yespit
asked on
SBS2003-STD Crash Server when OS X client renames file or folder // RANDOM - VsrFsJnl.sys
Install of SBS2003 STD with Exchange 2003 enabled, and operating as file server on seperate raid array.
Dual Core AMD system, 4gb Ram... almost a terrabyte of free space on File server and 200Gb free on Exchange Array.
Gigabit Network, ExtremeZ-IP share (shared via Windows also). Used this product (for OS X) as uploads were slow to server even thought GP was set for SMB signing correctly...
Most Recent dump analysis follows. HELP KINDLY APPRECIATED!!
Loading Dump File [C:\Documents and Settings\spike\Desktop\Min
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
**************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
**************************
Executable search path is:
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image \WINDOWS\system32\ntkrnlpa
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Kernel base = 0xe0800000 PsLoadedModuleList = 0xe08a6ea8
Debug session time: Mon May 1 12:04:37.734 2006 (GMT+10)
System Uptime: 1 days 21:49:33.890
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image \WINDOWS\system32\ntkrnlpa
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {19033c, be19f584, be19f280, e0882ad0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for fltMgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltMgr.sys
*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
*** WARNING: Unable to verify timestamp for VsrFsJnl.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsJnl.sys
Probably caused by : VsrFsJnl.sys ( VsrFsJnl+7fff )
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
FAULTING_MODULE: e0800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt+0x00082ad0)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt+0x82ad0:
e0882ad0 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDU
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from be19f754 to e0882ad0
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f648 be19f754 bfd25fff fcb11998 00000000 nt+0x82ad0
be19f64c bfd25fff fcb11998 00000000 be19fa68 0xbe19f754
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt+0x1de83
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs+0x7b6d
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs+0x3363a
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs+0x62fb
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt+0x1dce5
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr+0x4c53
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt+0x1dce5
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt+0x1dce5
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt+0xf0433
be19fd64 7c82ed54 badb0d00 00afb234 00000000 nt+0x88c6c
be19fd68 badb0d00 00afb234 00000000 00000000 0x7c82ed54
be19fd6c 00afb234 00000000 00000000 00000000 0xbadb0d00
be19fd70 00000000 00000000 00000000 00000000 0xafb234
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> .sympath srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
0: kd> .reload
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02 mov ax,[edx] ds:0023:00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from bfd25fff to e0882ad0
STACK_TEXT:
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
FAILURE_BUCKET_ID: 0x24_VsrFsJnl+7fff
BUCKET_ID: 0x24_VsrFsJnl+7fff
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02 mov ax,[edx] ds:0023:00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from bfd25fff to e0882ad0
STACK_TEXT:
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
FAILURE_BUCKET_ID: 0x24_VsrFsJnl+7fff
BUCKET_ID: 0x24_VsrFsJnl+7fff
Followup: MachineOwner
---------
0: kd> lm tn
start end module name
be13b000 be168000 RDPWD RDPWD.SYS Thu Jun 16 01:33:14 2005 (42B04A3A)
be2c0000 be2cb000 TDTCP TDTCP.SYS Fri Mar 25 11:27:15 2005 (42435AE3)
bf130000 bf15a000 Fastfat Fastfat.SYS Fri Mar 25 11:40:20 2005 (42435DF4)
bf7ea000 bf83a000 HTTP HTTP.sys Fri Mar 25 11:40:36 2005 (42435E04)
bfb0a000 bfb68000 srv srv.sys Wed May 04 12:44:01 2005 (427836F1)
bfb90000 bfbc4000 mrxdav mrxdav.sys Fri Mar 25 11:30:11 2005 (42435B93)
bfcee000 bfd1de60 exifs exifs.sys Fri Aug 26 10:29:05 2005 (430E6251)
bfd1e000 bfd38000 VsrFsJnl VsrFsJnl.sys Sat Dec 10 06:22:11 2005 (4399D963)
de400000 de5d0000 win32k win32k.sys Thu Oct 06 10:37:08 2005 (434471B4)
de5d0000 de5e6000 dxg dxg.sys Fri Mar 25 11:27:25 2005 (42435AED)
de5e6000 de9a0500 nv4_disp nv4_disp.dll Wed Aug 03 10:11:57 2005 (42F00BCD)
e0800000 e0a53000 nt ntkrpamp.exe Fri Mar 25 11:28:04 2005 (42435B14)
e0a53000 e0a7f000 hal halaacpi.dll Fri Mar 25 11:28:37 2005 (42435B35)
f38b6000 f38cb000 Cdfs Cdfs.SYS Fri Mar 25 11:40:55 2005 (42435E17)
f3953000 f395e000 VsrFsRec VsrFsRec.sys Sat Dec 10 06:22:11 2005 (4399D963)
f3993000 f39a4000 Fips Fips.SYS Fri Mar 25 11:40:33 2005 (42435E01)
f39a4000 f3a1a000 mrxsmb mrxsmb.sys Fri Mar 25 11:41:13 2005 (42435E29)
f3a1a000 f3a4a000 rdbss rdbss.sys Fri Mar 25 11:40:49 2005 (42435E11)
f3a4a000 f3a74000 afd afd.sys Fri Mar 25 11:40:43 2005 (42435E0B)
f3a74000 f3aa5000 netbt netbt.sys Fri Mar 25 11:40:31 2005 (42435DFF)
f3aa5000 f3b06000 tcpip tcpip.sys Fri Jan 13 13:12:43 2006 (43C70C9B)
f3b06000 f3b1f000 ipsec ipsec.sys Fri Mar 25 11:40:49 2005 (42435E11)
f3b3f000 f3b4c000 Npfs Npfs.SYS Fri Mar 25 11:30:04 2005 (42435B8C)
f3b5f000 f3b6c000 wanarp wanarp.sys Fri Mar 25 11:34:07 2005 (42435C7F)
f3bcf000 f3bd9000 dump_diskdump dump_diskdump.sys Fri Mar 25 11:28:56 2005 (42435B48)
f417f000 f4193000 usbhub usbhub.sys Fri Mar 25 11:30:46 2005 (42435BB6)
f41d2000 f4212000 update update.sys Fri Mar 25 11:40:27 2005 (42435DFB)
f4212000 f4249000 rdpdr rdpdr.sys Fri Mar 25 11:30:20 2005 (42435B9C)
f4249000 f425c000 raspptp raspptp.sys Fri Mar 25 11:40:43 2005 (42435E0B)
f425c000 f4276000 ndiswan ndiswan.sys Fri Mar 25 11:40:46 2005 (42435E0E)
f4276000 f428b000 rasl2tp rasl2tp.sys Fri Mar 25 11:40:29 2005 (42435DFD)
f428b000 f42a6000 VIDEOPRT VIDEOPRT.SYS Fri Mar 25 11:29:53 2005 (42435B81)
f42a6000 f45b2e60 nv4_mini nv4_mini.sys Wed Aug 03 10:17:04 2005 (42F00D00)
f45b3000 f45e5d80 NVSNPU NVSNPU.SYS Wed Apr 06 20:22:01 2005 (4253B849)
f45e6000 f4625f00 NVNRM NVNRM.SYS Wed Apr 06 20:22:11 2005 (4253B853)
f4626000 f464e000 e1000325 e1000325.sys Thu Jun 30 03:49:03 2005 (42C2DF0F)
f464e000 f4676000 ks ks.sys Fri Mar 25 11:41:03 2005 (42435E1F)
f4676000 f468a000 redbook redbook.sys Fri Mar 25 11:28:46 2005 (42435B3E)
f468a000 f469f000 cdrom cdrom.sys Fri Mar 25 11:28:57 2005 (42435B49)
f469f000 f46c9000 USBPORT USBPORT.SYS Fri Mar 25 11:30:43 2005 (42435BB3)
f46e9000 f46f7000 VsrFsFlt VsrFsFlt.sys Sat Dec 10 06:22:11 2005 (4399D963)
f4759000 f4762000 ndisuio ndisuio.sys Fri Mar 25 11:33:16 2005 (42435C4C)
f4789000 f4793000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f4821000 f4824280 nvnetbus nvnetbus.sys Wed Apr 06 20:22:28 2005 (4253B864)
f4b29000 f4b34000 fdc fdc.sys Fri Mar 25 11:28:43 2005 (42435B3B)
f4b79000 f4b86000 netbios netbios.sys Fri Mar 25 11:33:21 2005 (42435C51)
f4b99000 f4ba8000 termdd termdd.sys Fri Mar 25 11:27:15 2005 (42435AE3)
f4ba9000 f4bb4000 ptilink ptilink.sys Fri Mar 25 11:28:25 2005 (42435B29)
f4bb9000 f4bc4000 Msfs Msfs.SYS Fri Mar 25 11:30:04 2005 (42435B8C)
f4d5b000 f4d7a000 Mup Mup.sys Fri Mar 25 11:40:49 2005 (42435E11)
f4d7a000 f4db0000 NDIS NDIS.sys Fri Mar 25 11:40:26 2005 (42435DFA)
f4db0000 f4e45000 Ntfs Ntfs.sys Fri Mar 25 11:40:29 2005 (42435DFD)
f4e45000 f4e6c000 KSecDD KSecDD.sys Fri Mar 25 11:28:53 2005 (42435B45)
f4e6c000 f4e91000 fltMgr fltMgr.sys Fri Mar 25 11:30:25 2005 (42435BA1)
f4e91000 f4ea4000 CLASSPNP CLASSPNP.SYS Fri Mar 25 11:40:23 2005 (42435DF7)
f4ea4000 f4ec3000 SCSIPORT SCSIPORT.SYS Fri Mar 25 11:40:26 2005 (42435DFA)
f4ec3000 f4edf000 atapi atapi.sys Fri Mar 25 11:28:49 2005 (42435B41)
f4edf000 f4f09000 volsnap volsnap.sys Fri Mar 25 11:29:10 2005 (42435B56)
f4f09000 f4f35000 dmio dmio.sys Fri Mar 25 11:30:02 2005 (42435B8A)
f4f35000 f4f5c000 ftdisk ftdisk.sys Fri Mar 25 11:29:00 2005 (42435B4C)
f4f5c000 f4f72000 pci pci.sys Fri Mar 25 11:34:14 2005 (42435C86)
f4f72000 f4fa6000 ACPI ACPI.sys Fri Mar 25 11:34:09 2005 (42435C81)
f50a7000 f50b0000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f50b7000 f50c6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f50c7000 f50d4000 PCIIDEX PCIIDEX.SYS Fri Mar 25 11:28:48 2005 (42435B40)
f50d7000 f50e7000 MountMgr MountMgr.sys Fri Mar 25 11:27:23 2005 (42435AEB)
f50e7000 f50f2000 PartMgr PartMgr.sys Fri Mar 25 11:40:34 2005 (42435E02)
f50f7000 f5107000 disk disk.sys Fri Mar 25 11:28:58 2005 (42435B4A)
f5107000 f5113000 Dfs Dfs.sys Fri Mar 25 11:30:28 2005 (42435BA4)
f5117000 f5121000 crcdisk crcdisk.sys Fri Mar 25 11:29:40 2005 (42435B74)
f5157000 f5163000 vga vga.sys Fri Mar 25 11:29:54 2005 (42435B82)
f5197000 f51a1000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f51a7000 f51b2000 TDI TDI.SYS Fri Mar 25 11:35:34 2005 (42435CD6)
f51b7000 f51c0000 mssmbios mssmbios.sys Fri Mar 25 11:34:14 2005 (42435C86)
f51d7000 f51e0000 ndistapi ndistapi.sys Fri Mar 25 11:34:11 2005 (42435C83)
f51f7000 f5206000 raspppoe raspppoe.sys Fri Mar 25 11:34:16 2005 (42435C88)
f5207000 f5210000 raspti raspti.sys Fri Mar 25 11:34:16 2005 (42435C88)
f5217000 f5225000 msgpc msgpc.sys Fri Mar 25 11:33:31 2005 (42435C5B)
f5247000 f5251000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f5267000 f5271000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f5287000 f5295000 processr processr.sys Fri Mar 25 11:28:39 2005 (42435B37)
f52b7000 f52c5000 NDProxy NDProxy.SYS Fri Mar 25 11:34:13 2005 (42435C85)
f5317000 f5320000 watchdog watchdog.sys Fri Mar 25 11:30:19 2005 (42435B9B)
f5327000 f532f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f532f000 f5337000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f5337000 f533e000 pciide pciide.sys Tue Mar 25 18:04:46 2003 (3E7FFF8E)
f533f000 f5346000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f5347000 f534f000 st8350 st8350.sys Sat Jun 11 08:15:50 2005 (42AA1116)
f5357000 f535e000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f5387000 f538f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f538f000 f5397000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f53a7000 f53ab400 usbohci usbohci.sys Fri Mar 25 11:30:45 2005 (42435BB5)
f53af000 f53b5a00 usbehci usbehci.sys Fri Mar 25 11:30:43 2005 (42435BB3)
f53b7000 f53be000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f53bf000 f53c6000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f53df000 f53e7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f5477000 f547f000 dump_st8350 dump_st8350.sys Sat Jun 11 08:15:50 2005 (42AA1116)
f549f000 f54a7000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f54a7000 f54ad300 HIDPARSE HIDPARSE.SYS Fri Mar 25 11:30:36 2005 (42435BAC)
f54af000 f54b7000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f55f3000 f55f4420 ASACPI ASACPI.sys Fri Aug 13 12:52:52 2004 (411C2D04)
f55f5000 f55f6280 swenum swenum.sys Fri Mar 25 11:27:42 2005 (42435AFE)
f5605000 f5606580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)
f5619000 f561a160 AsIO AsIO.sys Thu Oct 14 19:52:27 2004 (416E4C5B)
Unloaded modules:
bfacd000 bfae2000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f51c7000 f51d5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f46f9000 f4702000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3bcc000 f3bdf000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f538f000 f5397000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
0: kd> !thread
GetPointerFromAddress: unable to read from e089c298
THREAD fd954830 Cid 0698.1ba0 Teb: bd5de000 Win32Thread: 00000000 RUNNING on processor 0
IRP List:
Unable to read nt!_IRP @ fd545c48
Unable to read Impersonation Information at e34a5340
GetUlongFromAddress: unable to read from e08ab934
Owning Process fe4cbd88 Image: ExtremeZ-IP.exe
ffdf0000: Unable to get shared data
Wait Start TickCount 10558329
Context Switch Count 71935
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.0000
KernelTime 00:00:00.0000
Start Address 0x77e6b5bb
Win32 Start Address 0x004ef930
Stack Init be1a0000 Current be19f4a0 Base be1a0000 Limit be19d000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr Args to Child
be19f080 f4dbea1a 00000024 0019033c be19f584 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
be19f0a8 f4db158c fd8e58b8 be19f0d4 e0880ce1 Ntfs!NtfsExceptionFilter+0
be19f0b4 e0880ce1 be19f0dc 00000000 be19f0dc Ntfs!NtfsFsdSetInformation
be19f0dc e088e1be be19f584 be19fbc4 be19f280 nt!_except_handler3+0x61 (FPO: [Uses EBP] [3,0,7])
be19f100 e088e190 be19f584 be19fbc4 be19f280 nt!ExecuteHandler2+0x26
be19f1b0 e082cd91 be19f584 be19f280 00000000 nt!ExecuteHandler+0x24
be19f568 e08896d2 be19f584 00000000 be19f5d8 nt!KiDispatchException+0x1
be19f5d0 e0889686 be19f64c e0882ad0 badb0d00 nt!CommonDispatchException
be19f680 e0893099 bfd343a8 00000004 00000000 nt!Kei386EoiHelper+0x186
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!ExAllocatePoolWithTag+0
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f (FPO: [Non-Fpo])
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ be19fd64)
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
Dual Core AMD system, 4gb Ram... almost a terrabyte of free space on File server and 200Gb free on Exchange Array.
Gigabit Network, ExtremeZ-IP share (shared via Windows also). Used this product (for OS X) as uploads were slow to server even thought GP was set for SMB signing correctly...
Most Recent dump analysis follows. HELP KINDLY APPRECIATED!!
Loading Dump File [C:\Documents and Settings\spike\Desktop\Min
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
**************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
**************************
Executable search path is:
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image \WINDOWS\system32\ntkrnlpa
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Kernel base = 0xe0800000 PsLoadedModuleList = 0xe08a6ea8
Debug session time: Mon May 1 12:04:37.734 2006 (GMT+10)
System Uptime: 1 days 21:49:33.890
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image \WINDOWS\system32\ntkrnlpa
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {19033c, be19f584, be19f280, e0882ad0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for fltMgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltMgr.sys
*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
*** WARNING: Unable to verify timestamp for VsrFsJnl.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsJnl.sys
Probably caused by : VsrFsJnl.sys ( VsrFsJnl+7fff )
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
FAULTING_MODULE: e0800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt+0x00082ad0)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt+0x82ad0:
e0882ad0 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDU
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from be19f754 to e0882ad0
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f648 be19f754 bfd25fff fcb11998 00000000 nt+0x82ad0
be19f64c bfd25fff fcb11998 00000000 be19fa68 0xbe19f754
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt+0x1de83
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs+0x7b6d
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs+0x3363a
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs+0x62fb
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt+0x1dce5
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr+0x4c53
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt+0x1dce5
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt+0x1dce5
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt+0xf0433
be19fd64 7c82ed54 badb0d00 00afb234 00000000 nt+0x88c6c
be19fd68 badb0d00 00afb234 00000000 00000000 0x7c82ed54
be19fd6c 00afb234 00000000 00000000 00000000 0xbadb0d00
be19fd70 00000000 00000000 00000000 00000000 0xafb234
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
0: kd> .sympath srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\websymbols*http://msdl.microsoft.com/download/symbols
0: kd> .reload
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for VsrFsFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VsrFsFlt.sys
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02 mov ax,[edx] ds:0023:00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from bfd25fff to e0882ad0
STACK_TEXT:
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
FAILURE_BUCKET_ID: 0x24_VsrFsJnl+7fff
BUCKET_ID: 0x24_VsrFsJnl+7fff
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 0019033c
Arg2: be19f584
Arg3: be19f280
Arg4: e0882ad0
Debugging Details:
------------------
EXCEPTION_RECORD: be19f584 -- (.exr ffffffffbe19f584)
ExceptionAddress: e0882ad0 (nt!wcscpy+0x0000000b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
CONTEXT: be19f280 -- (.cxr ffffffffbe19f280)
eax=0000007e ebx=00000000 ecx=fcb11998 edx=00000000 esi=fd545c48 edi=be19fa68
eip=e0882ad0 esp=be19f64c ebp=be19f64c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!wcscpy+0xb:
e0882ad0 668b02 mov ax,[edx] ds:0023:00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from bfd25fff to e0882ad0
STACK_TEXT:
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!wcscpy+0xb
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
FOLLOWUP_IP:
VsrFsJnl+7fff
bfd25fff ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: VsrFsJnl+7fff
MODULE_NAME: VsrFsJnl
IMAGE_NAME: VsrFsJnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xffffffffbe19f280 ; kb
FAILURE_BUCKET_ID: 0x24_VsrFsJnl+7fff
BUCKET_ID: 0x24_VsrFsJnl+7fff
Followup: MachineOwner
---------
0: kd> lm tn
start end module name
be13b000 be168000 RDPWD RDPWD.SYS Thu Jun 16 01:33:14 2005 (42B04A3A)
be2c0000 be2cb000 TDTCP TDTCP.SYS Fri Mar 25 11:27:15 2005 (42435AE3)
bf130000 bf15a000 Fastfat Fastfat.SYS Fri Mar 25 11:40:20 2005 (42435DF4)
bf7ea000 bf83a000 HTTP HTTP.sys Fri Mar 25 11:40:36 2005 (42435E04)
bfb0a000 bfb68000 srv srv.sys Wed May 04 12:44:01 2005 (427836F1)
bfb90000 bfbc4000 mrxdav mrxdav.sys Fri Mar 25 11:30:11 2005 (42435B93)
bfcee000 bfd1de60 exifs exifs.sys Fri Aug 26 10:29:05 2005 (430E6251)
bfd1e000 bfd38000 VsrFsJnl VsrFsJnl.sys Sat Dec 10 06:22:11 2005 (4399D963)
de400000 de5d0000 win32k win32k.sys Thu Oct 06 10:37:08 2005 (434471B4)
de5d0000 de5e6000 dxg dxg.sys Fri Mar 25 11:27:25 2005 (42435AED)
de5e6000 de9a0500 nv4_disp nv4_disp.dll Wed Aug 03 10:11:57 2005 (42F00BCD)
e0800000 e0a53000 nt ntkrpamp.exe Fri Mar 25 11:28:04 2005 (42435B14)
e0a53000 e0a7f000 hal halaacpi.dll Fri Mar 25 11:28:37 2005 (42435B35)
f38b6000 f38cb000 Cdfs Cdfs.SYS Fri Mar 25 11:40:55 2005 (42435E17)
f3953000 f395e000 VsrFsRec VsrFsRec.sys Sat Dec 10 06:22:11 2005 (4399D963)
f3993000 f39a4000 Fips Fips.SYS Fri Mar 25 11:40:33 2005 (42435E01)
f39a4000 f3a1a000 mrxsmb mrxsmb.sys Fri Mar 25 11:41:13 2005 (42435E29)
f3a1a000 f3a4a000 rdbss rdbss.sys Fri Mar 25 11:40:49 2005 (42435E11)
f3a4a000 f3a74000 afd afd.sys Fri Mar 25 11:40:43 2005 (42435E0B)
f3a74000 f3aa5000 netbt netbt.sys Fri Mar 25 11:40:31 2005 (42435DFF)
f3aa5000 f3b06000 tcpip tcpip.sys Fri Jan 13 13:12:43 2006 (43C70C9B)
f3b06000 f3b1f000 ipsec ipsec.sys Fri Mar 25 11:40:49 2005 (42435E11)
f3b3f000 f3b4c000 Npfs Npfs.SYS Fri Mar 25 11:30:04 2005 (42435B8C)
f3b5f000 f3b6c000 wanarp wanarp.sys Fri Mar 25 11:34:07 2005 (42435C7F)
f3bcf000 f3bd9000 dump_diskdump dump_diskdump.sys Fri Mar 25 11:28:56 2005 (42435B48)
f417f000 f4193000 usbhub usbhub.sys Fri Mar 25 11:30:46 2005 (42435BB6)
f41d2000 f4212000 update update.sys Fri Mar 25 11:40:27 2005 (42435DFB)
f4212000 f4249000 rdpdr rdpdr.sys Fri Mar 25 11:30:20 2005 (42435B9C)
f4249000 f425c000 raspptp raspptp.sys Fri Mar 25 11:40:43 2005 (42435E0B)
f425c000 f4276000 ndiswan ndiswan.sys Fri Mar 25 11:40:46 2005 (42435E0E)
f4276000 f428b000 rasl2tp rasl2tp.sys Fri Mar 25 11:40:29 2005 (42435DFD)
f428b000 f42a6000 VIDEOPRT VIDEOPRT.SYS Fri Mar 25 11:29:53 2005 (42435B81)
f42a6000 f45b2e60 nv4_mini nv4_mini.sys Wed Aug 03 10:17:04 2005 (42F00D00)
f45b3000 f45e5d80 NVSNPU NVSNPU.SYS Wed Apr 06 20:22:01 2005 (4253B849)
f45e6000 f4625f00 NVNRM NVNRM.SYS Wed Apr 06 20:22:11 2005 (4253B853)
f4626000 f464e000 e1000325 e1000325.sys Thu Jun 30 03:49:03 2005 (42C2DF0F)
f464e000 f4676000 ks ks.sys Fri Mar 25 11:41:03 2005 (42435E1F)
f4676000 f468a000 redbook redbook.sys Fri Mar 25 11:28:46 2005 (42435B3E)
f468a000 f469f000 cdrom cdrom.sys Fri Mar 25 11:28:57 2005 (42435B49)
f469f000 f46c9000 USBPORT USBPORT.SYS Fri Mar 25 11:30:43 2005 (42435BB3)
f46e9000 f46f7000 VsrFsFlt VsrFsFlt.sys Sat Dec 10 06:22:11 2005 (4399D963)
f4759000 f4762000 ndisuio ndisuio.sys Fri Mar 25 11:33:16 2005 (42435C4C)
f4789000 f4793000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f4821000 f4824280 nvnetbus nvnetbus.sys Wed Apr 06 20:22:28 2005 (4253B864)
f4b29000 f4b34000 fdc fdc.sys Fri Mar 25 11:28:43 2005 (42435B3B)
f4b79000 f4b86000 netbios netbios.sys Fri Mar 25 11:33:21 2005 (42435C51)
f4b99000 f4ba8000 termdd termdd.sys Fri Mar 25 11:27:15 2005 (42435AE3)
f4ba9000 f4bb4000 ptilink ptilink.sys Fri Mar 25 11:28:25 2005 (42435B29)
f4bb9000 f4bc4000 Msfs Msfs.SYS Fri Mar 25 11:30:04 2005 (42435B8C)
f4d5b000 f4d7a000 Mup Mup.sys Fri Mar 25 11:40:49 2005 (42435E11)
f4d7a000 f4db0000 NDIS NDIS.sys Fri Mar 25 11:40:26 2005 (42435DFA)
f4db0000 f4e45000 Ntfs Ntfs.sys Fri Mar 25 11:40:29 2005 (42435DFD)
f4e45000 f4e6c000 KSecDD KSecDD.sys Fri Mar 25 11:28:53 2005 (42435B45)
f4e6c000 f4e91000 fltMgr fltMgr.sys Fri Mar 25 11:30:25 2005 (42435BA1)
f4e91000 f4ea4000 CLASSPNP CLASSPNP.SYS Fri Mar 25 11:40:23 2005 (42435DF7)
f4ea4000 f4ec3000 SCSIPORT SCSIPORT.SYS Fri Mar 25 11:40:26 2005 (42435DFA)
f4ec3000 f4edf000 atapi atapi.sys Fri Mar 25 11:28:49 2005 (42435B41)
f4edf000 f4f09000 volsnap volsnap.sys Fri Mar 25 11:29:10 2005 (42435B56)
f4f09000 f4f35000 dmio dmio.sys Fri Mar 25 11:30:02 2005 (42435B8A)
f4f35000 f4f5c000 ftdisk ftdisk.sys Fri Mar 25 11:29:00 2005 (42435B4C)
f4f5c000 f4f72000 pci pci.sys Fri Mar 25 11:34:14 2005 (42435C86)
f4f72000 f4fa6000 ACPI ACPI.sys Fri Mar 25 11:34:09 2005 (42435C81)
f50a7000 f50b0000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f50b7000 f50c6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f50c7000 f50d4000 PCIIDEX PCIIDEX.SYS Fri Mar 25 11:28:48 2005 (42435B40)
f50d7000 f50e7000 MountMgr MountMgr.sys Fri Mar 25 11:27:23 2005 (42435AEB)
f50e7000 f50f2000 PartMgr PartMgr.sys Fri Mar 25 11:40:34 2005 (42435E02)
f50f7000 f5107000 disk disk.sys Fri Mar 25 11:28:58 2005 (42435B4A)
f5107000 f5113000 Dfs Dfs.sys Fri Mar 25 11:30:28 2005 (42435BA4)
f5117000 f5121000 crcdisk crcdisk.sys Fri Mar 25 11:29:40 2005 (42435B74)
f5157000 f5163000 vga vga.sys Fri Mar 25 11:29:54 2005 (42435B82)
f5197000 f51a1000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f51a7000 f51b2000 TDI TDI.SYS Fri Mar 25 11:35:34 2005 (42435CD6)
f51b7000 f51c0000 mssmbios mssmbios.sys Fri Mar 25 11:34:14 2005 (42435C86)
f51d7000 f51e0000 ndistapi ndistapi.sys Fri Mar 25 11:34:11 2005 (42435C83)
f51f7000 f5206000 raspppoe raspppoe.sys Fri Mar 25 11:34:16 2005 (42435C88)
f5207000 f5210000 raspti raspti.sys Fri Mar 25 11:34:16 2005 (42435C88)
f5217000 f5225000 msgpc msgpc.sys Fri Mar 25 11:33:31 2005 (42435C5B)
f5247000 f5251000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f5267000 f5271000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f5287000 f5295000 processr processr.sys Fri Mar 25 11:28:39 2005 (42435B37)
f52b7000 f52c5000 NDProxy NDProxy.SYS Fri Mar 25 11:34:13 2005 (42435C85)
f5317000 f5320000 watchdog watchdog.sys Fri Mar 25 11:30:19 2005 (42435B9B)
f5327000 f532f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f532f000 f5337000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f5337000 f533e000 pciide pciide.sys Tue Mar 25 18:04:46 2003 (3E7FFF8E)
f533f000 f5346000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f5347000 f534f000 st8350 st8350.sys Sat Jun 11 08:15:50 2005 (42AA1116)
f5357000 f535e000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f5387000 f538f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f538f000 f5397000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f53a7000 f53ab400 usbohci usbohci.sys Fri Mar 25 11:30:45 2005 (42435BB5)
f53af000 f53b5a00 usbehci usbehci.sys Fri Mar 25 11:30:43 2005 (42435BB3)
f53b7000 f53be000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f53bf000 f53c6000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f53df000 f53e7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f5477000 f547f000 dump_st8350 dump_st8350.sys Sat Jun 11 08:15:50 2005 (42AA1116)
f549f000 f54a7000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f54a7000 f54ad300 HIDPARSE HIDPARSE.SYS Fri Mar 25 11:30:36 2005 (42435BAC)
f54af000 f54b7000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f55f3000 f55f4420 ASACPI ASACPI.sys Fri Aug 13 12:52:52 2004 (411C2D04)
f55f5000 f55f6280 swenum swenum.sys Fri Mar 25 11:27:42 2005 (42435AFE)
f5605000 f5606580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)
f5619000 f561a160 AsIO AsIO.sys Thu Oct 14 19:52:27 2004 (416E4C5B)
Unloaded modules:
bfacd000 bfae2000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f51c7000 f51d5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f46f9000 f4702000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3bcc000 f3bdf000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f538f000 f5397000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
0: kd> !thread
GetPointerFromAddress: unable to read from e089c298
THREAD fd954830 Cid 0698.1ba0 Teb: bd5de000 Win32Thread: 00000000 RUNNING on processor 0
IRP List:
Unable to read nt!_IRP @ fd545c48
Unable to read Impersonation Information at e34a5340
GetUlongFromAddress: unable to read from e08ab934
Owning Process fe4cbd88 Image: ExtremeZ-IP.exe
ffdf0000: Unable to get shared data
Wait Start TickCount 10558329
Context Switch Count 71935
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.0000
KernelTime 00:00:00.0000
Start Address 0x77e6b5bb
Win32 Start Address 0x004ef930
Stack Init be1a0000 Current be19f4a0 Base be1a0000 Limit be19d000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr Args to Child
be19f080 f4dbea1a 00000024 0019033c be19f584 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
be19f0a8 f4db158c fd8e58b8 be19f0d4 e0880ce1 Ntfs!NtfsExceptionFilter+0
be19f0b4 e0880ce1 be19f0dc 00000000 be19f0dc Ntfs!NtfsFsdSetInformation
be19f0dc e088e1be be19f584 be19fbc4 be19f280 nt!_except_handler3+0x61 (FPO: [Uses EBP] [3,0,7])
be19f100 e088e190 be19f584 be19fbc4 be19f280 nt!ExecuteHandler2+0x26
be19f1b0 e082cd91 be19f584 be19f280 00000000 nt!ExecuteHandler+0x24
be19f568 e08896d2 be19f584 00000000 be19f5d8 nt!KiDispatchException+0x1
be19f5d0 e0889686 be19f64c e0882ad0 badb0d00 nt!CommonDispatchException
be19f680 e0893099 bfd343a8 00000004 00000000 nt!Kei386EoiHelper+0x186
be19f64c bfd25fff fcb11998 00000000 be19fa68 nt!ExAllocatePoolWithTag+0
WARNING: Stack unwind information not available. Following frames may be wrong.
be19f754 bfd26800 fd545c48 be19fa28 be19f770 VsrFsJnl+0x7fff
be19f794 bfd2f54b fd545c48 00000001 00000000 VsrFsJnl+0x8800
be19fa70 f46ead81 feed88d8 fd545c48 fdd3e588 VsrFsJnl+0x1154b
be19fa94 f46eaf92 fdd3e588 00000000 0600078b VsrFsFlt+0x1d81
be19fac8 e081de83 feee1668 fd545c48 fdd3e588 VsrFsFlt+0x1f92
be19faf8 f4db7b6d e6604d28 0000000a be19fb6c nt!IopfCompleteRequest+0xc
be19fb08 f4de363a fd8e58b8 fd545c48 00000000 Ntfs!NtfsCompleteRequest+0
be19fb6c f4db62fb fd8e58b8 fd545c48 feed88d8 Ntfs!NtfsCommonSetInformat
be19fbd4 e081dce5 fe8b0718 fd545c48 ff919f38 Ntfs!NtfsFsdSetInformation
be19fbe8 f4e70c53 ff919f38 fd545dd8 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc10 e081dce5 feed88d8 fd545c48 fd545dfc fltMgr!FltpDispatch+0x6f (FPO: [Non-Fpo])
be19fc24 f46ea1c8 be19fcac f46eb524 feee1720 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fc2c f46eb524 feee1720 fd545c48 00000000 VsrFsFlt+0x11c8
be19fcac e081dce5 feee1668 fd545c48 00000000 VsrFsFlt+0x2524
be19fcc0 e08f0433 be19fd64 00afb248 e08efe88 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
be19fd48 e0888c6c 00000e00 00afb288 00afb290 nt!NtSetInformationFile+0x
be19fd48 7c82ed54 00000e00 00afb288 00afb290 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ be19fd64)
00010bfe 00000000 00000000 00000000 00000000 0x7c82ed54
ASKER
Thanks for the Quick reply. Its definately not hardware as the backup server is running identical hardware and i swapped to it and same result.
I have posted 5 minidumps here: http://www.ground-under.com.au/Desktop.rar
I have posted 5 minidumps here: http://www.ground-under.com.au/Desktop.rar
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
VsrFsJnl.sys is the Symantec File System Journal Writer for the Continuous Protection Server (CPS) component.
From cpc2004 help i have ascertained that this crash situation only occurs whilst the hourly snapshot of the server is in progress or while the nightly offsite backup over the WAN (that often runs into the next morning) is in progress. If there is no snapshot occuring by the CPS the server doesnot crash.
As i have temporarily disable the CPS the issue is resolved, but as this cant be the solution i am now on the veritas forums trying to resolve the actual problem. Will post it for everyones further help.
Thanks cpc2004, your help enabled me to pinpoint the problem. I dont know if i should accept this answer? (can a mod be involved?) The solution will hopefully be forthcoming!
From cpc2004 help i have ascertained that this crash situation only occurs whilst the hourly snapshot of the server is in progress or while the nightly offsite backup over the WAN (that often runs into the next morning) is in progress. If there is no snapshot occuring by the CPS the server doesnot crash.
As i have temporarily disable the CPS the issue is resolved, but as this cant be the solution i am now on the veritas forums trying to resolve the actual problem. Will post it for everyones further help.
Thanks cpc2004, your help enabled me to pinpoint the problem. I dont know if i should accept this answer? (can a mod be involved?) The solution will hopefully be forthcoming!
Probably it is the software error at VsrFsJnl.sys. I search google and I cannot find any hit relating to this module. Another possibility is faulty ram. One minidump is insufficent to determine the root cause of blue scree.
,
Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit. Run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.
http://www.memtest86.com/.
Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/