with status code 128.

  1. I found the following error that :

    "The system process c:\WINNT\System32\Services.exe" terminated unexpectedly with status code 128. The system will now shutdown and restart.”

    Please Help Me.

  2. I found the following error that :

    "The system process c:\WINNT\System32\Services.exe" terminated unexpectedly with status code 128. The system will now shutdown and restart.”

    Please Help Me.

  3. Hi Dhanajeliyan,

    Have you tried the two KBs above?

    If tried and they don’t work, could you please tell me more information about your environment or your issue?

  4. Hi Nuo Yan,

    I have the same problem above. I am using widows 2000 server. The error message come up before the login screen. So I can’t even get into windows to change the registry. what should I do? the machine will be restart in one minute after that error message comes up.

    I have already update all the security patch and also anti-virus definition. I suspect there ‘s virus on the server.

    please help

  5. I’m afraid your computer may affect virus. You could try to log into safe mode of the system, and then perform a virus scan.

    If you can log into the safe mode, try to modify the registry there.

    If you even cannot log into safe mode, try to boot from your anti-virus software boot-disk and scan the virus.

  6. I can’t log into safe mode either. I take out that operating system hard drive and scan it by other machine . It cannot be found any virus. Any other idea?

  7. Ya… It’s registry corrupt, however Ka cannot log into safe mode either, difficult to modify registry or install service pack… Let me see…

  8. I am having the exact same problem. I cannot log into safe mode either. The Administrator account (which has no password) fails. Is there a way to fix this with the install cd from the recovery console or something?


  9. Hi, I am having a similar issue as well, however I am able to get into safe mode.

    Neither knowledebase article applied to me, and my virus scanner, which is right up to date, does not find anything.

    Please help. This is a production Windows 2000 Server with all the service packs and hotfixes applied.

    Very odd indeed!


  10. We (4 PC’s) got attacked by a whole boat load of stuff (adware/spyware/virii,etc.) a couple of days ago. Found lass32.exe using 99% of the cpu, so I killed it, killed the process, deleted all registry entries that referenced it, deleted the file. Now when we boot we get this same error message "Services.exe terminated unexpectedly with status code 128" and the system accounces it is shutting down in 60 seconds. Tried the 318447 tip, no values under the selected keys. Still boots in Safe Mode, but we’ve given up. Reinstalling Windows 2000 now.

  11. 1. Restart the computer in Safe mode: a. Restart the computer.

    b. Press F8 when you receive the "Please select the operating system to start" message.

    c. On the Windows Advanced Options menu, use the arrow keys to select Safe Mode, and then press ENTER.

    d. If you are running other operating systems on the computer, use the arrow keys to select Microsoft Windows 2000 in the list that is displayed, and then press ENTER.

    2. Click Start, click Run, type regedit in the Open box, and then press ENTER.

    3. Locate and then click the following registry key:


    4. Back up the registry key: a. On the Registry menu, click Export Registry File.

    b. In the File name box, type Shares_RegKey, and then click Save.

    This step saves the Shares registry key to the Shares_RegKey text file, which you can use to restore the key in the future. By default, the file is saved in the My Documents folder. For information about how to restore the key, search Regedit Help for the Import Registry Key topic.

    5. Examine the list of values in the right pane of Registry Editor.

    Notice that the Data column contains the paths to shared folders. For example, you may see a line similar to the following:

    CSCFlags=0 MaxUses=4294967295 Path=E:\NS Permissions=0 Remark= Type=0

    This refers to the E:\NS shared folder.

    6. For each value, use Windows Explorer to make sure that the path displayed in the Data column represents an existing shared folder. Delete all values that do not correspond to shared folders.

    7. Quit Registry Editor, and then restart the computer.

  12. I too am having this problem. Tried updating anti-virus, updating window patches, the Carl Andre solution, running anti virus scan outside server startup and nothing has worked. It became so critical that running a complete restore did not resolve the issue.

    Aside from re-installing the operating system…. any other ideas?

  13. i dont have any shares so there is no key to edit and its still doing it….

    ive reinstalled and keep getting all the same stuff happening no matter what i do. im about to throw my pc through the window please help.. im just glad there is a safe mode with networking so i could see that im not alone.

  14. Same here. W2000 WS, SP4. After running ALL DAY, shuts down with this message. No LANMAN. Not server. Nothing in event viewer.

  15. Here is a fix: If you can boot your server into safe mode, open up the services console and disable a service called "rewt". Once it’s disabled, reboot your server and you should be good to rock and roll! Good Luck!

  16. Hi,

    I am getting same error, but I aint running server. Im running 2000 Professional. Installing into same dir still has problem, yet installing new dir doesnt. Can anyone help?

  17. Hi Again,

    I have just fixed the problem on my computer.

    What I did was install a fresh copy into new dir (this is win2k Pro NOT Server)

    and then load into the new install. I then just copied system32 folder from new install over the old one. Once that was done I then booted into old install and works perfectly. Drawback involved is you gotta reinstall most of your drivers. (but you’d have to anyways if the other steps dont work and you have to reinstall ^^)



  18. Had the same problem, tried everything. Then I scanned the hard drive for viruses in another pc and found all sorts of adware, deleted them and away it went. So does look to be a virus/adware related problem.

  19. Started Windows 2000 Professional in safe mode, list of values in the right pane of registry editor were as follows:

    Name: Default Type: Reg_Sz Data: (value not set)

    Not sure what to try now…

  20. hi,

    i am also havin the same problem and i tried the microsoft website which is given above. but i dont see any info (CSCFlags=0 MaxUses=4294967295 Path=E:\NS Permissions=0 Remark= Type=0) in the registry. in shares folder ,on the right side i see (Default) REG_SZ (value not set).

    i also tried downloading some virus scanners .windows patch (Windows2000-KB835732-x86-ENU) and (Windows2000-KB823980-x86-ENU) but it didnt work.

    i have two logins in my system. i am able to open from the second login, but when i go into the admin login the services.exe error occurs.

    pls provide a solution.

  21. I think micorosft’s engineers were a little smoking something when they forgot to implement a tool for editing the registry outside of the os and when they forgot to include this tool into the recovery console.

  22. I caused this exact problem by creating a bogus registry entry while trying to create a DependsOnService entry under HKLM\system\CCS\services\xxxx. As it turns out I was lucky enough to know the exact entry that caused the corruption.

    I also could not boot into any of the safe modes, tried repair etc.. eventually loaded a parallel OS install.

    Next use regedt32 which can be used as an offline registry editor.

    Navigate to first OS C:\winnt\system32\config

    Load the corrupted hive edit to fix.

  23. Having the same problem.

    I cannot boot into safe mode, (the same message is still there, Cannot boot in anymode actually because the system still shutsdown when services.exe fails. (I thought the point of having safemode was that it didn’t load services?)

    The build up to the problem was the exchange mailbox store dismounted for unknown reasons, and would not start again, I restarted the server to make sure all services were restarted, and the system has been shutting it’s self down ever since!

    I’ve checked, (taking out the disk) there are not virii

    there were no shares (besides the default C$ d$ IPC$ and admin$ so I don’t think it’s that, (although I’m unable to run the regisrty editor to check for this problem as the machine cannot start.

    and the machine is

    Now I have a production server that cannot/will not start.

    I’m having to use Ghost to try to recover data files from it to *try* to recover mail boxes, Microsofts help articles are of little or no use.

    Performing a recovery installation of windows seems to have helped the situation…

    things are still broken but at least I can use the machine and make an effort to fix the problems!

  24. My problem is the same with the exception of the code. Tried the fixes listed for the 128 to no avail. W2k Pro machines.

  25. Having the same problem. I have Windows 2000 server with SP4.

    Using the Novell Client 4.90 SP2.

    Gonna try reinstalling Novell Client

  26. I’m having trouble.

    on one of my notebooks i recently updated from Windows XP SP1 to SP2.

    since the update, my computer now finds about 8 "Unknown New Hardware" on startup, when nothing’s new.

    as well as that, i regularly have services.exe close down unexpectedly with status code 128 or 1073741819. I’ve done some research but have unfortunately been unable to gather any solutions.

    I’m also unable to open IE now. i’ve scanned the computer for spyware and viruses and everything’s clean.

    Please advise, thanks.

  27. I have this same problem, but it happens when I just finish installing windows. It’s happened with Win2000 and I’ve had similar problems with WinXP. I am about ready to throw everything in the trash. I have tried three different HDD’s. I even bought a new one….which had the same problem the other ones did. I’m going crazy here.

  28. I was having the same problem. Was looking everywhere for help. I have a program called regseeker that’s been on there for a while. I used it numerous times to clean up my registry. I started in safe mode went to regseeker and had it put in an old backup registry. Restarted and so far everything is good.

  29. I fixed it by using the msconfig utility from an XP Professional machine.

    I followed MSFTs fix to the letter and no success.

    This is most likely a startup item.

    Get a copy of "MSConfig" from an XP Professional machine( yes it runs on Win 2k).

    Boot into safe mode and turn off all .ini and system services and startup items , if you can get into Safe Mode if you cannot get into safe mode, back up all of your data and reinstall if you can read below.

    With the MSConfig utility you can kill everything at startup the Win.ini, system.ini, boot.ini, services and startup Items. Add things back in one by one until you find the error again.

    Be sure to make careful note of what you added so as not to do double work.

    Hope this helps.


  30. The popup appear AFTER the login windows… 2 pc are infected on the company network … try the 2 kb and that didnt fix the problem

  31. same problem but i am on a university network. it has infected many machines and the two above kbs do not work. need to know what to do! HELP!

  32. I applied security update 899588 and the problem went away.

    I’m running Windows 2000, service pack 4. The problem hit me the morning of Aug 15, 2005, so I assume the problem was Zotob worm that was reported in the media, e.g.

    The various fixes referenced above did not work for me; it was the security update that did the trick. Since the worm causes reboot when I tried to access the network, I unplugged the network cable and restarted my machine. I then downloaded the patch on another machine and copied it over using flash memory. After installing it on the infected machine I reattached the network cable and everything is fine.

  33. @ Nigel Ward: THANKS!

    This problem hit us too at August 15th at two different machines using Win2000 SP4. The problem occurs only when connected to the Internet (dial-up or ethernet). As far as I can see for now, update 899588 did the trick!

  34. There is a way to sop the shutdown by running "shutdown /l /a" in the comand line.

    My question for all of you is…

    What if you are running W2K Pro SP3 in your company and can’t upgrade yet?

  35. After the su 899588 it still doesn’t work for me.

    The problem was on a 2000 sp 3 machine, my collegue upgraded it to sp4 from save mode.

  36. I started having the same problem yesterday with the difference that my computer shuts down only if I run the Start Active directory Wizard. I am running Windows 2000 Advanced Server. I have tried all of the fixes above (with the exception of installing Windows in another directory and etc…) and none have worked for me. Help?

  37. A friend of mine is having the same "C:\WINNT\system32\services.exe terminated unexpectedly with status code 128" message on his Windows 2000 SP3 Professional system.

    Tried many things, including scheduling a chkdsk /r to run at reboot. But it did not solve the problem.

    Then realised when i did not do a dial-up to Internet, the message did not appear. So tried dialing up to the Internet, and sure enough, the message pops up almost immediately. Initially suspected it was the Internet Explorer program that is causing the problem, so launch Internet Explorer without dialing up, but message never appears. This leads me to believe the dial-up connection instance is causing the problem.

    In the end, set up another instance of the dial-up connection and delete the old one, and thankfully, the message did not appear again.

    Just like to share, and hopes this will help those having the same problem.

  38. what you guys doing running servers on windows anyways. Get a real operating system. There is a reason that the vast majority of the internet is run on unix/linux pc’s. FYI: linux is free

  39. Linux is NOT really free to enterprises, but more expensive. Why? Consider the support costs from the linux vendors, IT people costs, managing costs, lower effiency (20 minutes’ work to build a well functioning DNS server in Windows Server 2003 but it needs more than 3 hours to build the same thing on a linux server), etc. Compare with Linux, Windows Server has lower total cost of ownership, easy to manage and administer, easier to hire IT people for Windows, etc.

  40. Sounds just like the talking points from Redmond. Funny how you can get the results you want when you pay for the study.

    It certaintly does NOT take three hours to install and configure a Linux DNS server. At least not if you have a clue about what you are doing. This whole TCO thing is completely bogus.

    Oh, and by the way, I have been administering both Windows and Linux platforms for about 15 years now.

  41. Hi all, I have managed to solve the problem. I spent forever looking through forums applying patches, doing scans etc but the problem still remained! I am using XP SP2.

    In the end I copied lsass.exe and services.exe from a ‘clean’ pc. I then used a pre-installed environment disk to access the windows file system and overwrit the originals. It worked! I am aware that most people wont have a PE disk so try this…..

    If you copy the files to a floppy disk using the ‘clean’ pc, boot to DOS using a 98 bootdisk and overwrite lsass.exe and services.exe in c:\windows\system32.

    The syntax will be….

    cd a:
    copy lsass.exe c:\windows\system32
    copy services.exe c:\windows\system32

    Hope this helps!

  42. I have this same error on an IBM Thinkpad running Windows 2000 Professional updated to the latest service pack.
    It was fine until I updated. Now I get the “”The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.” message. It says that “This shutdown was initiated by NT AUTHORITY/SYSTEM”.
    This only happens when I try to install new devices. The thinkpad will load normally and can be used without a problem, but as soon as I plug in my usb webcam, PCMCIA Wireless LAN card or PCMCIA Bluetooth adapter, I get the message and the Thinkpad restarts. I have done a full scan with AVG and Ad-Aware, and turned up nothing.
    When I reboot into safe mode the only value for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares is (Default), the same for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\Security.
    Any ideas?

  43. That’s kind of the point he was making. Most people, even most techs, don’t have 15 years of experience. Most of us have to learn on the fly and we have to deal with the standard operating system that our company or clients use: Windows. I can’t tell my boss or my clients that I don’t support Windows and that they should change their entire network. That’s ludicrous. Using non-mainstream operating systems/software is the easy way out. It’s avoiding the problem, not dealing with it. It’s only natural that non-mainstream operating systems/software has fewer problems because virus-makers and hackers naturally target the mainstream products.

    I believe that those who attempt to solve the actual problem at hand, whether they succeed or fail, are far more intelligent than those who argue semantics and claim that others are clueless.

  44. I haev found that if this is coming up when you are trying to install active directory or running dcpromo that the problem is from the HOSTS file located in c:\WINNT\system32\drivers\etc if you eitehr replace or remove this file then reboot and run the setup again this should solve the problem.

  45. i’m having a same problem after uninstalling sp4 form Windows 2000 server.

    i cannot boot in normal windows
    ii cannot boot in safe mode-using ms dos and normal safe mode.

    anyone can help me thru this…..

  46. I can not enter the save mode to do anything. Please advise me how I should do now.

    Thanks in advance.

  47. Im using windows 2000 SP4 and i have the same promblem. But my pc restarts when i am connected to the internet. I have done a virus check with AVG and Bitdefender but found nothing.
    Can someone help me out here??

  48. My pc is also restarting with this error. but only when im connected to the internet. I also did virus checks and found nothing. Im using win2000 SP4.
    Can someone please help me out here??

  49. I have the same problem. I scanned using AVG NOD32 and nothing no virus or anything. What I know is that this error only occurs when I connect to the internet using a password and username broadband

  50. I have the same problem too “c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128″. Our W2K Server is connected directly to internet using leased line. If I disconnected the internet line, the system is running smoothly but if the internet line connected back, the system will start shutting down unexpectedly for at least 3 to 4 times a day. I have the latest service pack 4 and patches and service pack 4 security rollup installed but the problem still there. Please help how to fix this problem. Our sever hase Exchange 2003 installed.

  51. I had the same problem with services.exe on Win2k SP4. If I unplugged the network cable the PC was fine. As soon as I plugged the network cable back in I would get the same error message and the PC would shutdown automatically.

    I decided to uninstall and reinstall the driver for the ethernet card.

    The PC is working fine now!!!

  52. I have the same issue on a handfull of win2k pro sp4 desktops. Thats are restarting,
    -virus outbreak in my network with the W32.Spybot.Worm
    upgrated my clients to SAV 10.1 Cleaned all Infections.
    -Computers still restarting MS KB dont work!

  53. I get the status code along with the C:\winnt\system32\services.exe

    The other strange thing is when i put in a usb mouse and click it immdiately crashes my computer.

  54. check your hosts file… if there are too many entries it can cause this error… especially if you are trying to run DCPROMO.


  55. Thank you Jesus! This was the cause of the problem for me!

    “check your hosts file… if there are too many entries it can cause this error… especially if you are trying to run DCPROMO.


  56. Just do a file search for lmhost, and host.
    It should find it for you..
    If it doesnt, you need to open up windows explorer, and go to folder options, and uncheck the option to hide protected operating system files.

    Open the file with notepad, if it had a ton of entries in it, you need to delete out a bunch of them. Or most of them… Start at the bottem, and deleted the lines. Leave about the top 5 entries.

  57. found the following error that :
    “The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.” this error comes in recently .

    Please Help Me.

  58. I’m having the same problem as everyone else, except even when I go to safe mode, the error still pops up and gives me a minute until shut down. How do I go about solving the problem in this instance?

  59. When i access the saft mode there has the same problem, then shutdown with 1 minute.
    Is there any solution if i cannot access the safe mode?

  60. Yep it was the hosts file for me too…… installed spybot ages ago and it uses hosts file to redirect you from dodgy websites so there was just too many for it.

    Used a blank hosts file and all was good again 🙂 Thanks heaps.

  61. HI i also having this error ,bt its not while we log in it after start os ,error not comes in a specific s\what should i do for this problem?

Leave a Reply

Your email address will not be published. Required fields are marked *