Event ID 1003 on Windows Server 2003 - repeated restarts

[jimbiddle]

In the absence of anyone who knows what they are doing, yours truely is trying to overcome a problem with seemingly random restarts on my server PC. Sometimes the server restarts at 12.00 midday but also at other times.
The problem started on 22 Sept, a few hours after the installation of an upgrade to the "Symantec Client Security" small business pack ver 3.0 (this contains 10 license of Symantec Antivisus 9.0.0.338 plus 1 copy of Semantic Service Center v 6.0). This made me very suspicious of the upgrade and I have had since had exhaustive support from them up to the point of them exhausting all the possible problems and pointing me back to Microsoft.
So far I have been in contact with Symantec and Dell (the server PC) and done everything they have advised - all to no effect. Breifly, the list of tasks performed is as follows:-
1) Remove and Reinstall all Symantec software.
2) Update virus definition files & run anti virus scan on the whole PC from safe mode (no viruses found).
3) Change the timing of the AV automatic updates from daily to weekly (Now happens on Sunday).
4) Download and run the Dell 32-bit Diagnostic utility V5061 - all tests pass OK (this includes the memory test, which I see in several other threads, by the way).
5) Install microsoft exchange server SP1 (as advised by Microsoft article 837444). This needed the hotfix 831464. Also installed SP2, which needed the removal of Exchange intelligent message filter program.
6) Downloaded a patch from Symantec to overcome problem with automatic updates not working properly.
7) Read all the threads and searched for the same thing all over the web. This looked like a promising (and friendly) site, so I thought I'd register and see if you could spot the problem. I've zipped and attached the 2 most recent minidumps, as this seems to be a key bit of information.
8) Attached a screen dump from the Event Viewer which shows nearly all the crash dates being coincident with this one event id/ system error. Please note that the log says 11.00 ish for a lot of the error messages but it was actually 12 ish - maybe the daylight saving adustment is factored in?

Also, just for completeness, here is a summary of the Server PC:-
Dell PowerEdge 800, Intel Pentium 4, 3.2GHz : 1GB RAM : 4 Disk Maxstor SATA drive RAID array.
Running Microsoft Windows Server 2003 for Small Business Server and Symantec Client Security 3.0.
This is used as a file server and email server.

All suggestions welcome. Many thanks,

Jim Biddle

 

[howard_hopkinso]

Hello and welcome to Techspot.

Ah Symantec strikes again.

Both your minidumps crash at SYMEVENT.SYS. This is the Symantec Event Library.

This is a known issue on some systems/configurations.

Contact Symantec for more info.

If you can`t fix this problem, maybe you should try a different security product.

Regards Howard :wave: :wave:

 

[jimbiddle]

So, its not me after all!!

Thanks for the analysis and reply. This is going to be a great help with Symantec when I call them up. They are very nice and polite but have told me it was definately not their problem...
By the way, I very much like the site and am very impressed.

Best Regards,

Jim Biddle.

 

[howard_hopkinso]

That sounds about right lol.

Unfortunately we see this problem on a regular basis.

If you care to Google SYMEVENT.SYS, you`ll see what I mean.

Personally, I wouldn`t have Symantec/Norton anywhere near my system. These forums are full of problems, as a result of using their substandard software.

Please note. This is my own personal opinion.

Regards and good luck Howard

 

[gary_hendricks]

Howard, totally agree about Symantec. They kick off all sorts of hidden processes which slow the system to a crawl.

 

[cpc2004]

I get a BSOD crash at another forum and the culprit is Norton AV. Your version of Norton AV (ie 30 Apr 2005) is exactly the same as my case. After the problem owner upgraded Norton AV and the problem was resolved.

 

[jimbiddle]

Here's some good news

First of all, my humble apologies go to Symantec - how could I have doubted them?? I have brought in the software equivalent of the Ghostbusters (DIY is great but sometimes you have to admit that, even with the best advice, you can't fix it yourself).
Their description of the problem/ fix is as follows ..........
"...Found that Volume Shadow copy was causing blue screens due to default schedule of 7am and noon each day. Applied MS VSS update, no effect. Changed to save copies on d drive rather than c drive – this appears to have fixed the blue screen issue. Run 5 tests – all ok compared to 4 tests before, all failed. If the problem recurs, disable the shadow copy scheduled task from start>programs>accessories>system tools>scheduled tasks. This will stop the VSS copy task from running. It’s features aren’t used anyway."
This seems pretty conclusive to me and I will know for sure after about a week or so without a restart. I hope this is of some use to anyone having a similar problem. Jim.