Server Boots to Grey Screen in any Mode….


1. Are you using etrust anti-virus? – Yes <See Below>


2. If you are NOT using etrust – Most likely LASSRV.B –http://www.symantec.com/security_response/writeup.jsp?docid=2006-082409-3922-99&tabid=3


If the answer is yes to etrust, then most likely the issue is with the latest etrust update….  The issue lies with a signature file that was released this morning that has some issues. 


Here are some of the symptoms:



  • Once the signature is installed the server reboots.

  • Boots to a grey screen immediately after the splash screen.

  • Happens in every mode

  • Directory Services Restore Mode – allows you to logon but you do not ee any icons or a start menu.

  • Unable to open Taskmanager.

  • Unable to Terminal Serve into the box.

  • Last known good does not work

Please follow these steps at your own risk!!!!!


Workaround: 


Boot into Recovery Console – If this is a Dell server using OEM media most likely Recovery Console will not be available.  If this is the case please boot to Recovery Console using an XP CD.


Copy LSASS.EXE  back onto the \windows\system32 and \windows\system32\dllcache


(Get lsass.exe from SBS CD #1 i386 folder using a different machine, you have to expand the file (expand <cd>\i386\lsass.ex_ a:\lsass.exe)


(You can also get lsass.exe from another working system).


Once you have LSASS.EXE back in the required locations, you need to disabled Etrust AV before rebooting.



  • Type Disable “eTrust Antivirus Job Server”

  • Disable “eTrust Antivirus Realtime Server”

  • Disable “eTrust Antivirus RPC Server”

After you are up, you need to get the latest signature files before enabling the AV services.


http://www3.ca.com/support/vicdownload/SignDownload.aspx?CID=49737


CA states that their signature 303.3056 is fixed.


>edwalt


Comments (11)

  1. Robert Crane says:

    I had a similiar probelsm a few weeks ago. I do run etrust. When I went to the server screen all I had was a mouse. Couldn’t Ctl-Alt-Del nothing. I could terminal server into the box and it seemed ok, nothing in the logs. I could not however shut it down. I therefore rebooted and it seemed ok. After the screen saver kicked in it went back to just having a mouse. I left it 24 hours and again rebooted it. After that it all seemed fine so I thought nothing of it. I had a feeling it was an etrust issue.

    I have not however seen the issue since then so I don’t know if it is indeed related.

  2. zxevil135 says:

    ZJ85Xa r u crazzy? I told u! I can’t read!

  3. zxevil136 says:

    nCm9Cp r u crazzy? I told u! I can’t read!

  4. zxevil134 says:

    Wm73la r u crazzy? I told u! I can’t read, man!

  5. zxevil141 says:

    ks9uV6 r u crazzy? I told u! I can’t read!

  6. zxevil150 says:

    v5r1hs r u crazzy? I told u! I can’t read!

  7. zxevil151 says:

    wdznkA r u crazzy? I told u! I can’t read!

  8. zxevil152 says:

    N9sx9f r u crazzy? I told u! I can’t read!

  9. zxevil153 says:

    sqdoEI r u crazzy? I told u! I can’t read!

  10. zxevil154 says:

    LrJLXH r u crazzy? I told u! I can’t read!

  11. zxevil155 says:

    H98omH r u crazzy? I told u! I can’t read!