BSOD 0x00000027 with mrxsmb20.sys

It's been second time I saw this BSOD today. No new software installed last days, just a bunch of MSFT updates. The only change in network configuration was changing enabling DMZ in the ADSL router for my IP, exposing it to the Internet (Windows Firewall & ISP filtering are enabled, anyway). No errors in the event log, except these two very suspicious entries recorded after the system restarted:

Log Name: System
Source: Microsoft-Windows-Dhcp-Client
Date: 11.05.2007 21:14:49
Event ID: 1003
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: DJETBOOK
Description:
The description for Event ID 1003 from source Microsoft-Windows-Dhcp-Client cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

00A0D15A87B4
%%2163146757

The description string for parameter reference (%1) could not be found

Very nice description, innit? And this one:

Log Name: System
Source: Microsoft-Windows-Dhcp-Client
Date: 11.05.2007 21:14:49
Event ID: 1002
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: DJETBOOK
Description:
The IP address lease 67.31.***.*** for the Network Card with network address *** has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).


I really really wonder where this IP comes from as my router assigns IPs from the internal 192 network.

Googling for this issues I found out I'm not alone with Toshiba Satellite A100 with 2GB RAM and this BSOD: http://forums.pcworld.co.nz/showthread.php?p=549688
Any ideas?

--
djet
Microsoft Certified Professional

This is an uncommon BSOD which frequently has memory issues as the cause.
http://aumha.org/a/stop.php#0x27

As such, I'd recommend running the memory tester that's built into the Vista
repair utilities.

Also, here's a fix that I found when searching for the error (may not apply
to you): http://support.microsoft.com/default.aspx/kb/935366

- John

"djet" wrote:

> It's been second time I saw this BSOD today. No new software installed
> last days, just a bunch of MSFT updates. The only change in network
> configuration was changing enabling DMZ in the ADSL router for my IP,
> exposing it to the Internet (Windows Firewall & ISP filtering are enabled,
> anyway). No errors in the event log, except these two very suspicious
> entries recorded after the system restarted:
>
> Log Name: System
> Source: Microsoft-Windows-Dhcp-Client
> Date: 11.05.2007 21:14:49
> Event ID: 1003
> Task Category: None
> Level: Warning
> Keywords: Classic
> User: N/A
> Computer: DJETBOOK
> Description:
> The description for Event ID 1003 from source
> Microsoft-Windows-Dhcp-Client cannot be found. Either the component that
> raises this event is not installed on your local computer or the
> installation is corrupted. You can install or repair the component on the
> local computer.
>
> If the event originated on another computer, the display information had
> to be saved with the event.
>
> The following information was included with the event:
>
> 00A0D15A87B4
> %%2163146757
>
> The description string for parameter reference (%1) could not be found
>
> Very nice description, innit? And this one:
>
> Log Name: System
> Source: Microsoft-Windows-Dhcp-Client
> Date: 11.05.2007 21:14:49
> Event ID: 1002
> Task Category: None
> Level: Error
> Keywords: Classic
> User: N/A
> Computer: DJETBOOK
> Description:
> The IP address lease 67.31.***.*** for the Network Card with network
> address *** has been denied by the DHCP server 192.168.1.1 (The DHCP
> Server sent a DHCPNACK message).
>
>
> I really really wonder where this IP comes from as my router assigns IPs
> from the internal 192 network.
>
> Googling for this issues I found out I'm not alone with Toshiba Satellite
> A100 with 2GB RAM and this BSOD:
> http://forums.pcworld.co.nz/showthread.php?p=549688
> Any ideas?
>
> --
> djet
> Microsoft Certified Professional
>

Hi djet -

Had the same problem as you have on both my notebooks ever since I
installed kb942624, which should fix some buffer overrun problems with
samba, especially SMB 2.0 Mini Redirector (mrxsmb20.sys).

My laptops have some loopback devices installed, so that I can access
the file servers at my work, using forwarding of 445.

The SMBv2 is used when vista communicates to other vista file shares,
else SMBv1 is used.

My fix was to disable SMBv2 and only use SMBv1. There may be some
decrease in performance, though I hardly can notice any difference,
except that I now can use my systems for more than 30 seconds ;).

To disable SMBv2 simply remove it as a dependency of the
LanmanWorkstation Service, assuming that its startup is set to 0x03
(manual).

In registry remove the line

MRxSmb20

from

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\LanmanWorkstation]
DependOnService

it by default read:

Bowser
MRxSmb10
MRxSmb20
NSI


--
cargo