Recommended Posts

Guys, i have this file server:

SERVER NAME ABCFILESERVER

MODEL IBM xSeries 235

PROCESSOR INTEL XEON 2.4GHz

MEMORY RAM 1GB RAM

HARDDISK 34GB, 34GB

OS WINDOWS 2000 SERVER SP3

Sometimes when opening a program,an error message appears saying "'Run-time error '7' out of memory" & the File Server's RPC Service has stopped running unexpectedly, the drag & drop can't function, copy&paste also can't function.

I need to restart the server to enable them back & it's really troublesome. This never happen before & it just happen lately. I tried scanning for viruses & spywares using latest updates but nothing found. Any ideas? :alien:

Link to comment
https://www.neowin.net/forum/topic/647735-windows-2000-server-problem/
Share on other sites

Well in that case do a full backup before upgrading and cross your fingers!

Otherwise, check the event logs for any specific error details. Runtime errors can be caused by too many things to put a finger on without more information. Although, the fact that the RPC service stops indicates that it's either a virus/trojan or most likely a system file issue.

Are all your client PC's protected against antivirus? The last time I saw RPC shutting down issues was the result of the Blaster virus. If your Windows 2000 Server is local only then maybe this server isn't patched to fix the RPC exploit. Is KB823980 listed as installed in Add/Remove Programs?

even on a lan a server should patched. maybe exercise caution and take your time and establish backups prior to applying patches but it still should be done regardless. your problem could quite easily caused by a viral attack or something similar attacking an open vulnerability.

after sp4 the very least should be to apply the post sp4 security rollup for win 2000 (sp5 by another name basically)

AFAIK that service is already configured on a default install to restart the computer.

I didn't mean restart the computer, I meant restart the service. Each service has recovery options that you can setup so if it crashes it will automatically try to start again.

Guys, i have updated the Server to Service Pack 4 yesterday. This morning the RPC service failed again. Looks like upgrading to service pack 4 didn't solve the RPC service failure. Even using Blaster removal tool didn't detect any virus. Got any other option except reinstalling windows? sigh...

The RPC shutting down message comes from other infected computers not the computer itself.

ur saying that the RPC failed on the server might be from other computer that connects to the server? But the other computer doesn't have this kind of problem.

I'm going to try out the anti-rootkit tools. I hope this will solve the problem for good.

I won't say for sure this is the problem your issue. But from past experiences its other infected PC's that broadcast the code that shuts down the RPC service. I guess if the other computers are patched against this then they won't be affected.

Have you installed that patch I posted on page 1? I guess installing this will eliminate the Blaster virus being the cause of the issue.

Guys, i have updated the Server to Service Pack 4 yesterday. This morning the RPC service failed again. Looks like upgrading to service pack 4 didn't solve the RPC service failure. Even using Blaster removal tool didn't detect any virus. Got any other option except reinstalling windows? sigh...

Take a backup and install all the MS updates. SP4 is a start but there's been many many bug fixes and patches since it was released.

Some caution regarding patches is good but it should be more on the lines of a good backup policy, waiting a few weeks after a patch has been released in case there are any issues with it when it goes public. Other than, a server should be kept up to date.

I won't say for sure this is the problem your issue. But from past experiences its other infected PC's that broadcast the code that shuts down the RPC service. I guess if the other computers are patched against this then they won't be affected.

Have you installed that patch I posted on page 1? I guess installing this will eliminate the Blaster virus being the cause of the issue.

If like that, i will have to check each 20+ clients.

Scanned using anti-rootkits i.e. F-Secure/McAfee/MS Malicious Removal Tool & nothing found except for McAfee the server goes BSOD.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Sandboxie Plus 1.17.8 / Classic 5.72.8 by Razvan Serea Run programs in a sandbox to prevent malware from making permanent changes to your PC. Sandboxie allows you to run your browser, or any other program, so that all changes that result from the usage are kept in a sandbox environment, which can then be deleted later. Sandboxie is a sandbox-based isolation software for 32- and 64-bit Windows NT-based operating systems. It is being developed by David Xanatos since it became open source, before that it was developed by Sophos (which acquired it from Invincea, which acquired it earlier from the original author Ronen Tzur). It creates a sandbox-like isolated operating environment in which applications can be run or installed without permanently modifying the local or mapped drive. An isolated virtual environment allows controlled testing of untrusted programs and web surfing. Sandboxie is available in two flavors Plus and Classic. Both have the same core components, this means they have the same level of security and compatibility. What's different is the user interface the Plus build has a modern Qt based UI which supports all new features that have been added since the project went open source. The Classic build has the old no longer developed MFC based UI, hence it lacks support for modern features, these features can however still be used when manually configured in the Sandboxie.ini. Sandboxie Plus 1.17.8 / Classic 5.72.8 release notes: Added added DisableCustomTitleOpt=[process,][y|n] to allow [#] sandboxie title markers on custom-titlebar windows (Delphi VCL, Qt, Electron) that were previously skipped to prevent DWM repaint CPU loops #5387 Changed updated bundled ImDisk driver to 3.0.2 #5419 Fixed fix Suppress logs for expected non-user SIDs #5422 SbieSvc.exe: SBIE2218/2219 error when run program as administrator #5417 fixed explorer.exe crashes in Application Compartment when Huorong Security is installed #5423 Download: Sandboxie Plus (64-bit) | 23.5 MB (Open Source) Download: Sandboxie Classic (64-bit) | 3.0 MB Links: Sandboxie Website | GitHub | ARM64 | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Hello, Christian Maas' XVI32 is a nice (and very small) hex editor. Speaking of hex editors, many years ago a colleague and I who both worked at Tribal Voice managed to edit a copy of the company's PowWow instant messaging client to make it behave better now that all of its lookup servers and other server-side tech was gone.  The program didn't support NAT (RFC-3022 was introduced in January 2001, the same time Tribal Voice was shuttered), but it still worked okay if you manually set up port-forwarding on your router.  The server at http://powwow.jazy.net/ hosts a copy (usual warnings about downloading and running untrusted code from random internet servers apply). I occasionally use some tools like Funduc Software's Search and Replace and Application Mover when I need to make mass-edits to text-based files or move programs with a hard-coded installation directories, respectively.  When I need to figure out the exact LCD panel inside of a laptop, EnTech Taiwan's Monitor Asset Manager is my go-to tool for that purpose. JD Design's website (now hosted on github.io) has a number of interesting freeware and shareware utilities.  I used to use their TouchPro utility to set the file timestamps on software I was mastering to match its version number (e.g., version 3.00 of a program had all of its files dates set to 3:00AM, and so forth). Karenware has a number of interesting freeware utilities, too. Regards, Aryeh Goretsky  
    • I still use HexChat! Not really as ancient as the 1994 AutoCAD above my post, but I have never found anything better to replace it. Yes we still operate an IRC server https://www.neowin.net/irc/ 😛 
    • At work we still have a couple of people that use a version of AutoCAD LT purchased in 1994. This predates Windows 95 and works fine on versions of Windows up to XP. Its long since run in an locked down isolated XP VM, accessible via RDP. I did install LibreCAD for them, however they said it was just too different to get to grips with. In all fairness one of them is now 75 and the other is almost 60.
    • On my music making (non internet) PC Sony Acid Pro 7.0 Adobe Audition 2015 Korg Legacy Collection Windows 7 SP1
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      509
    2. 2
      +Edouard
      198
    3. 3
      PsYcHoKiLLa
      138
    4. 4
      ATLien_0
      90
    5. 5
      Steven P.
      82
  • Tell a friend

    Love Neowin? Tell a friend!