Windows 2000 server rebooting

ramon82 · 09-01-2008, 10:41 PM

I have been having a strange problem. My Windows 2000 server is sometimes rebooting after giving a quick BSOD....The last line in the SYSTEM event log following the reboot was this:

01-09-2008 11:59:17 AM Save Dump Information None 1001 N/A SERVER-A The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xe4ff3428, 0x00000000, 0xf74f4c9e, 0x00000001). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.

The hijackthis log is this:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:04:54 AM, on 02-09-2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
c:\teamware\server\i500\i500stack\RFC1006D.EXE
C:\WINNT\System32\llssrv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Network Associates\ePO\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\snmptrap.exe
C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe
c:\teamware\server\tosvc.exe
c:\teamware\server\tostart.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\ismserv.exe
c:\teamware\server\toentdir.exe
c:\teamware\server\i500\bin\odssched.exe
c:\teamware\server\i500\bin\odscomms.exe
c:\teamware\server\i500\bin\odsmdsa.exe
c:\teamware\server\i500\bin\odssdsa.exe
c:\teamware\server\i500\bin\odssdsa.exe
c:\teamware\server\i500\bin\odssdsa.exe
c:\teamware\server\i500\bin\odsshad.exe
c:\teamware\server\i500\i500ldap\mtldapd.exe
c:\teamware\server\i500\i500ldap\odsldapv3.exe
c:\teamware\server\toserver.exe
c:\teamware\server\tombdisp.exe
c:\teamware\server\tomime.exe
c:\teamware\server\tomprep.exe
c:\teamware\server\toemsend.exe
c:\teamware\server\to3xbox.exe
c:\teamware\server\tohttp.exe
c:\teamware\server\tohttp.exe
c:\teamware\server\toalarm.exe
c:\teamware\server\toimap4.exe
c:\teamware\server\toalert.exe
c:\teamware\server\toaluser.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\McAfee\Common Framework\UpdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINNT\system32\Atiptaxx.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\robocopy.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nai.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 142.191.42.98:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 142.191.3.20
O1 - Hosts: 142.191.3.20 mail.techlab.com.mt
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00A7BD45-3D5C-11D4-BDA7-00C0F02C56AB} (DMSrvPushX Control) - http://142.191.31.10/webpages/DMWebX.ocx
O16 - DPF: {4EABBB94-847F-45CB-8C70-99AE8E88635A} (WebClient Control) - http://142.191.25.25/WebCamX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126528307562
O16 - DPF: {E8775171-BF76-42EC-A093-55E16A45C375} (prjTWAttachmentListG.TWAttachmentList) - https://www.snt.com.mt/prjTWAttachmentListG.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = techlab.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = techlab.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = techlab.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19
O23 - Service: Apache2 - Apache Software Foundation - C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: McAfee ePolicy Orchestrator 3.0.1 Event Parser (EVENTPARSER301) - Network Associates, Inc. - C:\Program Files\Network Associates\ePO\3.0.1\EVENTPARSER.EXE
O23 - Service: FSC ServerView Services - Fujitsu Siemens Computers - C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\scripts\SERVER~1\SnmpTrap\AlarmService.exe
O23 - Service: RFC1006 Transport Service (ISOSTACK.RFC1006) - ISOCOR - c:\teamware\server\i500\i500stack\RFC1006D.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: McAfee ePolicy Orchestrator 3.0.1 Server (NAIMSERV301) - Network Associates, Inc. - C:\Program Files\Network Associates\ePO\3.0.1\NAIMSERV.EXE
O23 - Service: Server Control Service (SrvCtrl) - Fujitsu Siemens Computers GmbH - C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe
O23 - Service: Teamware Server v7.1 (TeamWAREOffice5) - Unknown owner - c:\teamware\server\tosvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7247 bytes

CAN YOU KINDLY HELP ME PLS

09-01-2008, 10:41 PM	#1 (permalink)
ramon82 Registered User Join Date: Aug 2008 Posts: 57 OS: XP SP3	Windows 2000 server rebooting I have been having a strange problem. My Windows 2000 server is sometimes rebooting after giving a quick BSOD....The last line in the SYSTEM event log following the reboot was this: 01-09-2008 11:59:17 AM Save Dump Information None 1001 N/A SERVER-A The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xe4ff3428, 0x00000000, 0xf74f4c9e, 0x00000001). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP. The hijackthis log is this: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:04:54 AM, on 02-09-2008 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe c:\teamware\server\i500\i500stack\RFC1006D.EXE C:\WINNT\System32\llssrv.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Network Associates\ePO\MSSQL\Binn\sqlservr.exe C:\WINNT\system32\ntfrs.exe C:\WINNT\system32\regsvc.exe C:\WINNT\System32\locator.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\snmp.exe C:\WINNT\System32\snmptrap.exe C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe c:\teamware\server\tosvc.exe c:\teamware\server\tostart.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\System32\dns.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\System32\ismserv.exe c:\teamware\server\toentdir.exe c:\teamware\server\i500\bin\odssched.exe c:\teamware\server\i500\bin\odscomms.exe c:\teamware\server\i500\bin\odsmdsa.exe c:\teamware\server\i500\bin\odssdsa.exe c:\teamware\server\i500\bin\odssdsa.exe c:\teamware\server\i500\bin\odssdsa.exe c:\teamware\server\i500\bin\odsshad.exe c:\teamware\server\i500\i500ldap\mtldapd.exe c:\teamware\server\i500\i500ldap\odsldapv3.exe c:\teamware\server\toserver.exe c:\teamware\server\tombdisp.exe c:\teamware\server\tomime.exe c:\teamware\server\tomprep.exe c:\teamware\server\toemsend.exe c:\teamware\server\to3xbox.exe c:\teamware\server\tohttp.exe c:\teamware\server\tohttp.exe c:\teamware\server\toalarm.exe c:\teamware\server\toimap4.exe c:\teamware\server\toalert.exe c:\teamware\server\toaluser.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\McAfee\Common Framework\UpdaterUI.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\WINNT\system32\Atiptaxx.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\WINNT\system32\cmd.exe C:\WINNT\system32\robocopy.exe C:\Documents and Settings\Administrator\Desktop\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nai.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 142.191.42.98:3128 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 142.191.3.20 O1 - Hosts: 142.191.3.20 mail.techlab.com.mt O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user') O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00A7BD45-3D5C-11D4-BDA7-00C0F02C56AB} (DMSrvPushX Control) - http://142.191.31.10/webpages/DMWebX.ocx O16 - DPF: {4EABBB94-847F-45CB-8C70-99AE8E88635A} (WebClient Control) - http://142.191.25.25/WebCamX.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1126528307562 O16 - DPF: {E8775171-BF76-42EC-A093-55E16A45C375} (prjTWAttachmentListG.TWAttachmentList) - https://www.snt.com.mt/prjTWAttachmentListG.CAB O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = techlab.com O17 - HKLM\System\CCS\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = techlab.com O17 - HKLM\System\CS1\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = techlab.com O17 - HKLM\System\CS2\Services\Tcpip\..\{30EE7ADA-AD51-481C-A3D3-5E414189010E}: NameServer = 142.191.3.20,194.159.36.19 O23 - Service: Apache2 - Apache Software Foundation - C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\WEBSER~1\bin\Apache.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: McAfee ePolicy Orchestrator 3.0.1 Event Parser (EVENTPARSER301) - Network Associates, Inc. - C:\Program Files\Network Associates\ePO\3.0.1\EVENTPARSER.EXE O23 - Service: FSC ServerView Services - Fujitsu Siemens Computers - C:\PROGRA~1\FUJITS~1\SERVER~2\SERVER~1\scripts\SERVER~1\SnmpTrap\AlarmService.exe O23 - Service: RFC1006 Transport Service (ISOSTACK.RFC1006) - ISOCOR - c:\teamware\server\i500\i500stack\RFC1006D.EXE O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: McAfee ePolicy Orchestrator 3.0.1 Server (NAIMSERV301) - Network Associates, Inc. - C:\Program Files\Network Associates\ePO\3.0.1\NAIMSERV.EXE O23 - Service: Server Control Service (SrvCtrl) - Fujitsu Siemens Computers GmbH - C:\Program Files\Fujitsu Siemens\ServerView Agents\Server Control\SrvCtrl.exe O23 - Service: Teamware Server v7.1 (TeamWAREOffice5) - Unknown owner - c:\teamware\server\tosvc.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- End of file - 7247 bytes CAN YOU KINDLY HELP ME PLS