Windows 2000 Server Event Log Warning ID 3588

[Dennis Herrick]

Twice this week we got a raft (about 100) of
these event log entries on a Proliant DL580 Server with an MSA1000 array controller. The
entire eventlog message string is as follows:
"Received write request at IRQL2 for \device\HarddiskVolume1". It says the Event ID is 3588 and the source is cxbf. There is no mention out on the network of cxbf or event id 3588. I can't tell you how many times we seem to get into trouble that no one in the world has ever seen before. I figured I'd ask here first and if there is no explaination, I'll call in a support request.

Thanks,

Dennis Herrick
ADE Corporation
dherrick@ade.com

[Brian_Murdoch]

Hi Dennis,

Could it be a virus?

See the following on MyDoom-A...

http://lists.ibiblio.org/pipermail/freetds/2004q1/015390.html

Regards,

Brian

[e4services]

Nice catch Brian. That looks exactly like it. McAfee has a nice server product now, ;ook into it

[Dennis Herrick]

I did some more digging. I decided "source
cxbf" might refer to a driver. Sure enough there was a cxbf.sys in the system32 drivers directory. Ok now whose driver is it? I right clicked on the file entry and selected properties. Driver is from CommVault Galaxy backup software. It runs their "Image Option" feature. We are also
running Symantec V2i Protector for image backup of the system disk. I checked the times when the errors happen with the image backup schedule and they match. There must be a problem running disk image drivers from different companies at the same time.
I'll try CommVault and Symantec for suggestions. Thanks anyway for the quick replies. I'll also look into the cxbf.zip possibility too, you know how it goes, don't discount any solution too quickly.

Thanks again,

Dennis Herrick
dherrick@ade.com