RPCSS.dll causes svchost.exe to fail once hp drivers are installed

[Craig Forster]

Hi, i've been working on our scripted build of win2k3 on proliants for our network. Regardless of the server to which its built, after 1-4 days the RPC service will stop (causing a reboot and all appsand network services to fail) with the following in the event log:
Event ID=1004
Reporting queued error: faulting application svchost.exe, version 5.2.3790.0, faulting module rpcss.dll, version 5.2.3790.0, fault address 0x0002eb3c.
The dr Watson event entry is ID=4097:
The application, C:\WINDOWS\system32\svchost.exe, generated an application error The error occurred on 01/08/2004 @ 11:10:45.796 The exception generated was c0000005 at address 7572EB3C (rpcss!CoGetComCatalog)
Then, service that rely on RPC start failing, like the COM+ system with event ID=4609:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070005 from line 44 of d:\srv03rtm\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

Ive tried a ton of different servers (proliant 8000, 360 g3, 570 g3 etc etc) and its always the same.
Tried uninstalling HP network teaming (ms and hp say teaming and load balancing dont get on), but even with both teaming and wlbs removed it happens.
The error occours usually about 2 days after the server is built. Windows automatically reboots the server according to its recovery options, but a couple more days later it dies again.
I've tried server with v7.00a of the drivers from http://h18007.www1.hp.com/support/files/server/us/supportpaq.html but it didn't help. All servers have the most recent firmware for all upgradeable devices (raid, nic, ilo, disks, bios etc.
Its not my scripted build alterations as a server built manually off the win2k3 cd and only the hp bundled software will still get the same result.
Others on the web are getting this sort of thing too (link found in google search): http://www.computing.net/windows2003/wwwboard/forum/844.html

tried the ms q824146 fix, didn't help either.

Any ideas?

[Ron Kinner]

Could be you have one of the RPC worms on your network. Install the free version of Zone Alarm (http://www.zonelabs.com) on the next system you build and don't assign any trusted networks. Let it show you any attempts to connect.

Ron

[Craig Forster]

No dice. We're a big corporate with AV up the wah-zoo. There's no 'novice' stuff going on here. I tried building the servers with the q824146 patch "slipstreamed" into the build using q828930, so it comes prepatched. I will try installing trend server protect as AV moments afetr the build is complete, just incase.

But what I was really hoping for was an HP employee in the field to catch on this and acknowledge a real problem with their drivers..

[Jon Finley]

hmmm..... XP has Internet Connect Firewall (ICF)under the advanced settings on TCP/IP, W2K3 should have something like it.. you should be able to enable ICF on W2K3 as part of the install, and prior to patching to block all incoming attempts.

Jon

[Craig Forster]

Thats ok for small users, but not very clever on a large corporate network. If thats enabled on a server, no one could map a network drive, open email (if it had exchange), print to it, login to it (if it was a DC). it would be a simple room-warmer.

I really do need another acknowledgement from an HP person. but thanks for posting.
again, will be trying installing AV as soon as the server is built.

[Ron Kinner]

I think you need to contact HP directly if you want to talk to them.

You may also want to consider posting in the
http://forums1.itrc.hp.com/service/forums/categoryhome.do?categoryId=264

forum since it seems this is an issue more with a proliant server than a windows software issue.

Ron

[Andrea Rossi]

same problem. Did you solve it?
urgent!

[Craig Forster]

The problem WAS that a patch needed to be installed at build time as there is a virus loose on the network that killed the process.
Install http://support.microsoft.com/kb/828741 at build time and you'll be fine.

[Ron Kinner]

NO novice stuff huh? Large Corporation? RTFL!

The larger the corporation the higher the chance some idiot will bring in his laptop with the latest worm on it before Norton or whoever you use has discovered its existence.

Zone Alarm is what I use as an early warning system. When I start getting alarms that someone is trying to connect to my Zone Alarm PC I know we've got another worm or virus on the loose. The ZA log tells you who sent the packet so you can just track it down and exterminate it at the source. HijaqckThis is great for telling you what's running that shouldn't be.

Ron