clothespinguy
Posts: 14 +0
This is driving me nuts. I'm using my computer for work purposes and can't get anything done because it keeps restarting. I get a little message that says:
"This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" and it gives me a 60 second countdown, then restarts. I know I can delay it with the shutdown -a command but even when I do that it just locks up in 60 seconds and personally I'd rather it just restarts.
I've looked at the dump file (I've got it set to use the large one) but I'm not expert and I honestly can't tell what it's saying...it looks to me like it's a file called netevent.dll that keeps shuttind down and causing the process services.exe to quit.
I've attached the system logs that were flagged as warnings/errors and I've attached the dump file.
Any thoughts? I can't find the culprit...and when I do I don't know what to do to fix it (I heard you're not supposed to replace the netevent.dll). Ugh.
Memory dump:
--------------
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
+fffffffff47d6928
f47d6928 8a1401 mov dl,byte ptr [ecx+eax]
TRAP_FRAME: f26dd558 -- (.trap fffffffff26dd558)
ErrCode = 00000000
eax=00000000 ebx=f47dc94a ecx=0101d000 edx=804e3e5f esi=00001000 edi=0101c000
eip=f47d6928 esp=f26dd5cc ebp=f26dd5d8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f47d6928 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: WindowsXP-KB919
LAST_CONTROL_TRANSFER: from 8052202d to 805371aa
STACK_TEXT:
f26dd120 8052202d 0000008e c0000005 f47d6928 nt!KeBugCheckEx+0x1b
f26dd4e8 804de403 f26dd504 00000000 f26dd558 nt!KiDispatchException+0x3b1
f26dd550 804de3b4 f26dd5d8 f47d6928 badb0d00 nt!CommonDispatchException+0x4d
f26dd560 804e3e5f 0007df20 00000007 0007e1d0 nt!Kei386EoiHelper+0x18a
f26dd590 804e3e5f 0101d000 00000000 ffffffff nt!ZwQueryInformationFile+0x11
f26dd5a8 0101c000 00001000 f47dc94a f26dd5d8 nt!ZwQueryInformationFile+0x11
WARNING: Frame IP not in any known module. Following frames may be wrong.
f26dd6b0 80603978 0000028c 85c9b020 00000001 0x101c000
f26dd62c f47d88e8 85c9b020 01000000 01000218 nt!PspCreateThread+0x3a7
f26dd6b0 80603978 0000028c 85c9b020 00000001 0xf47d88e8
f26dd6b0 80603978 0000028c 85c9b020 00000001 nt!PspCreateThread+0x3a7
f26dd7f4 80584c40 0007d894 001f03ff 00000000 nt!PspCreateThread+0x3a7
f26dd86c 804dd99f 0007d894 001f03ff 00000000 nt!NtCreateThread+0x118
f26dd86c 7c90eb94 0007d894 001f03ff 00000000 nt!KiFastCallEntry+0xfc
0007df10 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDispatchException+3b1
8052202d cc int 3
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
SYMBOL_NAME: nt!KiDispatchException+3b1
FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1
BUCKET_ID: 0x8E_nt!KiDispatchException+3b1
Followup: MachineOwner
***Below are the 3 event logs of significance***
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 9/21/2006
Time: 8:32:25 PM
User: N/A
Computer: BLUE1
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0011D8890AE0. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Data:
0000: 79 00 00 00 y...
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 9/21/2006
Time: 8:34:27 PM
User: N/A
Computer: BLUE1
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 9/21/2006
Time: 8:37:01 PM
User: N/A
Computer: BLUE1
Description:
The Computer Browser service terminated with the following error:
This operation returned because the timeout period expired.
"This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" and it gives me a 60 second countdown, then restarts. I know I can delay it with the shutdown -a command but even when I do that it just locks up in 60 seconds and personally I'd rather it just restarts.
I've looked at the dump file (I've got it set to use the large one) but I'm not expert and I honestly can't tell what it's saying...it looks to me like it's a file called netevent.dll that keeps shuttind down and causing the process services.exe to quit.
I've attached the system logs that were flagged as warnings/errors and I've attached the dump file.
Any thoughts? I can't find the culprit...and when I do I don't know what to do to fix it (I heard you're not supposed to replace the netevent.dll). Ugh.
Memory dump:
--------------
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
+fffffffff47d6928
f47d6928 8a1401 mov dl,byte ptr [ecx+eax]
TRAP_FRAME: f26dd558 -- (.trap fffffffff26dd558)
ErrCode = 00000000
eax=00000000 ebx=f47dc94a ecx=0101d000 edx=804e3e5f esi=00001000 edi=0101c000
eip=f47d6928 esp=f26dd5cc ebp=f26dd5d8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f47d6928 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: WindowsXP-KB919
LAST_CONTROL_TRANSFER: from 8052202d to 805371aa
STACK_TEXT:
f26dd120 8052202d 0000008e c0000005 f47d6928 nt!KeBugCheckEx+0x1b
f26dd4e8 804de403 f26dd504 00000000 f26dd558 nt!KiDispatchException+0x3b1
f26dd550 804de3b4 f26dd5d8 f47d6928 badb0d00 nt!CommonDispatchException+0x4d
f26dd560 804e3e5f 0007df20 00000007 0007e1d0 nt!Kei386EoiHelper+0x18a
f26dd590 804e3e5f 0101d000 00000000 ffffffff nt!ZwQueryInformationFile+0x11
f26dd5a8 0101c000 00001000 f47dc94a f26dd5d8 nt!ZwQueryInformationFile+0x11
WARNING: Frame IP not in any known module. Following frames may be wrong.
f26dd6b0 80603978 0000028c 85c9b020 00000001 0x101c000
f26dd62c f47d88e8 85c9b020 01000000 01000218 nt!PspCreateThread+0x3a7
f26dd6b0 80603978 0000028c 85c9b020 00000001 0xf47d88e8
f26dd6b0 80603978 0000028c 85c9b020 00000001 nt!PspCreateThread+0x3a7
f26dd7f4 80584c40 0007d894 001f03ff 00000000 nt!PspCreateThread+0x3a7
f26dd86c 804dd99f 0007d894 001f03ff 00000000 nt!NtCreateThread+0x118
f26dd86c 7c90eb94 0007d894 001f03ff 00000000 nt!KiFastCallEntry+0xfc
0007df10 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDispatchException+3b1
8052202d cc int 3
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
SYMBOL_NAME: nt!KiDispatchException+3b1
FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1
BUCKET_ID: 0x8E_nt!KiDispatchException+3b1
Followup: MachineOwner
***Below are the 3 event logs of significance***
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 9/21/2006
Time: 8:32:25 PM
User: N/A
Computer: BLUE1
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0011D8890AE0. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Data:
0000: 79 00 00 00 y...
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 9/21/2006
Time: 8:34:27 PM
User: N/A
Computer: BLUE1
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 9/21/2006
Time: 8:37:01 PM
User: N/A
Computer: BLUE1
Description:
The Computer Browser service terminated with the following error:
This operation returned because the timeout period expired.