• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 261
  • Last Modified:

IPC$ share disappearing. I've seached the knowledge base on EE, tried most suggestions, but still no luck.

I'm running a file server with Windows Server 2000. The file server hosts a proxy to share the internet and deliver e-mail. Also, multiple users access an Access database located on the server. Now, no one can log onto the domain and when they try, they get "Server is not configured for transactions". I've checked and the administrative shares are missing. I can create them using net share IPC$, but like many of the other cases I've found on EE, they disappear again. I've ran startup.cop and found nothing. I've ran numerous antivirus and antispyware tools, removed everythinig that those did find, but still, no improvement on the shares. I've tried the Sasser removal tool and found nothing. I see that there are a lot of people on this site with this problem, but I'm not seeing many detailed procedures for correcting the problem. I really do not want to reinstall Server 2000, partially because of the downtime involved and partially because I'm not confident that it will fix the problem. Any suggestions?
0
evilwalrus77
Asked:
evilwalrus77
  • 8
  • 6
  • 3
2 Solutions
 
stevenlewisCommented:
have you seen this KB
http://support.microsoft.com/default.aspx?scid=kb;en-us;842715
scroll down to the reg values and check
0
 
evilwalrus77Author Commented:
I did check the Microsoft Knowledgebase first. One of the values was set to zero, but changing it had no effect. I also used poledit to change the values to make sure they were created on start up. Once again, nothing. Any user that has the drive mapped has access to the network, however files like Excel cannot be executed over the network. They have to be copied and opened locally.
0
 
stevenlewisCommented:
there is always the net share bat file in the startup, not an elegant solution, but it works
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
evilwalrus77Author Commented:
What exactly do you suggest? Elegant or not, I need to get this thing working properly.
0
 
stevenlewisCommented:
ther net share bat will be a band aid (it will start the share, so the server will work) but it is best to find out why it isn't starting on it's own
any thing in event vieweer?
0
 
stevenlewisCommented:
see here
HOW TO: Restore Administrative Shares That Have Been Deleted
http://support.microsoft.com/?kbid=318755

Administrative Shares Do Not Appear on Server
http://support.microsoft.com/?kbid=245117
0
 
stevenlewisCommented:
the net share bat is
net share IPC$
0
 
evilwalrus77Author Commented:
I'm almost embarrassed to say yes, the even log is LOADED. I've tried solving the problems using Microsoft Event ID lookup, but mostly dead-ends. I'll cut and paste some of the log here. Let me know what you'd like to tackle first.

System Log:
Type      Date      Time      Source      Category      Event      User      Computer
Warning      11/19/2004      11:41:32 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      9:41:26 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      8:25:04 AM      W32Time      None      11      N/A      SCORISERVER
Warning      11/19/2004      7:41:21 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      7:03:57 AM      RSVP      None      10064      N/A      SCORISERVER
Warning      11/19/2004      7:03:18 AM      RSVP      None      10040      N/A      SCORISERVER
Warning      11/19/2004      5:41:17 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      3:41:12 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      1:41:07 AM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/19/2004      12:10:01 AM      W32Time      None      11      N/A      SCORISERVER
Warning      11/18/2004      11:41:03 PM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/18/2004      11:02:24 PM      RSVP      None      10064      N/A      SCORISERVER
Warning      11/18/2004      11:01:55 PM      RSVP      None      10040      N/A      SCORISERVER
Warning      11/18/2004      9:40:59 PM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/18/2004      7:40:54 PM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/18/2004      7:40:00 PM      W32Time      None      11      N/A      SCORISERVER
Warning      11/18/2004      5:40:48 PM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/18/2004      5:24:59 PM      W32Time      None      11      N/A      SCORISERVER
Warning      11/18/2004      3:54:58 PM      W32Time      None      11      N/A      SCORISERVER
Warning      11/18/2004      3:09:58 PM      W32Time      None      11      N/A      SCORISERVER
Warning      11/18/2004      3:09:46 PM      Netlogon      None      5781      N/A      SCORISERVER
Warning      11/18/2004      3:01:00 PM      RSVP      None      10064      N/A      SCORISERVER
Warning      11/18/2004      2:59:13 PM      RSVP      None      10040      N/A      SCORISERVER
Information      11/18/2004      2:55:43 PM      Application Popup      None      26      N/A      SCORISERVER
0
 
crissandCommented:
Your rpc service is not started. Maybe a virus or worm.
0
 
stevenlewisCommented:
0
 
evilwalrus77Author Commented:
crissand - In the services pane, it shows that the rpc service is running, but it will not allow me to stop, start or change to manual. Interesting. Any suggestions?

stevenlewis - I'm doing an on-line scan right now from trendmicro. I'm out in the sticks, so only a 56k dialup connection for me. It'll take  a while just to download the definintions.

Doe anyone have something I can be checking in the mean time?

FYI - I am running BitDefender File Server and BitDefender on my e-mail proxy, and all are up to date. I also am running SP2 on Win2k Server and have all the critical updates.
0
 
crissandCommented:
Install sp4.
0
 
evilwalrus77Author Commented:
Sorry, typo. I am running SP4.
0
 
crissandCommented:
Looks like your server has lost contact with the domain. This can happen if the clock of the server and the one of the domain are not synchronized, or if the server has been disjoined. Have you, or somebody, uninstalled the server service?

See here:
http://www.annoyances.org/exec/forum/win2000/1063240889
0
 
evilwalrus77Author Commented:
Thank you both for your help. For the time being, I believe I have found my problem: worm_rbot.ue. It created servic.exe (that's service without the 'e') which was located in my c:\Winnt\system32 folder. I first had to do a registry search and deleted all of the entries associated with the file. Then, you have to kill the process and all of it's associated processes. Since I don't know enough to do this on my own, I downloaded ProcessExplorer (www.sysinternals.com), which in case you've never heard of it (because I haven't), is the Window's Task manager on steroids. It will kill the process and all of it's associated processes, allowing you to delete the servic.exe file, thus, solving the problem...or at least so it seems. My administrative shares have been present for almost an hour now, which is about (1,000) times longer than it had been present. I just hope it keeps working.

Thanks again.
0
 
stevenlewisCommented:
Glad you got it!
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

  • 8
  • 6
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now