locked
Crashing inetinfo.exe with Exception c0000005 on Windows 2K Sever SP4 with IIS5 RRS feed

  • 問題

  • Hello,

     

    Recently our web server started crashing, but I have made no changes to the server.  We are running Microsoft Windows 2000 Service Pack 4 with IIS5.

     

    Unlike a similar post, we are not actively running a virus scanner that is not the problem.

     

    Event Viewer System Log is reporting:

     

                Event Id: 7031

                The IIS Admin Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

     

    (Also at that exact second, it logs the crash of these 3 dependent services:  FTP Publishing Service, Simple Mail Transport Protocol (SMTP), and World Wide Web Publishing Service.)

     

    Then minutes to hours later, it may crash again triggering a reboot (which is the way I set the service to handle a 2nd crash).

     

    One of the headers of drwtsn32.log shows:

     

                Application exception occurred:

                            App: inetinfo.exe (pid=2312)

                            When: 10/20/2008 @ 08:18:48.797

                            Exception number: c0000005 (access violation)

     

    I also found in that same log entry (and a majority also have this same FAULT):

     

                function: RtlAllocateHeap

                ...

                FAULT ->77fcb0c8 8901             mov     [ecx],eax         ds:66657250=????????

                ...

     

    I have kept the machine up to date with Microsoft updates and have not changed or installed anything on our web server in months (except Microsoft updates).   I applied the last one (before the crashes) back on Wednesday, September 10, 2008.  The crashes started Saturday, October 11, 2008.  Hoping an update would solve the problem, I applied the Wednesday, October 15, 2008 updates, but that did not help.

     

    Looking at dates in drwtsn32.log, I see the server was mostly stable until the 11th then started crashing daily.  So I do not know if it is a software issue, hardware failure, or a hacker.

     

    We would greatly appreciate any help.  Thank you.

    2008年10月20日 下午 08:00

解答

  • Dear Customer,

     

    Thank you for your post.

     

    Based on my research, the issue can be caused by various factors. I suggest you test the following steps for this issue:

     

    1.  Disabled all the third party services by running msconfig.

     

    2. Rebooted the server.

     

    3. Check the IIS service is still crash.

     

    4. Check the SMTP that was causing IIS also to crash.

     

    5. Keep the IIS admin started without SMTP been started, check the IIS admin service.

     

    Please refer to the following Microsoft Knowledge Base articles:

    One or more IIS services may unexpectedly close, and you may receive an "Event ID 7031" error message in the System log when you start a Web site that is hosted on IIS 5.0

    http://support.microsoft.com/kb/899301/en-us

     

    If anything is unclear, please feel free to let me know. I am glad to be of assistance.

     

    Sincerely

     

    Tom Zhang, MCSE 2003

     

    2008年10月21日 上午 03:20
    版主

所有回覆

  • Dear Customer,

     

    Thank you for your post.

     

    Based on my research, the issue can be caused by various factors. I suggest you test the following steps for this issue:

     

    1.  Disabled all the third party services by running msconfig.

     

    2. Rebooted the server.

     

    3. Check the IIS service is still crash.

     

    4. Check the SMTP that was causing IIS also to crash.

     

    5. Keep the IIS admin started without SMTP been started, check the IIS admin service.

     

    Please refer to the following Microsoft Knowledge Base articles:

    One or more IIS services may unexpectedly close, and you may receive an "Event ID 7031" error message in the System log when you start a Web site that is hosted on IIS 5.0

    http://support.microsoft.com/kb/899301/en-us

     

    If anything is unclear, please feel free to let me know. I am glad to be of assistance.

     

    Sincerely

     

    Tom Zhang, MCSE 2003

     

    2008年10月21日 上午 03:20
    版主
  • Thanks for the quick response.  I got pulled off to another project last week, so just getting back to it.

     

    I am kind of stuck.  This is our main and only web server, so I can not break it for days to see if it quits crashing.  I have not added any 3rd party services that I do not need (or ones that did not come through windows updates).

     

    I have disabled the FTP and SMTP services (since we recently quit using them), and rebooted the machine many times since then, and it still crashes, recently applied the new latest updates from microsoft and still crashing.

     

    ISAPI Caching is enabled, as per the default.

     

    Any more suggestions?  Thanks so far!!!

    2008年10月28日 下午 07:50
  • Dear Customer,

     

    I suggest that we perform the following steps:
     
    1> Clean up the message queue.
     
    a) Make sure SMTP service is stooped.
     
    b) Open "d:\program files\exchsrvr\mailroot\vsi 1" in Windows Explorer.
     
    c) Rename the Queue folder to Old.
     
    d) Create a new folder and name it Queue.
     
    e) Try to start the services. Does it help?
     
    For more information, please refer to:
     
    311517 The Inetinfo.exe Process Stops Responding
    http://support.microsoft.com/?id=311517
     
    2> If the issue persists, it's also possible that IIS metabase becomes corrupted. It’s recommended that you following the steps in KB 304166, instead of restoring system state.
     
    Normally, reinstall server 2000 doesn’t affect information store. However, it’s always recommended that you perform a full backup first!
     
    For more information, please refer to:
     
    304166 Exchange Databases Are Not Mounted and Event Logs Contain Error Messages
    http://support.microsoft.com/?id=304166
     
    3> Do you have any other anti-virus application installed on the server? Other anti-virus might also cause this issue.
     
    For more information, please refer to the following steps:
     
    317482 XADM: Information Store Does Not Start After You Install Exchange 2000
    http://support.microsoft.com/?id=317482
     
    821749 PRB: Antivirus Software May Cause IIS to Stop Unexpectedly
    http://support.microsoft.com/?id=821749
     
    If anything is unclear, please feel free to let me know. I'm looking forward to your reply.

    Have a nice day.

    Sincerely

     

    Tom Zhang

     

    2008年10月30日 上午 10:16
    版主
  • Just a follow up -- problem resolved -- apparently by Dell firmware and driver updates.  Below is my reply to someone off another forum, hope this helps.  Thanks everyone.

     

    Right after this, I was going to try the "Debug Diagnostics tool" suggested on here, but wanted to get a full backup of the machine.  The incremental backups had been running fine (plus the previous full backup at the first of the month), but all of a sudden I was not able to run the backup either.

     

    Had to call Dell tech support (good thing we extended the warranty) who fixed the tape problem, and got it working by updating the firmware of the tape drive, back plane, plus updated some of the driver software (can not remember what all driver wise got updated).

     

    I was then able to get the full backups, and installed the debug software, but it has not crashed since Dell finished their updates, so I have since uninstalled the debug software to keep things running as quickly as possible.

     

    The best I can figure is that somehow it decided to become incompatible in the hardware (even though no Window's updates had occurred close to the start of the problem); and the Dell updates resolved the conflict, which in turn resolved the IIS crashing problem.

     

    That, or if it was a hacker, they stopped; or a later Microsoft patch fixed the IIS crashing issue.

     

    If you have your Windows' updates up to date, then check in to flashing your hardware (at least backplane and tape drive) and updating the hardware drivers.

     

    2008年12月3日 下午 05:03