Analysis System Failure: Stop error Reason Code: 0x805000f


I had this problem a few days ago, and this information might help you.

Problem:

Hardware: IBM Blade – Firmware and drivers are not upgraded since December 2010
OS: windows Server 2003 Enterprise, Service Pack 2, Not Updated since November 2011
Function :  Front end Web Servers.
Problem : Server crashed reporting the reason “System Failure: Stop error Reason Code: 0x805000f”.

Evidence that could collect at the System log, and memory DUMPS.

This slideshow requires JavaScript.

Check Slide Show to see events is System Log.

Were also generated two Dump files (Mini022112-01.DMP e MEMORY.DMP), when server failed.

After a review of “Mini022112-01.dmp” it was found that the process that led to the Crash was ProcessXP version 11.3 (MODULE_NAME: PROCEXP113), see Annex CrashDumpAnalisys.txt.

After a review of “MEMORY.DMP” the following sentence was removed from the report “Probably Caused by: PROCEXP113.SYS (PROCEXP113 +1210).” Check Slide Show.

Recommendations to prevent the problem from occurring again, and work plan to perform in all Servers Windows 2003 32 Bits.

1 – It is advisable to use the latest version of Process Explorer v15.13 http://technet.microsoft.com/en-us/sysinternals/bb896653

2 – Installation of all Security Updates on failure, and Service Packs

3 – Upgrade Firmware and drivers. It was withdrawn following information from “CrashMemoryDUMP” analysis.

“BAD_POOL_HEADER (19)

The pool is corrupt Already at the time of the current request. This may or may not be due to the caller.
The internal pool links must be Walked to figure out the Possible causes of the problem, and then special pool Applied to the suspect tags or the driver verifier to a suspect driver. ” check this link http://msdn.microsoft.com/en-us/library/ff557389%28v=vs.85%29.aspx

4 – I’ve checked that the file Ntfs.sys is not the most recent file and should be Updated to a newer version, check security patchKB937455, will undoubtedly reduce the number of similar problems. However it is not imperative that it be installed.

After speaking with the user that was working with the ProcessXp.exe we clear the last dough that is: He lost connection to the server RDP session, at the moment that he choose the option “Find” in ProcessXP.

To Resume:
An older version of ProcessXP, when option find is used, with Firmware and Drivers not updated), will caused a unexpected Shut down (blue screen).

To analyse the problem I’ve used Win debug, Dumps generated when crash happened and Event Logs. The user input, was also very important to get all the information needed.

You can also check this website that has valid information about this problem. http://forum.sysinternals.com/procexpexe-bluescreen-on-find_topic22598.html

hope that this information can be useful.

Advertisements

About rodvars
Been working in IT Services/Consulting for the past 15 years. My main areas of work are planning, development, managing and administration System infrastructures focusing on optimizing user processes, enforcing business security, performance enhancements, high availabilty and infrastucture scalability.

6 Responses to Analysis System Failure: Stop error Reason Code: 0x805000f

  1. ruiabel says:

    Keep the nice work.

  2. Anonymous User says:

    Very Good and useful article.

  3. I savor, result in I discovered exactly what I used to be taking a look
    for. You have ended my 4 day lengthy hunt! God Bless you man.
    Have a nice day. Bye

  4. shop says:

    Hello my loved one! I want to say that this post is amazing, great written and
    include approximately all significant infos.
    I would like to look extra posts like this .

  5. Pingback: Fix Stop Error Reason Code Errors - Windows XP, Vista & Windows 7, 8

  6. I am in fact thankful to the owner of this site who has shared
    this fantastic paragraph at here.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: