Jump to content

Windows Server 2003 R2 crashes (blue screen)


digitalage

Recommended Posts

Hi,

The problems started when I added more torrents than usual. Windows crashes (blue screen) with the error: kernel_stack_inpage_error (no other info, such as hex, just few text lines "if I installed software or hardware, remove it..."). I'm using Windows Server 2003 R2 Enterprise Edition, and utorrent version 1.8.2.14458. Windows Firewall is OFF, DEP is also OFF (disabled in boot.ini).

I used to run 20-30 torrents at once without any problem. Now I have about 100 torrents (about 40 active, 60 stopped) and now if I start utorrent, Windows crashes after 3-5 minutes. I cannot create crash dump, since Windows gives blue screen, but here are more info I could get:

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:50:13 PM, on 3/9/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP2 (6.00.3790.3959)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\serverappliance\appmgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\serverappliance\elementmgr.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Binn\sqlservr.exe
C:\MySQL\bin\mysqld-nt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\serverappliance\srvcsurg.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Virtual Server\vmh.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\kxmixer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\YPOPs\YPOPs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\Program Files\Totalcmd\TOTALCMD.EXE
C:\Program Files\Totalcmd\TOTALCMD.EXE
c:\windows\system32\inetsrv\w3wp.exe
C:\DOCUME~1\MYCOMP~1\LOCALS~1\Temp\Temporary Directory 1 for ProcessExplorer.zip\procexp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla\Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/softAdmin.htm
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
O4 - HKLM\..\Run: [kX Mixer] C:\WINDOWS\system32\kxmixer.exe --startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - Startup: Task Manager.lnk = C:\WINDOWS\system32\taskmgr.exe
O4 - Startup: YPOPs.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O15 - Trusted Zone: http://www.volksbank.ro
O16 - DPF: {D3CCEFAF-8EE1-40FE-BE25-366E2B016DAB} (Microsoft Virtual Server VMRC Control) - http://home-pc:1024/VirtualServer/activex/VMRCActiveXClient.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MySQL - Unknown owner - C:\MySQL\bin\mysqld-nt (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5366 bytes

List of processes:

Process    PID    CPU    Description    Company Name
System Idle Process 0 53.79
Interrupts n/a 0.76 Hardware Interrupts
DPCs n/a 3.79 Deferred Procedure Calls
System 4 1.52
smss.exe 396 Windows NT Session Manager Microsoft Corporation
csrss.exe 444 Client Server Runtime Process Microsoft Corporation
winlogon.exe 468 Windows NT Logon Application Microsoft Corporation
services.exe 516 0.76 Services and Controller app Microsoft Corporation
svchost.exe 688 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 756 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 808 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 852 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 872 Generic Host Process for Win32 Services Microsoft Corporation
ccSetMgr.exe 956 Symantec Settings Manager Service Symantec Corporation
ccEvtMgr.exe 984 Symantec Event Manager Service Symantec Corporation
SPBBCSvc.exe 1092 SPBBC Service Symantec Corporation
spoolsv.exe 1252 Spooler SubSystem App Microsoft Corporation
msdtc.exe 1288 MS DTCconsole program Microsoft Corporation
appmgr.exe 1396 Remote Server Manager Microsoft Corporation
DefWatch.exe 1416 Virus Definition Daemon Symantec Corporation
elementmgr.exe 1464 Web Element Manager Microsoft Corporation
inetinfo.exe 1552 Internet Information Services Microsoft Corporation
mdm.exe 1604 Machine Debug Manager Microsoft Corporation
sqlservr.exe 1680 SQL Server Windows NT Microsoft Corporation
sqlservr.exe 1932 SQL Server Windows NT Microsoft Corporation
mysqld-nt.exe 1956
svchost.exe 1976 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 2004 Generic Host Process for Win32 Services Microsoft Corporation
POP3Svc.exe 2024 Microsoft Pop3 Service Microsoft Corporation
svchost.exe 2084 Generic Host Process for Win32 Services Microsoft Corporation
OWSTIMER.EXE 2164 SharePoint Timer Service Microsoft Corporation
sqlwriter.exe 2288 SQL Server VSS Writer Microsoft Corporation
srvcsurg.exe 2364 Remote Administration Service Microsoft Corporation
svchost.exe 2424 Generic Host Process for Win32 Services Microsoft Corporation
Rtvscan.exe 2436 Symantec AntiVirus Symantec Corporation
svchost.exe 2524 Generic Host Process for Win32 Services Microsoft Corporation
vmh.exe 2568 Virtual Machine Helper Microsoft Corporation
winvnc4.exe 2600 VNC Server Free Edition for Win32 RealVNC Ltd.
WMServer.exe 2732 Windows Media Services Microsoft Corporation
svchost.exe 2816 Generic Host Process for Win32 Services Microsoft Corporation
vssrvc.exe 2832 Virtual Server 2005 R2 SP1 Service Microsoft Corporation
svchost.exe 3216 Generic Host Process for Win32 Services Microsoft Corporation
alg.exe 3348 Application Layer Gateway Service Microsoft Corporation
svchost.exe 3780 Generic Host Process for Win32 Services Microsoft Corporation
lsass.exe 528 LSA Shell Microsoft Corporation
rdpclip.exe 3592 RDP Clip Monitor Microsoft Corporation
csrss.exe 1940 Client Server Runtime Process Microsoft Corporation
winlogon.exe 2488 Windows NT Logon Application Microsoft Corporation
explorer.exe 1860 Windows Explorer Microsoft Corporation
smax4pnp.exe 3084 SMax4PNP Analog Devices, Inc.
rundll32.exe 3168 Run a DLL as an App Microsoft Corporation
VM_STI.EXE 3200 1.52 BIGDOG BIGDOG
kxmixer.exe 3264 kX mixer Eugene Gavrilov
ccApp.exe 3480 Symantec User Session Symantec Corporation
VPTray.exe 3548 Symantec AntiVirus Symantec Corporation
sqlmangr.exe 3676 SQL Server Service Manager Microsoft Corporation
taskmgr.exe 3720 Windows TaskManager Microsoft Corporation
ypops.exe 3756 Free POP3/SMTP access to Yahoo! Mail http://YPOPsEmail.com/
procexp.exe 3372 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
notepad.exe 2768 1.54 Notepad Microsoft Corporation
uTorrent.exe 2592 37.12 µTorrent BitTorrent, Inc.
firefox.exe 1024 Firefox Mozilla Corporation

Process: uTorrent.exe Pid: 2592

Name Description Company Name Version
ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation 5.2.3790.3959
adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.2.3790.3959
ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 5.2.3790.3959
ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation 3.5.2283.0
CLBCatQ.DLL COM+ Configuration Catalog Microsoft Corporation 2001.12.4720.3959
COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.0.3790.3959
comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.0.3790.3959
COMRes.dll COM+ Resources Microsoft Corporation 2001.12.4720.3959
credui.dll Credential Manager User Interface Microsoft Corporation 5.2.3790.3959
ctype.nls
DnsApi.dll DNS Client API DLL Microsoft Corporation 5.2.3790.3959
GDI32.dll GDI Client DLL Microsoft Corporation 5.2.3790.3959
hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation 5.2.3790.3959
Iphlpapi.dll IP Helper API Microsoft Corporation 5.2.3790.3959
kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 5.2.3790.3959
locale.nls
MPRAPI.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.2.3790.3959
msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.3790.3959
mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 5.2.3790.3959
netapi32.dll Net Win32 API DLL Microsoft Corporation 5.2.3790.3959
ntdll.dll NT Layer DLL Microsoft Corporation 5.2.3790.3959
ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.2.3790.3959
oleaut32.dll Microsoft Corporation 5.2.3790.3959
PSAPI.DLL Process Status Helper Microsoft Corporation 5.2.3790.3959
R000000000010.clb
rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.2.3790.3959
RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 5.2.3790.3959
rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 5.2.3790.3959
rtutils.dll Routing Utilities Microsoft Corporation 5.2.3790.3959
SAMLIB.dll SAM Library DLL Microsoft Corporation 5.2.3790.3959
Secur32.dll Security Support Provider Interface Microsoft Corporation 5.2.3790.3959
SETUPAPI.dll Windows Setup API Microsoft Corporation 5.2.3790.3959
SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.0.3790.3959
shfolder.dll Shell Folder Service Microsoft Corporation 6.0.3790.3959
SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.0.3790.3959
sortkey.nls
sorttbls.nls
unicode.nls
USER32.dll Windows USER API Client DLL Microsoft Corporation 5.2.3790.3959
USERENV.dll Userenv Microsoft Corporation 5.2.3790.3959
uTorrent.exe µTorrent BitTorrent, Inc. 1.8.2.14458
UxTheme.dll Microsoft UxTheme Library Microsoft Corporation 6.0.3790.3959
VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 5.2.3790.3959
winrnr.dll LDAP RnR Provider DLL Microsoft Corporation 5.2.3790.3959
WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 5.2.3790.3959
WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.2.3790.3959
WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.2.3790.3959
wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.2.3790.3959

I wonder if there's a fix for this. Thanks!

later edit: added DLL to list of processes.

Link to comment
Share on other sites

There is no dump file. Windows 2003 is suppose to create a small memory dump in %windir%/memory.dmp, but it doesn't. Not there, not anywhere else.

The way it crashes is very weired. I can describe it as a slow dying. In about 3-5 minutes, it's getting slower an slower, I cannot use Explorer (can't open programs from icons from desktop/taskbar, can't open start/menu and as such can't open any program). Programs already open are not frozen, I can switch to them using alt+tab. However, it takes about 1-2 minutes after these programs dye. I use to keep Task Manager open, and when I feel it very slow (dying), I check processes (I am still able to see processes, 'thou I can't do any action here such as "end task", or "new task" etc, not even close Task Manager). One thing to mention: when it dies, I can see in Task Manager/Applications 2 processes of utorrent, both "not responding" (trying to kill them has no effect, as I said). That's weired, because utorrent does not act as multi-instance application.

Those said, I've to mention that I'm a computer administrator and a responsible person. I take good care of applications I have installed and I'm a bit paranoid when about viruses and spyware. I have a good experience in removing viruses from computers, I would have see if I'm infected.

I'm 100% percent sure that things go wrong because of settings, if utorrent is really well designed (and I believe it is, I've no doubt about it). I wish I know how to use settings in advances preferences without crashing again, that's why I try getting help here instead of experimenting with everything. I have torrents on many hard-drives, and for every crash the computer stays forever until it checks all drives (5-7 hours to be more specific).

Later edit: I guess I found out what the issue is. It could be related to "disk overload" (see http://forum.utorrent.com/viewtopic.php?id=5116&p=5, post #121) - I detailed there. I'll wrote here for others to see if they arrive through search engines. This thread could be closed.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...