Nope - rolling back the KB835732 hotfix made no difference in the fw srvc crashes. Looks like I'm in for an overhaul. Just the excuse I needed to move to Win03 anyway, sure wish I knew the release date of ISA04... Thank you, Scott Talley IT Manager, The Combined Group e> stalley@xxxxxxxxxxxxxxxxx p> 469.892.4000 x829 f> 469.221.6900 -----Original Message----- From: David Farinic [mailto:davidf@xxxxxxx] Sent: Tuesday, June 01, 2004 2:04 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org That's good idea, let us know if reverting KB835732 helped. I mentioned that ntdll.dll has nothing to do with being registered as plug-in in ISA server as same thing happened to me during testing of my filter. Indeed I found bug in different DLL then it was reported. -----Original Message----- From: Talley, Scott [mailto:stalley@xxxxxxxxxxxxxxxxx] Sent: Tuesday, June 01, 2004 8:39 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org nothing under ..\Fpc for "ntdll". Tonight I think I'll roll back the KB835732 hotfix (which includes the new ntdll.dll) and see what happens. It's definately the eTrust AVG/SMTP App Filter thats misbehaving, I just can't do without it. Hopefully CA will work with me for a permanent fix. Thank you, Scott Talley IT Manager, The Combined Group e> stalley@xxxxxxxxxxxxxxxxx p> 469.892.4000 x829 f> 469.221.6900 -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Tuesday, June 01, 2004 1:07 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org Sorry; that's bad advice; don't forget that ntdll.dll is listed as an ISA component. This is a core Windows component that has no business being listed as in the Application Filters. The fact that it is listed this way indicates that, at the very least, the ISA storage is corrupted. What should happen is to remove (not disable) any non-default app filters and reboot the machine to ensure that "in-use" components are properly re-registered or removed. You can also search the registry under HKLM\Software\Microsoft\Fpc for "ntdll" to see if this really is listed this way, or if another plugin is messing with you. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://www.microsoft.com/isaserver http://isaserver.org/Jim_Harrison http://isatools.org Read the help, books and articles! ----- Original Message ----- From: "David Farinic" <davidf@xxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Tuesday, June 01, 2004 08:49 Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org Forget idea that ntdll.dll was registered as filter to ISA. What happened is that 1 of application filter calls used standard system call (probably with wrong parameters or faulty memory addresses) nd this caused error reported to ntdll.dll but failure was in caller DLL. Disable filters 1 by 1 and observe when error doesn't occur. Then report error to vendor of faulty plug-in. With Regards David Farinic. -----Original Message----- From: Talley, Scott [mailto:stalley@xxxxxxxxxxxxxxxxx] Sent: Tuesday, June 01, 2004 5:28 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org Thanks for your reply Jim, all my ISA-Standard Application Filters are disabled except for FTP Access and the HTTP Redirector plus the non-ISA-Standard eTrust AVG SMTP Filter, which I have un/re-installed without success. Any ideas how to "unregister" the ntdll.dll as an app filter short of a complete overhaul? Thank you, Scott Talley IT Manager, The Combined Group e> stalley@xxxxxxxxxxxxxxxxx p> 469.892.4000 x829 f> 469.221.6900 -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Tuesday, June 01, 2004 10:04 AM To: [ISAserver.org Discussion List] Subject: [isalist] Re: FW Service crashing http://www.ISAserver.org You should remove any application filters you're using. The registration for one or more of them is completely hosed. C:\WINNT\system32\ntdll.dll is a system component that shouldn't be registered as an application filter. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://www.microsoft.com/isaserver http://isaserver.org/Jim_Harrison http://isatools.org Read the help, books and articles! ----- Original Message ----- From: "Talley, Scott" <stalley@xxxxxxxxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Tuesday, June 01, 2004 05:34 Subject: [isalist] FW Service crashing http://www.ISAserver.org Hi Guys, I really need some help. I'm having serious issues with my Firewall Service crashing and restarting about every 30 minutes. Below is the error generated, I have 2 other applications running on the ISA box, Rainconnect and CA eTrust AntiVirus Gateway, however I haven't made any changes to either in months. The AV Gateway does have an SMTP Application Filter, but I can't see any reason it would suddenly start to misbehave. Anyone seen this before or have any ideas? The Firewall service stopped because an application filter module C:\WINNT\system32\ntdll.dll generated an exception code C0000005 in address 77FCC8E1 when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service. Thank you, Scott Talley IT Manager, The Combined Group e> stalley@xxxxxxxxxxxxxxxxx p> 469.892.4000 x829 f> 469.221.6900 ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: stalley@xxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: davidf@xxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist This mail was checked for malicious code and viruses by GFI MailSecurity. GFI MailSecurity provides email content checking, exploit detection, threats analysis and anti-virus for Exchange & SMTP servers. Viruses, Trojans, dangerous attachments and offensive content are removed automatically. Key features include: multiple virus engines; email content and attachment checking; an exploit shield; an HTML threats engine; a Trojan & Executable Scanner; and more. In addition to GFI MailSecurity, GFI also produces the GFI MailEssentials anti-spam software, the GFI FAXmaker fax server & GFI LANguard network security product ranges. For more information on our products, please visit http://www.gfi.com. This disclaimer was sent by GFI MailEssentials for Exchange/SMTP. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: stalley@xxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: davidf@xxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: stalley@xxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist