Re: Server randomly rebooting due to bugcheck



Dave,

I didn't do the !analyze -v but I will try it on the next dump.

We are running ESET NOD32, not Symantec on the server so it may not be that
but I will search the ESET forums for anything helpful.

Thanks,
Andy.

"Dave Nickason [SBS MVP]" wrote:

Andy - when you followed the debugging steps from Peter's blog, did you go
down to the bottom and do the "!analyze -v" part? If not, try that and see
if you get any more useful information. FYI, there are a couple of google
results for that reason code pointing to Symantec AV.


"Andy Desborough" <AndyDesborough@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:506ED1C3-272F-4239-8AC1-CC9656A7B4FE@xxxxxxxxxxxxxxxx
Hi there,

I have a SBS2003 SP1 server which reboots at various times of day and
shows
this entry in the event log:

The reason supplied by user xxxxx\Administrator for the last unexpected
shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x000000f4 (0x00000003, 0x89f041f0, 0x89f04354,
0x8094b734)
Comment: 0x000000f4 (0x00000003, 0x89f041f0, 0x89f04354, 0x8094b734)

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

To my knowledge nothing has changed in the time it has been happening.
Sometimes it also BSOD's when rebooting with an error:

"Process thread crucial to system operation has unexpectedly exited or
been
terminated - restart your computer again & if this message appears again
contact your support company"

I have run the Microsoft debugger tool as detailed on Petergal's SBS blog
which produced the following output:

Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is:
SRV*e:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free
x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer
SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Jun 23 07:34:09.455 2006 (GMT+1)
System Uptime: 0 days 0:06:25.644
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 89f041f0, 89f04354, 8094b734}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Loading unloaded module list
....
1: kd> .reload
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Loading unloaded module list
....

So then I searched around for the csrss.exe which I find "Csrss.exe is a
Microsoft client server runtime which generates worker threads for client
requests" and some references to virus/trojan activity but a virus scan on
the file comes up clean.

Any suggestions please?

TIA
Andy.



.



Relevant Pages

  • Please help with this dump
    ... The dump analysis is pasted below.. ... Loading Kernel Symbols ... Use!analyze -v to get detailed debugging information. ...
    (microsoft.public.windows.server.networking)
  • Re: Server randomly rebooting due to bugcheck
    ... So it always fails for the same reason or is it more random ... Has anything been done to the server lately - new HW, patches, updates? ... Loading Kernel Symbols ...
    (microsoft.public.windows.server.sbs)
  • Windows 2003 server keeps rebooting
    ... My 2003 Server keeps rebooting occasionally. ... Product: Server, suite: Enterprise TerminalServer SingleUserTS ... Loading Kernel Symbols ...
    (microsoft.public.win32.programmer.kernel)
  • XP Memory Dump
    ... then the network driver e100?.sys now on NTOSKRNL.EXE the latest dump is ... Executable search path is: ... Loading Kernel Symbols ...
    (microsoft.public.windowsxp.general)
  • Re: Bug check: 0x000000d1 (0x77f68b33, 0x000000ff, 0x00000000, 0x77f68b33)
    ... I don't think you could post the full dump ... --Jonathan Maltz [Microsoft MVP - Windows Server, ... >>> Loading Kernel Symbols ...
    (microsoft.public.windows.server.general)