It keeps rebooting with error: Event Type: Warning Event Source: USER32 Event Category: None Event ID: 1076 Date: 16.5.2011 Time: 7:33:02 User: administrator Computer: STH Description: The reason supplied by user Administrator for the last unexpected shutdown of this computer is: System Failure: Stop error Reason Code: 0x805000f Bug ID: test Bugcheck String: 0x00000000 (0x00000000, 0x00000000, 0x00000000, 0x00000000) Comment: 0x00000000 (0x00000000, 0x00000000, 0x00000000, 0x00000000) I have googled bunch of pages but haven't find a solution. Can anyone help me with this?

Hello, what have you changed before, new hard/software, drivers etc.? Please provide the minidump as shown in the following thread: http://social.technet.microsoft.com/Forums/en/winserverTS/thread/e26d568f-7258-4427-9074-14e874cdad43 Also see: http://www.eventid.net/display.asp?eventid=1076&eventno=3664&source=USER32&phase=1Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Greetings! I thought it may be related with updating Mcafee Virusscan 8.7i with patch 5, but that does not make any sense, cause we have some other 2003 servers and not with this problem. I checked the power suplly, (server has two power supplies) and both look fine. This evening I will do memtest. About, creating Dr. Watson mini dump. What is the default folder of already created Dr watson log files? Cause I have ran drwtsn32 and change Log file path, crash dump folder an clicked Ok, hoping I will get some log files created, but it does not do anything (probably it will create some log files, the next time that error appears?). I have also loked in map \Documents and Settings\All Users.WINNT\Application Data\Microsoft\ but there is no Dr Watson folder.bostjanc

Well... error just appeared (server rebooted himself) ... i have setup a new folder where i want to get log file path, crash dump of dr watson, but why is FOLDER is empty??? Event Type: Warning Event Source: USER32 Event Category: None Event ID: 1076 Date: 17.5.2011 Time: 13:46:01 User: DOMAIN\USER Computer: SERVER Description: The reason supplied by user DOMAIN\USER for the last unexpected shutdown of this computer is: Other (Unplanned) Reason Code: 0xa000000 Bug ID: Bugcheck String: 0x00000000 (0x00000000, 0x00000000, 0x00000000, 0x00000000) Comment: 0x00000000 (0x00000000, 0x00000000, 0x00000000, 0x00000000) For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 00 0a .... bostjanc

Hi, As you suspect Mcafee Virusscan 8.7i patch 5, did the issue occur after installing the Mcafee patch? Except the rebooting and the Warning in Event Log, did you receive any errors? Please choose Disable automatic restart when system failure under Control Panel, System, Advance tab, Startup and Recovery Settings. If any error is showed, please let us know. Please check the memory dump files for further troubleshooting. For more information, please refer to the following article: How to read the small memory dump files that Windows creates for debugging http://support.microsoft.com/kb/315263 If anything is unclear, please let us know. If no error is found or no clues, please check whether the system restart automatically in Safe Mode. Thanks. NinaPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Today server rebooted again (just a few minutes ago). At restart it said this error mesage: 0x100000c5 (0x00000044, 0xd0000002, 0x00000001, 0x808933b7) Before the reboot happened I have followed your instructions and disabled the automatically restart but server has rebooted anyway. I have a dmp file but I have a trouble of installing sdk on client computer (win7 x86). I have downloaded installation from this link: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6b6c21d2-2006-4afa-9702-529fa782d63b&displaylang=en I have .net 4 installed. If choose the installation to install only: Common Utilities/Debugging tools for windows Redistributable packages/Debugging tools and unmark everything else, the installion freezes saying: "Preparing", the hole time.bostjanc

Hello, Please use Microsoft Skydrive to upload dump files (c:\windows\minidumps) and post a link here. I will analyze them for you. You can also contact Microsoft CSS. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Greetings! Is there a way that I can deliver this file only to you. cause this is our development server and the data are sensitive.bostjanc

Don't worry as there is no confidential data that can be retrieved from a dump file. It is just a file that allow to me to determine the cause of your problem (driver, hardware, kernel ...). So, you can upload it and post a link here without any worry about the data sensitivity. This is an example of the output of the debugger: http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/dcc58259-70e1-4b5b-8280-8ba6c3c059d0 This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

http://cid-f2036d479ec1756d.office.live.com/self.aspx/.Documents/Mini051811-01.dmp bostjanc can you confirm that you have download it?

******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is caused by drivers that have corrupted the system pool. Run the driver verifier against any new (or suspect) drivers, and if that doesn't turn up the culprit, then use gflags to enable special pool. Arguments: Arg1: 00000044, memory referenced Arg2: d0000002, IRQL Arg3: 00000001, value 0 = read operation, 1 = write operation Arg4: 808933b7, address which referenced memory Debugging Details: ------------------ BUGCHECK_STR: 0xC5_D0000002 CURRENT_IRQL: 2 FAULTING_IP: nt!ExAllocatePoolWithTag+83f 808933b7 897004 mov dword ptr [eax+4],esi CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: javaw.exe LAST_CONTROL_TRANSFER: from bad61636 to 808933b7 STACK_TEXT: b46783d0 bad61636 00000010 00000000 7346744e nt!ExAllocatePoolWithTag+0x83f b4678460 bad512fe b467877c a500c6e8 0004c6c4 Ntfs!NtfsCreateFcb+0x1a5 b4678538 bad4f0b9 b467877c a2aee698 a2aee828 Ntfs!NtfsOpenFile+0xf8 b467875c bad68aa3 b467877c a2aee698 b46788a4 Ntfs!NtfsCommonCreate+0x127e b4678928 f72b8e0c a2aee698 b4678bfc a500c608 Ntfs!NtfsNetworkOpenCreate+0x96 WARNING: Stack unwind information not available. Following frames may be wrong. b4678940 bae42d72 a533c008 a2aee698 b4678bfc sptd+0x32e0c b4678964 bae50abd 000000f2 00000000 b467899c fltmgr!FltpPerformFastIoCall+0x300 b46789bc bac8e5b8 a2aee698 b4678bfc a500e260 fltmgr!FltpFastIoQueryOpen+0xa1 b4678a04 808f8f2f a2aee698 b4678bfc a4ffc780 mfehidk+0x265b8 b4678af8 80937a40 a5282bc8 00000000 a300fa00 nt!IopParseDevice+0x917 b4678b78 80933b74 00000000 b4678bb8 00000040 nt!ObpLookupObjectName+0x5b0 b4678bcc 808ec9e2 00000000 00000000 a3687a01 nt!ObOpenObjectByName+0xea b4678d54 808897ec 009bf97c 009bf944 009bf9ac nt!NtQueryFullAttributesFile+0x152 b4678d54 7c82847c 009bf97c 009bf944 009bf9ac nt!KiFastCallEntry+0xfc 009bf9ac 00000000 00000000 00000000 00000000 0x7c82847c STACK_COMMAND: kb FOLLOWUP_IP: sptd+32e0c f72b8e0c ?? ??? SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: sptd+32e0c FOLLOWUP_NAME: MachineOwner MODULE_NAME: sptd IMAGE_NAME: sptd.sys DEBUG_FLR_IMAGE_TIMESTAMP: 47cf3bb9 FAILURE_BUCKET_ID: 0xC5_D0000002_sptd+32e0c BUCKET_ID: 0xC5_D0000002_sptd+32e0c Followup: MachineOwner --------- 7: kd> lmvm sptd start end module name f7286000 f7386000 sptd T (no symbols) Loaded symbol image file: sptd.sys Image path: sptd.sys Image name: sptd.sys Timestamp: Thu Mar 06 01:32:57 2008 (47CF3BB9) CheckSum: 000B4211 ImageSize: 00100000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 ________________________________________________________________________ Your BSOD was caused by sptd.sys driver or another driver. To determine the exact driver, you have to use Driver Verifier. Based on internet searches I have not found to which application this driver (sptd.sys) belongs. Have a look to that: http://www.computing.net/answers/windows-xp/what-is-sptdsys-/156322.html It should be one of your installed applications that is causing the issue. I see that the driver had not been updated since 2008. So, you have to determine which application is using this driver and then contact its vendor Technical Support. It is possible that this is due to a malware program. Please perform a full scan on your disks to make sure that all is okay. If this does not help then please update all possible drivers and check again. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Mr X... Thank you for your reply and help. Let me say I have also contacted MS support as we are gold partner, but they said to me I had to wait for 1 day. I was very dissappointed but very happy for this forum helping to solve our problem. I have uninstalled programs daemon tools and magicdisc (which are both sw for cloning virtual drives). I have also deleted sptd.sys file from c:\windows\system32\drivers... Now i will be watchin if the server is rebooting again. If it will not reboot in next 7 days you can cloose this thread. Once again thanks, I ow you a beer, soo if you will be in Slovenia nudge me. with best regards,bostjanc

Somehow it looks like that sptd.sys was not the only program. We are using clearcase on this server and Virusscan 8.7i patch 5. it looks like that virusscan caused the BSOD. We have upgraded virusscan on version 8.8. Until now, rebot has not repeated yet.bostjanc

It will be better to update all possible drivers / firmwares / BIOS so that you avoid BSODs because I saw drivers that have not been updated since a long time. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Updating Mcafee Virusscan to version 8.8 solved the issue.bostjanc