gchq

Further on down the rabbit hole..... I thought I might have tracked the problem to :- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.ZJ But not so! No entries in the registry! However in services I DID find an entry under "System Log Service" and a path to system32 looking for svsys.exe - this file doesn't exist - but the actual system log is working fine and quite happily reporting that it isn't starting up! For now I have disabled this at startup!

Quote: Is your system now working? or is it not? Are you asking now that it works, how did this happen? There can be various reasons how this can happen - 1) an attempt was made to repair an installation, but rather than repair, it created a second instance. 2) someone attempted to gain admininistrator privileges and botched it, 3) a "hijack" occured through a trojan/worm to gain access to passwords and set in place its own administrator's profile. Those are a few I can think of. It comes up with that error every time it is started - seems to be looking for file(s) for the System Log Service. I must confess I have just put up with it and let it run as nothing actually seems to have been effected! No attempts have been made at a repair, as with any W2K server on the net people constantly try to gain access, par for the course now and I monitor for possible trojans/worms with Port Explorer and Process Explorer!

Sampson Thanks for that - but still seems a mystery as the Documents and Setting directory has not been moved from the default since installation!

I am getting the very same error code on a W2K Server Quad Xeon box - no changes in hardware at all, just started to appear - same event ID number as well!