Microsoft KB Archive/905539

From BetaArchive Wiki

Article ID: 905539

Article Last Modified on 12/3/2007


APPLIES TO

  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Small Business Server 2003 Premium Edition
  • Microsoft Windows Small Business Server 2003 Standard Edition


Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry


SYMPTOMS

On a computer that is running Microsoft Windows Small Business Server 2003 or Microsoft Windows Server 2003, you may experience any one of the following symptoms:

  • Your computer automatically restarts.

  • After you log on, you receive the following error message:

    Microsoft Windows
    The system has recovered from a serious error.
    A log of this error has been created.
    Please tell Microsoft about this problem.
    We have created an error report that you can send to help us improve Microsoft Windows. We will treat this report as confidential and anonymous.
    To see what data this error report contains, click here.

    If you click the click here link at the bottom of the message box, you may receive a Stop error that is similar to one of the following data samples:

    Data sample 1

    BCCode: 00000020 BCP1: 0x00000000 BCP2: 0x0000ffff BCP3: 0x00000000 
BCP4: 0x00000001 OSVer: 5_1_2600 SP : 0_0 Product: 256_1

    Data sample 2

    BCCode: 00000020 BCP1: 0x00000000 BCP2: 0x0000fffe BCP3: 0x00000000 
BCP4: 0x00000001 OSVer: 5_1_2600 SP: 0_0 Product    : 256_1

  • You receive the following Stop error messages:

    Message 1

    A problem has been detected and Windows has been shut down to prevent damage to your computer...
    Technical information:

        • STOP: 0x00000020 (0x0x00000000, 0x0x0000ffff, 0x0x00000000, 0x0x00000001)

    KERNEL_APC_PENDING_DURING_EXIT

    Message 2

    A problem has been detected and Windows has been shut down to prevent damage to your computer...
    Technical information:

        • STOP: 0x00000020 (0x0x00000000, 0x0x0000fffe, 0x0x00000000, 0x0x00000001)

    KERNEL_APC_PENDING_DURING_EXIT

  • An error that is similar to the following is logged in the System event log:

    Date: date
    Source: System
    Error Time: time
    Category: (102)
    Type: Error
    Event ID: 1003
    User: N/A
    Computer: COMPUTER
    Description: Error code 00000020, parameter1 0x00000000, parameter2 0x0000ffff, parameter3 0x00000000, parameter4 0x00000001. For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 30 30 30 30 30 30 35 0000020 0020: 30 20 20 50 61 72 61 6d 0 Param 0028: 65 74 65 72 73 20 66 66 eters ff 0030: 66 66 66 66 64 31 2c

Notes

  • The Stop errors may occur intermittently as long as the server is being used. The Stop errors may also occur during startup. If a Stop error occurs during startup, you can typically start the server in Safe Mode. However, if you disable all startup items and third-party services by using the System Configuration Utility (Msconfig.exe), the error still occurs when you try to start the server as you typically would.
  • The symptoms of a Stop error vary according to your computer's system failure options. For more information about how to configure system failure options, click the following article number to view the article in the Microsoft Knowledge Base:

    307973 How to configure system failure and recovery options in Windows

  • The four parameters that are inside the parentheses of a Stop error vary according to the computer's configuration.
  • Not all "Stop 0x00000020" errors are caused by the problem that is described in this article.


CAUSE

This problem is known to occur on servers that are running Symantec pcAnywhere 11.5 with Symantec AntiVirus 8.x or with Symantec AntiVirus 9.0. An updated version of the Symantec Event Handler driver (Symevent.sys) causes this problem. The Symevent.sys driver is installed with pcAnywhere 11.5. The Symevent.sys driver causes the Symantec real-time protection drivers to generate the "Stop 0x00000020" error.

RESOLUTION

To resolve this problem, download and install the latest Symevent.sys driver. For more information, visit the following Symantec Web sites:

Error: "STOP 0x00000020 KERNEL_APC_PENDING_DURING_EXIT" on Windows 2003 (Document ID:2005030816000512)


Updating the Symevent files (Document ID:1998092408260848)


Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

WORKAROUND

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
To work around this problem, disable the Symantec real-time protection drivers. If you cannot start the server as you typically would, start the server in Safe Mode, and then temporarily disable the real-time protection drivers.

Note Follow these steps only if the server does not start as it usually does. After you disable the real-time protection drivers and start the server as you typically would, we recommend that you immediately install the updated Symevent.sys driver. Then, re-enable the real-time protection drivers.

To disable the real-time protection drivers, use the appropriate steps for the version of Symantec AntiVirus that is running.

CAUTION The server will be vulnerable to viruses and other malicious software as long as the real-time protection drivers are disabled. Therefore, we recommend that you disconnect the server from the network until the drivers are re-enabled.

To disable the Symantec AntiVirus 8.x real-time protection drivers, follow these steps:

  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

  3. Click the Navap key.
  4. In the right pane, double-click the Start entry.
  5. In the Value data box, change the value to 4, and then click OK.
  6. Under the Services key, click the Navapel key.
  7. In the right pane, double-click the Start entry.
  8. In the Value data box, change the value to 4, and then click OK.
  9. Quit Registry Editor.
  10. Disconnect the server from the network.
  11. Restart the server.

To disable the Symantec AntiVirus 9.0 real-time protection drivers, follow these steps:

  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

  3. Click the Savrt key.
  4. In the right pane, double-click the Start entry.
  5. In the Value data box, change the value to 4, and then click OK.
  6. Under the Services key, click Savrtpel.
  7. In the right pane, double-click the Start entry.
  8. In the Value data box, change the value to 4, and then click OK.
  9. Quit Registry Editor.
  10. Disconnect the server from the network.
  11. Restart the server.

For information about how to re-enable Symantec AntiVirus real-time protection drivers, contact Symantec.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Keywords: kbbug kberrmsg kbfix kbqfe KB905539



Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.


Retrieved from ‘https://www.betaarchive.com/wiki/index.php?title=Microsoft_KB_Archive/905539&oldid=216321’
the Creative Commons 3.0 ShareAlike (except the Microsoft KB Archive).
Powered by MediaWiki