Blue screen error - Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 ) ??? - 2003 ent ed.

Some additional info - we have found out that its really is 2 errors:

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            2/7/2007
Time:            12:33:26 PM
User:            N/A
Computer:      
Description:
Error code 000000c2, parameter1 00000007, parameter2 0000121a, parameter3 00320033, parameter4 e205dbf8.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 30 30 30 30 30 30 63    000000c
0020: 32 20 20 50 61 72 61 6d   2  Param
0028: 65 74 65 72 73 20 30 30   eters 00
0030: 30 30 30 30 30 37 2c 20   000007,
0038: 30 30 30 30 31 32 31 61   0000121a
0040: 2c 20 30 30 33 32 30 30   , 003200
0048: 33 33 2c 20 65 32 30 35   33, e205
0050: 64 62 66 38               dbf8    

AND

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            2/7/2007
Time:            12:32:53 PM
User:            N/A
Computer:      
Description:
Error code 1000008e, parameter1 c0000005, parameter2 8092c1f4, parameter3 aba29828, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 38 30 39 32 63 31 66 34   8092c1f4
0040: 2c 20 61 62 61 32 39 38   , aba298
0048: 32 38 2c 20 30 30 30 30   28, 0000
0050: 30 30 30 30               0000    

1003 is a SNMP configuration issue (typically)

does it occur when some one is connecting via terminal services.?????

Hmm.... We have recieved one more on this machine.. So there is 3 types of stop errors. As follows:

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: H:\Debugging_2003_server\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Thu Feb  8 08:01:59.611 2007 (GMT+1)
System Uptime: 0 days 12:24:30.048
Loading Kernel Symbols
.................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdc00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, 808960cd, adf30018, 0}

*** ERROR: Module load completed but symbols could not be loaded for naiavf5x.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+172 )

Followup: Pool_corruption
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 808960cd, The address that the exception occurred at
Arg3: adf30018, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+172
808960cd 8937            mov     dword ptr [edi],esi

TRAP_FRAME:  adf30018 -- (.trap ffffffffadf30018)
ErrCode = 00000002
eax=e310a1c8 ebx=00000001 ecx=000001ff edx=e310a4d0 esi=00000000 edi=00000000
eip=808960cd esp=adf3008c ebp=adf300c4 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!ExDeferredFreePool+0x172:
808960cd 8937            mov     dword ptr [edi],esi  ds:0023:00000000=????????
Resetting default scope

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 808553d1 to 80875d0e

STACK_TEXT:  
adf2fbe4 808553d1 0000008e c0000005 808960cd nt!KeBugCheckEx+0x1b
adf2ffa8 80823dca adf2ffc4 00000000 adf30018 nt!KiDispatchException+0x3a2
adf30010 80823d7e adf300c4 808960cd badb0d00 nt!CommonDispatchException+0x4a
adf300c4 80895b90 897c4030 80a6ea90 00000000 nt!Kei386EoiHelper+0x182
adf300c4 80895b90 897c4030 80a6ea90 00000000 nt!ExFreePoolWithTag+0x54b
adf30118 809025b1 e252b8d8 e56b6f54 8979c040 nt!ExFreePoolWithTag+0x54b
adf30134 8090483c e252b8e8 00000000 8979c040 nt!ObpFreeObject+0x192
adf30148 80828af5 e252b900 00000000 890ea008 nt!ObpRemoveObjectRoutine+0xe6
adf30168 ada7949d 89491008 896dd12c ada796ac nt!ObfDereferenceObject+0x67
WARNING: Stack unwind information not available. Following frames may be wrong.
adf3018c ada79736 00000000 ada7781e 8825c304 naiavf5x+0x1349d
adf301b4 ada747bd ffffffff 00000008 02100049 naiavf5x+0x13736
adf30200 ada6d933 895aa0b8 892c7dd0 02100049 naiavf5x+0xe7bd
adf30290 ada6de92 895a8008 895a8198 895aa0b8 naiavf5x+0x7933
adf302d8 ada68800 00000000 895aa0b8 88685690 naiavf5x+0x7e92
adf302ec 80828c95 893f8f08 895a8008 895a8008 naiavf5x+0x2800
adf30300 80907bfa adf304a8 89694bf0 00000000 nt!IofCallDriver+0x45
adf303e8 80902fad 89694c08 00000000 895dae00 nt!IopParseDevice+0xa35
adf30468 80906a15 00000000 adf304a8 00000040 nt!ObpLookupObjectName+0x5a9
adf304bc 8090613b 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
adf30538 8092b2c2 00cdec38 00100020 00cdebfc nt!IopCreateFile+0x447
adf30594 8091bd30 00cdec38 00100020 00cdebfc nt!IoCreateFile+0xa3
adf305d4 8082337b 00cdec38 00100020 00cdebfc nt!NtOpenFile+0x27
adf305d4 7c82ed54 00cdec38 00100020 00cdebfc nt!KiFastCallEntry+0xf8
00cdecc8 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+172
808960cd 8937            mov     dword ptr [edi],esi

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+172

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  0x8E_nt!ExDeferredFreePool+172

BUCKET_ID:  0x8E_nt!ExDeferredFreePool+172

Followup: Pool_corruption
---------

Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            2/8/2007
Time:            10:48:00 AM
User:            N/A
Computer:      
Description:
Error code 1000008e, parameter1 c0000005, parameter2 808960cd, parameter3 adf30018, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005,
0038: 38 30 38 39 36 30 63 64   808960cd
0040: 2c 20 61 64 66 33 30 30   , adf300
0048: 31 38 2c 20 30 30 30 30   18, 0000
0050: 30 30 30 30               0000    
 

"Does it occur when some one is connecting via terminal services.?????"

Not that we know of...

I would say that it happens more randomly, without saying to much....

The stack trace of the second dump has the footprint of naiavf5x.sys (ie Mcafee Anti Virus Filter). What version of Mcafee Anti Virus Filter are you using?


adf3018c ada79736 00000000 ada7781e 8825c304 naiavf5x+0x1349d
adf301b4 ada747bd ffffffff 00000008 02100049 naiavf5x+0x13736

We have Network Associates (Mcafee) VirusScan Enterprise 8.0i Patch 13, and are planning for upgrading to 8.5. We havn't done that yet becasue the new version is very comprehensive and we need to dig through the docs before implementing it.

Ho w can we found out which version of the filter is running on the server? If you click "about" that info does not pop up..

Hm ram issue you say?
That is very anoying - We have just for about a month changed all ram blocks on this server due to corrupted ram blocks.

Hmm looks like I'm all alone here!  :-(

Anyhow if could get some help with the question towards the version of Mcafee Anti Virus Filter I would be very happy.

//whatisthesolution

Hi PowerIT,

Have you run those? Yup we did and it came out negative. Did not find anything.

We are running memtest and we will hopefully soon have result of that.

Hi guys- sorry for the time gone by - but we need to test it thoroughly to be sure.. - same thing again RAM error. That's quite annoying..   Ggrr

I'll split the pts between you cpc2004 and powerit.
thanks for the help.
whatisthesolution