RPC not starting ... please help !

[Designware]

Hi,

I have a Windows 2000 system. I noticed a problem with the printers. They were gone. And when I tried to install them again, it told me the spooler subsystem wasn't running. I checked the services, and sure enough, the print spooler was not running. I tried to start it, and a dependency wasn't running (RPC).

I tried to start RPC but get the error message "Could not start RPC .. Error 32: The process cannot access the file because it is being used by another process"

I have scanned the PC for viruses using AntiVir .. it found two and deleted them. Scans are now clear.

Any direction you can provide would be greatly appreciated!

Designware

 

[Frank4d]

Has this machine had a Lexmark (or Dell branded Lexmark) printer that is no longer used? Lexmark software runs a service LEXBCES that is required for RPC to start. And RPC is required for SPOOLSV to start.

 

[bcastner]

Looking more and more like an infected machine.

http://www.eventid.net/display.asp?eventid=4097&eventno=830&source=EventSystem&phase=1

Error 7001 is just a constant complaint that it cannot start services because dependent services will not start. Which is to be expected, because it is clear they are not starting.

See:

http://www.mvps.org/sramesh2k/Scanners.htm

Run the Trend Micro and Panda online AV scans.

 

[tlcscousin]

Have you looked through all RPC's Dependencies and checked that all the dependant services are set to Automatic?

http://www.techspot.com/tweaks/win2k_services/print.shtml

discusses all the services in 2000 and the default settings.

 

[bcastner]

RpcSs (RPC) has no dependencies in Win2k Pro or Server.
XP makes a dependency to DCOM.

In all cases it seems that nearly every service depends on RPC running.

 

[tlcscousin]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs]
What is the value listed at this key?
On my w2k machine the imagepath is
%systemroot%\system32\svchost -k rpcss

My machine though is just a standalone w2k machine.

 

[Designware]

Thanks for all the replies!

FRED4D, There hasn't been a lexmark printer on this PC. Only an Epson. Just in case, I searched the registry for anything starting with "LEXB", found none.

BCASTNER, I cannot run either the Panda or Trend Micro online scan. I cannot even click on the hyperlinks on the web site you provided (absolutely nothing happens). I manually type in the URL and get to the Trend Micro or Panda site, but when I actually click on the final link to run the scan, nothing happens. The Internet Explorer screen just sits there, not frozen (I can go back), but nothing occurs.

However, I do have "Antivir" (a free antivirus program) already installed on the PC. I ran it initially, it found two files infected. If I run it now, it finds nothing. (I just ran an update as well.) I can download and install AVG or something if that may to a better job.

tlcscousin, Yes, under the "ImagePath" key in HKLM\System\CurrentControlSet\Services\RpcSs\ImagePath is " %systemroot%\system32\svchost -k rpcss "

 

[bcastner]

With all IE sessions closed:
Start, Run, iexplore /rereg

Then download IEFIX and run it:

http://windowsxp.mvps.org/IEFIX.htm

 

[Designware]

when I did Start, Run, iexplore /rereg .... an Internet Explorer box popped up with

http:///rereg

(yes 3 "/"s is correct) in the URL text field.

Anyway, I WAS able to download the IEFIX program and run it. I rebooted (for good measure) after it completed. Tried to run Panda and Trend Micro online scans, with the same result.

 

[Designware]

BCastner, I searched for more information on the "iexplore /rereg" function. I saw it on the same domain you have been referring to.

http://inetexplorer.mvps.org/answers/26.html

It stated that if that command did not work, to manually register 6 different dlls. I tried to do that. 4 worked fine, 2 (Shdoevw.dll & Aetxprxy.dll) said they could not be found.

Don't know if that helps or not, but FYI.

 

[bcastner]

Sandi Hardemeir is a friend of mine and fellow MS-MVP. I did not refer to her site, but I should have. Running IEFix will do the re-registration of needed DLLs as well. A more aggresive re-registration is done here:

http://iefaq.info/index.php?action=artikel&cat=24&id=31&artlang=eni

One thing a look at Sandi's site reminded of was to check for Class registry entries:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q281679

 

[Designware]

I downloaded the more aggressive re-registration and ran it, with no change.

I did find something curious though. In the KB article you provided, it stated to make sure that several keys were correct. They were

HKLM\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}

and some sub-keys to that. What I found was that the name of the keys was SUPPOSED to be "default". Instead, they were "No Name" within the registry ... even though the data inside appeared to be correct.

 

[Designware]

FYI, it's the same for the other keys that the KB article had me check
[HKEY_CLASSES_ROOT\CLSID\{79eac9e0-baf9-11ce-8c82-00aa004ba90b}\InprocServer32]

and two others. They did NOT have the name "Default" as they should, but "No Name".

Don't know exactly what this means, if anything.

 

[tlcscousin]

Locate the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
On the Security menu, click Permissions. Make sure that the Everyone group has only read-only permissions, check for any other accounts other than System and set those to read only, and then click OK.
Open the value and make sure that a valid character exists. Also, check by backspacing across any entry to find out if a valid character or empty field is in the string.
Quit Registry Editor.
Restart the computer.

http://support.microsoft.com/default.aspx?scid=kb;en-us;307765

This might be worth looking at as well.

 

[bcastner]

tlscousin,

This is Win2k, not NT.
Read registry permissions are the default and not editable only expandable to Full Control.

Furthermore, RpcSs service has no dependencies on the Server service under Win2k and XP and Windows 2003. SRVCOMMENT makes no difference under these operating systems.

 

[tlcscousin]

you are right never scrolled down far enough to see it only applied to nt4

I would almost try downloading sysclean and then run it from safe mode.

http://www.trendmicro.com/download/dcs.asp

Download the latest pattern file lpt$vpn.XXX in ZIP format
lptXXX.ZIP from the following location:

http://www.trendmicro.com/download/pattern.asp

This file must be saved in the same folder where you run this fix package.

 

[Designware]

Thanks. I downloaded trend on another PC, ran it from the problem PC, and it had a clean scan.

Thank you for your help. Hopefully there are some other ideas.

 

[tlcscousin]

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q259733

Might be worth trying the steps mentioned in the link.

 

[bcastner]

Start, Run, CMD
sfc /Scannow

 

[Designware]

bcastner, ran sfc /scannow. It ran through, but with no change after it was done.

tlcscousin, tried the KB article. No change.

Thank you both for your efforts. After hours on the phone with Microsoft, I ended up reformatting and reinstalling. I should have done it a long time ago I guess. Thanks again.