Strange Windows 2000 problem

[Cameron McShane]

Hey all

I have a Windows 2000 workstation that has just started experiencing some
very strange issues. The problem was first detected by the user when he
tried to copy some files from a CD to the hard drive. The machine is a
member of a domain, and the users domain account is the local machine's
administrators group. When trying to copy any files to the hard drive the
'paste' option was not available, either form the right click context menu
or Ctrl-V keyboard shortcut. On further investigation, I can create folders
and files, but cannot copy, paste or move any files on the hard drive or
copy any files to or from from it. I then logged on as the local machine
administrator account, which produced the same results. Remotely, I can map
the problem drive as c$ and can copy files from it without an issue.

I then tried checking the event viewer, however no property pages will open.
I then chose 'Manage' from the My Computer context menu. Most of the options
would not display, and several give an error - 'The array bounds are
invalid'. This occurred when trying to open disk management, removable
drives etc. I also tried viewing the properties of the Local Users and
Groups, however none of the property sheets will display. However when I try
and close the MMC, it says that i must close all property sheets before
closing.

I am just performing a full system backup, and will then try using sfc.exe
to repair system files, followed by a recovery console repair if that doesnt
help, followed by a backup restore. Before doing all this, does anyone have
any suggestions about what the problem may be, or any other measures to try
before a recovery from a backup.

Any help would be greatly appreciated.

Cheers


Cameron

 

[Guillermo]

I've seen that kind of behavior in computers infected with the blaster
virus....
does your control panel shows up very weird?

 

[Jason Hall [MSFT]]

--------------------

From: "Cameron McShane" <[email protected]>
Subject: Strange Windows 2000 problem
Date: Mon, 24 May 2004 15:29:03 +1000

Hey all

I have a Windows 2000 workstation that has just started experiencing some
very strange issues. The problem was first detected by the user when he
tried to copy some files from a CD to the hard drive. The machine is a
member of a domain, and the users domain account is the local machine's
administrators group. When trying to copy any files to the hard drive the
'paste' option was not available, either form the right click context menu
or Ctrl-V keyboard shortcut. On further investigation, I can create folders
and files, but cannot copy, paste or move any files on the hard drive or
copy any files to or from from it. I then logged on as the local machine
administrator account, which produced the same results. Remotely, I can map
the problem drive as c$ and can copy files from it without an issue.

I then tried checking the event viewer, however no property pages will open.
I then chose 'Manage' from the My Computer context menu. Most of the options
would not display, and several give an error - 'The array bounds are
invalid'. This occurred when trying to open disk management, removable
drives etc. I also tried viewing the properties of the Local Users and
Groups, however none of the property sheets will display. However when I try
and close the MMC, it says that i must close all property sheets before
closing.

I am just performing a full system backup, and will then try using sfc.exe
to repair system files, followed by a recovery console repair if that doesnt
help, followed by a backup restore. Before doing all this, does anyone have
any suggestions about what the problem may be, or any other measures to try
before a recovery from a backup.

Any help would be greatly appreciated.

Cheers


Cameron

----------------------

It looks like your RPC service is down. Does the behaviour occur after you
reboot without the network cable plugged in? If it does not, it's likely
that the machine if being attacked by an RPC vulnerability
(MS03-039: "A Buffer Overrun in RPCSS Could Allow an Attacker to Run"
http://support.microsoft.com/?id=824146)

If the problem is persistent, copy the system event log file to another
machine and import it for analysis (c:\WINNT\system32\config\SysEvent.evt)

Let me know what you find out

--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Cameron McShane]

Jason

Thanks for your comments. Unfortunately, I'm still having no luck. the
problem doesn't appear to be with RPC as far as I can work out. The machine
is fully patched (it is a member of a domain with a SUS server), and having
just checked, it is all up to date. It's anti-virus is also up-to-date and I
have completed a full scan. The RPC service is also running.

I tried copying the event log to another machine, however when I try and
open the log in the event viewer it says that the log file is corrupted.
This is also the case for the appplication event log. I have tried opening
them on both a Windows XP and Windows 2000 machine. This is strange as they
do open on the problem machine itself, however I cannot view the actual
errors as when clicking on the individual errors it will not display the
property pages (similar problem as with the MMC's).

Have you any other ideas I can try?

Thanks again


Cameron

 

[Jason Hall [MSFT]]

--------------------

From: "Cameron McShane" <[email protected]>
Subject: Re: Strange Windows 2000 problem
Date: Tue, 25 May 2004 12:00:32 +1000

Jason

Thanks for your comments. Unfortunately, I'm still having no luck. the
problem doesn't appear to be with RPC as far as I can work out. The machine
is fully patched (it is a member of a domain with a SUS server), and having
just checked, it is all up to date. It's anti-virus is also up-to-date and I
have completed a full scan. The RPC service is also running.

I tried copying the event log to another machine, however when I try and
open the log in the event viewer it says that the log file is corrupted.
This is also the case for the appplication event log. I have tried opening
them on both a Windows XP and Windows 2000 machine. This is strange as they
do open on the problem machine itself, however I cannot view the actual
errors as when clicking on the individual errors it will not display the
property pages (similar problem as with the MMC's).

Have you any other ideas I can try?

Thanks again


Cameron

-------------------

It might be just the COM+ that is corrupt (COM+ relies on RPC to function,
that's why I suggested the RPC fix earlier)
To re-apply COM+.....
1. Check whether the ~clbcatq.dll file is present in your %windir%\system32
folder. Delete the ~clbcatq.dll file if it is present.
2. Move the contents of %systemroot%\registration somewhere else
3. Export the HKLM\Software\Microsoft\COM3 for posterity, then delete it.
4. Re-run COM+ setup. To do this, follow these steps:
a. In Control Panel, click Add/Remove Programs.
b. Click Add/Remove Windows Components.
c. Click Next several times, and then click Finish.
When you click Finish, Windows Optional Component Manager checks whether
COM+ has been set up correctly. If not, Windows Optional Component Manager
re-attempts COM+ setup.
(this is from KB article Q246499)

--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Cameron McShane]

Jason

No luck unfortunately. I got the following error when trying to reinstall
COM+:

Sub-component COM+ raised an exception while processing the
OC_COMPLETE_INSTALLATION setup message.
d:\nt\com\com1x\src\complussetup\comsetup\ccompluscore.cpp (line 565)
Error Code = 0x80040155
Interface not registered
The COM+ event classes could not be registered.

I then tried a Repair via Windows setup, again with no luck. A search found
that this had been encountered by others, however nothing to do with any
ways around it other than a reinstall.

As the machine was needed fairly urgently, I have had to abandon measures to
fix the problem, and am now in the process of re-imaging, and restoring
files from backup.

Thanks again for your help


Cameron

 

[Jason Hall [MSFT]]

--------------------

From: "Cameron McShane" <[email protected]>
Subject: Re: Strange Windows 2000 problem
Date: Wed, 26 May 2004 11:32:20 +1000

Jason

No luck unfortunately. I got the following error when trying to reinstall
COM+:

Sub-component COM+ raised an exception while processing the
OC_COMPLETE_INSTALLATION setup message.
d:\nt\com\com1x\src\complussetup\comsetup\ccompluscore.cpp (line 565)
Error Code = 0x80040155
Interface not registered
The COM+ event classes could not be registered.

I then tried a Repair via Windows setup, again with no luck. A search found
that this had been encountered by others, however nothing to do with any
ways around it other than a reinstall.

As the machine was needed fairly urgently, I have had to abandon measures to
fix the problem, and am now in the process of re-imaging, and restoring
files from backup.

Thanks again for your help


Cameron

----------------------

You might be able to re-install COM+ successfully after doing this:
start > run > regsvr32 ole32.dll

--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.