You may receive a "Stop 0x00000020" error message on a computer that is running Windows Small Business Server 2003 or Windows Server 2003

On a computer that is running Microsoft Windows Small Business Server 2003 or Microsoft Windows Server 2003, you may experience any one of the following symptoms:

• Your computer automatically restarts.
• After you log on, you receive the following error message:
  Microsoft Windows
  The system has recovered from a serious error.
  A log of this error has been created.
  Please tell Microsoft about this problem.
  We have created an error report that you can send to help us improve Microsoft Windows. We will treat this report as confidential and anonymous.
  To see what data this error report contains, click here.
  If you click the click here link at the bottom of the message box, you may receive a Stop error that is similar to one of the following data samples:
  Back to the top

  Data sample 1

  BCCode: 00000020 BCP1: 0x00000000 BCP2: 0x0000ffff BCP3: 0x00000000 
  BCP4: 0x00000001 OSVer: 5_1_2600 SP : 0_0 Product: 256_1

  Back to the top

  Data sample 2

  BCCode: 00000020 BCP1: 0x00000000 BCP2: 0x0000fffe BCP3: 0x00000000 
  BCP4: 0x00000001 OSVer: 5_1_2600 SP: 0_0 Product	: 256_1

• You receive the following Stop error messages:
  Back to the top

  Message 1

  A problem has been detected and Windows has been shut down to prevent damage to your computer...
  Technical information:
  
  *** STOP: 0x00000020 (0x0x00000000, 0x0x0000ffff, 0x0x00000000, 0x0x00000001)
  KERNEL_APC_PENDING_DURING_EXIT
  Back to the top

  Message 2

  A problem has been detected and Windows has been shut down to prevent damage to your computer...
  Technical information:
  
  *** STOP: 0x00000020 (0x0x00000000, 0x0x0000fffe, 0x0x00000000, 0x0x00000001)
  KERNEL_APC_PENDING_DURING_EXIT
• An error that is similar to the following is logged in the System event log:
  Date: date
  Source: System
  Error Time: time
  Category: (102)
  Type: Error
  Event ID: 1003
  User: N/A
  Computer: COMPUTER
  Description: Error code 00000020, parameter1 0x00000000, parameter2 0x0000ffff, parameter3 0x00000000, parameter4 0x00000001. For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 30 30 30 30 30 30 35 0000020 0020: 30 20 20 50 61 72 61 6d 0 Param 0028: 65 74 65 72 73 20 66 66 eters ff 0030: 66 66 66 66 64 31 2c

Notes

• The Stop errors may occur intermittently as long as the server is being used. The Stop errors may also occur during startup. If a Stop error occurs during startup, you can typically start the server in Safe Mode. However, if you disable all startup items and third-party services by using the System Configuration Utility (Msconfig.exe), the error still occurs when you try to start the server as you typically would.
• The symptoms of a Stop error vary according to your computer's system failure options. For more information about how to configure system failure options, click the following article number to view the article in the Microsoft Knowledge Base:
  307973  (http://support.microsoft.com/kb/307973/ ) How to configure system failure and recovery options in Windows
• The four parameters that are inside the parentheses of a Stop error vary according to the computer's configuration.
• Not all "Stop 0x00000020" errors are caused by the problem that is described in this article.

This problem is known to occur on servers that are running Symantec pcAnywhere 11.5 with Symantec AntiVirus 8.x or with Symantec AntiVirus 9.0. An updated version of the Symantec Event Handler driver (Symevent.sys) causes this problem. The Symevent.sys driver is installed with pcAnywhere 11.5. The Symevent.sys driver causes the Symantec real-time protection drivers to generate the "Stop 0x00000020" error.

To resolve this problem, download and install the latest Symevent.sys driver. For more information, visit the following Symantec Web sites: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
To work around this problem, disable the Symantec real-time protection drivers. If you cannot start the server as you typically would, start the server in Safe Mode, and then temporarily disable the real-time protection drivers.

Note Follow these steps only if the server does not start as it usually does. After you disable the real-time protection drivers and start the server as you typically would, we recommend that you immediately install the updated Symevent.sys driver. Then, re-enable the real-time protection drivers.

To disable the real-time protection drivers, use the appropriate steps for the version of Symantec AntiVirus that is running.

CAUTION The server will be vulnerable to viruses and other malicious software as long as the real-time protection drivers are disabled. Therefore, we recommend that you disconnect the server from the network until the drivers are re-enabled.

To disable the Symantec AntiVirus 8.x real-time protection drivers, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
3. Click the Navap key.
4. In the right pane, double-click the Start entry.
5. In the Value data box, change the value to 4, and then click OK.
6. Under the Services key, click the Navapel key.
7. In the right pane, double-click the Start entry.
8. In the Value data box, change the value to 4, and then click OK.
9. Quit Registry Editor.
10. Disconnect the server from the network.
11. Restart the server.

To disable the Symantec AntiVirus 9.0 real-time protection drivers, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
3. Click the Savrt key.
4. In the right pane, double-click the Start entry.
5. In the Value data box, change the value to 4, and then click OK.
6. Under the Services key, click Savrtpel.
7. In the right pane, double-click the Start entry.
8. In the Value data box, change the value to 4, and then click OK.
9. Quit Registry Editor.
10. Disconnect the server from the network.
11. Restart the server.

For information about how to re-enable Symantec AntiVirus real-time protection drivers, contact Symantec.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.