Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1410
  • Last Modified:

Server 2003 TS Box - Blue Screen Error code 1000008e, parameter1 c0000005

One of our terminal server boxes blue screened earlier today and we cannot figure out why.  The System logs do not show any relevant errors before the BSOD.  However, I have pasted the event log from the error notifications.  I have also attached the dmp file.


Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            11/30/2010
Time:            11:53:08 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Error code 1000008e, parameter1 c0000005, parameter2 bf8980f4, parameter3 91f06a6c, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 62 66 38 39 38 30 66 34   bf8980f4
0040: 2c 20 39 31 66 30 36 61   , 91f06a
0048: 36 63 2c 20 30 30 30 30   6c, 0000
0050: 30 30 30 30               0000    


Event Type:      Warning
Event Source:      USER32
Event Category:      None
Event ID:      1076
Date:            11/30/2010
Time:            11:52:09 AM
User:            FCSHARE001\edecker
Computer:      RDPSRVRSS18
Description:
The reason supplied by user FCSHARE001\edecker for the last unexpected shutdown of this computer is: System Failure: Stop error
 Reason Code: 0x805000f
 Bug ID:
 Bugcheck String: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)
 Comment: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08               ....    


If it is any help, we are getting application error events.  They are all similar to what is shown below with the only difference being the actual performance counter that cannot load.

Event Type:      Error
Event Source:      Enterprise Library Instrumentation
Event Category:      None
Event ID:      0
Date:            11/30/2010
Time:            11:56:03 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Failed to create instances of performance counter 'Total # of Cache Access Attempts' - The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly..

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Mini113010-01.dmp
0
z711500
Asked:
z711500
1 Solution
 
gheistCommented:
It is most likely a driver problem. Win32k.sys is kernel part of win32 i.e layer that interacts between user mode and kernel drivers. There are recent exploits hitting this module
My guesses (since i do not see module versions on your system from minidump)
Mcafee needs superdat to get to engine 5400?
Chkdsk after installing latest NTFS driver http://support.microsoft.com/kb/981166/?
chkdsk /f c: or  fsutil dirty set c: after that?
0
 
z711500Author Commented:
I've applied the update provided and will continue to monitor this.

Thank you.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now