Exchange Server Forums

Information store crashes on attachements in OWA

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Information Stores >> Information store crashes on attachements in OWA

Page: [1] 2 next > >>

Message

<< Older Topic Newer Topic >>

Information store crashes on attachements in OWA - 9.Apr.2004 8:54:00 AM

Haroun

Posts: 14
Joined: 21.Mar.2004
From: Netherlands
Status: offline

Hello,

I have a major problem with my Information Store
When users try to attachement with OWA, the store crashes instantly with on the client side the known 503 service unavailable error and on the server side the following events are logged:
Application eventlog:
Event Type: Error
Event Source: MSExchangeIS
Event Category: General
Event ID: 9673
Date: 4/9/2004
Time: 6:13:57 AM
User: N/A
Computer: Exchange
Description:
An exception with code 0xc00000fd was thrown in module C:\WINDOWS\system32\ntdll.dll; some parameters and their values were <Exception address - 57fffffd>. A significant section of the call stack is in the data section.

For more information, click http://www.microsoft.com/contentredirect.asp.
Data:
0000: b8 32 9c 2e c5 8c f6 77 +2?.+?�w
0008: d0 32 9c 2e d8 d6 9f 2e -2?.++?.
0010: ec 32 9c 2e a8 32 9c 2e 82?.�2?.
0018: fd ff ff 57 02 00 00 00 ��W....
0020: d0 32 9c 2e d8 d6 9f 2e -2?.++?.
0028: b4 8b f6 77 d0 32 9c 2e �?�w-2?.
0030: d8 d6 9f 2e ec 32 9c 2e ++?.82?.
0038: a8 32 9c 2e fd ff ff 57 �2?.��W

System eventLog:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10002
Date: 4/9/2004
Time: 7:05:04 AM
User: NT AUTHORITY\SYSTEM
Computer: Exchange
Description:
Access denied attempting to launch a DCOM Server. The server is:
{9DA0E11E-86CE-11D1-8699-00C04FB98036}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I am running windows 2003 Enterprise, Exchange 2003 on a domain controller. The server has 1024 MB ram with the /3GB /userva=3030 on
I am runnin TrendMicro ScanMail Exchange 6.2 with both store and Smtp scanning, but this is not the issue, i already tried disabling it and ran the the test again, same issue. OWA is running forms-based logon (https).
Please help, the majority of the customers use OWA accessing their mail.
Thanks in Advance
Haroun Debbabi

Post #: 1

Featured Links*

RE: Information store crashes on attachements in OWA - 21.Aug.2004 12:47:00 PM

Haroun

Posts: 14
Joined: 21.Mar.2004
From: Netherlands
Status: offline

Is there no one else with the same issue?
Do i really have to uninstall and reinstall everything? [Confused]

Kind regards,
Haroun Debbabi

(in reply to Haroun)

Post #: 2

RE: Information store crashes on attachements in OWA - 21.Aug.2004 2:36:00 PM

Henrik Walther

Posts: 6928
Joined: 21.Nov.2002
From: Copenhagen, Denmark
Status: offline

Instead of beginning to reinstall anything I would spend a few bucks and make a call to Microsoft Product Support Services.

(in reply to Haroun)

Post #: 3

RE: Information store crashes on attachements in OWA - 2.Sep.2004 8:43:00 PM

Yichuan

Posts: 1
Joined: 2.Sep.2004
From: New York
Status: offline

I have the exact same problem and also run E2K3 on a W2K3 domain controller.

Does anyone know what the issue is and have any solution to it?

Thanks a lot!

(in reply to Haroun)

Post #: 4

RE: Information store crashes on attachements in OWA - 20.Sep.2004 11:35:00 AM

Cannis

Posts: 1
Joined: 20.Sep.2004
From: Denmark
Status: offline

I'm having the same problem and none of the fixes supplied by MS worked:
http://support.microsoft.com/?kbid=837285
http://support.microsoft.com/?kbid=823159

(in reply to Haroun)

Post #: 5

RE: Information store crashes on attachements in OWA - 20.Sep.2004 2:20:00 PM

rytmehans

Posts: 848
Joined: 10.Jul.2004
From: Denmark
Status: offline

Hi,

Have you tried to remove the domain controller role from the Exchange server??

(make sure that you have at least 1 DC also configured as a GC before testing this)

(in reply to Haroun)

Post #: 6

RE: Information store crashes on attachements in OWA - 20.Sep.2004 3:23:00 PM

Haroun

Posts: 14
Joined: 21.Mar.2004
From: Netherlands
Status: offline

Hi Leif,
No, i didnt test that particular scenario, i did test the owa on the front-end server, even when attaching an opject to a mail, the information store will still crash on the back-end!

Kind regards,
Haroun

(in reply to Haroun)

Post #: 7

RE: Information store crashes on attachements in OWA - 29.Jan.2005 1:10:00 PM

tommthom

Posts: 15
Joined: 19.Jan.2005
From: Oslo, Norway
Status: offline

Yichuan: Did you find any solution? We have the same config (E2k3 on w2k3 server) and this occurs each time someone tries to attach something to a mail in OWA.
We have disabled the possibility for attachments in OWA at the moment, so that IS won't hang all the time.
We have hundreds of students using our webmail.

From System log - Event ID 7034
The Microsoft Exchange Information Store service terminated unexpectedly. It has done this 3 time(s).

From Application log - Event ID 9673
MSExchangeIS
An exception with code 0xc00000fd was thrown in module C:\WINDOWS\system32\ntdll.dll; some parameters and their values were <Exception address - 8962c983>. A significant section of the call stack is in the data section.

Any news/help on this subject?

Thanks [Smile]

[ January 29, 2005, 01:12 PM: Message edited by: Thomassen ]

(in reply to Haroun)

Post #: 8

RE: Information store crashes on attachements in OWA - 29.Jan.2005 2:43:00 PM

Henrik Walther

Posts: 6928
Joined: 21.Nov.2002
From: Copenhagen, Denmark
Status: offline

Did you install Exchange 2003 SP1? If not I suggest you do that and afterwards apply below Exchange Server 2003 post-RTM store rollup:

How to obtain the Exchange Server 2003 post-RTM store rollup:
http://support.microsoft.com/?id=838236

(in reply to Haroun)

Post #: 9

RE: Information store crashes on attachements in OWA - 29.Jan.2005 2:59:00 PM

tommthom

Posts: 15
Joined: 19.Jan.2005
From: Oslo, Norway
Status: offline

Hi.
Thanks for your reply.

We have installed SP1 on Exchange 2003.

I went to the link you gave me, and I see that in the list of fixes, It takes care of two of the issues which I think is causing this error.

http://support.microsoft.com/default.aspx?scid=kb;en-us;872963
Maybe this for E2k3
http://support.microsoft.com/default.aspx?scid=kb;en-us;823597

But since we have installed SP1 it gives an error:
"838236 Setup Error:
Setup has detected that the service pack version of the system installed is newer than the update you are applying to it.

You can install this update on Service Pack %d only."

Is there a work-around for getting this fix in?

[ January 29, 2005, 03:22 PM: Message edited by: Thomassen ]

(in reply to Haroun)

Post #: 10

RE: Information store crashes on attachements in OWA - 31.Jan.2005 10:36:00 AM

tommthom

Posts: 15
Joined: 19.Jan.2005
From: Oslo, Norway
Status: offline

Ok, then I've tested some more.

I got 2 patches from MS support.
I installed the first one, http://support.microsoft.com/?kbid=885910 , restarted the server, no change.

Then I installed the second one, http://support.microsoft.com/?kbid=872963 , restarted the server, still no change.

It still hangs when using attachment in OWA...
[Confused]

(in reply to Haroun)

Post #: 11

RE: Information store crashes on attachements in OWA - 31.Jan.2005 10:55:00 AM

Henrik Walther

Posts: 6928
Joined: 21.Nov.2002
From: Copenhagen, Denmark
Status: offline

Then you might want to raise a call with Microsoft Product Support Services...

(in reply to Haroun)

Post #: 12

RE: Information store crashes on attachements in OWA - 31.Jan.2005 6:38:00 PM

BeTaCam

Posts: 423
Joined: 24.Feb.2003
From: India
Status: offline

Hi

Is there a conversion happening between HTML to RTF or vice versa ?

do let me know please !

/
BC

(in reply to Haroun)

Post #: 13

RE: Information store crashes on attachements in OWA - 4.Feb.2005 6:37:00 AM

Guest

Attention ! This is a known issue with Exchange and OWA, but only if your server has been compromised. Their is a root kit called Hacker Defender 1.00 that causes this issue. Basicly this root kit causes OWA to access a block of memory that is not accessible, the result is your Exchange Information Store crashes.

You can find a piece of detection software at the following link.

.62.zip]Hacker Defender Detection

Simply unzip run rkdetector.exe this will tell you if you have the root kit running. If the result is positive; you can download a piece of removal software at the following link. (Note: SysmonLog is a Microsoft service; in most cases it is disabled, but this tool seems to always pick it up; ignore.)

Removal Tool

Run this tool.... and remove Hacker Defender and any other Kit's it finds. Then reboot the system. The result will relieve some of your headaches, as it did mine.

I know this will help!

Nathan Bray

(in reply to Haroun)

Post #: 14

RE: Information store crashes on attachements in OWA - 4.Feb.2005 6:40:00 AM

Guest

Sorry the Detection Software is located at

http://bagpuss.swan.ac.uk/comms/RKDetectorv0[1].62.zip

.62.zip]Detection

Nathan Bray

(in reply to Haroun)

Post #: 15

RE: Information store crashes on attachements in OWA - 8.Feb.2005 1:56:00 PM

tommthom

Posts: 15
Joined: 19.Jan.2005
From: Oslo, Norway
Status: offline

Problem now fixed [Smile]

[ February 09, 2005, 02:21 PM: Message edited by: Thomassen ]

(in reply to Haroun)

Post #: 16

RE: Information store crashes on attachements in OWA - 11.Feb.2005 3:24:00 PM

troublefix

Posts: 2
Joined: 10.Feb.2005
From: Kehl / Germany
Status: offline

Hello.

We have the same problem and it is good to know "we are not alone". We have download rkdetector and it says "Rootkit Hacker Defender V1.0.0 is installed", but the Unhackme-tool says "There is no trojan found" ??? The OWA problem still exists. [Frown]

Any idea ?

(in reply to Haroun)

Post #: 17

RE: Information store crashes on attachements in OWA - 16.Feb.2005 9:37:00 AM

tommthom

Posts: 15
Joined: 19.Jan.2005
From: Oslo, Norway
Status: offline

Maybe it is unable to detect the trojan..

But you can always try to boot with the windows cd and go into recovery mode. Do the list services command, and check carefully everything which is listed as startup services or boot services. Check for suspicious things. Then if you find any, try to disable them, and then checking the service in windows when you startup again. Maybe you will find it leads to an exe with the trojan or similar. It's like well past 200 services you see in the recovery mode, so take your time and do it thorough.

(in reply to Haroun)

Post #: 18

RE: Information store crashes on attachements in OWA - 16.Feb.2005 3:12:00 PM

troublefix

Posts: 2
Joined: 10.Feb.2005
From: Kehl / Germany
Status: offline

Hello.

I have found some tools like knlps, knlsc13. they show exactly the hidden services so i can check the system. The hacker defender works under the name of a service ipxmon32. Stop the service, delete the files and registry keys - done. It works fine.

(in reply to Haroun)

Post #: 19