Jump to content


Photo

Blue Screen Stop 0x0000007f

Started by GIUSEPPE CAPECE , 22 April 2009 - 08:08 PM
13 replies to this topic

GIUSEPPE CAPECE Members

GIUSEPPE CAPECE
  • 84 posts

Posted 22 April 2009 - 08:08 PM

Hi, The other yesterday I have upgraded my Server Citrix 4.5 to version 5.0 for Windows 2003 sp2 Multilanguage, the server is a IBM xSeries 3550 with all the updates for Windows Update. I have also updated BIOS, BMC, Raid and firmware the disks. up to this afternoon we went well. Suddenly, while users were related, the server restarted self is spread evenly, after 30 minutes has locked up with the black screen, I have restarted and the third time is exit a blue screen with written stop 0x0000007f. Then I have been to apply the patch of Microsoft kb928006, the server it seems that it is not it is more blocked or restarted. I would ask if someone is in the same position after the update to version 5.0 of Citrix for Windows 2003 with task pack 04.vi thank you for the aid



Dan Kaiser Members

Dan Kaiser
  • 23 posts

Posted 12 May 2009 - 02:06 PM

Giuseppe,

I installed R04 (from R03) on our XenApp 5/Win2K3 farm over the weekend and started getting blue screens yesterday: 0x0000007f (0x00000008, 0xf772fff0, 0x00000000, 0x00000000).

We run Symantec Antivirus Corporate Edition v10 on the servers and my guess is that this was contributing to the problem. I had tried the KStackMinFree and RegisterFileSystem registry settings and they didn't fix the problem, so I'm rolling back to R03 right now.

Anyway, you may want to only upgrade to R03 and whatever post-R03 you need.

Thanks,

Dan



GIUSEPPE CAPECE Members

GIUSEPPE CAPECE
  • 84 posts

Posted 15 May 2009 - 08:29 AM

I have updated the version of Symantec antivirus with the version endpoint last release and the problem seems not recur...



Dan Kaiser Members

Dan Kaiser
  • 23 posts

Posted 18 May 2009 - 02:19 PM

Giuseppe,

Could you tell me what versions of the client and the SYMEVENT components you upgraded to?

Thanks,

Dan



Arthur Harris Members

Arthur Harris
  • 6 posts

Posted 29 May 2009 - 06:18 PM

Dan I'm having the same issue and we are running version 12.5.4.1 of symevent.sys
I noticed that Symantecs Maintenance Release 8 updates symevent.sys to 12.5.4.2
What version of the file are you running?



Chris Orgel Members

Chris Orgel
  • 48 posts

Posted 04 June 2009 - 03:41 PM

Hello

I updated R04 (from R03) on our XenApp 5/Win2K3 farm in Dev and QA this past week. Started getting blue screens at the end of the week only on one server: 0x0000007f (0x00000008, 0xf772fff0, 0x00000000, 0x00000000). Other servers are fine with the same software installed. We also use SAV10 on the server. symevent.sys version is 12.2.1.1. Rolling back to R03 on one server to see if that actually temporarily resolves the issue.



Dan Kaiser Members

Dan Kaiser
  • 23 posts

Posted 09 June 2009 - 08:58 PM

I started an incident with Citrix about this issue and sent them some blue screen dumps to analyze.

They recommended that I disable the Symantec tamper protection filter driver - SPBBCDrv.

This is done in the registry:
HKLM\System|CurrentControlSet\Services\SPBBCDrv
Set the Start value to 4 (which means disabled) and reboot the server.

I did this on three of our servers and updated them to R04. After 4 days (2 weekend and 2 production), no blue screens.



Dan Foley Members

Dan Foley
  • 38 posts

Posted 19 June 2009 - 04:04 PM

I just came across this same issue this week. It would occur when a Mac user would connect remotely, launch a published application and then his Citrix Session would lock up when presented with the applications login screen. In the background, the Server was actually rebooting with the same stop error. After researching, I found the same Symantec articles and applied the KStackMinFree registry key to all the Citrix Servers. The user connected last night without incident. Any feedback from Citrix would be appreciated if you hear something back on your case. Thanks!

Dan



Scott Rose Members

Scott Rose
  • 1 posts

Posted 22 June 2009 - 06:17 AM

We have also been experiencing the same Blue Screen Stop codes since installing Hotfix Rollup 4. The BSOD seems to occur when a Mac client connects to the presentation server via either the Citrix client or Java client via CSG. We have also had it occur a couple of times with Windows users connecting with the Java client on the CSG. I will give the KStackMinFree registry changes for Symantec Antivirus a go and see if this sorts it out.

Cheers

Scott



Dan Kaiser Members
  • #10

Dan Kaiser
  • 23 posts

Posted 22 June 2009 - 04:04 PM

I closed the case with Citrix. After disabling the SPBBCDrv filter driver, we haven't had any blue screens.

Thanks,

Dan



Joey Albert Members
  • #11

Joey Albert
  • 2 posts

Posted 20 August 2009 - 04:26 PM

Had 4.5 R04 (we upgraded from 4 then applied the rollover). MAC Clients were crashing our servers regardless of client version (10 or 11). Something similar was posted at: http://forums.citrix...250765&tstart=0 but we didn't have RSA installed. After perusing this forum, I tried disabling SPBBCDrv on START=4. No luck. I tried upgrading to the latest build of SAV Corp Ed. No luck. The only thing that worked for me (like a charm) on all servers: http://www.brianmadd...ms/t/36255.aspx

Adding REG KEY KStackMinFree to 2200 as outlined in the URL above:
To modify the registry by adding the KStackMinFree value in Symantec AntiVirus 9.x or later

In the Registry Editor, go to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan

Right-click the RealTimeScan key, and then click New > DWORD Value.
Type KStackMinFree for the name of the new value.
Right-click the KStackMinFree value, and then click Modify.
Set the Base to Hexadecimal, and then type 2200 in the Value field.
Click OK.
Restart the Symantec AntiVirus service.
If the problem persists, restart the computer. After you restart the computer, confirm that the changes that you made to the KStackMinFree value are still present.



Jamie Lotz Members
  • #12

Jamie Lotz
  • 107 posts

Posted 10 November 2009 - 08:57 PM


I had the exact issue described in the above posts. I implemented both the KStackMinFree fix and the SPBBCdrv fix. My issue seems to have been resolved.

Now I'm seeing a lot of:
"Auto-Protect could not scan file <various files> for viruses due to low kernel stack."
warnings in my System logs every time a user logs on. The source of the warning messages is SAVRT.

Is this expected, and have others also noticed these messages after implementing the above fixes? I'm assuming this is related to the KStackMinFree fix, but just wanting to make sure.
Thanks.



PACER HIBLER Members
  • #13

PACER HIBLER
  • 125 posts

Posted 18 January 2010 - 02:25 PM

Im actually having this same problem now that I implemented the KStackMinFree key as specified by Symantect. I get the "Auto-Protect could not scan file for viruses due to low kernel stack. Did anybody have any recommendations on this issue? Im assuming that the Citrix Servers is less secure if Auto-Protect cannot complete its job.



Pawel Bogucki Citrix Employees
  • #14

Pawel Bogucki
  • 199 posts

Posted 18 January 2010 - 03:17 PM

It will be less secure but not that much as you think.

"File System Realtime Protection or Auto-Protect only skips files that are accessed by trusted kernel components (Ring 0). If files are accessed by user mode components (non-Ring 0), then File System Realtime Protection or Auto-Protect examines the files for viruses."

For details please check:
Blue screen with "STOP 0x0000007f" error on Windows 2003/XP/2000/NT
http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2002071208532048