Windows 2000 Server problem

[Razers]

Guys, i have this file server:

SERVER NAME ABCFILESERVER

MODEL IBM xSeries 235

PROCESSOR INTEL XEON 2.4GHz

MEMORY RAM 1GB RAM

HARDDISK 34GB, 34GB

OS WINDOWS 2000 SERVER SP3

Sometimes when opening a program,an error message appears saying "'Run-time error '7' out of memory" & the File Server's RPC Service has stopped running unexpectedly, the drag & drop can't function, copy&paste also can't function.

I need to restart the server to enable them back & it's really troublesome. This never happen before & it just happen lately. I tried scanning for viruses & spywares using latest updates but nothing found. Any ideas? :alien:

[timmmay]

My first step would be to upgrade to Windows 200 Service Pack 4

[Razers]

I've been thinking of that too but i afraid some of the application later won't work i.e. SQL applications.

any ideas what step should i take?

[timmmay]

Well in that case do a full backup before upgrading and cross your fingers!

Otherwise, check the event logs for any specific error details. Runtime errors can be caused by too many things to put a finger on without more information. Although, the fact that the RPC service stops indicates that it's either a virus/trojan or most likely a system file issue.

[Razers]

alright, i'll give it a try. stay tuned...

[Guest]

Are you sure the RPC Service is stopping? I'm sure Windows normally reboots itself when that service stops.

How much drive space is left on that 34GB drive?

[Razers]

The HDD still have 70% free space. Luckily the server didn't restart by itself & only that certain functions can't use after RPC service failure.

[Guest]

Ouch. Can you try an online scanner?

[Razers]

Oops...the server is not connected to WAN only LAN.

[Guest]

Are all your client PC's protected against antivirus? The last time I saw RPC shutting down issues was the result of the Blaster virus. If your Windows 2000 Server is local only then maybe this server isn't patched to fix the RPC exploit. Is KB823980 listed as installed in Add/Remove Programs?

[garethevans1986]

I remember that one on Server 2003.

GE

[bobbba]

even on a lan a server should patched. maybe exercise caution and take your time and establish backups prior to applying patches but it still should be done regardless. your problem could quite easily caused by a viral attack or something similar attacking an open vulnerability.

after sp4 the very least should be to apply the post sp4 security rollup for win 2000 (sp5 by another name basically)

[timmmay]

One other thing to do is edit the RPC service and change the recovery options to restart itself if it fails.

[Razers]

I've checked the server. It doesn't have any updates installed including KB823980 is not listed. I need to get approval from the top management before i can do any changes to the server. Will update u guys when i get this done. Thanks all.

[Guest]

One other thing to do is edit the RPC service and change the recovery options to restart itself if it fails.

AFAIK that service is already configured on a default install to restart the computer.

[timmmay]

AFAIK that service is already configured on a default install to restart the computer.

I didn't mean restart the computer, I meant restart the service. Each service has recovery options that you can setup so if it crashes it will automatically try to start again.

[Marshalus Veteran]

I've been thinking of that too but i afraid some of the application later won't work i.e. SQL applications.

any ideas what step should i take?

I don't see why going to SP4 would break SQL.

[Razers]

Guys, i have updated the Server to Service Pack 4 yesterday. This morning the RPC service failed again. Looks like upgrading to service pack 4 didn't solve the RPC service failure. Even using Blaster removal tool didn't detect any virus. Got any other option except reinstalling windows? sigh...

[Statikk]

Try running a few rootkit detection/removal programs.

[Guest]

The RPC shutting down message comes from other infected computers not the computer itself.

[Razers]

The RPC shutting down message comes from other infected computers not the computer itself.

ur saying that the RPC failed on the server might be from other computer that connects to the server? But the other computer doesn't have this kind of problem.

I'm going to try out the anti-rootkit tools. I hope this will solve the problem for good.

[Guest]

I won't say for sure this is the problem your issue. But from past experiences its other infected PC's that broadcast the code that shuts down the RPC service. I guess if the other computers are patched against this then they won't be affected.

Have you installed that patch I posted on page 1? I guess installing this will eliminate the Blaster virus being the cause of the issue.

[bobbba]

Guys, i have updated the Server to Service Pack 4 yesterday. This morning the RPC service failed again. Looks like upgrading to service pack 4 didn't solve the RPC service failure. Even using Blaster removal tool didn't detect any virus. Got any other option except reinstalling windows? sigh...

Take a backup and install all the MS updates. SP4 is a start but there's been many many bug fixes and patches since it was released.

Some caution regarding patches is good but it should be more on the lines of a good backup policy, waiting a few weeks after a patch has been released in case there are any issues with it when it goes public. Other than, a server should be kept up to date.

[Razers]

I won't say for sure this is the problem your issue. But from past experiences its other infected PC's that broadcast the code that shuts down the RPC service. I guess if the other computers are patched against this then they won't be affected.

Have you installed that patch I posted on page 1? I guess installing this will eliminate the Blaster virus being the cause of the issue.

If like that, i will have to check each 20+ clients.

Scanned using anti-rootkits i.e. F-Secure/McAfee/MS Malicious Removal Tool & nothing found except for McAfee the server goes BSOD.

[Guest]

Do the client PC's have internet/email access? Are the clients using anti-virus software?