srv.sys

[Jill]

As regular readers will know, my XP system has, for months, been randomly re-booting. The error always indicates the crash was caused by a device driver.

Today, I was working on my other machine, the XP box was sitting there idle, when it BSOD'd! Usual thing - device driver. However - this time I actually got to see the BSOD and on the BSOD it told me the error was caused by "srv.sys".

Can anyone tell me anything about this file? In my Windows folders I have one dated 28/3/2003 and in LastGood one dated 20/12/2002.

Any help would be appreciated.

 

[Toejam31]

"srv.sys" is the Server service driver, which supports file, print, and named-pipe sharing over a network.

Have you installed this patch?

<A HREF="http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS02-045.asp" target="_new">Microsoft Security Bulletin MS02-045</A>

For more information about the error, look in the Event Viewer logs. Right-click "My Computer", and choose "Manage" from the menu. Go to "Event Viewer", and open the Application and System logs. If you see an error, right-click and go to "Properties" for additional information. Take note of the source, and particularly the Event ID numbers, which are searchable.

If you wish for the random rebooting to stop, go to Control Panel\System\Advanced\Startup and Recovery\Settings\System Failure. Clear the check box for "Automatically restart", and I also recommend setting the "Write Debugging" information" to "(none)". This will give you the time needed to take complete notes the next time the BSOD occurs. However, you may not be able to boot into Windows after this happens, so you'll need Internet access from the other computer to search for errors related to the problem.

Be sure to write down at least the first two numbers (sets of eight) that follow any error message, as these parameters are also searchable, and provide much information as to how the driver or file affected the system during the crash.

I'd also do a couple of other things. First, I'd disable <A HREF="http://security.uchicago.edu/windows/netbios/index.shtml" target="_new">File and Print Sharing</A> (at least temporarily) if the computers are on a network, scan for viruses in <A HREF="http://support.microsoft.com/?kbid=315222" target="_new">Safe Mode</A> with the <A HREF="http://www.trendmicro.com/download/dcs.asp" target="_new">Trend Micro Sysclean Package</A> with the latest <A HREF="http://www.trendmicro.com/download/pattern.asp" target="_new">pattern file</A>, remove any peer-to-peer programs that might have compromised the system, update any NIC drivers, and reapply SP1 and all critical hotfixes (if the service pack was already in place) after the NIC driver upgrade.

Toey

<A HREF="http://forums.btvillarin.com/index.php?act=ST&f=41&t=328&s=91c282f2e5207e99b7a652ee13b3512a" target="_new"><font color=green>My System Rigs</font color=green></A>
___________________________________________

<A HREF="http://forums.btvillarin.com/" target="_new"><b><font color=purple>BTVILLARIN.com</font color=purple></b></A> - <i><font color=orange>Your Computer Questions Answered</font color=orange></i>

 

[Jill]

Thanks for replying.

>>> Have you installed this patch?

No, it would seem to be Pro and 64 specific, not available for Home.

I get regular errors in my ErrorLog, Invariably "System Error" "1003". The subcode from the hex below is usually, 8e, sometime 50 which on searching gets a fairly general "you have a device driver problem" - something I already knew! (Discussed in another of my threads)

If I turn off the Auto Restart, am I running on an unstable system if this error appears? Right now, it is annoying because I am logged out and my own background tasks are stopped, but at least my services are running.

The file/print sharing is enables, but rarely used. I have run with it disabled, and have switched the lan to use IPX/SPX protocol, (i.e. avoiding the TCP/IP stack), but neither move improved the situation. (Discussed in another of my threads)

I have no peer - peer s/w.

I have NAV Professional AV automatically updated once a week. Scanned daily. Also AdAware and SpyBot.

I BIOS disabled the onboard NIC and bought a new card, (SMC), but this has also not changed anything. The PnP installer said the existing driver was fine, so it has not been upgraded.

I spent ages going right through the system one weekend looking for newer drivers for just about everything - but I seem to be current.

 

[Toejam31]

Sorry, Jill ... I had no way of knowing that you had Home Edition. I come to the board as often as time allows, but I had not read any of the discussions of your situation in previous threads.

I get regular errors in my ErrorLog, Invariably "System Error" "1003". The subcode from the hex below is usually, 8e, sometime 50 which on searching gets a fairly general "you have a device driver problem" - something I already knew! (Discussed in another of my threads)

You are quite correct, this appears to be related to a device driver, as noted here:

Error code 1000008e = "KERNEL_MODE_EXCEPTION_NOT_HANDLED_M" - Most of newsgroup comments about this error point to faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP. Q310740 gives an example of this error occurring when and old Audigy sound card driver is installed.

If I turn off the Auto Restart, am I running on an unstable system if this error appears? Right now, it is annoying because I am logged out and my own background tasks are stopped, but at least my services are running.

Currently, your system is already unstable, or the BSODs would not be occurring on a regular basis. If the screen is flashing by with the needed data so quickly that you don't have time to write it down, forcing a stop by turning off the auto reboot may be the only answer, so you can adequately document the problem.

I have NAV Professional AV automatically updated once a week. Scanned daily. Also AdAware and SpyBot.

I hate to tell you this, but these applications may not be enough, if the system has acquired a W32 virus. I've seen antivirus programs compromised by these type of worms, and scanning for spyware is only one aspect of protecting a system. I have an antivirus program that is updated daily, and still managed to pick up a Backdoor Trojan recently; and this worm corrupted the virus definition files so that it couldn't be completely removed ... only identified.

Scanning from Safe Mode was the only removal technique that corrected the problem, sans formatting, or working from DOS.

I BIOS disabled the onboard NIC and bought a new card, (SMC), but this has also not changed anything. The PnP installer said the existing driver was fine, so it has not been upgraded.

I'd look for a newer driver, if nothing else, because the source of conflicts of this nature that I discovered while searching seem to be related to the service pack being applied while the srv.sys is not present. In these cases, updating the driver, deleting older System Restore Points, and reinstalling the service pack corrected the issue. If you <i>do</i> have a driver issue, there could be conflicts that do not appear in the Device Manager, due to unseen conflicting memory addresses. You might also consider moving the new NIC card to another open PCI slot, if one is available.

Other possibilities for troubleshooting:

Bad memory chip (Recommended for testing: <A HREF="http://www.memtest86.com/" target="_new">Memtest86</A>)
Inadequate or overheating PSU
Incompatible BIOS (WinXP often requires a BIOS flash to function correctly, especially if the system is more than two years old, and/or if the mainboard is an early version of a recently released model. Too old, or too new ... same problem.)
APIC enabled in the BIOS (this type of Interrupt Controller can cause all sorts of unusual IRQ conflicts ... but changing it to PIC requires a repair or better ... a clean reinstallation of the operating system.)
Conflicts with incompatible or corrupted programs running from the Registry (anything unusual, or that can't be easily identified under the Startup tab when running MSCONFIG should be disabled.)
Corrupted system files (which would warrant a repair of the OS.)
Page file corruption (removing the paging file and recreating it after a reboot often solves many problems.)
Conflicting "hidden" devices loading up when Windows starts, which are often impossible to see without making a Registry change, as shown:

<b>Show/Conceal Hidden Devices in Device Manager</b>
[Start] [Run] [Regedit]
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
Data Type: REG_SZ [String Value] // Value Name: DEVMGR_SHOW_NONPRESENT_DEVICES
Modify/Create the Value Name [DEVMGR_SHOW_NONPRESENT_DEVICES] according to the Value Data listed below.
Value Data: [1 = Show Devices / 0 = Hide Devices]
Exit Registry and Reboot

The Device Manager will <i>not</i> show all hidden devices without this string value. But with them actually visible, you can remove the nonexistent devices. But be sure not to remove components that are needed, such as a printer, that might not be currently running, but is still attached to the computer.

I really can't tell you anything more without knowing exactly what programs are running when the system crashes, which drivers are installed, and without having a fairly complete, documented list of the hardware in the system. You might find <A HREF="http://www.belarc.com/free_download.html" target="_new">Belarc Advisor</A> useful in this instance.

Toey

<A HREF="http://forums.btvillarin.com/index.php?act=ST&f=41&t=328&s=91c282f2e5207e99b7a652ee13b3512a" target="_new"><font color=green>My System Rigs</font color=green></A>
___________________________________________

<A HREF="http://forums.btvillarin.com/" target="_new"><b><font color=purple>BTVILLARIN.com</font color=purple></b></A> - <i><font color=orange>Your Computer Questions Answered</font color=orange></i>

 

[Jill]

>>> no way of knowing that you had Home Edition

My fault, I guess I've been flogging this horse for so long I assume everyone knows! Sorry! x

I have been sure it was network related for almost a year, and device driver since I started seriously researching it. I have numerous "odd" networking problems as well, another thread...!

>>> your system is already unstable

Yes, but when the error occurs, the system goes down and comes back up. My services are working. If I stop the system rebooting on error, am I risking losing my services as well?

The BSOD's happen every 2-3 days, but, I don't sit by the machine 24/7 so it was a total suprise to see it actually happen, and point to srv.sys.

>>> or working from DOS.

I can't work from DOS, I am running XP, there is no DOS on my machine, (any of my machines in fact!).

>>> I'd look for a newer driver

I have tried all the "common" fiddles with drivers in the networking arena, (because of other networking problems I have). Despite DAYS of research, I cannot find anything better than what I have. These have been deleted and replaced with fresh copies!

>>> moving the new NIC card to another open PCI slot,

You think like me! Been there - done that!

Memory: checks out fine with inbuilt tools, Belarc and SiSoft Sandra.
PSU: Is under minimal load for the configuration it was designed for, and has 1 more fan than recomended.
System: is not a year old yet - been a pain in the arse for so long it feels like it is older, but in fact, only 10 months old.
APIC: don't know about that.
Registry starups: Have run without anything enabled - no good.
Repair: tried that several times - have a totally legit system, only thing I have not tried in that line is a total reformat and install, but I'm reluctant because I know a) it'll be problematic b) I am not sure it will fix it - the system is, after all, pretty much as installed, it is so unreliable, I've never used it for much! (Typing now on my reliable 233MHz P-II system under 95!!!).

I'll try looking for hidden devices.

As for Belarc etc., uyeah, I got htose months back, they are interesting in themselves, but have not helped me really...

 

[Toejam31]

Yes, but when the error occurs, the system goes down and comes back up. My services are working. If I stop the system rebooting on error, am I risking losing my services as well?

You may have no other choice, if you intend on gaining enough information to actually discover what the error is, and what is causing the system to crash and reboot. What you are risking is increasing instability and possible data loss each time the BSOD occurs. The computer may finally become unbootable, altogether. It certainly won't repair itself by thinking optimistic thoughts, or hoping it will go away.

I can't work from DOS, I am running XP, there is no DOS on my machine, (any of my machines in fact!).

Working from DOS is simple matter, unless you have NTFS partitions, which can't be manipulated (and sometimes even seen) by older operating systems without a third-party tool. Running DOS requires nothing more than booting the system with a floppy disk that contains a working version of DOS, or Windows DOS, such as a Win98SE boot disk. Which is one of the reasons I continue to advocate FAT32 partitions on this forum, even with WinXP.

I have tried all the "common" fiddles with drivers in the networking arena, (because of other networking problems I have). Despite DAYS of research, I cannot find anything better than what I have. These have been deleted and replaced with fresh copies!

If you would be kind enough to post some information about the system, including the brand and model number of the NIC card, I suspect that I could locate the newest driver for you, and post a link. Otherwise, this is ESP troubleshooting, and I have little or no psychic ability! ;-) Therein lies many of the problems when attempting to remotely troubleshoot a system ... getting the user to post adequate information is like pulling teeth. No offense intended.

Memory: checks out fine with inbuilt tools, Belarc and SiSoft Sandra.

Neither of these utilities is meant for testing memory chips for errors, which can cause unusual problems in any system, including numerous BSODs of different types, which may be seemingly unrelated. Try Memtest86, instead.

APIC: don't know about that.

Take a look. This is only needed for systems that have more than one processor, and I've seen several computers that became increasingly unstable over various periods of time with the newer controller enabled, especially pertaining to NIC cards, video cards, and USB devices.

And again, I mention ... a BIOS flash might be in order for the operating system to become stable. So might a complete, fresh installation, with the minimum hardware installed at the time (after the BIOS flash, and checking to see if the APIC controller is running, with the safest BIOS settings enabled.)

Please post detailed hardware information, currently running driver versions, a list of installed software, and any programs that are loading up with Windows.

Without this information, any help you might receive is nothing but educated guessing, instead of something specific that you might find useful. Which is why my answers so far have covered a fairly wide range of different things for you to try. It's shooting in the dark, which is nearly as frustrating a feeling as you've experienced while watching that BSOD flash by.

Toey

<A HREF="http://forums.btvillarin.com/index.php?act=ST&f=41&t=328&s=91c282f2e5207e99b7a652ee13b3512a" target="_new"><font color=green>My System Rigs</font color=green></A>
___________________________________________

<A HREF="http://forums.btvillarin.com/" target="_new"><b><font color=purple>BTVILLARIN.com</font color=purple></b></A> - <i><font color=orange>Your Computer Questions Answered</font color=orange></i>

 

[Jill]

>>>
It certainly won't repair itself by thinking optimistic thoughts, or hoping it will go away.
<<<

I've been around machines for to long to believe that it would be fixed by that approach!

>>> unless you have NTFS partitions

I have a single NTFS partition.

>>> including the brand and model number of the NIC card,

The motherboard, (ECS P4S5A/DX+ 1.0), has an onboard SiS900 NIC. To eliminate it from my ongoing networking problems, I have disabled it in the BIOS and have installed an SMC 1233A-TX, (which is basically an ADMtek AN983), this NIC is identical to that in my other machine which does not have networking problems. The swap did not fix or change anything.

>>> Try Memtest86, instead.

I downloaded MemTest86, however, when I try to run the Install to create the floppy, it momentarily flashes a console window then exits.

>>> Take a look.

I browsed my system, and my BIOS, I cannot find anything called APIC.

>>> detailed hardware information

The output from Belarc can be seen here...

http://www.adrianxw.dk/personalsite/JillsPages/foniks.html

Hows that?

Thanks again for your help.

Jill.

 

[Toejam31]

After browsing through the Belarc file, I'd have to settle on attempting a BIOS flash in the hope that this would repair the problem, and add some stability to the system. You've got a very early revision of the ECS P4S5A/DX+ mainboard, and the date of the American Megatrends BIOS is somewhat out-of-date. The date of the most current BIOS is 05/23/03. Yours is 04/02/01.

<A HREF="http://www.ecsusa.com/downloads/p4s5a_dx_plus.html" target="_new">P4S5A/DX+ PCB 5.X</A>

<A HREF="http://www.ecsusa.com/downloads/flashAMI.html" target="_new">How to use AMI Flash Utility</A>

Take careful notes of the BIOS settings (on paper) before flashing, as changes to the BIOS might not show up in the mainboard manual, and you'll need a reference.

If you'd like to install the latest driver for the SMC 1233A-TX NIC card, it is available here:

<A HREF="http://www.smc-europe.com/english/support/driver_manual/network/1233ATX.html" target="_new">SMC1233A-TX</A>

I'd consider this an important second step, since your errors tend to point towards problems that are networking-related. Updating the driver certainly couldn't hurt, if it happens to be the source of the problem.

I saw little that is software-based that might be a trouble spot. Nero is not the latest version, and neither is PowerDVD or the DivX codecs. The video driver is slightly out-of-date, and the nVidia Drive Helper Service doesn't need to be running. But none of these applications should cause BSODs in WinXP, simply because they are older versions.

Beyond that (and a suggestion that you might consider editing the Administrative Services, as you may have a few items running that simply aren't needed for a streamlined system), I didn't see anything that normally causes a conflict.

I'd back up any critical data, proceed with the BIOS flash, and then run the system for a few days to ascertain whether or not this corrects the problem. If not, post back here, with all the information on any errors that occur that you are able to document, and we'll try something else.

Toey

P.S. Perhaps you might be able to create the Memtest86 floppy on the other machine. What you described when attempting to make the bootable floppy is unusual, to say the least, and not something I've seen happen with that particular program in the past. I'd still like to see a complete check of the memory, especially after the BIOS flash is complete.

<A HREF="http://forums.btvillarin.com/index.php?act=ST&f=41&t=328&s=91c282f2e5207e99b7a652ee13b3512a" target="_new"><font color=green>My System Rigs</font color=green></A>
___________________________________________

<A HREF="http://forums.btvillarin.com/" target="_new"><b><font color=purple>BTVILLARIN.com</font color=purple></b></A> - <i><font color=orange>Your Computer Questions Answered</font color=orange></i>

 

[knight0]

You might want to try creating the Memtest86 floppy through Command Prompt (Start->All Programs->Accessories). At least now the window won't close immediately. Also, make sure you extract all the contents of the zip file.

I was experiencing random reboots last month as well. A new driver for my network card made it all go away.

A bad hard drive might also cause problems. I had a faulty hard drive a year ago that caused all sorts of weird crashes and reboots. Hard drive manufacturers usually provide diagnostic tools you can run.

 

[Jill]

I could not get the MemTest86 to work on the XP system, no matter what I did. It would not work on my other system either, it seemed to take exception to my LS120 drive - I don't have a standard floppy in that box.

Eventually, I was at a friends and we managed to produce a working floppy.

This I have now run on the offending machine, and, really as expected, I let it run 4 full passes and it reported no errors.

I'll check out the driver today - but that site looks very familiar to me - I have that deja-vu that I've done this before!

I'll get back.

*** EDIT ***

Okay, I do, indeed, have that .zip in my downloads folder. Running the Device Manager device driver update and pointing it to the extracted driver file - the manager says it cannot find a better driver. Feeling bold, I said install it anyway, and it did, warning me that I was probably destabilising my system.

Have I goofed here?

(I did the driver first as it is something I am familiar with - the BIOS is something I tend to leave alone - I've never "flashed" one before).

<P ID="edit"><FONT SIZE=-1><EM>Edited by Jill on 10/24/03 07:29 AM.</EM></FONT></P>

 

[Guest]

(I did the driver first as it is something I am familiar with - the BIOS is something I tend to leave alone - I've never "flashed" one before).

It's pretty simple and straight forward, if you follow the instructions. Judging from your previous posting, you sound like your up to the job. However, if you don't feel comfortable doing it, then you should probably let someone else do it for you. That said, it is risky. I have only done it a few times myself, but I always download the newest bios, and, the version that I have already, TWICE. Just in case of a corrupted download or something. And then make the floppies out of the seperate downloads. This is probably overkill, but I like to be safe. After you boot from the floppy, follow the instructions. You should be OK.

Good Luck!

_________________________
Your arrogance is boring!

 

[Jill]

Okay, now I'm really confused!

I've been running with the new driver, and have not flashed my BIOS yet, (although I have made the disks, 2 as suggested).

Could this new driver have done something that effects the whole network? The reason I ask is that I'm now seeing a whole range of bizarre networking problems on /both/ of my machines.

The XP system keeps popping up a little bubble in the system tray area saying "a cable is unplugged", however, the "fault" disappears again without intervention, so there clearly is not a cable unplugged.

I'm guessing my other machine has the same problem, because every now and again, it asks me to power up my old modem, (I used to use a dial up before the ADSL came), presumably because it cannot see the network connection any more. Additionally, my Seti@Home screen saver cannot connect to it's server any more. My anti virus "Live Update" doesn't work anymore, and even a "ping" doesn't work it gives me error 10050.

I powered down the XP system and still had the problem with the other. So I powered everything down, machines, router, DSL modem the lot, and then brought them up again, minus the XP. Now I could update my AV software and collect another Seti work unit. I bring the XP system up and now, again, I have the problems with the other machine.

I have not had any "driver like" BSOD's since changing the driver, instead, the system has gone down twice, once with errors claiming to be disk/ntfs based, (didn't see the BSOD), the second time with MEMORY MANAGEMENT on the BSOD.

Does this turn any lights on for anyone? Like I said, I'm more puzzled now then I was before, I'd considered that to be impossible!