From: AbrarKhan on
Dear Support,

My SBS Server crash on daily bases, I get the following error.
The previous system shutdown at 1:18:44 AM on 6/11/2006 was unexpected.

Since three week back I use to get the following error message. Now the
system just crash.

Error code 00000077, parameter1 c0000185, parameter2 c0000185, parameter3
00000000, parameter4 01d25000.
Error code 0000000a, parameter1 0003afda, parameter2 00000002, parameter3
00000001, parameter4 80a5702a.
Error code 0000000a, parameter1 0001afd8, parameter2 00000002, parameter3
00000001, parameter4 80a5702a.
Error code 1000007e, parameter1 c0000005, parameter2 b7f3aa9e, parameter3
f7906c38, parameter4 f7906934.

Please advice, any can assist me in solving the this problem. The Server
Hard ware vendor has check hardware log, Raid Controller Log, but no hardware
problem found.

The problem started, when I have uninstalled the SP2 of ISA Server and than
I have uninstalled the ISA Server application two months back.

Below is the memory dump records.
Loading Dump File [C:\Users\Abrark\MEMORY.DMP] Kernel Summary Dump File:
Only kernel address space is available

Symbol search path is: C:\WINDOWS\Symbols Executable search path is:
C:\WINDOWS Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4
procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer
SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time:
Sun May 21 23:04:09.370 2006 (GMT+3) System Uptime: 3 days 11:05:32.109
Loading Kernel Symbols
................................................................................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 77, {c0000185, c0000185, 0, 1d25000}

Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+5c1 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in. Caused by bad block
in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature in the
kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
(STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read
from the disk due to a bad block. Upon reboot autocheck will run and attempt
to map out the bad sector. If the status is C0000185
(STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then
the cabling and termination should be checked. See the knowledge base
article on SCSI termination.
Arguments:
Arg1: c0000185, status code
Arg2: c0000185, i/o status code
Arg3: 00000000, page file number
Arg4: 01d25000, offset into page file

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR: 0x77_c0000185

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8084a89b to 80827451

STACK_TEXT:
f7922cbc 8084a89b 00000077 c0000185 c0000185 nt!KeBugCheckEx+0x1b
f7922d34 8084b73f c05d2bd0 000b7885 00000001
nt!MiMakeOutswappedPageResident+0x5c1
f7922d68 8084b7d5 8a73ec20 f7922d78 ba57b000
nt!MiInPageSingleKernelStack+0x14b
f7922d8c 8088724e 8a73ec20 00000000 8ab836c0 nt!MmInPageKernelStack+0x39
f7922da4 8088785e 8a73ec80 80948bb2 00000000 nt!KiInSwapKernelStacks+0x16
f7922dac 80948bb2 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
f7922ddc 8088d4d2 808877e2 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiMakeOutswappedPageResident+5c1
8084a89b cc int 3

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiMakeOutswappedPageResident+5c1

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1

BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1

From: Cris Hanna (SBS-MVP) on
Can you start in Safe Mode?
If so, start in Safe Mode, delete all page files and reboot, then recreate your pagefile and reboot one more time

--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:C80EDEDF-90CB-4502-9396-7830554D94B3(a)microsoft.com...
Dear Support,

My SBS Server crash on daily bases, I get the following error.
The previous system shutdown at 1:18:44 AM on 6/11/2006 was unexpected.

Since three week back I use to get the following error message. Now the
system just crash.

Error code 00000077, parameter1 c0000185, parameter2 c0000185, parameter3
00000000, parameter4 01d25000.
Error code 0000000a, parameter1 0003afda, parameter2 00000002, parameter3
00000001, parameter4 80a5702a.
Error code 0000000a, parameter1 0001afd8, parameter2 00000002, parameter3
00000001, parameter4 80a5702a.
Error code 1000007e, parameter1 c0000005, parameter2 b7f3aa9e, parameter3
f7906c38, parameter4 f7906934.

Please advice, any can assist me in solving the this problem. The Server
Hard ware vendor has check hardware log, Raid Controller Log, but no hardware
problem found.

The problem started, when I have uninstalled the SP2 of ISA Server and than
I have uninstalled the ISA Server application two months back.

Below is the memory dump records.
Loading Dump File [C:\Users\Abrark\MEMORY.DMP] Kernel Summary Dump File:
Only kernel address space is available

Symbol search path is: C:\WINDOWS\Symbols Executable search path is:
C:\WINDOWS Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4
procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer
SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time:
Sun May 21 23:04:09.370 2006 (GMT+3) System Uptime: 3 days 11:05:32.109
Loading Kernel Symbols
.................................................................................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 77, {c0000185, c0000185, 0, 1d25000}

Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+5c1 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in. Caused by bad block
in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature in the
kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
(STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read
from the disk due to a bad block. Upon reboot autocheck will run and attempt
to map out the bad sector. If the status is C0000185
(STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then
the cabling and termination should be checked. See the knowledge base
article on SCSI termination.
Arguments:
Arg1: c0000185, status code
Arg2: c0000185, i/o status code
Arg3: 00000000, page file number
Arg4: 01d25000, offset into page file

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR: 0x77_c0000185

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8084a89b to 80827451

STACK_TEXT:
f7922cbc 8084a89b 00000077 c0000185 c0000185 nt!KeBugCheckEx+0x1b
f7922d34 8084b73f c05d2bd0 000b7885 00000001
nt!MiMakeOutswappedPageResident+0x5c1
f7922d68 8084b7d5 8a73ec20 f7922d78 ba57b000
nt!MiInPageSingleKernelStack+0x14b
f7922d8c 8088724e 8a73ec20 00000000 8ab836c0 nt!MmInPageKernelStack+0x39
f7922da4 8088785e 8a73ec80 80948bb2 00000000 nt!KiInSwapKernelStacks+0x16
f7922dac 80948bb2 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
f7922ddc 8088d4d2 808877e2 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiMakeOutswappedPageResident+5c1
8084a89b cc int 3

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiMakeOutswappedPageResident+5c1

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1

BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
From: AbrarKhan on
Dear Cris,

I have done the need full, the Server is Fujitsu Siemens, with 4GB memory.

System is under observation.

I was thing of uninstalling all the SBS Server Applications, like exchange,
isa, SQL and 3rd party application like Trend Micro, CA Server protect for
SBS.

and reinstalling these applications one by one, because hardware wise,
server does not shows any error, the server is fully manageable. and the
problem is random. At the point of time when we are working on the server the
problem does not showsup.

Now a day there is no memory dump, the Server just restart.

Looking forward to hear from you soon.

"Cris Hanna (SBS-MVP)" wrote:

> Can you start in Safe Mode?
> If so, start in Safe Mode, delete all page files and reboot, then recreate your pagefile and reboot one more time
>
> --
> Cris Hanna [SBS-MVP]
> --------------------------------------
> Please do not respond directly to me, but only post in the newsgroup so all can take advantage
> "AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:C80EDEDF-90CB-4502-9396-7830554D94B3(a)microsoft.com...
> Dear Support,
>
> My SBS Server crash on daily bases, I get the following error.
> The previous system shutdown at 1:18:44 AM on 6/11/2006 was unexpected.
>
> Since three week back I use to get the following error message. Now the
> system just crash.
>
> Error code 00000077, parameter1 c0000185, parameter2 c0000185, parameter3
> 00000000, parameter4 01d25000.
> Error code 0000000a, parameter1 0003afda, parameter2 00000002, parameter3
> 00000001, parameter4 80a5702a.
> Error code 0000000a, parameter1 0001afd8, parameter2 00000002, parameter3
> 00000001, parameter4 80a5702a.
> Error code 1000007e, parameter1 c0000005, parameter2 b7f3aa9e, parameter3
> f7906c38, parameter4 f7906934.
>
> Please advice, any can assist me in solving the this problem. The Server
> Hard ware vendor has check hardware log, Raid Controller Log, but no hardware
> problem found.
>
> The problem started, when I have uninstalled the SP2 of ISA Server and than
> I have uninstalled the ISA Server application two months back.
>
> Below is the memory dump records.
> Loading Dump File [C:\Users\Abrark\MEMORY.DMP] Kernel Summary Dump File:
> Only kernel address space is available
>
> Symbol search path is: C:\WINDOWS\Symbols Executable search path is:
> C:\WINDOWS Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4
> procs) Free x86 compatible
> Product: LanManNt, suite: SmallBusiness TerminalServer
> SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp1_rtm.050324-1447
> Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time:
> Sun May 21 23:04:09.370 2006 (GMT+3) System Uptime: 3 days 11:05:32.109
> Loading Kernel Symbols
> .................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> ..
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 77, {c0000185, c0000185, 0, 1d25000}
>
> Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+5c1 )
>
> Followup: MachineOwner
> ---------
>
> 2: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> KERNEL_STACK_INPAGE_ERROR (77)
> The requested page of kernel data could not be read in. Caused by bad block
> in paging file or disk controller error.
> In the case when the first arguments is 0 or 1, the stack signature in the
> kernel stack was not found. Again, bad hardware.
> An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
> (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read
> from the disk due to a bad block. Upon reboot autocheck will run and attempt
> to map out the bad sector. If the status is C0000185
> (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then
> the cabling and termination should be checked. See the knowledge base
> article on SCSI termination.
> Arguments:
> Arg1: c0000185, status code
> Arg2: c0000185, i/o status code
> Arg3: 00000000, page file number
> Arg4: 01d25000, offset into page file
>
> Debugging Details:
> ------------------
>
>
> ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
>
> DISK_HARDWARE_ERROR: There was error with disk hardware
>
> BUGCHECK_STR: 0x77_c0000185
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from 8084a89b to 80827451
>
> STACK_TEXT:
> f7922cbc 8084a89b 00000077 c0000185 c0000185 nt!KeBugCheckEx+0x1b
> f7922d34 8084b73f c05d2bd0 000b7885 00000001
> nt!MiMakeOutswappedPageResident+0x5c1
> f7922d68 8084b7d5 8a73ec20 f7922d78 ba57b000
> nt!MiInPageSingleKernelStack+0x14b
> f7922d8c 8088724e 8a73ec20 00000000 8ab836c0 nt!MmInPageKernelStack+0x39
> f7922da4 8088785e 8a73ec80 80948bb2 00000000 nt!KiInSwapKernelStacks+0x16
> f7922dac 80948bb2 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
> f7922ddc 8088d4d2 808877e2 00000000 00000000 nt!PspSystemThreadStartup+0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!MiMakeOutswappedPageResident+5c1
> 8084a89b cc int 3
>
> FAULTING_SOURCE_CODE:
>
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: nt!MiMakeOutswappedPageResident+5c1
>
> MODULE_NAME: nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
>
> IMAGE_NAME: memory_corruption
>
> FAILURE_BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
>
> BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
>
From: Cris Hanna (SBS-MVP) on
Have you considered 2 options?
Reinstalling ISA and ISA SP2 and see if the error goes away
OR
Booting to CD1 and doing a repair?

--
Cris Hanna [SBS-MVP]
--------------------------------------
Please do not respond directly to me, but only post in the newsgroup so all can take advantage
"AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:A135BD32-C64E-4B41-8E6E-229ED958D0E5(a)microsoft.com...
Dear Cris,

I have done the need full, the Server is Fujitsu Siemens, with 4GB memory.

System is under observation.

I was thing of uninstalling all the SBS Server Applications, like exchange,
isa, SQL and 3rd party application like Trend Micro, CA Server protect for
SBS.

and reinstalling these applications one by one, because hardware wise,
server does not shows any error, the server is fully manageable. and the
problem is random. At the point of time when we are working on the server the
problem does not showsup.

Now a day there is no memory dump, the Server just restart.

Looking forward to hear from you soon.

"Cris Hanna (SBS-MVP)" wrote:

> Can you start in Safe Mode?
> If so, start in Safe Mode, delete all page files and reboot, then recreate your pagefile and reboot one more time
>
> --
> Cris Hanna [SBS-MVP]
> --------------------------------------
> Please do not respond directly to me, but only post in the newsgroup so all can take advantage
> "AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:C80EDEDF-90CB-4502-9396-7830554D94B3(a)microsoft.com...
> Dear Support,
>
> My SBS Server crash on daily bases, I get the following error.
> The previous system shutdown at 1:18:44 AM on 6/11/2006 was unexpected.
>
> Since three week back I use to get the following error message. Now the
> system just crash.
>
> Error code 00000077, parameter1 c0000185, parameter2 c0000185, parameter3
> 00000000, parameter4 01d25000.
> Error code 0000000a, parameter1 0003afda, parameter2 00000002, parameter3
> 00000001, parameter4 80a5702a.
> Error code 0000000a, parameter1 0001afd8, parameter2 00000002, parameter3
> 00000001, parameter4 80a5702a.
> Error code 1000007e, parameter1 c0000005, parameter2 b7f3aa9e, parameter3
> f7906c38, parameter4 f7906934.
>
> Please advice, any can assist me in solving the this problem. The Server
> Hard ware vendor has check hardware log, Raid Controller Log, but no hardware
> problem found.
>
> The problem started, when I have uninstalled the SP2 of ISA Server and than
> I have uninstalled the ISA Server application two months back.
>
> Below is the memory dump records.
> Loading Dump File [C:\Users\Abrark\MEMORY.DMP] Kernel Summary Dump File:
> Only kernel address space is available
>
> Symbol search path is: C:\WINDOWS\Symbols Executable search path is:
> C:\WINDOWS Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4
> procs) Free x86 compatible
> Product: LanManNt, suite: SmallBusiness TerminalServer
> SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp1_rtm.050324-1447
> Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time:
> Sun May 21 23:04:09.370 2006 (GMT+3) System Uptime: 3 days 11:05:32.109
> Loading Kernel Symbols
> ...................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> ..
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 77, {c0000185, c0000185, 0, 1d25000}
>
> Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+5c1 )
>
> Followup: MachineOwner
> ---------
>
> 2: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> KERNEL_STACK_INPAGE_ERROR (77)
> The requested page of kernel data could not be read in. Caused by bad block
> in paging file or disk controller error.
> In the case when the first arguments is 0 or 1, the stack signature in the
> kernel stack was not found. Again, bad hardware.
> An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
> (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read
> from the disk due to a bad block. Upon reboot autocheck will run and attempt
> to map out the bad sector. If the status is C0000185
> (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then
> the cabling and termination should be checked. See the knowledge base
> article on SCSI termination.
> Arguments:
> Arg1: c0000185, status code
> Arg2: c0000185, i/o status code
> Arg3: 00000000, page file number
> Arg4: 01d25000, offset into page file
>
> Debugging Details:
> ------------------
>
>
> ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
>
> DISK_HARDWARE_ERROR: There was error with disk hardware
>
> BUGCHECK_STR: 0x77_c0000185
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from 8084a89b to 80827451
>
> STACK_TEXT:
> f7922cbc 8084a89b 00000077 c0000185 c0000185 nt!KeBugCheckEx+0x1b
> f7922d34 8084b73f c05d2bd0 000b7885 00000001
> nt!MiMakeOutswappedPageResident+0x5c1
> f7922d68 8084b7d5 8a73ec20 f7922d78 ba57b000
> nt!MiInPageSingleKernelStack+0x14b
> f7922d8c 8088724e 8a73ec20 00000000 8ab836c0 nt!MmInPageKernelStack+0x39
> f7922da4 8088785e 8a73ec80 80948bb2 00000000 nt!KiInSwapKernelStacks+0x16
> f7922dac 80948bb2 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
> f7922ddc 8088d4d2 808877e2 00000000 00000000 nt!PspSystemThreadStartup+0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!MiMakeOutswappedPageResident+5c1
> 8084a89b cc int 3
>
> FAULTING_SOURCE_CODE:
>
>
> SYMBOL_STACK_INDEX: 1
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: nt!MiMakeOutswappedPageResident+5c1
>
> MODULE_NAME: nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
>
> IMAGE_NAME: memory_corruption
>
> FAILURE_BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
>
> BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
>
From: AbrarKhan on
Hi,
Thanks for your response, things are getting out of control here with SBS, I
have Task Manager running infront of me, the server freezing a lot, but Task
manager is showing 1 to 6 % normal processor utilization. It does not shows
or indicate if any running process is taking process utilization. Problem is
really weard. Does not gives me any clue, after a while things started
working and again going back in to the freezing mode.
When it freez, the Task Pannel is not accessable, it task ten minutes,
untill it become ok for while.

As you have mention that I should boot from the CD1 and choice repaire do I
lose any thing, like 3rd party application, Active Directory, Exchange,
register Computers and so on.
Regarding the ISA Server, since I have already a hardware firewall, I donot
need it, in addition to this, the ISA is blocking port that are used by the
3rd party application, like Trend Micro, and other.

It would be highly appreciated, if you could get MS artical regarding the
recovery. and enclosed I would like to give you more information, which were
shown in the EVENT Viewer.
Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 6/14/2006
Time: 8:29:21 AM
User: RIFAI-NET\administrator
Computer: SERVER
Description:
The reason supplied by user DOM-NET\Administrator for the last unexpected
shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID: Dont know
Bugcheck String: 0x0000000a (0x0003afda, 0x00000002, 0x00000001, 0x80a5702a)

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 6/14/2006
Time: 8:07:29 AM
User: N/A
Computer: SERVER
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the
NtFrs service.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 6/14/2006
Time: 7:55:58 AM
User: N/A
Computer: SERVER
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the
TapiSrv service.






"Cris Hanna (SBS-MVP)" wrote:

> Have you considered 2 options?
> Reinstalling ISA and ISA SP2 and see if the error goes away
> OR
> Booting to CD1 and doing a repair?
>
> --
> Cris Hanna [SBS-MVP]
> --------------------------------------
> Please do not respond directly to me, but only post in the newsgroup so all can take advantage
> "AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:A135BD32-C64E-4B41-8E6E-229ED958D0E5(a)microsoft.com...
> Dear Cris,
>
> I have done the need full, the Server is Fujitsu Siemens, with 4GB memory.
>
> System is under observation.
>
> I was thing of uninstalling all the SBS Server Applications, like exchange,
> isa, SQL and 3rd party application like Trend Micro, CA Server protect for
> SBS.
>
> and reinstalling these applications one by one, because hardware wise,
> server does not shows any error, the server is fully manageable. and the
> problem is random. At the point of time when we are working on the server the
> problem does not showsup.
>
> Now a day there is no memory dump, the Server just restart.
>
> Looking forward to hear from you soon.
>
> "Cris Hanna (SBS-MVP)" wrote:
>
> > Can you start in Safe Mode?
> > If so, start in Safe Mode, delete all page files and reboot, then recreate your pagefile and reboot one more time
> >
> > --
> > Cris Hanna [SBS-MVP]
> > --------------------------------------
> > Please do not respond directly to me, but only post in the newsgroup so all can take advantage
> > "AbrarKhan" <AbrarKhan(a)discussions.microsoft.com> wrote in message news:C80EDEDF-90CB-4502-9396-7830554D94B3(a)microsoft.com...
> > Dear Support,
> >
> > My SBS Server crash on daily bases, I get the following error.
> > The previous system shutdown at 1:18:44 AM on 6/11/2006 was unexpected.
> >
> > Since three week back I use to get the following error message. Now the
> > system just crash.
> >
> > Error code 00000077, parameter1 c0000185, parameter2 c0000185, parameter3
> > 00000000, parameter4 01d25000.
> > Error code 0000000a, parameter1 0003afda, parameter2 00000002, parameter3
> > 00000001, parameter4 80a5702a.
> > Error code 0000000a, parameter1 0001afd8, parameter2 00000002, parameter3
> > 00000001, parameter4 80a5702a.
> > Error code 1000007e, parameter1 c0000005, parameter2 b7f3aa9e, parameter3
> > f7906c38, parameter4 f7906934.
> >
> > Please advice, any can assist me in solving the this problem. The Server
> > Hard ware vendor has check hardware log, Raid Controller Log, but no hardware
> > problem found.
> >
> > The problem started, when I have uninstalled the SP2 of ISA Server and than
> > I have uninstalled the ISA Server application two months back.
> >
> > Below is the memory dump records.
> > Loading Dump File [C:\Users\Abrark\MEMORY.DMP] Kernel Summary Dump File:
> > Only kernel address space is available
> >
> > Symbol search path is: C:\WINDOWS\Symbols Executable search path is:
> > C:\WINDOWS Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4
> > procs) Free x86 compatible
> > Product: LanManNt, suite: SmallBusiness TerminalServer
> > SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp1_rtm.050324-1447
> > Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time:
> > Sun May 21 23:04:09.370 2006 (GMT+3) System Uptime: 3 days 11:05:32.109
> > Loading Kernel Symbols
> > ...................................................................................................................
> > Loading User Symbols
> > Loading unloaded module list
> > ..
> > *******************************************************************************
> > *
> > *
> > * Bugcheck Analysis
> > *
> > *
> > *
> > *******************************************************************************
> >
> > Use !analyze -v to get detailed debugging information.
> >
> > BugCheck 77, {c0000185, c0000185, 0, 1d25000}
> >
> > Probably caused by : memory_corruption ( nt!MiMakeOutswappedPageResident+5c1 )
> >
> > Followup: MachineOwner
> > ---------
> >
> > 2: kd> !analyze -v
> > *******************************************************************************
> > *
> > *
> > * Bugcheck Analysis
> > *
> > *
> > *
> > *******************************************************************************
> >
> > KERNEL_STACK_INPAGE_ERROR (77)
> > The requested page of kernel data could not be read in. Caused by bad block
> > in paging file or disk controller error.
> > In the case when the first arguments is 0 or 1, the stack signature in the
> > kernel stack was not found. Again, bad hardware.
> > An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
> > (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read
> > from the disk due to a bad block. Upon reboot autocheck will run and attempt
> > to map out the bad sector. If the status is C0000185
> > (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then
> > the cabling and termination should be checked. See the knowledge base
> > article on SCSI termination.
> > Arguments:
> > Arg1: c0000185, status code
> > Arg2: c0000185, i/o status code
> > Arg3: 00000000, page file number
> > Arg4: 01d25000, offset into page file
> >
> > Debugging Details:
> > ------------------
> >
> >
> > ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
> >
> > DISK_HARDWARE_ERROR: There was error with disk hardware
> >
> > BUGCHECK_STR: 0x77_c0000185
> >
> > DEFAULT_BUCKET_ID: DRIVER_FAULT
> >
> > CURRENT_IRQL: 0
> >
> > LAST_CONTROL_TRANSFER: from 8084a89b to 80827451
> >
> > STACK_TEXT:
> > f7922cbc 8084a89b 00000077 c0000185 c0000185 nt!KeBugCheckEx+0x1b
> > f7922d34 8084b73f c05d2bd0 000b7885 00000001
> > nt!MiMakeOutswappedPageResident+0x5c1
> > f7922d68 8084b7d5 8a73ec20 f7922d78 ba57b000
> > nt!MiInPageSingleKernelStack+0x14b
> > f7922d8c 8088724e 8a73ec20 00000000 8ab836c0 nt!MmInPageKernelStack+0x39
> > f7922da4 8088785e 8a73ec80 80948bb2 00000000 nt!KiInSwapKernelStacks+0x16
> > f7922dac 80948bb2 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
> > f7922ddc 8088d4d2 808877e2 00000000 00000000 nt!PspSystemThreadStartup+0x2e
> > 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
> >
> >
> > STACK_COMMAND: kb
> >
> > FOLLOWUP_IP:
> > nt!MiMakeOutswappedPageResident+5c1
> > 8084a89b cc int 3
> >
> > FAULTING_SOURCE_CODE:
> >
> >
> > SYMBOL_STACK_INDEX: 1
> >
> > FOLLOWUP_NAME: MachineOwner
> >
> > SYMBOL_NAME: nt!MiMakeOutswappedPageResident+5c1
> >
> > MODULE_NAME: nt
> >
> > DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
> >
> > IMAGE_NAME: memory_corruption
> >
> > FAILURE_BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
> >
> > BUCKET_ID: 0x77_c0000185_nt!MiMakeOutswappedPageResident+5c1
> >