Solved

Server 2003 TS Box - Blue Screen Error code 1000008e, parameter1 c0000005

Posted on 2010-11-30
2
1,399 Views
Last Modified: 2012-05-10
One of our terminal server boxes blue screened earlier today and we cannot figure out why.  The System logs do not show any relevant errors before the BSOD.  However, I have pasted the event log from the error notifications.  I have also attached the dmp file.


Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            11/30/2010
Time:            11:53:08 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Error code 1000008e, parameter1 c0000005, parameter2 bf8980f4, parameter3 91f06a6c, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 62 66 38 39 38 30 66 34   bf8980f4
0040: 2c 20 39 31 66 30 36 61   , 91f06a
0048: 36 63 2c 20 30 30 30 30   6c, 0000
0050: 30 30 30 30               0000    


Event Type:      Warning
Event Source:      USER32
Event Category:      None
Event ID:      1076
Date:            11/30/2010
Time:            11:52:09 AM
User:            FCSHARE001\edecker
Computer:      RDPSRVRSS18
Description:
The reason supplied by user FCSHARE001\edecker for the last unexpected shutdown of this computer is: System Failure: Stop error
 Reason Code: 0x805000f
 Bug ID:
 Bugcheck String: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)
 Comment: 0x0000008e (0xc0000005, 0xbf8980f4, 0x91f06a6c, 0x00000000)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08               ....    


If it is any help, we are getting application error events.  They are all similar to what is shown below with the only difference being the actual performance counter that cannot load.

Event Type:      Error
Event Source:      Enterprise Library Instrumentation
Event Category:      None
Event ID:      0
Date:            11/30/2010
Time:            11:56:03 AM
User:            N/A
Computer:      RDPSRVRSS18
Description:
Failed to create instances of performance counter 'Total # of Cache Access Attempts' - The requested Performance Counter is not a custom counter, it has to be initialized as ReadOnly..

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Mini113010-01.dmp
0
Comment
Question by:z711500
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 62

Accepted Solution

by:
gheist earned 500 total points
ID: 34246529
It is most likely a driver problem. Win32k.sys is kernel part of win32 i.e layer that interacts between user mode and kernel drivers. There are recent exploits hitting this module
My guesses (since i do not see module versions on your system from minidump)
Mcafee needs superdat to get to engine 5400?
Chkdsk after installing latest NTFS driver http://support.microsoft.com/kb/981166/?
chkdsk /f c: or  fsutil dirty set c: after that?
0
 

Author Comment

by:z711500
ID: 34295439
I've applied the update provided and will continue to monitor this.

Thank you.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question