Re: firewall service crash due to ntdll.dll

We have also the same error on our ISA 2004 Array with TM Webprotect 5.x
installed..

Errors:
------------------------
Type: Error
Source: Microsoft Firewall
Event ID: 14057
Event Time: 10/23/2006 12:43:30 PM
User: n/a
Computer: FISA03N1
Description:
The Firewall service stopped because an application filter module
C:\WINDOWS\system32\ntdll.dll generated an exception code C0000005 in address
7C83002E when function CompleteAsyncIO was called. To resolve this error,
remove recently installed application filters and restart the service.
----------------
and
----------------
Faulting application wspsrv.exe, version 4.0.3443.610, stamp 442d35a4,
faulting module ntdll.dll, version 5.2.3790.1830, stamp 424377d2, debug? 0,
fault address 0x0003002e.
----------------
and
----------------

Network Load Balancing on the local computer will be stopped because the
Firewall service stopped responding.
----------------

Do you have any news about this Problem ?
Whe have disabled the Webprotect Filter temp. and the problem stops.

Thank you for your help

Atel

"Phillip Windell" wrote:

The focus is not the ntdll.dll file. That file is the "victem" of the
problem, not the cause of the problem. That is an OS System DLL file not an
ISA file.

You may have to call MS support.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those of
my employer or anyone else associated with me.
-----------------------------------------------------


"paul" <paul@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:06FA55B9-F9CD-40E5-BB2A-51F28CE4B2DB@xxxxxxxxxxxxxxxx
i installed the HTTP fix last week, did not help.
i also got the 923767 hotfix from MS, but it specifies the w3filter.dll
and
our issue is with the ntdll.dll file. I have not installed that hotfix
yet.

thanks.
paul

"Phillip Windell" wrote:

Ah, yes. That is the patch that was produced to fix all the things
screwed
up by the ISA SP2.

Update for HTTP issues in Internet Security and Acceleration Server 2004
Service Pack 2
http://support.microsoft.com/kb/916106/

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not those
of
my employer or anyone else associated with me.
-----------------------------------------------------


<ayarasan@xxxxxxxxx> wrote in message
news:1161441685.569311.220150@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

We had a similar case with ISA 2004 enterprise server SP2,

filter module C:\Program Files\Microsoft ISA Server\w3filter.dll
generated an exception code C0000005 in address 6472D8AE when function
CompleteAsyncIO was called

and we've solved the case by deploying kb916106. First we suspected the
webprotect filter running on ISA and disabled the filter but eventually
this was the hotfix that solved the problem.

Phillip Windell yazdi:
The C0000005 seems familiar to me from the old Proxy2 days, but I
can't
remember any specifics. These types problems can be really tough to
figure
with newsgroup messages. Not saying that someone here might not have
an
idea,...I'm just saying don't hesitate to call MS support on this one
if
it
comes to that. If problems stem from security updates or Service
Packs
the
call is free.

1-800-936-4900


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed are my own (as annoying as they are), and not
those
of
my employer or anyone else associated with me.
-----------------------------------------------------




"paul" <paul@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:73022AA5-290C-4885-9489-5D99863355E0@xxxxxxxxxxxxxxxx
ISA 2004 Standard SP2 + hotfixes running on Server
2003 Standard SP2 has had its firewall service crash twice in the
last
two
days with the following error messages:

"event code 1000
Faulting application wspsrv.exe, version 4.0.2165.617, stamp
448687eb,
faulting module ntdll.dll, version 5.2.3790.1830, stamp 424377d2,
debug?
0,
fault address 0x0002f583."

and,
Event ID: 14057
The Firewall service stopped because an application filter module
C:\WINDOWS\system32\ntdll.dll generated an exception code C0000005
in
address
7C830115 when function CompleteAsyncIO was called. To resolve this
error,
remove recently installed application filters and restart the
service.

There have been no recent changes except the installation of SP2 in
july,
the recent http support update, and more recent win2003 updates done
oct
18.

If anyone is having this issue, it would be appreciated if they
could
shed
any light on what they've been able to find out.

Thanks.








.

Relevant Pages

  • Re: firewall service crash due to ntdll.dll
    ... our firewall has no additional applications installed, it's very basic, smtp, ... Whe have disabled the Webprotect Filter temp. ... ISA file. ... There have been no recent changes except the installation of SP2 in ...
    (microsoft.public.isa)
  • Re: isa 2004 SP2 failed to install!!!
    ... Is SNMP service running on your ISA computer? ... I've fixed the server now but I'm going to leave it a few weeks before I ... I'll try the installation again later this week, ... But finally this filter doesn't works, ...
    (microsoft.public.isa)
  • Re: isa 2004 SP2 failed to install!!!
    ... I'll try an installation with the MOM agent and SNMP services stopped. ... Is SNMP service running on your ISA computer? ... I've fixed the server now but I'm going to leave it a few weeks before I ... But finally this filter doesn't works, ...
    (microsoft.public.isa)
  • Re: isa 2004 SP2 failed to install!!!
    ... I do the job with a domain admin account. ... I'll try the installation again later this week, ... A remember I have tried to install an ISA filter in the past. ... But finally this filter doesn't works, ...
    (microsoft.public.isa)
  • RE: SBS 2003 and ISA content types running slow
    ... types filter and extension filter and the Internet access slow. ... Open ISA 2004 console, extend Monitoring, click Dashboard tap in middle ... Please follow the link and download and run the Microsoft Internet ... Clear the current existing W3C logs. ...
    (microsoft.public.windows.server.sbs)