System reboots with ‘Serious Error’

175 pts.
Tags:
Enterprise Desktop
Event ID 1003
Random reboots
Rebooting PC
Windows XP
A user I support is experiencing frequent system reboots each night. When he comes in in the morning, he receives a message stating that a 'Serious Error' has occurred. There's a long string of info below, so I'll say thanks in advance for any help anyone can offer on the issue. Lordhowe Below are the details from his event log: Event Type: Error Event Source: System Error Event Category: (102) Event ID: 1003 Date: 6/6/2009 Time: 8:40:42 AM User: N/A Computer: DLIEBSTERWK2 Description: Error code 1000008e, parameter1 c0000047, parameter2 80521b10, parameter3 a561336c, parameter4 00000000. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 31 30 30 30 30 30 38 1000008 0020: 65 20 20 50 61 72 61 6d e Param 0028: 65 74 65 72 73 20 63 30 eters c0 0030: 30 30 30 30 34 37 2c 20 000047, 0038: 38 30 35 32 31 62 31 30 80521b10 0040: 2c 20 61 35 36 31 33 33 , a56133 0048: 36 63 2c 20 30 30 30 30 6c, 0000 0050: 30 30 30 30 0000 I also took the details of his mini-dump files: Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:Documents and SettingsjhoweDesktopMinidumpDan LiebsterMini060909-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Symbol search path is: SRV*C:symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.090206-1233 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0 Debug session time: Tue Jun 9 08:55:31.618 2009 (GMT-4) System Uptime: 3 days 1:08:18.389 Loading Kernel Symbols ............................................................... ................................................................ ......... Loading User Symbols Loading unloaded module list ................. Unable to load image Crypto.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for Crypto.sys *** ERROR: Module load completed but symbols could not be loaded for Crypto.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000047, 80521b10, a57c3c90, 0} *** WARNING: Unable to verify timestamp for SPBBCDrv.sys *** ERROR: Module load completed but symbols could not be loaded for SPBBCDrv.sys Probably caused by : Crypto.sys ( Crypto+1d0b5 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000047, The exception code that was not handled Arg2: 80521b10, The address that the exception occurred at Arg3: a57c3c90, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000047 - An attempt was made to release a semaphore such that its maximum count would have been exceeded. FAULTING_IP: nt!KeReleaseSemaphore+3a 80521b10 e99c75fcff jmp nt!KeReleaseSemaphore+0x3a (804e90b1) TRAP_FRAME: a57c3c90 -- (.trap 0xffffffffa57c3c90) ESP EDITED! New esp=a57c4040 ErrCode = 00000000 eax=00000000 ebx=00000001 ecx=00000000 edx=00000000 esi=a7b0a778 edi=00000002 eip=80521b10 esp=a57c3d04 ebp=a57c4054 iopl=0 nv up ei pl zr na pe nc cs=0000 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246 nt!KeReleaseSemaphore+0x3a: 80521b10 e99c75fcff jmp nt!KeReleaseSemaphore+0x3a (804e90b1) Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: BTSNTSvc.exe LAST_CONTROL_TRANSFER: from a7aa60b5 to 80521b10 STACK_TEXT: a57c4054 a7aa60b5 a7b0a778 00000000 00000001 nt!KeReleaseSemaphore+0x3a WARNING: Stack unwind information not available. Following frames may be wrong. a57c4080 a7aa5b4d a7b19f60 a57c4098 804dd99f Crypto+0x1d0b5 a57c408c 804dd99f 80001a44 a57c4188 804e3487 Crypto+0x1cb4d a57c408c 804e3487 80001a44 a57c4188 804e3487 nt!KiFastCallEntry+0xfc a57c4108 a9f0208b 80001a44 e5e199ac a57c43d4 nt!ZwClose+0x11 a57c4188 a9ecf3dc 000004e0 e1417500 e5e199ac SPBBCDrv+0x4908b a57c41b4 a9ec85a4 e5e19984 a9ed6fda a9ed71c3 SPBBCDrv+0x163dc a57c41d8 a9ed7603 a57c4308 00000005 0000000b SPBBCDrv+0xf5a4 a57c4208 a9ed72e8 a57c42fc e8537f28 00000000 SPBBCDrv+0x1e603 a57c4244 a9ec8335 00000002 a57c42fc e5e19820 SPBBCDrv+0x1e2e8 a57c42a4 a9ec970a a57c43d4 007c43a8 00000002 SPBBCDrv+0xf335 a57c4324 804dc605 00000005 a57c4358 e19db3ec SPBBCDrv+0x1070a a57c4334 00000000 89d25ab0 a9ec2200 00000000 nt!ExReleaseResourceLite+0x8d STACK_COMMAND: kb FOLLOWUP_IP: Crypto+1d0b5 a7aa60b5 ?? ??? SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: Crypto+1d0b5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Crypto IMAGE_NAME: Crypto.sys DEBUG_FLR_IMAGE_TIMESTAMP: 42fcebd8 FAILURE_BUCKET_ID: 0x8E_Crypto+1d0b5 BUCKET_ID: 0x8E_Crypto+1d0b5 Followup: MachineOwner

Answer Wiki

Thanks. We'll let you know when a new response is added.

Try to repair your windows OS files. Follow these steps:

> Insert you OS disk
> Now open Run
> Now Type the command sfc /scannow

This process will repair your whole windows files.

For more windows help please go through this link: www.iyogi.net

Discuss This Question: 8  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Kelvinsw
    When this problem started? Any new application/hardware being installed? Any Windows Updates? Check RAM...Free Windows Memory Diagnostic can download from... http://oca.microsoft.com/en/windiag.asp Check inside the case, is CPU fan too dirty? overheat CPU cos all kind of strange error message too.
    275 pointsBadges:
    report
  • Schmidtw
    Check the Event Viewer for some more information. Right click 'My Computer', select 'Manage'. Hope this helps! -Schmidtw
    11,330 pointsBadges:
    report
  • mshen
    Check for hardware problems. Run a RAM test and motherboard diagnostics.
    27,385 pointsBadges:
    report
  • Kevin Beaver
    This sounds like a hardware or malware problem. Try changing the memory chips out and make sure it's free of malware. Check out this malware removal handbook I wrote that can help you on this path. Best of luck!
    16,470 pointsBadges:
    report
  • Aerendyl
    To test RAM i recommend to use memtest: http://hcidesign.com/memtest/
    35 pointsBadges:
    report
  • ITGuySFI
    Although the symptoms do seem very hardware related, I would take a closer look at the dump you got and you will notice that the faulting process is something to do with BiZ talk server. That being the case, I assume the user has a connection to that server at some time or other. I would be looking in that direction. As for hardware, I would be suspicious of the power supply. I have had this type of issue before and new power supply resolved it. These answers came from a quick Google on the process name shown in the dump. PROCESS_NAME: BTSNTSvc.exe. From the dump it looks like a command or something passed from the server was not understandable to the pc.
    50 pointsBadges:
    report
  • Lordhowe
    Thanks for the replies. So far, I've run some detailed hardware and memory stress tests. All passed without an issue, so it's not hardware related. It's definitelty not malware. ITguySFI, your answer seems to be most relevant so far.
    175 pointsBadges:
    report
  • Abushahd
    check please the following : www.eventid.net
    3,620 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following