Solved

Server 2003 TS Box - Blue Screen Error code 1000008e, parameter1 c0000005

Posted on 2010-11-30
2
1,398 Views
Last Modified: 2012-05-10
One of our terminal server boxes blue screened earlier today and we cannot figure out why.  The System logs do not show any relevant errors before the BSOD.  However, I have pasted the event log from the error notifications.  I have also attached the dmp file.


Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            11/30/2010
Time:            11:53:08 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Error code 1000008e, parameter1 c0000005, parameter2 bf8980f4, parameter3 91f06a6c, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 62 66 38 39 38 30 66 34   bf8980f4
0040: 2c 20 39 31 66 30 36 61   , 91f06a
0048: 36 63 2c 20 30 30 30 30   6c, 0000
0050: 30 30 30 30               0000    


Event Type:      Warning
Event Source:      USER32
Event Category:      None
Event ID:      1076
Date:            11/30/2010
Time:            11:52:09 AM
User:            FCSHARE001\edecker
Computer:      RDPSRVRSS18
Description:
The reason supplied by user FCSHARE001\edecker for the last unexpected shutdown of this computer is: System Failure: Stop error
 Reason Code: 0x805000f
 Bug ID:
 Bugcheck String: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)
 Comment: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08               ....    


If it is any help, we are getting application error events.  They are all similar to what is shown below with the only difference being the actual performance counter that cannot load.

Event Type:      Error
Event Source:      Enterprise Library Instrumentation
Event Category:      None
Event ID:      0
Date:            11/30/2010
Time:            11:56:03 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Failed to create instances of performance counter 'Total # of Cache Access Attempts' - The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly..

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Mini113010-01.dmp
0
Comment
Question by:z711500
2 Comments
 
LVL 62

Accepted Solution

by:
gheist earned 500 total points
ID: 34246529
It is most likely a driver problem. Win32k.sys is kernel part of win32 i.e layer that interacts between user mode and kernel drivers. There are recent exploits hitting this module
My guesses (since i do not see module versions on your system from minidump)
Mcafee needs superdat to get to engine 5400?
Chkdsk after installing latest NTFS driver http://support.microsoft.com/kb/981166/?
chkdsk /f c: or  fsutil dirty set c: after that?
0
 

Author Comment

by:z711500
ID: 34295439
I've applied the update provided and will continue to monitor this.

Thank you.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
In-place Upgrading Dirsync to Azure AD Connect
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question