service control manager error

[inusrat]

Hi,

I have installed windows 2000 advanced server. When I go to administrative tools and then event viewer. I see error writen in front of "Service Control Manager" error no 7031.
Why I am geting this error? is it a serious error?. I am going to host a website on my machine so that is why I am little concerned, I do not want OS to crash once I put my website on my machine...

Thanks

 

[inusrat]

sorry the descriptions of errors are:

The World Wide Web Publishing Service service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 0 milliseconds: No action.

and other error says:

The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 0 milliseconds: No action.

and one more:

The IIS Admin Service service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.

 

[markdmac]

Try setting the services to restart after failure. You will find this setting by doubleclicking the services. Click the recover tab.

Check your event logs for an indication of why it is stopping. Post your results if you need help interpretting them.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[inusrat]

Thanks for your reply. I found out that "World Wide Web Publishing Service" and "SMTP service" both depend on
"IIS Admin Service service" so when IIS Admin Service service terminated they get terminated too. But I don'y know why why "IIS Admin Service service" gets terminated. But when I go to services all they services are running as they start back automaticallty. But I could not find any other log that tells me why IIS "Admin Service service"
gets terminated. After installing W2k advanced server I did not configure that or anything, since I am on stand alone computer, I only confifured IIS 5.0. I don't know if these services start back again how much I should be concerned about it?

Thanks

 

[markdmac]

Do you get anything in your log files? If you are going to be publishing a web site, I think you have sufficient reason for concern.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[inusrat]

In which folder normaly that log file is , the one you
want me to check?

 

[markdmac]

Right click My Computer, choose Manage. Expand the Event Logs and look in the System Logs and Application Logs.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[sveiki]

Hi,

I also get IIS Adminterminated unexpetedly
avery day multiple times.
Microsoft says it can be AntiVirus program that
detects Code Red and shuts down IIS.
We found that article on TrendMicro.com
that describes that this is the case with ServerProtect 5.5
and they suggested to ugrade to ServerProtect 5.56
which we did but...
IIS Admin stops again.

Anybody has the same problem?

 

[inusrat]

Hi markdmac,

When I Right click My Computer, choose Manage. Expand the Event Logs and look in the System Logs and Application Logs. I get to the same log which I get when go to administrative control/event viewer.. and when I look for description of error all it tell you that.

"The World Wide Web Publishing Service service terminated unexpectedly. It has done this 8 time(s). The following corrective action will be taken in 0 milliseconds: No action."

 

[sveiki]

Hi inusrat,

I have the same problem on my W2K Server.
Read my post from "sveiki" today.

I'm going to isolate the problem.

Shut down AntiVirus program (ServerProtect 5.56 from TrendMicro)on the server for one day
and see if 7031 error disappears.
If it does then I know for sure it's AntiVirus problem.

 

[inusrat]

Hi sveiki,

I actually do not have any Anti virus program but i still get that error. I installed service pack 4 it also did not make any difference.. I have IIS 5.1 on XP professional there I do not have any such error.

thnaks

 

[sveiki]

Hi insurat,

I just read microsoft KB
and it says Code Red II might cause thsi probelm!

 

[markdmac]

inusrat, you are looking at the details of the event, but not the header info. It should give you an event ID number too. Let me know what you see there.

As indicated by the above posts, you could be looking at a code red infection. Make sure your system is clean, updated and running current AV definitions.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[sveiki]

INUSRAT does not have AntiVirus
but we do.
And we have all latest IIS patches installed.
But still get Event ID 7031 error.

 

[markdmac]

Hi Sveiki,

Have you run the patch for Code Red yet and verified that its back door has been removed?

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[sveiki]

I applied a patch more than a year ago when
Code Red hit the Internet.
Since then I didn't do anything about CodeRed.

Is there a chance it can come back?

 

[markdmac]

Not if you have applied the patch, but I don't believe the patch removed the backdoor if it was already there. You might want to check the AV sites and also load a copy of LavaSoft's AdAware from

http://www.lavasoft.de.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[inusrat]

So have we come to any conclusion, why we get this error. Like I said in my case i do not have any anti virus or exchange program I still get that error both in windows 2000 server and windows 2000 advanced server.

 

[markdmac]

inusrat, you have been given a number of suggestions to check your machine for malware. Have you investigated that avenue?

Do you have the ability to remove and reinstall IIS?

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[sveiki]

I did a test.
I ran Deploy Task on our AntiVirus
program and 7031 error didn't come up.

So I assume that the error is not related
to any AntiVirus issues.

To prove this theory I'm going to
apply Code Red II patch and if the error is not gone
then I'm pretty sure it's not virus or spyware related.