Select the product you need help with

IIS and Exchange services quit unexpectedly

Article ID: 316612 - View products that this article applies to.

This article was previously published under Q316612

SYMPTOMS

A Microsoft Exchange 2000 Server computer may have intermittent mail flow and connectivity issues. Microsoft Internet Information Services and Exchange services may quit unexpectedly. Any or all of the following errors may be logged every 5 to 10 minutes in the System Log on the server:

Event Type: Error
Event Source: Service Control Manager
Event ID: 7032
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Exchange Routing Engine service, but this action failed with the following error: An instance of the service is already running.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The IIS Admin Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Microsoft Exchange IMAP4 service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Site Server ILS Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The FTP Publishing Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Network News Transport Protocol (NNTP) service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Microsoft Exchange POP3 service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Microsoft Exchange Routing Engine service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 60000 milliseconds: Restart the service.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description: The World Wide Web Publishing Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.

Back to the top | Give Feedback

CAUSE

This issue may occur if the server is infected with the Code Red worm or a variant. The worm can cause the IISAdmin service and other services that depend on the IISAdmin service to stop.

Back to the top | Give Feedback

RESOLUTION

To resolve this issue, you must remove the worm from the computer. A tool is available to remove the back door that is created by the Code Red II worm. For more information about this tool, visit the following Microsoft Web page:

Tool to remove obvious effects of the Code Red II worm

(http://technet.microsoft.com/en-us/library/dd277360.aspx)

Contact the vendor of your virus protection software for information about how to remove the worm from the computer.

After you remove the worm, apply the latest security patches from Microsoft. For information about where to find the latest Microsoft security patches, visit the following Microsoft Web page:

Patch management, security updates, and downloads

(http://www.microsoft.com/technet/security/current.aspx)

For more information about the "Nimda" Worm, visit the following Microsoft Web page:

Information about the "Nimda" worm

(http://technet.microsoft.com/en-us/library/cc723473.aspx)

Back to the top | Give Feedback