Solved

The Remote Procedure Call (RPC) service terminated unexpectedly.

Posted on 2006-06-17
16
784 Views
Last Modified: 2013-11-21
I have a server computer with Windows 2000 Server Family which shows an error begining with the question title, The Remote Procedure... etc, etc.
The machine shuts down in one minute and loops in this fashion indefinitely.

I have searched solutions in this site, but all the ones I have found assume that one is able to boot the computer successfuly, or have enough time to abort the shutdown, disable the RPC service, and download the security patch from Microsoft.

I do not have enough time to perform the fix suggested because the system only gives me a one-minute window. I have not been able to logon yet. Not normally, not Safe Mode, nothing.

Please let me know if have any ideas as to stop the looping and restoring the system to its normal condition.

Thank you very much,

-snafix
0
Comment
Question by:snafix
  • 7
  • 3
  • 2
  • +2
16 Comments
 
LVL 6

Expert Comment

by:Booda2us
Comment Utility
Hello snafix, try this: Insert your OS installation disc into the cd drive and start computer,  When install wizard shows up select 'Repair'. You might have a virus ( the old Netsky.Q worm instigated RP shutdown). After repair is finished, reboot into safe mode, hold down (F8) key during boot. If it succesfully boots then run a virus scan. If it doesn't fix problem do a System Restore to a point previous to problem occuring..(assuming you can get to safe mode screen). Let me know if this works, I will research new virus's and see what fix procedures are...Hope this helps..Booda2us
0
 
LVL 6

Expert Comment

by:Booda2us
Comment Utility
Here is a solution from Castlecops:brightguy

Cadet



Joined: Dec 19, 2004
Posts: 6
Location: USA

 Posted: Tue Jan 11, 2005 12:05 am    Post subject: [b]FINALLY... SUCCESS!!![/b]  

--------------------------------------------------------------------------------
 
Okay, I finally solved the problem and thought I would share it, as I know others have had the same issue. I cannot pin-point to a 'T' the exact cause, but I will take you thru my steps:

MY COMPUTER SPECS:
- Windows XP Home SP2
- Panda Titanium Anti-Virus Software

PROBLEM:
- The RPC Shutdown notice kept coming up
- No ability to add/remove software as the RPC Shutdown would occur
- No Start Menu or Taskbar
- No ability to copy, cut or paste
- No ability to modify the properties of Services (including RPC)
- None of the previously mentioned fixes mention in this thread solved the issue permanently
- No scanning apps could detect a virus or worm of any kind; even when I piggy-backed the problematic HD onto a good system as a slave and ran several through utilities

SOLUTION:
1. I uninstalled Service Pack 2 (it let me remove it through add/remove programs without an RPC Shutdown notice)

2. I went into the Registry and removed any extraneous commands from the "Run" folders (AOL, MSN Messenger, MS Works, Quicktime, Real Media, Webshots, etc...)

3. Restarted the system

4. I went into the Registry (HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs) and manually modified the Value Data from "FailureActions" based on the values from another system running the same OS (NOTE: I verified first on the remote system that I set the values as I wanted them in the Services console... I set the actions for RPC to "Restart the service" on 1st, 2nd and Subsequent failures and also set restart to 0 minutes - then I checked the data values that were assigned in the Registry - i only changed/added the 2 digit values, leaving the extra characters at the end of each line untouched)

5. I went into "Add/Remove Programs" and removed several apps (AOL and all of the components, Webshots, Panda Anti-Virus). I was able to remove all of them successfully without a shutdown notice. I also did them in one fell swoop, dismissing any restart requests until I was finished.

6. I restarted the system and found my Start menu had returned, my taskbar was back and everything seemed to be working perfectly.

7. I reinstalled SP2 and then I installed Norton Anti-Virus 2005

--------------
The system is trouble-free as of now. From my analysis, I think that there were some issues with the AOL 9.0 software. I doubt I ever needed to unistall SP2, but I did it anyway.

I hope this is of help to someone out there... as I am not a big computer guru, I really can't make heads-or-tails of the official diagnosis, but I'm guessing that there were some software conflicts.

Thanks to everyone  
http://castlecops.com/postt93587.html
Hope this is of some help....Booda2us
 
0
 

Author Comment

by:snafix
Comment Utility
Booda2us,

Thanks for your quick response.
I had tried to perform repair with original OS disc without success before my posting.
It told me that I had no hard drives to perform repair. Eventhough the computer tries to boot up from the hard drive. Go figure.
The solution you posted from castlecops will not work since I am unable to logon prior to the automatic shutdown. Perhaps when I get into Windows...

Thank you,
-snafix
0
 
LVL 4

Expert Comment

by:johanvz1
Comment Utility
Some viruses also do that scan the drive for viruses and whilst you are logged in go start->run>shutdown -a this will stop shutdown temporarily and give you more time to troubleshoot
0
 
LVL 15

Expert Comment

by:venom96737
Comment Utility
What you need to do is get your hands on a windows 2000 resource kit and install shutdown.exe then goto the command prompt and issue the command shutdown.exe -a to abort the shutdown the change the rpc to not rebbot on error and apply patchs should fix the issue.
0
 

Author Comment

by:snafix
Comment Utility
Johanvz1,
I do not understand you mean when you say: "Some viruses also do that scan the drive for viruses..."
Could you please elaborate?

venom96737,
Is it possible to download the executable you mentioned in your response (shutdown.exe)?

Thank you both,
-snafix
0
 

Author Comment

by:snafix
Comment Utility
Johanvz1,
I was able to download shutdown.exe (from the Resource Kit), how do I use it?
What I mean is, can you explain to me how would you use/run it to prevent the automatic shutdown?
Thanks,
-snafix
0
 

Author Comment

by:snafix
Comment Utility
Please keep in mind that I can not boot up and logon with this system.
Installation from within the installed OS is not possible. The automatic shutdown does not allow me time to get into the operating system.
Therefore, the installations or issued command must take place by an alternative way of booting up the computer.

Thank you,

-snafix
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 6

Expert Comment

by:engineer_dell
Comment Utility
Click Start > Run. The Run dialog box appears.
Type:

SERVICES.MSC /S

in the open line, and then click OK. The Services window opens.


In the right pane, locate the Remote Procedure Call (RPC) service.


--------------------------------------------------------------------------------
CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two.
--------------------------------------------------------------------------------


Right-click the Remote Procedure Call (RPC) service, and then click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply, and then OK.


--------------------------------------------------------------------------------
CAUTION: Make sure that you change these settings back once you have removed the worm.
--------------------------------------------------------------------------------

Now clean your computer

http://www.microsoft.com/technet/security/bulletin/MS03-039.mspx

GooD LucK
Ritesh
0
 
LVL 15

Accepted Solution

by:
venom96737 earned 500 total points
Comment Utility
snafix can you slave the drive off to another computer that does boot up.  If you can what you can do is take that exe file and place it in the system32 folder then write a batchfile to run the shutdown.exe -a command and place it on the desktop using the other installation then replace the drive in the other system boot up and hit that batch file once you log in this will stop the shutdown and allow for you to work on the issue.
0
 

Author Comment

by:snafix
Comment Utility
Ok, this is a summary of the events.
I got into the recovery console and disable the RPC service. Also, I renamed the services.exe file and copied another services.exe from another server installation.
The computer boots up but I does not have the TCP/IP properties available for me to configure. I can not get internet connection.
Is the RPC to blame?
Any ideas?

-snafix
0
 
LVL 15

Expert Comment

by:venom96737
Comment Utility
Yes sna if you dont have RPC you dont have the internet.
0
 

Author Comment

by:snafix
Comment Utility
Thank you everyone who helped me resolve this issue.
I applied the security patch to repair the hole in the RPC service.
Then I used the recovery console to enable the RPC service I had disabled.
After that the system booted up without a problem.
Downloaded and installed service pack 4 and 37 other security patches from Microsoft.
Upgraded antivirus.
The works.
The server is back to work.

-snafix
0
 
LVL 6

Expert Comment

by:engineer_dell
Comment Utility
Cheers !!

0
 
LVL 4

Expert Comment

by:johanvz1
Comment Utility
Hi,

Snafix was it a patch that fixed the lsass.exe security hole which could have been used by a virus like the Sasser virus?. Let me know what if you found inything like that I am curious.

Regards,

Johan
0
 

Author Comment

by:snafix
Comment Utility
johanvz1,

I believe that the patch repaired the security, or the lack thereof, of the lsass.exe.
Once I stopped the RPC service, and I was able to run the patch within Windows, I could see the light at the end of the "hole".
After that, I enabled the RPC service and I found myself in the clear.
As I've mentioned in my previous response, this server had not been administered for a while--I downloaded and installed 37 security patches!
We are lucky we got this box out of the ICU, and it is back without a reinstall. Pretty lucky fellow.

Thank you for your interest,

-snafix
0

Featured Post

Too many email signature changes to deal with?

Are you constantly being asked to update your organization's email signatures? Do they take up too much of your time? Wouldn't you love to be able to manage all signatures from one central location, easily design them and deploy them quickly to users. Well, you can!

Join & Write a Comment

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
#Citrix #POC #XenDesktop #vCenter #VMware #ESX
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now