Windows 2003 Server Services.exe out of control

Posted on 2006-06-14
Last Modified: 2010-05-18
Having performing an ill-advised installation of Ricoh's scanrouter V2 lite on an Windows 2003 Active Directory Server,
services.exe is now using 152000k and consuming 95%+ of CPU.
When running the services panel , i cannot see anything onthe extended tab, only the standards tab.
Per Ricoh's instructions i manually removed the rds and rdcab folders and eliminated all references to scanrouter in the registry.
Unfortunlately, i could not remove the legacy scan router references.
Using msconfig i found and turned off a 'delivery service' startup entry and also turned of a Ridoc Server Information record in the services list.
I've run out of ideas. This is urgent as this machine is our primary file server as well as the domain controller. It is still of some use so down time
must be kept to a minimum while trouble shooting

Any help would be greatly appreciated.
Question by:meyerworks

Author Comment

ID: 16902217
Another piece of information..
Viewing the application event i am being flooded with COM 10022 errors

Accepted Solution

Booda2us earned 250 total points
ID: 16902413
Do a system restore to a point right before you loaded the Ricoh software. Error code 'COM 10022' =invalid argument (not bind), thats why services is freeking out. It's stuck in a 'attempt to resolve instruction/report error/reload argument' loop. Hope this helps you out...Booda2us

Author Comment

ID: 16903085
I'm not quite sure how i might do a system restore.
Can you elaborate ..I've never tried one on a server let alone a Active Directory Controller

Assisted Solution

CharliePete00 earned 250 total points
ID: 16908113
I take it they didn't have an unistall package?

Is this the only DC in the Domain?  

Do you have a current good full backup and one from from before the installation?

Before you make too many modification make sure you have a good current full backup of the server (it may barely work right now but it is working).  The next time you can afford some down time (after business hours):

Before doing anything else:
1.  Create a test user account in AD and wait for replication if more than 1 DC is in the domain

The system restore route is the easiest so I'd try that first:  
1.  Start > All Programs > Accessories > System Tools > System Restore > "Restore my computer to an earlier time"
2.  Choose the most recent restore point prior to installing the scanrouter app (one was probably created just prior to installation)
3.  Reboot and test the machine
4. Verify the test user account exists and password is correct

If unsuccessful you have still have a couple of options: restoring from backup; and manually deregistering any components left over from the scanrouter app.  I walk you through the restore if necessay, but how that is done will depend on the number of DCs in your domain.
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.


Author Comment

ID: 16912154
There is only one DC
Control Panel/Remove Programs generated an install shield error ( ikernel.exe) could not be launched.
Therefore I was advised by Ricoh to delete their application folders ( rds and rdcab) , then delete all references to scanrouter in the registry.
Is there any way to track errors that are being written to the application event log: source COM, error code 10022, user N/A?
Would this error indicate that an exe, listed in the registry, trying to load, can't be found?


Expert Comment

ID: 16916554

Author Comment

ID: 16952747
I can not access the properties of most any object by right clicking
The symptom referred to at the link is exactly what I'm experiencing.
To sum up:

machine is the one and only active directory domain controller and dns server

Services.exe is consuming 152000k.
double clicking on My computer does nothing.
I can not see anything on the extended page when viewing events, only the standard tab.
I can not right click on component services when running dcomcfg in order to access the properties for anything.

I see references to 2 objects under dcom that i think should be removed but there is no action taking place when i try to delete them ( what are the registry locations for DCOM entries in component services?)


Author Comment

ID: 17099091
I was hoping for a little more i feedback from the 'experts' community, i suppose the well has run dry so you can call it closed if you like.
LVL 87

Expert Comment

ID: 17099159
It is better if you, the asker closes the Q. If you find none of the posts helped and you don't want to give them any points, just follow the link above which will tell you what to do in such a case. Thanks.

EE Cleanup Volunteer

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
In this article we will discuss all things related to StageFright bug, the most vulnerable bug of android devices.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now