System reboots with ‘Serious Error’
Home > IT Answers > Microsoft Windows > System reboots with 'Serious Error'
Lordhowe
105 pts.
0
Q:
System reboots with 'Serious Error'
Rebooting PC, Random reboots, Windows XP, Enterprise Desktop, Event ID 1003
A user I support is experiencing frequent system reboots each night. When he comes in in the morning, he receives a message stating that a 'Serious Error' has occurred.

There's a long string of info below, so I'll say thanks in advance for any help anyone can offer on the issue.

Lordhowe

Below are the details from his event log:

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/6/2009
Time: 8:40:42 AM
User: N/A
Computer: DLIEBSTERWK2
Description:
Error code 1000008e, parameter1 c0000047, parameter2 80521b10, parameter3 a561336c, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 38 1000008
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 63 30 eters c0
0030: 30 30 30 30 34 37 2c 20 000047,
0038: 38 30 35 32 31 62 31 30 80521b10
0040: 2c 20 61 35 36 31 33 33 , a56133
0048: 36 63 2c 20 30 30 30 30 6c, 0000
0050: 30 30 30 30 0000

I also took the details of his mini-dump files:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\jhowe\Desktop\Minidump\Dan Liebster\Mini060909-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.090206-1233
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Tue Jun 9 08:55:31.618 2009 (GMT-4)
System Uptime: 3 days 1:08:18.389
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.................
Unable to load image Crypto.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Crypto.sys
*** ERROR: Module load completed but symbols could not be loaded for Crypto.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000047, 80521b10, a57c3c90, 0}

*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for SPBBCDrv.sys
Probably caused by : Crypto.sys ( Crypto+1d0b5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000047, The exception code that was not handled
Arg2: 80521b10, The address that the exception occurred at
Arg3: a57c3c90, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000047 - An attempt was made to release a semaphore such that its maximum count would have been exceeded.

FAULTING_IP:
nt!KeReleaseSemaphore+3a
80521b10 e99c75fcff jmp nt!KeReleaseSemaphore+0x3a (804e90b1)

TRAP_FRAME: a57c3c90 -- (.trap 0xffffffffa57c3c90)
ESP EDITED! New esp=a57c4040
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=00000000 edx=00000000 esi=a7b0a778 edi=00000002
eip=80521b10 esp=a57c3d04 ebp=a57c4054 iopl=0 nv up ei pl zr na pe nc
cs=0000 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeReleaseSemaphore+0x3a:
80521b10 e99c75fcff jmp nt!KeReleaseSemaphore+0x3a (804e90b1)
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: BTSNTSvc.exe

LAST_CONTROL_TRANSFER: from a7aa60b5 to 80521b10

STACK_TEXT:
a57c4054 a7aa60b5 a7b0a778 00000000 00000001 nt!KeReleaseSemaphore+0x3a
WARNING: Stack unwind information not available. Following frames may be wrong.
a57c4080 a7aa5b4d a7b19f60 a57c4098 804dd99f Crypto+0x1d0b5
a57c408c 804dd99f 80001a44 a57c4188 804e3487 Crypto+0x1cb4d
a57c408c 804e3487 80001a44 a57c4188 804e3487 nt!KiFastCallEntry+0xfc
a57c4108 a9f0208b 80001a44 e5e199ac a57c43d4 nt!ZwClose+0x11
a57c4188 a9ecf3dc 000004e0 e1417500 e5e199ac SPBBCDrv+0x4908b
a57c41b4 a9ec85a4 e5e19984 a9ed6fda a9ed71c3 SPBBCDrv+0x163dc
a57c41d8 a9ed7603 a57c4308 00000005 0000000b SPBBCDrv+0xf5a4
a57c4208 a9ed72e8 a57c42fc e8537f28 00000000 SPBBCDrv+0x1e603
a57c4244 a9ec8335 00000002 a57c42fc e5e19820 SPBBCDrv+0x1e2e8
a57c42a4 a9ec970a a57c43d4 007c43a8 00000002 SPBBCDrv+0xf335
a57c4324 804dc605 00000005 a57c4358 e19db3ec SPBBCDrv+0x1070a
a57c4334 00000000 89d25ab0 a9ec2200 00000000 nt!ExReleaseResourceLite+0x8d


STACK_COMMAND: kb

FOLLOWUP_IP:
Crypto+1d0b5
a7aa60b5 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: Crypto+1d0b5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Crypto

IMAGE_NAME: Crypto.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42fcebd8

FAILURE_BUCKET_ID: 0x8E_Crypto+1d0b5

BUCKET_ID: 0x8E_Crypto+1d0b5

Followup: MachineOwner
ASKED: Jul 17 2009  2:26 AM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
Lusy
825 pts.
0
A:
 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0
  • AddThis Social Bookmark Button
Try to repair your windows OS files. Follow these steps:

> Insert you OS disk
> Now open Run
> Now Type the command sfc /scannow

This process will repair your whole windows files.

For more windows help please go through this link: www.iyogi.net
Last Answered: Jul 17 2009  4:59 AM GMT by Lusy   825 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Kelvinsw   265 pts.  |   Jul 17 2009  7:32AM GMT

When this problem started? Any new application/hardware being installed? Any Windows Updates?
Check RAM…Free Windows Memory Diagnostic can download from…
 <a href="http://oca.microsoft.com/en/windiag.asp" title="http://oca.microsoft.com/en/windiag.asp" target="_blank">http://oca.microsoft.com/en/windiag.asp</a>

Check inside the case, is CPU fan too dirty? overheat CPU cos all kind of strange error message too.

 

Schmidtw   10505 pts.  |   Jul 17 2009  3:43PM GMT

Check the Event Viewer for some more information.

Right click ‘My Computer’, select ‘Manage’.

Hope this helps!

-Schmidtw

 

Mshen   23535 pts.  |   Jul 17 2009  11:50PM GMT

Check for hardware problems. Run a RAM test and motherboard diagnostics.

 

KevinBeaver   7610 pts.  |   Jul 18 2009  11:59PM GMT

This sounds like a hardware or malware problem. Try changing the memory chips out and make sure it’s free of malware. Check out this malware removal handbook I wrote that can help you on this path. Best of luck!

 

Aerendyl   35 pts.  |   Jul 19 2009  7:29PM GMT

To test RAM i recommend to use memtest:

 

ITGuySFI   50 pts.  |   Jul 21 2009  4:09PM GMT

Although the symptoms do seem very hardware related, I would take a closer look at the dump you got and you will notice that the faulting process is something to do with BiZ talk server. That being the case, I assume the user has a connection to that server at some time or other. I would be looking in that direction. As for hardware, I would be suspicious of the power supply. I have had this type of issue before and new power supply resolved it.

These answers came from a quick Google on the process name shown in the dump. PROCESS_NAME: BTSNTSvc.exe. From the dump it looks like a command or something passed from the server was not understandable to the pc.

 

Lordhowe   105 pts.  |   Jul 22 2009  1:36PM GMT

Thanks for the replies. So far, I’ve run some detailed hardware and memory stress tests. All passed without an issue, so it’s not hardware related. It’s definitelty not malware.

ITguySFI, your answer seems to be most relevant so far.

 

Abushahd   1535 pts.  |   Jul 24 2009  3:53PM GMT

check please the following :

 <a href="http://www.eventid.net" title="http://www.eventid.
" target="_blank">www.eventid.net</a>

 
0