Event ID 7031 - Service service terminated unexpectedly

I have the same issue & found this

CAUSE
This issue may occur if the server is infected with the Code Red worm or a
variant. The worm can cause the IISAdmin service and other services that
depend on the IISAdmin service to stop.

http://support.microsoft.com/kb/316612
 >> Stay informed about: Event ID 7031 - Service service terminated unexpectedly 

Hi.

This is a public and free support forum. Several knowledgeable people
volunteer their time and effort to monitor and answer questions, but
there should never be an expectation of timeliness nor in getting an
answer at all. If you desire a guaranteed answer within a determined
time limit, then paid-support is the only way to go.

That detail aside:
1. You've got a crash. You can diagnose it with tools like IIS State,
DebugDiag, or your favorite native code debugger.
http://blogs.msdn.com/david.wang/archive/2005/08/29/HOWTO_Understand_a...Diagnos
2. There is no need to speculate on a cause (FYI: IIS5 is hardly
serviced anymore, so you really shouldn't start by suspecting MS
Patch).
3. This "quite common problem" is usually not with IIS itself but the
applications you run on top of it. 90+% of crashes that result in the
event log entries you see are caused by non-Microsoft software
instructed by the user to run (and crash) in an IIS process.

So, let's look at the crash log first...


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//




On Mar 19, 1:37 am, "myrealbroone" <myrealbr... RemoveThis @myrealbox.com> wrote:
> Hi again,
>
> Can someone please tell me what should I use to debug this problem?
> IISState or the IIS diagnostic toolkit?
>
> Thanks in advance,
> m.
>
> On Mar 14, 5:59 pm, "myrealbroone" <myrealbr... RemoveThis @myrealbox.com> wrote:
>
>
>
> > Hello,
>
> > Sorry to bother you with this - it seems - quite common problem.
>
> > Windows 2000 server, IIS5 with 10 sites, Tomcat's ISAPI_redirect
> > version 1.2.15 , ISAPI_Rewrite version 2.9.0.65, Symantec Antivirus
> > 10.1.
>
> > No problem whatsoever until a few days ago (maybe until the last ms
> > patch update).
> > Now, the following every 2/30 mins:
>
> > Event ID 7031
> > The World Wide Web Publishing Service service terminated
> > unexpectedly. It has done this n time(s). The following corrective
> > action will be taken in 0 milliseconds: No action.
>
> > Event ID 7031
> > The IIS Admin Service service terminated unexpectedly. It has done
> > this n time(s). The following corrective action will be taken in 0
> > milliseconds: Run the configured recovery program.
>
> > I suppose I should now get IISstate and produce a log.
> > Would it be possible to post the log here, and have anyone able to
> > read it tell me what is happening?
>
> > Thank you in advance,
> > m.- Hide quoted text -
>
> - Show quoted text -
 >> Stay informed about: Event ID 7031 - Service service terminated unexpectedly