Services stopping on 2003 servers

[Tony_Mc]

Hi

 

We are having a few issues at school this week.

 

on our data servers we keep having our "workstation", "server" and "computer browser" services stop. they are set to "automatic" but just, stop.

 

There are obvious problems with this such as sharing stops so students can't get to files, access the start menu and printing for the whole school just stops. we have a script in place to keep them running and things seem to be OK at the moment. This workaround will be ok for now, but we need to figure out what is causing this.

 

we are running sophos *sigh* which tells me that everything is ok and I have scanned for confiktor, nothing found.

 

anyone got any ideas?

 

Thanks for any help anyone can give.

 

Tony

[Michael]

I presume you have already tried rebooting the servers?

[bertster]

Anything in the event logs? Event ID's etc?

[Tony_Mc]

I presume you have already tried rebooting the servers?

 

Hi, yeah we have rebooted the servers and the problem is still present.

 

Nothing in event logs.

 

really REALLY odd.

[ascott2]

We have had the same problems but on random workstations running xp. Same services, workstation, server and those that rely on them. We managed to fix those on XP by patching them and updating them to SP3 but on the servers Im not sure. Interestingly, we have used Sophos, I wonder if that is the root of the issue?

[Tony_Mc]

I don't trust sophos at all but that is personal and not the view of my establishment of work.

[ascott2]

I don't trust sophos at all but that is personal and not the view of my establishment of work.

 

Sophos is great when it works. I personally don't have a problem with it, but know quite a few that have had problems or simply don't like it. It has done me well so far(touch wood )

[Dos_Box]

What you need is to use the 'EventTriggers' command. This will detect the service stopping via it's Event ID and you can then point it to a script to restart the service automatically.

 

Overview here: How to use Eventtriggers.exe to send e-mail based on Event IDs

[ascott2]

What you need is to use the 'EventTriggers' command. This will detect the service stopping via it's Event ID and you can then point it to a script to restart the service automatically.

 

Overview here: How to use Eventtriggers.exe to send e-mail based on Event IDs

 

I actually have a program I wrote which runs through all of the active directory machines and any services that should be automatic but are stopped it fires them all off manually. It was wrote for a different purpose but works for this. It's more of a bandage than cure though!

[fatnhairy]

definitely sounds like a virus or malware...

 

seen this before and sophos hadn't picked it up. Try a different AV/malware scanner, eg malware bytes

[ascott2]

These machines have been reimaged more than once and still did it, up until SP3 was installed. Yet other (same build) machines don't and have never done it. It is a services issue, did once have a suggestion from another forum that it was the messenger service preventing the correct startup and their advice was to update to SP3.

[Tony_Mc]

Cheers guys, I am running malware bytes at the moment on one of the servers that has been affected. We shall see. I was thinking virus and have been scanning accordingly.

[Roopert]

Sorry but we had these same symptoms and they were part of the conficker family viruses, this was also with sophos running on the servers and finding nothing

[Tony_Mc]

Sorry but we had these same symptoms and they were part of the conficker family viruses, this was also with sophos running on the servers and finding nothing

 

 

how did you get rid of them?

[ascott2]

Thankfully our issue was long before conficker or the exploit was known, so that didn't cause it?

[Tony_Mc]

Well, it is conficker - A.

 

but check the attachment.

 

*sigh*

 

here we go...

[ascott2]

If your enterprise manager is up to date it should delete conficker straight away. That might be why the standalone isn't finding it?

[Tony_Mc]

If your enterprise manager is up to date it should delete conficker straight away. That might be why the standalone isn't finding it?

 

Yeah, my enterprise console is updating every hour, occasionally it doesn't but that is normally down to our proxy. maybe 0.001 % of the time it fails but catches it up on the next hour.

[mullet_man]

We had the same problem with our two Admin servers, the best tool we found to get rid of Conficker was the Microsoft Malcious Software Remover.

 

Download and run, do a full scan as well, takes a while but gets rid of it.

 

Also deploy it as well to your workstations, it takes a while at startup but gets rid of it.