RPC not starting ... please help !

[Designware]

Hi,

I have a Windows 2000 system. I noticed a problem with the printers. They were gone. And when I tried to install them again, it told me the spooler subsystem wasn't running. I checked the services, and sure enough, the print spooler was not running. I tried to start it, and a dependency wasn't running (RPC).

I tried to start RPC but get the error message "Could not start RPC .. Error 32: The process cannot access the file because it is being used by another process"

I have scanned the PC for viruses using AntiVir .. it found two and deleted them. Scans are now clear.

Any direction you can provide would be greatly appreciated!

Designware

 

[bcastner]

Click Start, Run and type Reged32.exe

Navigate to the following branch

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Spooler

In the right-pane, double-click the DependOnService value

Delete the existing data, and then type RPCSS

Close Regedit.exe

Reboot

 

[bcastner]

Click Start, Run and type Reged32.exe

Navigate to the following branch

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Spooler

In the right-pane, double-click the DependOnService value

Delete the existing data, and then type RPCSS

Close Reged32.exe

Reboot

 

[Designware]

BCastner,

Thanks for the reply. That entry (RPCSS) is already listed in the registry key you listed. I removed it anyway, rebooted, and readded it, and rebooted. Same result.

I even try to run RPC directly from the Component Services area of the control panel. It gives the error message listed in my first post.

Designware

 

[bcastner]

Very odd, it almost reminds me of Blaster (three years ago yesterday it was introduced).

Do at least two online AV scans. I would use Panda and Trend Micro:

http://windowsxp.mvps.org/Scanners.htm

 

[Designware]

I went to the web site that has the free virus scans. I tried to run Panda and Trend scans, but the scan would never start. (I would click on it, but absolutely no response.) So, I noticed that it used Java to run, I thought the PC may not have a recent Java version. So I went to download the latest java. It would not install ... it gave me the error message

"The Windows Installer service could not be accessed. This can occur if you are running Windows in Safe Mode, or if the Windows Installer is not correctly installed."

So, I downloaded Windows MSI installer, and installed it on the machine. I then attempted to download and install java again ... with the same error messge.

This seems to be getting worse.

Designware

 

[Designware]

Just for good measure, I downloaded the FixBlaster program from Symantec and scanned the PC. Blaster was NOT found on the system.

FYI

Designware

 

[bcastner]

I did not think you had Blaster, although it is still very active.

Could you download Process Explorer by Sysinternals (now Microsoft) and check what is using these three files:

%windir%\System32\rpcss.dll
%windir%\System32\rpcrt4.dll
%windir%\System32\rpcns4.dll

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

 

[Designware]

What a great utility. Thanks for the link.

However, I don't see those dlls being used anywhere. The utility has an option to save the report. I have copied and pasted the report below:

Process PID Description
System Idle Process 0
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 8
SMSS.EXE 144 Windows NT Session Manager
CSRSS.EXE 168 Client Server Runtime Process
WINLOGON.EXE 188 Windows NT Logon Application
SERVICES.EXE 216 Services and Controller app
sched.exe 412 Avira GmbH Scheduler
avguard.exe 424 Antivirus On-Access Service
regsvc.exe 472 Remote Registry Service
stisvc.exe 520 Still Image Devices Monitor
LSASS.EXE 228 LSA Executable and Server DLL (Export Version)
svchost.exe 464
explorer.exe 2792 Windows Explorer
type32.exe 2820 Microsoft IntelliType Pro
avgnt.exe 2836 Antivirus System Tray Tool
aim.exe 2852 AOL Instant Messenger
regscan.exe 2788 Microsoft(C) Registry Scaner
IEXPLORE.EXE 2952 Internet Explorer
OSA.EXE 2892
IEXPLORE.EXE 2940 Internet Explorer
POWERARC.EXE 2976 The most powerful Freeware Archive Utility
procexp.exe 2796 Sysinternals Process Explorer

 

[bcastner]

Lets try tslist:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;250320

Start, Run, CMD
tslist -s >filename.txt

 

[Designware]

bcastner,

Thank you for your persistence!

I try to run tslist from the command prompt and get the following message: "'tslist' is not recognized as an internal or external command, operable program or batch file."

At the bottom of the KB article, it definitely listed Windows 2000 Professional as one of the O/Ss it applied to. So I decided to do a search for the file. I discovered clicking START and SEARCH ... the computer doesn't respond. (I cannot search for any files.) So I decided to poke around in WINNT and further into SYSTEM and SYSTEM32, but did not find a tslist program.

I also tried to see if I could extract tslist from the Windows 2000 CD, but couldn't find an article on that. And simply perusing the CD .. I didn't find it. (FYI, I have already tried a repair booting from the Windows 2000 CD.)

 

[bcastner]

Using reged32, what do you see under this key value?

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost:
netsvcs: Reg_Multi_SZ: EventSystem Ias Iprip Irmon Netman Nwsapagent Rasauto Rasman Remoteaccess SENS Sharedaccess Tapisrv Ntmssvc
rpcss :Reg_Multi_SZ: RpcSs

 

[tlcscousin]

Is the Com + event service started?

http://support.microsoft.com/default.aspx?scid=kb;en-us;274696

The above link might get search working as well and possibly the spooler.

 

[Designware]

bcastner,
The only thing I see under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs is a key named CoInitializeSecurityParam with a Hex number of 1.

tlcscousin,
Thanks for the post. No, the COM+ service was / is not started. For some reason it is set to manual. When I try to start it I get the error "Could not start the COM+ Event System Service on the local computer. Error 1068: The dependency service or group failed to start."

Also, the KB article you provided was accurate. I added the two Names with "allow access", but nothing changed. Still can't search for files, but ALL the descriptions of the problems in the KB article are accurate and apply to me.

Thanks!

 

[bcastner]

You looked at the wrong key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost\rpcss

 

[Designware]

bcastner,

Sorry about that. The data under that key is " RpcSs

 

[bcastner]

The file regscan.exe is a virus/trojan.

http://www.bleepingcomputer.com/startups/regscan.exe-8651.html

Click Start, and then click Run. (The Run dialog box appears.)
Type reged32, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

RegScan %Windir%\Regscan.exe

Exit the Registry Editor.

Reboot.

Then see faq608-4650 for sources on on-line antivirus scanners.

I do not see a firewall enabled. This is not wise.

 

[Designware]

I didn't find it under HKLM, but I did find it under HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\Run . I removed it there and rebooted. No change.

Thanks for hanging in there with me!

 

[bcastner]

If you create a brand new user, and then logon as that brand new user, does the spooler service work properly?

 

[Designware]

Tried the new user, set up as an adminstrator, with same result. Have an error in the application log every time I boot. It is Error 4097 from the EventSystem.

In the System Log File, I get a ton of Event ID: 7001 errors from the Service Control Manager. Not just when I boot, but about 2 or 3 times a minute.

I cannot double-click on these to see the full error messages. It doesn't let me.