Event ID 1014; Cannot load unknown illegal module

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Recently, an application terminal server has begun reporting "Cannot load
illegal module: C:\WINNT\system32\Drivers\.SYS" when people login to the
server.

Upon logoff, connectionns named "Down (655xx)" remain and need to be reset
within terminal services manager.

The server is running Windows 2000 sp4. The full error message is as follows:

Event Type: Error
Event Source: TermService
Event Category: None
Event ID: 1014
Date: 1/2/2006
Time: 6:36:21 PM
User: N/A
Description:
Cannot load illegal module: C:\WINNT\system32\Drivers\.SYS.

Is this correctable?

Thank you.

John Grogan
 
This sounds serious!

Note that the EventID is supposed to list the search path to a dll
in C:\WINNT\system32\Drivers\
In your case, it lists a file called ".SYS". That sounds suspicious
to me.
Have you inspected the \Drivers folder? Is there such a file? If
yes, when was it created? Who owns the file?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"=?Utf-8?B?Sm9obiBHcm9nYW4=?=" <John
(e-mail address removed)> wrote on 03 jan 2006 in
microsoft.public.win2000.termserv.apps:
 
No. No such file exists.
- j

Vera Noest said:
This sounds serious!

Note that the EventID is supposed to list the search path to a dll
in C:\WINNT\system32\Drivers\
In your case, it lists a file called ".SYS". That sounds suspicious
to me.
Have you inspected the \Drivers folder? Is there such a file? If
yes, when was it created? Who owns the file?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"=?Utf-8?B?Sm9obiBHcm9nYW4=?=" <John
(e-mail address removed)> wrote on 03 jan 2006 in
microsoft.public.win2000.termserv.apps:
Click to expand...
 
For me, this would be a reason to re-image the server.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

"=?Utf-8?B?Sm9obiBHcm9nYW4=?="
 
Back
Top