SYMPTOMS
A Microsoft Exchange 2000 Server computer may have intermittent mail flow and connectivity issues. Microsoft Internet Information Services and Exchange services may quit unexpectedly. Any or all of the following errors may be logged every 5 to 10 minutes in the System Log on the server:
Event Type: Error
Event Source: Service Control Manager
Event ID: 7032
Description:
The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Exchange Routing Engine service, but this action failed with the following error: An instance of the service is already running.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The IIS Admin Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 1 milliseconds: Run the configured recovery program.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Microsoft Exchange IMAP4 service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Site Server ILS Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The FTP Publishing Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Network News Transport Protocol (NNTP) service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Microsoft Exchange POP3 service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Microsoft Exchange Routing Engine service terminated unexpectedly. It has
done this X time(s).
The following corrective action will be taken in 60000
milliseconds: Restart the service.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The Simple Mail Transport Protocol (SMTP) service terminated unexpectedly. It
has done this X time(s).
The following corrective action will be taken in 0
milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event ID: 7031
Description:
The World Wide Web Publishing Service service terminated unexpectedly. It has done this X time(s).
The following corrective action will be taken in 0 milliseconds: No action.
RESOLUTION
To resolve this issue, you must remove the worm from the computer.
A tool is available to remove the back door that is created by the Code Red II worm. For more information about this tool, visit the following Microsoft Web page:
Contact the vendor of your virus protection software for information about how to remove the worm from the computer.
After you remove the worm, apply the latest security patches from Microsoft. For information about where to find the latest Microsoft security patches, visit the following Microsoft Web page:
For more information about the "Nimda" Worm, visit the following Microsoft Web page: