BillBomm wrote:
> This happened this morning and rebooted itself.
> If you want to see any previous entrys let me know. This has been happeneing
> since Friday 7-8-05
> I have also disabled the NLS metering per TID 10087177
>
> We also run another 6.0 server with Groupwise and have had no problems.
>
> ************************************************** *******
>
> Server J*** halted Wednesday, July 13, 2005 10:42:48.000 am
> Abend 1 on P01: Server-5.60.05: Page Fault Processor Exception (Error code
> 00000000)
>
> Registers:
> CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0010 SS = 0010
> EAX = 84405000 EBX = CA723310 ECX = CA723264 EDX = 00000002
> ESI = CA62BA00 EDI = 43434343 EBP = 00000198 ESP = 89945C80

^^^^^^^^

ASCII codes for "CCCC"

Any of the registers filled with the same value over and over _tend_ to
indicate a buffer overflow triggered by an external virus/worm
attempting to crash and infect the machine.

If you are running Native File Access and don't need it, unload it
(unpactched CIFS.NLM is vulnerable to these crashes). if you do need it,
make sure you get the CIFSPT9 (for NetWare 6.0)

> EIP = 002618AB FLAGS = 00010087
> 002618AB 8B5704 MOV EDX,[EDI+04]=?
> EIP in SERVER.NLM at code start +0005A5CBh
> Access Location: 0x43434347


ADrian