IIS * Service service terminated unexpectedly

Hello all,

I'm a having a problem in IIS 5 with all web services
shutting down & restarting a coupld of times a day.

The event log usually looks like this:

1.)Application popup: inetinfo.exe - Application Error :
The instruction at "0x77f952f8" referenced memory
at "0x00ce8000". The memory could not be "read".

2.)The IIS Admin Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective
action will be taken in 1 milliseconds: Run the configured
recovery program.

3.)The FTP Publishing Service service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 0 milliseconds: No
action.

4.)The Network News Transport Protocol (NNTP) service
terminated unexpectedly. It has done this 1 time(s). The
following corrective action will be taken in 0
milliseconds: No action.

5.)The Simple Mail Transport Protocol (SMTP) service
terminated unexpectedly. It has done this 1 time(s). The
following corrective action will be taken in 0
milliseconds: No action.

6.)The World Wide Web Publishing Service service
terminated unexpectedly. It has done this 1 time(s). The
following corrective action will be taken in 0
milliseconds: No action.

7.)IIS stop command received from user NT
AUTHORITY\SYSTEM. The logged data is the status code.
For additional information specific to this message please
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

8.)The Microsoft NNTP Service 5.00.0984 Version:
5.0.2195.6702 Virtual server 1 has been started.

9.)The Microsoft NNTP Service 5.00.0984 Version:
5.0.2195.6702 has been started.

10.)IIS start command received from user NT
AUTHORITY\SYSTEM. The logged data is the status code.
For additional information specific to this message please
visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.

This all happens within 15 seconds.

I've been doing much research on the web & at
microsoft.com & have come across many hotfixes with some
related to viruses, but I can apply none of them since I
am on service pack 4, & all the updates are for service
pack 2. I actually did the autoupdate yesterday 12/11, so
I am currently uptodate on updates.

I've also downloaded the hotfix checker, but that wasn't
of much use.

Virus sig's are up to date, & recently scanned system,
There are no other application log entries that take palce
anywhere near these errors.

c:\winnt\system32\logfiles logs show nothing around these
events.

I have the .net architecture installed, & am running php &
mysql, although everything has ran fine for over 3 months
without any errors in event viewer.

Right now I have Visual Studio waiting to debug this error:

1.)Application popup: inetinfo.exe - Application Error :
The instruction at "0x77f952f8" referenced memory
at "0x00ce8000". The memory could not be "read".

the next time it comes up.

I've also found in other threads the use of
iisstate -p <PID> -sc <enter>, but I do not know where to
find this program.

Please, please, any help would be greatly appreciated.
Even though this only brings problems to the server a
couple times a day for about 30 seconds total, I'm still
having to deal with corrupt databases because of this.

Samueli,

If your server is crashing or hanging you might want to
download our ReJuvin8 tool. It's free for the first
15-days. It can keep your site running despite problems.

It's designed to detect problems then restart or reboot.
It can restart ANY programs, services, or processes in
precise order. It doesn't fix bugs but it does give you some
breathing room while you are finding them. ReJuvin8 also
gives you email and telephone alert messages and graphic
status reports.

It can also test, alert, and report on URLs running anywhere
on any server on your net connection. So if you use multiple
servers you can use them to watch each other, too.

ReJuvin8 has both an automatic and a custom mode. In the
auto mode you make all the settings by pointing and
clicking. This will handle most applications.

The custom mode uses heartbeat synch files to get absolute
detection that key processes are working. Tools and
instructions are provided to help you do this. We also offer
customization as a contract service.

Charles


Get ReJuvin8 at: <a style='text-decoration: underline;' href="http://www.rejuvin8.net?ac=ch1" target="_blank">http://www.rejuvin8.net?ac=ch1</a>


"Samueli" <info.RemoveThis@coinmonger.com> wrote in message
news:270901c3c0d2$47e48690$7d02280a@phx.gbl...
 > Hello all,
 >
 > I'm a having a problem in IIS 5 with all web services
 > shutting down & restarting a coupld of times a day.
 >
 > The event log usually looks like this:
 >
 > 1.)Application popup: inetinfo.exe - Application Error :
 > The instruction at "0x77f952f8" referenced memory
 > at "0x00ce8000". The memory could not be "read".
 >
 > 2.)The IIS Admin Service service terminated unexpectedly.
 > It has done this 1 time(s). The following corrective
 > action will be taken in 1 milliseconds: Run the configured
 > recovery program.
 >
 > 3.)The FTP Publishing Service service terminated
 > unexpectedly. It has done this 1 time(s). The following
 > corrective action will be taken in 0 milliseconds: No
 > action.
 >
 > 4.)The Network News Transport Protocol (NNTP) service
 > terminated unexpectedly. It has done this 1 time(s). The
 > following corrective action will be taken in 0
 > milliseconds: No action.
 >
 > 5.)The Simple Mail Transport Protocol (SMTP) service
 > terminated unexpectedly. It has done this 1 time(s). The
 > following corrective action will be taken in 0
 > milliseconds: No action.
 >
 > 6.)The World Wide Web Publishing Service service
 > terminated unexpectedly. It has done this 1 time(s). The
 > following corrective action will be taken in 0
 > milliseconds: No action.
 >
 > 7.)IIS stop command received from user NT
 > AUTHORITY\SYSTEM. The logged data is the status code.
 > For additional information specific to this message please
 > visit the Microsoft Online Support site located at:
<font color=purple> > <a style='text-decoration: underline;' href="http://www.microsoft.com/contentredirect.asp.</font" target="_blank">http://www.microsoft.com/contentredirect.asp.</font</a>>
 >
 > 8.)The Microsoft NNTP Service 5.00.0984 Version:
 > 5.0.2195.6702 Virtual server 1 has been started.
 >
 > 9.)The Microsoft NNTP Service 5.00.0984 Version:
 > 5.0.2195.6702 has been started.
 >
 > 10.)IIS start command received from user NT
 > AUTHORITY\SYSTEM. The logged data is the status code.
 > For additional information specific to this message please
 > visit the Microsoft Online Support site located at:
<font color=purple> > <a style='text-decoration: underline;' href="http://www.microsoft.com/contentredirect.asp.</font" target="_blank">http://www.microsoft.com/contentredirect.asp.</font</a>>
 >
 > This all happens within 15 seconds.
 >
 > I've been doing much research on the web & at
 > microsoft.com & have come across many hotfixes with some
 > related to viruses, but I can apply none of them since I
 > am on service pack 4, & all the updates are for service
 > pack 2. I actually did the autoupdate yesterday 12/11, so
 > I am currently uptodate on updates.
 >
 > I've also downloaded the hotfix checker, but that wasn't
 > of much use.
 >
 > Virus sig's are up to date, & recently scanned system,
 > There are no other application log entries that take palce
 > anywhere near these errors.
 >
 > c:\winnt\system32\logfiles logs show nothing around these
 > events.
 >
 > I have the .net architecture installed, & am running php &
 > mysql, although everything has ran fine for over 3 months
 > without any errors in event viewer.
 >
 > Right now I have Visual Studio waiting to debug this error:
 >
 > 1.)Application popup: inetinfo.exe - Application Error :
 > The instruction at "0x77f952f8" referenced memory
 > at "0x00ce8000". The memory could not be "read".
 >
 > the next time it comes up.
 >
 > I've also found in other threads the use of
 > iisstate -p <PID> -sc <enter>, but I do not know where to
 > find this program.
 >
 > Please, please, any help would be greatly appreciated.
 > Even though this only brings problems to the server a
 > couple times a day for about 30 seconds total, I'm still
 > having to deal with corrupt databases because of this.<!-- ~MESSAGE_AFTER~ -->