svchost.exe

[Patrick Herb]

Hello,

We have a small peer-to-peer network in our institute in which most
machines run Win2k. A few days ago some (not all) people in the
network started getting the message "svchost.exe has generated an
error and will be terminated".
This happens at the same time on all affected computers and it happens
increasingly often. Computers have to be restarted to work properly
again so the error isn't acceptable.
The event log on all machines that experienced the error showed an
error in the EventSystem service and in the RPC service. The
description for the EventSystem error is something like "The COM+
event system experinced erroneous return code. HRESULT was 800706BF in
line 42 of .\eventsystemobj.cpp. Please contact Microsoft Support
Service." The description for the RPC error was just "RPC service was
terminated."

I did a search in the Microsoft Knowledge Base and in
www.dejanews.com. No success.
I know svchost.exe is a generic host process name for a number of
services including EventSystem and RPC so the error must be either in
the EventSystem service or in the RPC service.

Any ideas what could be the problem or at least what exactly the
EventSystem and RPC services are doing?

patrick

 

[Matt Scarborough]

On 31 Jul 2003 08:16:39 -0700, Patrick Herb wrote

Hello,

We have a small peer-to-peer network in our institute in which most
machines run Win2k. A few days ago some (not all) people in the
network started getting the message "svchost.exe has generated an
error and will be terminated".
This happens at the same time on all affected computers and it happens
increasingly often. Computers have to be restarted to work properly
again so the error isn't acceptable.
The event log on all machines that experienced the error showed an
error in the EventSystem service and in the RPC service. The
description for the EventSystem error is something like "The COM+
event system experinced erroneous return code. HRESULT was 800706BF in
line 42 of .\eventsystemobj.cpp. Please contact Microsoft Support
Service." The description for the RPC error was just "RPC service was
terminated."

This is quite possibly associated with this activity.

CERT Advisory CA-2003-19 Exploitation of Vulnerabilities in Microsoft RPC Interface
Original issue date: July 31, 2003
http://www.cert.org/advisories/CA-2003-19.html

To be certain, use System Tools | System Information, then Tools | Dr. Watson to open the minidump that is created by default for these events.

Matt Scarborough 2003-08-01

I did a search in the Microsoft Knowledge Base and in
www.dejanews.com. No success.

<http://groups.google.com/[email protected]&oe=UTF-8&output=gplain>