Microsoft KB Archive/316612

= IIS and Exchange services quit unexpectedly =

Article ID: 316612

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange 2000 Enterprise Server

-



This article was previously published under Q316612



SYMPTOMS
A Microsoft Exchange 2000 Server computer may have intermittent mail flow and connectivity issues. Microsoft Internet Information Services and Exchange services may quit unexpectedly. Any or all of the following errors may be logged every 5 to 10 minutes in the System Log on the server:

Event Type: Error

Event Source: Service Control Manager

Event ID: 7032

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Exchange Routing Engine service, but this action failed with the following error: An instance of the service is already running.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The IIS Admin Service service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Microsoft Exchange IMAP4 service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Site Server ILS Service service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The FTP Publishing Service service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Network News Transport Protocol (NNTP) service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Microsoft Exchange POP3 service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Microsoft Exchange Routing Engine service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 60000 milliseconds: Restart the service.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error

Event Source: Service Control Manager

Event ID: 7031

Description: The World Wide Web Publishing Service service terminated unexpectedly. It has done this X time(s).

The following corrective action will be taken in 0 milliseconds: No action.



CAUSE
This issue may occur if the server is infected with the Code Red worm or a variant. The worm can cause the IISAdmin service and other services that depend on the IISAdmin service to stop.



RESOLUTION
To resolve this issue, you must remove the worm from the computer. A tool is available to remove the back door that is created by the Code Red II worm. For more information about this tool, visit the following Microsoft Web page:

Tool to remove obvious effects of the Code Red II worm

Contact the vendor of your virus protection software for information about how to remove the worm from the computer.

After you remove the worm, apply the latest security patches from Microsoft. For information about where to find the latest Microsoft security patches, visit the following Microsoft Web page:

Patch management, security updates, and downloads

For more information about the &quot;Nimda&quot; Worm, visit the following Microsoft Web page:

Information about the &quot;Nimda&quot; worm

Additional query words: front page

Keywords: kbprb KB316612

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.