Solved

The Remote Procedure Call (RPC) service terminated unexpectedly.

Posted on 2006-06-17
16
798 Views
Last Modified: 2013-11-21
I have a server computer with Windows 2000 Server Family which shows an error begining with the question title, The Remote Procedure... etc, etc.
The machine shuts down in one minute and loops in this fashion indefinitely.

I have searched solutions in this site, but all the ones I have found assume that one is able to boot the computer successfuly, or have enough time to abort the shutdown, disable the RPC service, and download the security patch from Microsoft.

I do not have enough time to perform the fix suggested because the system only gives me a one-minute window. I have not been able to logon yet. Not normally, not Safe Mode, nothing.

Please let me know if have any ideas as to stop the looping and restoring the system to its normal condition.

Thank you very much,

-snafix
0
Comment
Question by:snafix
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
  • 2
  • +2
16 Comments
 
LVL 6

Expert Comment

by:Booda2us
ID: 16928402
Hello snafix, try this: Insert your OS installation disc into the cd drive and start computer,  When install wizard shows up select 'Repair'. You might have a virus ( the old Netsky.Q worm instigated RP shutdown). After repair is finished, reboot into safe mode, hold down (F8) key during boot. If it succesfully boots then run a virus scan. If it doesn't fix problem do a System Restore to a point previous to problem occuring..(assuming you can get to safe mode screen). Let me know if this works, I will research new virus's and see what fix procedures are...Hope this helps..Booda2us
0
 
LVL 6

Expert Comment

by:Booda2us
ID: 16928421
Here is a solution from Castlecops:brightguy

Cadet



Joined: Dec 19, 2004
Posts: 6
Location: USA

 Posted: Tue Jan 11, 2005 12:05 am    Post subject: [b]FINALLY... SUCCESS!!![/b]  

--------------------------------------------------------------------------------
 
Okay, I finally solved the problem and thought I would share it, as I know others have had the same issue. I cannot pin-point to a 'T' the exact cause, but I will take you thru my steps:

MY COMPUTER SPECS:
- Windows XP Home SP2
- Panda Titanium Anti-Virus Software

PROBLEM:
- The RPC Shutdown notice kept coming up
- No ability to add/remove software as the RPC Shutdown would occur
- No Start Menu or Taskbar
- No ability to copy, cut or paste
- No ability to modify the properties of Services (including RPC)
- None of the previously mentioned fixes mention in this thread solved the issue permanently
- No scanning apps could detect a virus or worm of any kind; even when I piggy-backed the problematic HD onto a good system as a slave and ran several through utilities

SOLUTION:
1. I uninstalled Service Pack 2 (it let me remove it through add/remove programs without an RPC Shutdown notice)

2. I went into the Registry and removed any extraneous commands from the "Run" folders (AOL, MSN Messenger, MS Works, Quicktime, Real Media, Webshots, etc...)

3. Restarted the system

4. I went into the Registry (HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs) and manually modified the Value Data from "FailureActions" based on the values from another system running the same OS (NOTE: I verified first on the remote system that I set the values as I wanted them in the Services console... I set the actions for RPC to "Restart the service" on 1st, 2nd and Subsequent failures and also set restart to 0 minutes - then I checked the data values that were assigned in the Registry - i only changed/added the 2 digit values, leaving the extra characters at the end of each line untouched)

5. I went into "Add/Remove Programs" and removed several apps (AOL and all of the components, Webshots, Panda Anti-Virus). I was able to remove all of them successfully without a shutdown notice. I also did them in one fell swoop, dismissing any restart requests until I was finished.

6. I restarted the system and found my Start menu had returned, my taskbar was back and everything seemed to be working perfectly.

7. I reinstalled SP2 and then I installed Norton Anti-Virus 2005

--------------
The system is trouble-free as of now. From my analysis, I think that there were some issues with the AOL 9.0 software. I doubt I ever needed to unistall SP2, but I did it anyway.

I hope this is of help to someone out there... as I am not a big computer guru, I really can't make heads-or-tails of the official diagnosis, but I'm guessing that there were some software conflicts.

Thanks to everyone  
http://castlecops.com/postt93587.html
Hope this is of some help....Booda2us
 
0
 

Author Comment

by:snafix
ID: 16928643
Booda2us,

Thanks for your quick response.
I had tried to perform repair with original OS disc without success before my posting.
It told me that I had no hard drives to perform repair. Eventhough the computer tries to boot up from the hard drive. Go figure.
The solution you posted from castlecops will not work since I am unable to logon prior to the automatic shutdown. Perhaps when I get into Windows...

Thank you,
-snafix
0
Is Your DevOps Pipeline Leaking?

Is your CI/CD pipeline a hodge-podge of randomly connected tools? You’ve likely got a tool to fix one problem & then a different tool to fix another, resulting in a cluster of tools with overlapping functionality. Learn how to optimize your pipeline with Gartner's recommendations

 
LVL 4

Expert Comment

by:johanvz1
ID: 16929197
Some viruses also do that scan the drive for viruses and whilst you are logged in go start->run>shutdown -a this will stop shutdown temporarily and give you more time to troubleshoot
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16929610
What you need to do is get your hands on a windows 2000 resource kit and install shutdown.exe then goto the command prompt and issue the command shutdown.exe -a to abort the shutdown the change the rpc to not rebbot on error and apply patchs should fix the issue.
0
 

Author Comment

by:snafix
ID: 16929704
Johanvz1,
I do not understand you mean when you say: "Some viruses also do that scan the drive for viruses..."
Could you please elaborate?

venom96737,
Is it possible to download the executable you mentioned in your response (shutdown.exe)?

Thank you both,
-snafix
0
 

Author Comment

by:snafix
ID: 16929720
Johanvz1,
I was able to download shutdown.exe (from the Resource Kit), how do I use it?
What I mean is, can you explain to me how would you use/run it to prevent the automatic shutdown?
Thanks,
-snafix
0
 

Author Comment

by:snafix
ID: 16929882
Please keep in mind that I can not boot up and logon with this system.
Installation from within the installed OS is not possible. The automatic shutdown does not allow me time to get into the operating system.
Therefore, the installations or issued command must take place by an alternative way of booting up the computer.

Thank you,

-snafix
0
 
LVL 6

Expert Comment

by:engineer_dell
ID: 16930571
Click Start > Run. The Run dialog box appears.
Type:

SERVICES.MSC /S

in the open line, and then click OK. The Services window opens.


In the right pane, locate the Remote Procedure Call (RPC) service.


--------------------------------------------------------------------------------
CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.
--------------------------------------------------------------------------------


Right-click the Remote Procedure Call (RPC) service, and then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.


--------------------------------------------------------------------------------
CAUTION: Make sure that you change these settings back once you have removed the worm.
--------------------------------------------------------------------------------

Now clean your computer

http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx

GooD LucK
Ritesh
0
 
LVL 15

Accepted Solution

by:
venom96737 earned 500 total points
ID: 16930886
snafix can you slave the drive off to another computer that does boot up.  If you can what you can do is take that exe file and place it in the system32 folder then write a batchfile to run the shutdown.exe -a command and place it on the desktop using the other installation then replace the drive in the other system boot up and hit that batch file once you log in this will stop the shutdown and allow for you to work on the issue.
0
 

Author Comment

by:snafix
ID: 16935953
Ok, this is a summary of the events.
I got into the recovery console and disable the RPC service. Also, I renamed the services.exe file and copied another services.exe from another server installation.
The computer boots up but I does not have the TCP/IP properties available for me to configure. I can not get internet connection.
Is the RPC to blame?
Any ideas?

-snafix
0
 
LVL 15

Expert Comment

by:venom96737
ID: 16941564
Yes sna if you dont have RPC you dont have the internet.
0
 

Author Comment

by:snafix
ID: 16945844
Thank you everyone who helped me resolve this issue.
I applied the security patch to repair the hole in the RPC service.
Then I used the recovery console to enable the RPC service I had disabled.
After that the system booted up without a problem.
Downloaded and installed service pack 4 and 37 other security patches from Microsoft.
Upgraded antivirus.
The works.
The server is back to work.

-snafix
0
 
LVL 6

Expert Comment

by:engineer_dell
ID: 16946804
Cheers !!

0
 
LVL 4

Expert Comment

by:johanvz1
ID: 16949059
Hi,

Snafix was it a patch that fixed the lsass.exe security hole which could have been used by a virus like the Sasser virus?. Let me know what if you found inything like that I am curious.

Regards,

Johan
0
 

Author Comment

by:snafix
ID: 16957178
johanvz1,

I believe that the patch repaired the security, or the lack thereof, of the lsass.exe.
Once I stopped the RPC service, and I was able to run the patch within Windows, I could see the light at the end of the "hole".
After that, I enabled the RPC service and I found myself in the clear.
As I've mentioned in my previous response, this server had not been administered for a while--I downloaded and installed 37 security patches!
We are lucky we got this box out of the ICU, and it is back without a reinstall. Pretty lucky fellow.

Thank you for your interest,

-snafix
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
OS Selection Menu 1 84
Automate Windows Updates with SCCM 2 127
CTIOS error on Windows 10 3 64
web browsers 9 43
Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
Windows 7 does not have the best desktop search built in. This is something Windows 7 users have struggled with. You type something in, and your search results don’t always match what you are looking for, or it doesn’t actually work at all. There ar…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question