Windows Server 2003 keeps rebooting?

[Dean J Garrett]

Our Windows Server 2003 Enterprise Ed. server suddenly has a problem after
about a year of operation. We login using our admin user/password, and get
the
message:

"Shutdown initiated by NT AUTHORITY SYSTEM
c:\windows\system32\services.exe terminated unexpectedly"

--or-- sometimes is refers to c:\windows\system32\lsass.exe terminated
unexpectedly

It then reboots, and the same thing happens again... If I reboot in Safe
Mode, this doesn't happen. What can I do??? Thank you!

I've run a virus check on the server, but nothing found (TrendMicro
Sysclean)

Thanks!!

[Todd J Heron]

"RPC call service was initiated by NT Authority/Systems. Windows must
restart because remote procedure call (RPC) terminated unexpectedly."

Other possible symptoms:
Two errors below seen everytime Windows is started:

Lsass.exe error, the computer will shutdown in 60 seconds (this window pops
up before logging onto windows)

-or-

When the log on screens pops up and I enter the password it says I can't log
in because the "handle is invalid"

Probable reasons, listed in order of likelihood.
1) A worm such as blaster or a variant such a w32korgo has infected the
machine.
2) A hotfix is needed. See below.

Possible problems with Lsass.exe.

Windows Server 2003-Based Computer Becomes Slow and Unresponsive After
Running for Several Days:
http://support.microsoft.com/?scid=kb;en-us;821008

Computer Does Not Respond to Client Requests After Lsass.exe Stops
Responding:
http://support.microsoft.com/?scid=kb;en-us;821265

The Server Stops Responding and an Access Violation Occurs in Lsass.exe When
the Server Reloads Certain Policy Parameters:
http://support.microsoft.com/Default...b;en-us;826819

Reference:
http://www.microsoft.com/security/incident/blast.mspx -- description of
blaster worm
http://www.trendmicro.com/download/dcs.asp -- copy Sysclean and pattern
file into same folder to execute from.
http://www.trendmicro.com/download/pattern.asp
http://www.microsoft.com/smallbusine...dance/hub.mspx --
Microsoft security guidance.
http://www.microsoft.com/technet/sec.../avdind_0.mspx --
Microsoft AntiVirus Defense-in-depth Guide.

--
Todd J Heron, MCSE
Windows Server 2003/2000/NT; CCA
----------------------------------------------------------------------------
This posting is provided "as is" with no warranties and confers no rights

[Jonah Olsson]

Hello,

We're having the same problem with rebooting due to a sudden shutdown of the
RPC, but all patches has been installed and antivirus software and removal
tools reports no virus/worm. What could be wrong? Any help would be much
appreciated!

Regards,
Jonah Olsson

Here's the error messages we receive:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 2005-05-09
Time: 12:39:44
User: N/A
Computer: WEBSTAGE
Description:
Faulting application svchost.exe, version 5.2.3790.1830, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.


Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 2005-05-09
Time: 12:39:47
User: N/A
Computer: WEBSTAGE
Description:
The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 800706BA from line 44 of
d:\srvrtm\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact
Microsoft Product Support Services to report this error.


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 2005-05-09
Time: 12:39:47
User: N/A
Computer: WEBSTAGE
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has
done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.


Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 2005-05-09
Time: 12:39:47
User: NT AUTHORITY\SYSTEM
Computer: WEBSTAGE
Description:
The process winlogon.exe has initiated the restart of computer WEBSTAGE on
behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for
this reason could be found
Reason Code: 0x30006
Shutdown Type: restart
Comment: Windows must now restart because the Remote Procedure Call (RPC)
service terminated unexpectedly