Services intermittantly stopping

[Guest]

I am having problems with numerous PCs in our organization, where they will
intermittantly stop vital services. The following services are affected:
Computer Browser
Workstation
Server
DHCP Client
Automatic Updates
Distributed Link Tracking Client
Error Reporting Service
Logical Disk Manger
Shell hardware Detection
Windows Audio
Task Scheduler
Wireless Zero Configuration
Portable Media Serial Number Service
Secondary Logon

These are the ones that I have noticed so far, sometimes it may not be all
the listed above, but in every case it has been the Computer Browser,
Workstation, and Server Service.

As a result, users will loose connectivity to network shares, and in some
cases Outlook 2002 will appear to lockup. We began having these problem in
Mid July 2005, and we have just recently been able to narrow the problems
down to these services stopping.

Typically a user will reboot and the services will start back up and they
are working. I have check all the event logs and nothing is recorded as
stopping, so I don't have any indication of the problem.
I have suspected a Virus or Spyware/Malware, and have scanned these PCs with
various Anti-Spyware utilities but we are not finding anything. We are
up-to-day the McAfee Virus Definitions and we have patched McAfee VirusScan
with the latest patch (version 11) . We also use WSUS to push Microsoft
critical and security updates to all the PCs, which we are currently
up-to-date.
We have re-imaged the PCs back to their original install and the problem
comes back.
We have contacted McAfee to see if there may be a Virus/Spyware released
that may be causing these issues, but they are not aware of any.

Our environment is a Windows 2000 Active Directory Domain (native), with all
XP workstations (maybe a handfull of 2000 workstations).

If we could get some help or direction of what we could try next or some way
to perform some kind of advanced logging, it would be very much appreciated.

Thanks.

 

[Guest]

Two things you may wanna check are
1) Dependency could it be that services are stopping because just one of
them has stopped and all others depend on it?
2) Logon account. Is it local system account? Could it be that Local System
account is misbehaving in some wierd way? May be yuo try to change the
account?

 

[MAP]

I too have this problem on occasion (but the services are different)I posted
the same question as you did.
Two people, regulars here who I trust hands down said this.
Responce 1
Check for malware/Viruses.

Responce 2
Windows update may at times change/stop services.

My system is clean from all parasites which leaves windows update which I
haven't been to in about a month so I have yet to check it out yet,the funny
thing is none of my services have shut off in the last month which leaves me
tending to believe that windows update might be the cause.
When was the last time you went there and installed an update?

 

[Guest]

Thanks for your response.

Regarding Responce 1: What tools utilities did you use to check for
Spyware/Malware? I've used AdAware, Microsoft Anti-Spyware, and Spybot. And
the PCs are coming up clean.

Regarding Responce 2: Our PCs updates from our WSUS server using Group
Policy, so our PCs will download Microsoft updates from the WSUS server when
ever a new update is approved. Then it is scheduled to install any new
updates at 3:00am. But to answer your question, I believe the PCs looks for
updates serveral times a day, not sure how often though. But they only poll
our WSUS server.

I think I will disable the Automatic Updates service on one of our problem
PCs and see if the problem returns.

Thanks.

 

[MAP]

Regarding Responce 1: What tools utilities did you use to check for

Spyware/Malware?

1.Ad-Aware
2.Spybot S&D
3.SpySweeper
4.SpywareBlaster (Installed and updated)
5.Ewido http://www.ewido.net/en/
6.Nod32 Anti-Virus
7.Process Guard http://www.diamondcs.com.au/processguard/
8.Winpatrol
9. TDS-3 Trojan scanner (No longer supported but still useful for now)
10.Multi AV command line scanner (Reccomended by David Lipman in the Virus
newsgroup) This is a nice tool for double checking your existing AV
software.

I know this is overkill.

 

[Guest]

I disabled and stopped the Automatic Updates service on 4 PCs that were
having this problem. And after 24 hours, I have had no problems. Before,
each PC would have many problems a day, and sometimes several in 2 hours.

So, I'm going to let it run like this for a couple more days and see if this
is indeed the Automatic Updates service. If so, do you (or anyone) have any
suggestions? Do I need to contact Microsoft and open a support call?

It's really weird that out of 2500 PCs, with virtually the same image, that
only 50 to 100 has this problem, that I am aware of. Is there a way to
re-install the Automatic Updates service?

Thanks for any help.