can not start sql server2012.the request failed or ther service did not respond in a timely fashion.

Han Yang 0

This error will be reported after starting sql server 2012, check the log，Please refer to the following picture to view the log. How to solve it?

The description for Event ID 17836 from source MSSQL$MSSQL2012 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

[CLIENT: ]

The message resource is present but the message was not found in the message table

The description for Event ID 18456 from source MSSQL$MSSQL2012 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Reason: Password did not match that for the login provided.

[CLIENT: ]

The message resource is present but the message was not found in the message table

User's image

Erland Sommarskog 102.3K Reputation points

2024-05-11T08:35:04.5133333+00:00

The eventlog shows errors that occurred in April. Are you asking about a problem you had back then?

Furthermore the message in the last screenshot relates to a login failure in SQL Server, which means that SQL Server was running at the time. (And this message was produced before the other screenshot, which also appears to be a login failure.)

Or are you still having the problem that SQL Server does not start? First check the SQL Server errorlog, which may be in C:\Program Files\Microsoft SQL Server\MSSQL$MSSQL2012\MSSQL\LOG\ERRORLOG. I say "may", because that would be the default location, but your setup may be different.

When you attempt to start SQL Server, do the file get a new date? If so, the errorlog should tell you why SQL Server does not start. Feel free to attach it here, if you can make anything out of it. You will need to rename the file to ERRORLOG.txt to be able to attach it here.
Han Yang 0 Reputation points

2024-05-11T15:41:18.7766667+00:00

Thank you for your reply. only has one .txt. said stopped
Erland Sommarskog 102.3K Reputation points

2024-05-11T17:38:01.18+00:00

It's difficult to understand when I only see fragments of the file. And why does everything have Arthur at the end?

Can you please do this? Attempt to start SQL Server from the SQL Server Configuration Manager and then rename C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQL2012\MSSQL\LOG\ERRORLOG to ERRORLOG.txt and attach it here?
Han Yang 0 Reputation points

2024-05-12T15:54:53.1766667+00:00

Here is the fdlaunch error log

2024-04-11 03:33:02.664 MSSQLFDLauncher$MSSQL2012 service successfully started.

2024-04-11 03:33:03.726 MSSQLFDLauncher$MSSQL2012 service received control message.

2024-04-11 03:33:03.867 MSSQLFDLauncher$MSSQL2012 service successfully launched FDHost.exe Process(process id = 3824).

2024-05-07 15:50:03.041 MSSQLFDLauncher$MSSQL2012 service stopped.

I was try to start the sql server,it is not working ,and I can not get errorlog.
Han Yang 0 Reputation points

2024-05-12T15:55:43.1566667+00:00

When you have time?can we make a zoom meeting?
Erland Sommarskog 102.3K Reputation points

2024-05-12T16:05:51.4566667+00:00

FDLauncher is not of interest here. You did try starting the service SQL Server (MSSQL2012), didn't you?

Assuming that you did, you did not get any errorlog file. This means that SQL Server did not start and then stopped. SSCM is not able to start it at all.

Can you check the Windows event log to see it there are any messages related to the start attempt?

And can you explain all these .ARTHUR extensions? Where do they come from? They are not normal? Do you have these in other SQL Server folders as well?

When you have time?can we make a zoom meeting?

This is a peer-to-peer forum where people answer questions in their free time. You cannot expect people to devote time for a zoom meeting with you.
Han Yang 0 Reputation points

2024-05-13T03:30:25.3933333+00:00

Thank you for your support!!

When starting sql server, the following situations occur:

1.Application popup: SQL Server : Your SQL Server installation is either corrupt or has been tampered with (Could not open default language SQLEVN70 resource file). Please uninstall then re-run setup to correct this problem

2.error:The SQL Server (MSSQL2012) service terminated unexpectedly. It has done this 9 time(s).

3.The Software Protection service entered the running state.

4.The Software Protection service entered the stopped state.

Where can I find the error log? I don’t see any relevant errors.

I don’t know what extension .ARTHUR is. There are many files in the log.
Erland Sommarskog 102.3K Reputation points

2024-05-13T06:39:15.02+00:00

In Windows Explorer, go to the Folder C:\Program Files\Micorsoft SQL Server. In the search bar enter SQLEVN70. Show us what it finds.
Han Yang 0 Reputation points

2024-05-13T07:11:29.2366667+00:00

all the .ARTHUR

2 answers

LucyChenMSFT-4874 1,280 Reputation points

2024-05-13T06:20:27.6433333+00:00
Hi @Han Yang,

Thanks for your information. Below is a list of reasons this issue:

sa Reason: Password did not match that for the login provided.

Please ensure SQL Authentication is enabled.

This user ID hasn’t been granted access on the server.

Wrong password or just a typo.

The user ID might be disabled on the server

In addition, here is a known issue like yours, it provides detailed solutions to resolve the issue, hope this can help you well.

Note: We cannot rely on old threads completely. The above article can only be used as a reference. Thanks for your understanding, we are looking forward to hearing from you to assist further.

For this issue:

Application popup: SQL Server: Your SQL Server installation is either corrupt or has been tampered with (Could not open default language SQLEVN70 resource file). Please uninstall then re-run setup to correct this problem

Can you find the SQLEVEN70 file in path? You can copy and paste all the file from another machine which was having same patch level.

Best regards,

Lucy Chen

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our Documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

https://docs.microsoft.com/en-us/answers/support/email-notifications
Please sign in to rate this answer.
Han Yang 0 Reputation points

2024-05-13T07:17:54.4666667+00:00

The username and password have not been changed. Does this mean that it has been attacked?

Where can I find the SQLEVEN70 file for repair?

Thank you Lucy!

LucyChenMSFT-4874 1,280 Reputation points

2024-05-13T08:35:44.33+00:00

Hi @Han Yang,

Thanks for your kindly feedback.

I've checked the message you provided for Erland about SQLEVEN70, for the issue, could you please verify “View Installed Updates” under Control Panel -> Programs -> Programs and Features -> Installed Updates to tell us updates that got installed recently?

For this issue:

error: The SQL Server (MSSQL2012) service terminated unexpectedly. It has done this 9 time(s).

I've found the official document, and it tells us the issue was fixed in the latest cumulative update of SQL Server.

The next issue:

The Software Protection service entered the stopped state.

I notice that you are using the SQL Server 2012, and this is a known issue. Hope this can help you well.

Regards,

Lucy Chen

Erland Sommarskog 102.3K Reputation points

2024-05-13T09:21:12.26+00:00

Lucy, why do you believe that the KB article you linked has anything to do with the problems that Han are facing? It is quite clear that Han's machine has been hacked, and it has nothing to do with KB articles. Please don't confuse Han further!

LucyChenMSFT-4874 1,280 Reputation points

2024-05-13T09:32:22.8066667+00:00

I feel sorry to confuse Han.

I don't know enough about what will happen if the machine is hacked. It seems that I need to learn more.

Finally, I apologize again for confusing Han.
Sign in to comment
Erland Sommarskog 102.3K Reputation points

2024-05-13T09:19:23.3+00:00

It seems that your machine has been attacked in some way. Maybe be an outside intruder. Maybe a colleague that has been pulling your legs. (By chance, do you know any Arthur?)

The first thing is to remove all these Arthur extensions. If you are lucky, all that has happened that the files have been renamed. But if it's a ransomware attack, this is not where it stops.

To rename all these files, google for Bulk Rename Utility. It can help you rename the files at scale.

Of course, if you have a backup taken before the attack, that helps a lot!
Please sign in to rate this answer.
Han Yang 0 Reputation points

2024-05-13T09:47:57.11+00:00

I made a backup, but the correct backup was wiped.I haven’t seen the ransomware interface yet. How can I modify these file names? I have tried modifying them, but after opening the document, it is still garbled.

Erland Sommarskog 102.3K Reputation points

2024-05-13T10:46:44.9066667+00:00

To rename a single file. select the file in Explorer and press F2. To rename files at scale, Bulk Rename Utility can help you.

But if the attacker also garbled or encrypted the file, that is not going to help much.

You may want to find some computer-savvy in your vicinity that can help you.

Han Yang 0 Reputation points

2024-05-13T12:02:46.5433333+00:00

All of your files are encrypted, but don't worry; you can still retrieve them all.

We understand the importance of the this situation and are committed to providing a solution as soon as possible.

We have also collected private and highly sensitive data from your servers.

This information is now kept on our private servers.

Once the payment has been received, these servers will be instantly deleted.

Our top priority is to protect the reputation of your company and make sure that none of your data are compromised or leaked.

To begin the decryption procedure and retrieve your files,

Please contact us at this email address and submit the Device ID:

Device ID: 203F950DFE8426AF

Arthur@mailum.com

Please do not be shy and contact us directly. It's just business for us,

we are always ready for pleasant and mutually productive communication, and possibly a good discount.

Once you make the payment, we will provide you the decryption software and remove all of your data.

In case you don't pay, we auction off your files to potential buyers on a number of DarkNet websites.

Following that, we use email and any other contacts of your clients to inform them of what happened;

Possibly they will be interested in buying your data individually.

Data leaks are a serious violation of the law.

However if you pay, this incident will be kept private, and the data will be preserved.

What guarantee is there?

To test our ability to return files, send us two unimportant random small files in any format.

We will decrypt them and give them back to you for free.

That is what we guarantee.

We have no political aims and are not attempting to damage your reputation.

This is our business.The only things that matter to us are money and our reputation.

We target companies worldwide, excluding hospitals and medical care facilities, which are our red lines.

Our ransomware is the only one in the world that does not destroy files.

A feature lacking in other ransomwares, even the most well-known ones.

Using third-party software to restore your files will result in permanent file corruption. Take a backup before proceeding with them.

Discovered the blackmail situation.

How should this situation be handled?

Erland Sommarskog 102.3K Reputation points

2024-05-13T12:54:55.98+00:00

My personal preference is: give these bastards the finger and don't pay. But I don't know how dear the data is to you.

And for the future: install better production against attacks like these. Don't expose things on the internet if you don't have to.

Han Yang 0 Reputation points

2024-05-13T14:58:47.8866667+00:00

It is possible that these data are no longer usable. I believe they won't recover the data even if you pay them. Does Microsoft have any related products that can resist it?

Erland Sommarskog 102.3K Reputation points

2024-05-13T21:05:52.08+00:00

So to cut it short: I think that in the realm of the SQL Server tag, this question is resolved. You cannot start SQL Server because your machine is vicitim to a ransomware attack. How to recover from the ransomware attack is out of scope for this tag, but I can leave some tips.

If you are that lucky that they left the MDF files unmolested, you can get your data back, but I would not count on.

Backup the disk(s) you have to an external disk. Then reformat the disk and reinstall everything from scratch. (Or may be it's time for a new computer anyway.)

For more advice on how to recover from the attack, other tags here in Microsoft Q&A may be better.

Han Yang 0 Reputation points

2024-05-15T06:13:17.54+00:00

Thank you Erland,Where can I find the log of files being copied remotely?

Han Yang 0 Reputation points

2024-05-15T07:23:16.2866667+00:00

Thank you Erland, Which log can I check to know that the file was copied remotely?

Erland Sommarskog 102.3K Reputation points

2024-05-15T11:05:37.2333333+00:00

There is no reason to expect that such a log exists.

LucyChenMSFT-4874 1,280 Reputation points

2024-05-23T07:15:26.1733333+00:00

Hi @Han Yang,

Is this issue solved now? If you have any questions, please feel free to share with us.

And don't forget to accept the Erland's answer if it helped.

Your action would be helpful to other users who encounter the same issue and read this thread.

Thanks for your understanding!

Regards,

Lucy Chen
Sign in to comment

Share via

can not start sql server2012.the request failed or ther service did not respond in a timely fashion.

2 answers