FW Service crashing

  • From: "Talley, Scott" <stalley@xxxxxxxxxxxxxxxxx>
  • To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
  • Date: Wed, 2 Jun 2004 08:29:56 -0500

Nope - rolling back the KB835732 hotfix made no difference in the fw srvc
crashes.  Looks like I'm in for an overhaul.  Just the excuse I needed to
move to Win03 anyway, sure wish I knew the release date of ISA04...

Thank you,

Scott Talley
IT Manager, The Combined Group
e> stalley@xxxxxxxxxxxxxxxxx
p> 469.892.4000 x829
f> 469.221.6900

-----Original Message-----
From: David Farinic [mailto:davidf@xxxxxxx]
Sent: Tuesday, June 01, 2004 2:04 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW Service crashing


http://www.ISAserver.org


That's good idea, let us know if reverting KB835732 helped.
I mentioned that ntdll.dll has nothing to do with being registered as
plug-in in ISA server as same thing happened to me during testing of my
filter. 
Indeed I found bug in different DLL then it was reported.

-----Original Message-----
From: Talley, Scott [mailto:stalley@xxxxxxxxxxxxxxxxx] 
Sent: Tuesday, June 01, 2004 8:39 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW Service crashing

http://www.ISAserver.org

nothing under ..\Fpc for "ntdll".  Tonight I think I'll roll back the
KB835732 hotfix (which includes the new ntdll.dll) and see what happens.
It's definately the eTrust AVG/SMTP App Filter thats misbehaving, I just
can't do without it.  Hopefully CA will work with me for a permanent
fix.

Thank you,

Scott Talley
IT Manager, The Combined Group
e> stalley@xxxxxxxxxxxxxxxxx
p> 469.892.4000 x829
f> 469.221.6900

-----Original Message-----
From: Jim Harrison [mailto:jim@xxxxxxxxxxxx]
Sent: Tuesday, June 01, 2004 1:07 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW Service crashing


http://www.ISAserver.org

Sorry; that's bad advice; don't forget that ntdll.dll is listed as an
ISA
component.
This is a core Windows component that has no business being listed as in
the
Application Filters.
The fact that it is listed this way indicates that, at the very least,
the
ISA storage is corrupted.

What should happen is to remove (not disable) any non-default app
filters
and reboot the machine to ensure that "in-use" components 
are properly re-registered or removed.
You can also search the registry under HKLM\Software\Microsoft\Fpc for
"ntdll" to see if this really is listed this way, or if 
another plugin is messing with you.

 Jim Harrison
 MCP(NT4, W2K), A+, Network+, PCG
 http://www.microsoft.com/isaserver
 http://isaserver.org/Jim_Harrison
 http://isatools.org

 Read the help, books and articles!
----- Original Message ----- 
From: "David Farinic" <davidf@xxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Tuesday, June 01, 2004 08:49
Subject: [isalist] Re: FW Service crashing


http://www.ISAserver.org

Forget idea that ntdll.dll was registered as filter to ISA.
What happened is that 1 of application filter calls used standard system
call (probably with wrong parameters or faulty memory addresses) nd this
caused error reported to ntdll.dll but failure was in caller DLL.

Disable filters 1 by 1 and observe when error doesn't occur.
Then report error to vendor of faulty plug-in.

With Regards David Farinic.




-----Original Message-----
From: Talley, Scott [mailto:stalley@xxxxxxxxxxxxxxxxx]
Sent: Tuesday, June 01, 2004 5:28 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW Service crashing

http://www.ISAserver.org

Thanks for your reply Jim,  all my ISA-Standard Application Filters are
disabled except for FTP Access and the HTTP Redirector plus the
non-ISA-Standard eTrust AVG SMTP Filter, which I have un/re-installed
without success.  Any ideas how to "unregister" the ntdll.dll as an app
filter short of a complete overhaul?

Thank you,

Scott Talley
IT Manager, The Combined Group
e> stalley@xxxxxxxxxxxxxxxxx
p> 469.892.4000 x829
f> 469.221.6900

-----Original Message-----
From: Jim Harrison [mailto:jim@xxxxxxxxxxxx]
Sent: Tuesday, June 01, 2004 10:04 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW Service crashing


http://www.ISAserver.org

You should remove any application filters you're using.
The registration for one or more of them is completely hosed.
C:\WINNT\system32\ntdll.dll is a system component that shouldn't be
registered as an application filter.

 Jim Harrison
 MCP(NT4, W2K), A+, Network+, PCG
 http://www.microsoft.com/isaserver
 http://isaserver.org/Jim_Harrison
 http://isatools.org

 Read the help, books and articles!
----- Original Message ----- 
From: "Talley, Scott" <stalley@xxxxxxxxxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Tuesday, June 01, 2004 05:34
Subject: [isalist] FW Service crashing


http://www.ISAserver.org

Hi Guys, I really need some help.  I'm having serious issues with my
Firewall Service crashing and restarting about every 30 minutes.  Below
is
the error generated, I have 2 other applications running on the ISA box,
Rainconnect and CA eTrust AntiVirus Gateway, however I haven't made any
changes to either in months.  The AV Gateway does have an SMTP
Application
Filter, but I can't see any reason it would suddenly start to misbehave.
Anyone seen this before or have any ideas?

The Firewall service stopped because an application filter module
C:\WINNT\system32\ntdll.dll generated an exception code C0000005 in
address
77FCC8E1 when function CompleteAsyncIO was called. To resolve this
error,
remove recently installed application filters and restart the service.


Thank you,

Scott Talley
IT Manager, The Combined Group
e> stalley@xxxxxxxxxxxxxxxxx
p> 469.892.4000 x829
f> 469.221.6900

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
stalley@xxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
davidf@xxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist

This mail was checked for malicious code and viruses
by GFI MailSecurity. GFI MailSecurity provides email content
checking, exploit detection, threats analysis and anti-virus for
Exchange & SMTP servers. Viruses, Trojans, dangerous
attachments and offensive content are removed automatically.
Key features include: multiple virus engines; email content and
attachment checking; an exploit shield; an HTML threats engine;
a Trojan & Executable Scanner; and more.

In addition to GFI MailSecurity, GFI also produces the
GFI MailEssentials anti-spam software, the GFI FAXmaker
fax server & GFI LANguard network security product ranges.
For more information on our products, please visit
http://www.gfi.com. This disclaimer was sent by
GFI MailEssentials for Exchange/SMTP.


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
stalley@xxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
davidf@xxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
stalley@xxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist


Other related posts: