Product

Error

STOP 0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000) UNEXPECTED_KERNEL_MODE_TRAP

Symptoms

System reboots itself

Cause

This problem occurs because there is a limited amount of kernel space available for kernel drivers. If the operating system runs out of kernel space, the computer displays a blue screen error message. The following message may appear in the Event Log: “Event ID: 1005. Source: SAVRT: Symantec AntiVirus Auto-Protect could not scan file for viruses due to low kernel stack.”

A common configuration that can cause this problem is a Windows 2000 Server with Terminal Services in Remote Administration Mode, combined with any of the following applications:

• Symantec AntiVirus Corporate Edition 8.0
• St. Bernard Open File Manager
• Quota Manager
• Legato RepliStor
• other filter drivers that register with the Kernel Stack

Solution

To fix this problem, perform the following step-by-step procedures.

Modify Symantec AntiVirus 9.x Registry
To add the KStackMinFree value in Symantec AntiVirus 9.x:

1. Run Regedit.exe to open the Windows registry.
2. Browse to the registry key for your software version: HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan.
3. Under RealTimeScan create a new DWORD value named KStackMinFree.
4. Right-click the KStackMinFree value, and then click Modify.
5. Set the Base to Hexadecimal, and type 2200 in the Value field.

Modify Norton AntiVirus 7.6 or Symantec AntiVirus 8.x Registry
To add the KStackMinFree value in Norton AntiVirus 7.6 or Symantec AntiVirus 8.x:

1. Run Regedit.exe to open the Windows registry.
2. Browse to the registry key for your software version: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus NT\Auto-Protect\InternalSettings.
3. Under InternalSettings create a new DWORD value named KStackMinFree.
4. Right-click the KStackMinFree value, and then click Modify.
5. Set the Base to Hexadecimal, and type 2200 in the Value field.

Windows 2000/XP users can automatically create the KStackMinFree value at 2200 by downloading and importing the SAVCE8_KStackMinFree.reg file. Symantec recommends a range between 8.0 KB and 8.5 KB (Hex 2000-2200), though each environment is different and it may take some experimenting to find the right value. Other possible values are defined in the following list. Required minimum available kernel memory HEX Value:

• 5.0 KB 0x1400
• 5.5 KB 0x1600
• 6.0 KB 0x1800
• 6.5 KB 0x1a00
• 7.0 KB 0x1c00
• 7.5 KB 0x1e00
• 8.0 KB 0x2000
• 8.5 KB (recommended) 0x2200
• 9.0 KB 0x2400

Technical contact(s)

Philip Samaniego, Derek Braendel

Submitted by

Gary Tanaka

Date submitted

23 Jun 2005