Re: RPC error that restarts the servers
- From: "Tariq Malik" <tariq@xxxxxxxxxxxx>
- To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
- Date: Mon, 3 Oct 2005 11:20:28 +0100
This error is normally related to the MSblast Worm.There is an update
patch available for this at The following link
http://microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS03-026.asp
Kind Regards
Tariq Malik
Frontline Business Services
Allied House, 25 Boulton Road, Stevenage Business Park, Stevenage,
Herts, SG1 4QX
Phone No: 01438 740 750
Fax No: 01438 740 751
E-mail: Tariq@xxxxxxxxxxxx / Helpdesk@xxxxxxxxxxxx
<mailto:hHelpdesk@xxxxxxxxxxxx>
*********************************************************************
This email and any attachments to it are confidential and intended
solely for the individual or organisation to whom they are addressed.
You must not copy or retransmit this e-mail or its attachments in whole
or in part to anyone else without our permission. The views expressed in
them are those of the individual author and do not necessarily represent
the views of this Company.
This email has been swept for viruses using Trend Micro Online but you
should still take all sensible precautions against viruses.
Frontline Business Services Ltd, is registered in England under Company
Number 04600736.
________________________________
From: Exchange server [mailto:exchange@xxxxxxxxxxxxxx]
Sent: 03 October 2005 10:52
To: [ExchangeList]
Subject: [exchangelist] Re: RPC error that restarts the servers
http://www.MSExchange.org/
This error is not specific to the <service name> service but it is
generated by the Service Control Manager when it detects that a specific
service terminated ungracefully. In order to troubleshoot this error
look for other events, logs, etc., that are specific to the service in
question.
- Service: "McShield" - This is caused by a bug in the McAfee software,
install the latest version.
- Service: "Print Spooler" - As per Microsoft, this problem may occur if
a print job that contains an older version 3 DEVMODE structure that does
not contain ICM information is submitted. When the spooler tries to
reference this data, it causes the access violation. A post SP3 hotfix
is available - see M324183.
- Service: "IIS Admin Service" - See M311517.
- Service: "Distributed Transaction Coordinator" - See M290637.
- Service: "Microsoft ISA Server" - See M288247.
- Service: "Remote Procedure Call (RPC)" - This may occur if the system
is infected by the MSBlaster or LoveSAN Internet worm. See M823980 for
details. See also the Symantec Security Response on how to detect it and
remove it.
Not a fix, but a way to work around occasional failures is to configure
the "Recovery" option of the service to restart it if the service fails.
I would not recommend setting all the 3 options to restart the service
but only the first two "First failure" and "Second failure" - this way,
you avoid an continuous failure/restart cycle. We used this for example
with Adiscon MoniLog that failed occasionally. The Service Control
Manager would simply restart it and the service worked fine.
On Mon, 03 Oct 2005 Osman Mahmud wrote :
>http://www.MSExchange.org/
>
>Hello everybody,
>
>
>
>We are encountering a problem related to RPC error that restarts the
>servers those do not have Windows server 2K3 SP1. And these are
Exchange
>Cluster servers and some other oracle servers. I have attended the
>problem immediately and for the time being I have changed service
>recovery option to restart the services instead of restart the
computer.
>But I think it is not a permanent solution. Event log is as follows:
>
>
>
>Event Type: Error
>
>Event Source: Service Control Manager
>
>Event Category: None
>
>Event ID: 7031
>
>Date: 10/2/2005
>
>Time: 1:38:25 PM
>
>User: N/A
>
>Computer: BLDHKEXCL22
>
>Description:
>
>The Remote Procedure Call (RPC) service terminated unexpectedly. It
has
>done this 1 time(s). The following corrective action will be taken in
>60000 milliseconds: Reboot the machine.
>
>
>
>For more information, see Help and Support Center at
>http://go.microsoft.com/fwlink/events.asp.
>
>
>
>Would you please help me.
>
>
>
>
>
>Best Regards,
>
>Osman Mahmud
>
>
>
>________________________________
>
>
>
>------------------------------------------------------
>List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
>Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
>------------------------------------------------------
>Visit TechGenix.com for more information about our other sites:
>http://www.techgenix.com
>------------------------------------------------------
>You are currently subscribed to this MSEXchange.org Discussion List as:
exchange@xxxxxxxxxxxxxx
>To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
>Report abuse to listadmin@xxxxxxxxxxxxxx
Thanks and regards
Prabhakar k
Exchange Team
India
<http://adworks.rediff.com/cgi-bin/AdWorks/sigclick.cgi/www.rediff.com/s
ignature-home.htm/1507191490@Middle5?PARTNER=3>
------------------------------------------------------ List Archives:
http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange
Newsletters: http://www.msexchange.org/pages/newsletter.asp
------------------------------------------------------ Visit
TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------ You are currently
subscribed to this MSEXchange.org Discussion List as: tariq@xxxxxxxxxxxx
To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to
listadmin@xxxxxxxxxxxxxx
Other related posts:
