Nyo

I will give a little background first.

Ive come into the job of looking after a windows server 2003 server recently
a little green. while i do have a lot of knowledge of computing all those
little bits you build up as you go along are missing, and i have a general
worry of doing anything major to the server because i am worried about it
going down. we dont have a backup server or a test server or anything like
that. so a reformat is going to be a final final (final) solution

we are a small company so we dont have a backup server or a test server or
anything like that just the live one.

Ok basically almost daily our ISA server crashes and takes out all network
traffic with it. this started happening about a month after i got here after
i did a full virus scan on the machine with NOD32. to this day i dont know if
that was coincidence or not.

Initially the ISA server would crash regularly and i would have to restart
the server in all cases it would give the following error


Faulting application wspsrv.exe, version 4.0.2167.887, stamp 462cc525,
faulting module [module], version 4.0.2167.887, stamp 462cc4b1, debug? 0,
fault address 0x00041cc1.

where module was a number of different dll's, however i did notice that the
module was often amon.dll which i knew was the active scanner part of NOD32

after some research i told NOD32 not to scan the ISA directory as well as a
couple of other folders in the windows directory as instructed by the guide i
was reading.

The firewall stopped crashing...for 3 days. when its crashing 2-3 times a
day it being stable for so long made it seem like id cracked it but it
crashed again.

Were now back to a situation where it crashes almost daily again however the
module it crashes on is now identicle. it gives the following errors every
time


Microsoft ISA Server 2004 Event ID 1000

Faulting application wspsrv.exe, version 4.0.2167.887, stamp 462cc525,
faulting module msfpc.dll, version 4.0.2167.887, stamp 462cc4b1, debug? 0,
fault address 0x00041cc1.

Microsoft ISA Server Control Event ID 14079
Due to an unexpected error, the service fwsrv stopped responding to all
requests. Stop the service or the corresponding process if it does not
respond, and then start it again. Check the Windows event Viewer for related
error messages.

and also occasionally

Microsoft Firewall Event ID 14057
The Firewall service stopped because an application filter module [Unknown]
generated an exception code C0000005 in address 00000000 when function
CompleteAsyncIO was called. To resolve this error, remove recently installed
application filters and restart the service.

i have installed no new filters since i joined the company in the last 3
months, and i can in no way say or tell what order the filters were installed
prior to that.

also today after i crash i got that the filter module was unknown but the following error about the faulting module listed that as unknown also!

We also get regular warning messages that our connectivity verifier to
google.com is over the 5000ms threshhold but i dont know if thats related

If anyone can help id be eternally gratefull, ive been researching and
researching this and with very little success, i think its begginging to
drive me mad!.

A little systems information

We use Server 2003 on a duel 3.2Ghz Xenon Proccesor
it has 2GB of ram and a 1GM network connection
it runs ISA Server 2004 as its firewall
we use NOD32 as our virus scanner, each client machine also has an install
of NOD32
we are also currently using GFI mail essentials to filter spam.

The network consists of about 14 computers and a single Dell Server

If you need any other information i will endevour to provide it.

Also i apologise about my spelling >.>

catmil

I am currently having the same problem. Did you resolve the problem?

unfair

I would like to know if either of you are running GFi Webmonitor 4 or Symantec Mail Security 5 or Symantec Endpoint Protection 11