On windows 2000 Blusescreen 0x0000004d

Hi Jonathanpham,

It works fine another system.

Thanks

This USB disk is probably not compatible with your server. You can try adding RAM or looking for mainboard driver updates. If your Server only has USB 1 onboard you may want to try adding a PCI USB 2 card to which you can try connecting the disk. What Server OS version are you using, have you installed the latest SP and windowsupdates?

Check this link

http://www.eventid.net/display.asp?eventid=1000&eventno=1473&source=Save%20Dump&phase=1

Reps

Does it work on another 2k machine?
Can you give us some system specs? RAM, HD space, installed expansion cards...
Can you back up all the data and reformat the drive?

http://support.microsoft.com/kb/907404/en-us
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/w2kmsgs/438.asp

You need to find the dump and have it analyzed.

http://www.freewarehome.com/index.html?%2FProgramming%2FHelper_Apps%2FAnalysis_t.html

Try that. I haven't had a crash, so I can't test it, but it might prove useful

Hi,

It is Windows 2000 SP4 machine.
IBM x series server 8656 6RY.

Thanks

Hi all,
This is the memory dump analyzed;

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NO_PAGES_AVAILABLE (4d)
No free pages available to continue operations.
If kernel debugger available "!vm 3".
        This bugcheck can occur for the following reasons:
        1.  A driver has blocked, deadlocking the modified or mapped
            page writers.  Examples of this include mutex deadlocks or
            accesses to paged out memory in filesystem drivers, filter
            drivers, etc.  This indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!vm 3" in the kernel debugger.
        2.  The storage driver(s) are not processing requests.  Examples
            of this are stranded queues, non-responding drives, etc.  This
            indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!process 0 7" in the kernel debugger.
        3.  Not enough pool is available for the storage stack to write out
            modified pages.  This indicates a driver bug.
            If parameter 3 is small, then this is a possibility.  Type
            "!vm" and "!poolused 2" in the kernel debugger.
        4.  A high priority realtime thread has starved the balance set
            manager from trimming pages and/or starved the modified writer
            from writing them out.  This indicates a bug in the component
            that created this thread.
            This one is hard to determine, try "!ready"
        5.  All the processes have been trimmed to their minimums and all
            modified pages written, but still no memory is available.  The
            freed memory must be stuck in transition pages with non-zero
            reference counts - thus they cannot be put on the freelist.
            A driver is neglecting to unlock the pages preventing the
            reference counts from going to zero which would free the pages.
            This may be due to transfers that never finish and the driver
            never aborts or other driver bugs.
            If parameter 4 is large, then this is a possibility.  But it
            is very hard to find the driver.  Try "!process 0 1" and look
            for any that have a lot of locked pages.
If the problem cannot be found, then try booting with /DEBUG and a kernel
debugger attached, so if it reproduces, a debug session can be initiated
to identify the cause.
Arguments:
Arg1: 00075a80, Total number of dirty pages
Arg2: 00000000, Number of dirty pages destined for the pagefile(s).
Arg3: 0000f0c4, Internal flags.
Arg4: 00000080, Most recent modified write error status.

Debugging Details:
------------------


POISONED_TB: nt!MmPoisonedTb is non-zero:

DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR:  0x4D

LAST_CONTROL_TRANSFER:  from 8044412c to 8044aabe

STACK_TEXT:  
ba7dcca8 8044412c 88c87be0 c0000218 800656b0 nt!IopRemoveLockedDeviceNode+0x92
ba7dccc4 8044373b 00086820 c0000218 ba7dccf8 nt!RtlWalkFrameChain+0xfd
ba7dccfc 8044ccd6 00000000 00086820 c0000218 nt!MmCopyToCachedPage+0x60e
ba7dcd4c 8046b063 00000000 00086820 00000001 nt!MmMapLockedPagesSpecifyCache+0x2ac
ba7dcd64 00000000 00000000 00000000 00000000 nt!PopCompositeBatteryUpdateThrottleLimit+0x85


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!IopRemoveLockedDeviceNode+92
8044aabe 803d5882478000 cmp byte ptr [nt!MiFreePoolPages+0x521 (80478258)],0x0

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!IopRemoveLockedDeviceNode+92

MODULE_NAME:  nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4344ec59

FAILURE_BUCKET_ID:  0x4D_VFL_nt!IopRemoveLockedDeviceNode+92

BUCKET_ID:  0x4D_VFL_nt!IopRemoveLockedDeviceNode+92
*** WARNING: nt!MmPoisonedTb is non-zero:
***    The machine has been manipulated using the kernel debugger.
***    MachineOwner should be contacted first



Followup: MachineOwner
---------

0: kd> !Vm 3

*** Virtual Memory Usage ***
      Physical Memory:   524164   ( 2096656 Kb)
80491a00: Unable to get page file
unable to get nt!MmExtendedCommit
unable to get nt!MmPageFileFullExtendPages
unable to get nt!MmPageFileFullExtendCount
      Available Pages:        1   (       4 Kb)
      ResAvail Pages:    439765   ( 1759060 Kb)
      Modified Pages:    481920   ( 1927680 Kb)
      ********** High Number Of Modified Pages ********
      NonPagedPool Usage:  3900   (   15600 Kb)
      NonPagedPool Max:   68609   (  274436 Kb)
      PagedPool 0 Usage:   7773   (   31092 Kb)
      PagedPool 1 Usage:    456   (    1824 Kb)
      PagedPool 2 Usage:    445   (    1780 Kb)
      PagedPool 3 Usage:    449   (    1796 Kb)
      PagedPool 4 Usage:    446   (    1784 Kb)
      PagedPool Usage:     9569   (   38276 Kb)
      PagedPool Maximum:  87040   (  348160 Kb)
      Shared Commit:       1954   (    7816 Kb)
      Special Pool:    -1063010253   (42926284 Kb)
      Free System PTEs: 1532911615   (1836679164 Kb)
      Shared Process:      7518   (   30072 Kb)
      PagedPool Commit:    9569   (   38276 Kb)
      Driver Commit:        953   (    3812 Kb)
      Committed pages:   128382   (  513528 Kb)
      Commit limit:     1270915   ( 5083660 Kb)


      Memory Management Thread Stacks:


0: kd> lm t n
start    end        module name
80062000 80076f80   hal      halmacpi.dll Fri Dec 03 08:59:15 2004 (41AFDD8B)
80400000 805a29c0   nt       ntkrnlmp.exe Thu Oct 06 14:50:25 2005 (4344EC59)
a0000000 a0190000   win32k   win32k.sys   Thu Oct 06 15:03:42 2005 (4344EF76)
a0190000 a01f7000   S3gsav4  S3gsav4.dll  unavailable (FFFFFFFE)
a07e0000 a07ed000   RDPDD    RDPDD.dll    unavailable (FFFFFFFE)
bb015000 bb02af20   RDPWD    RDPWD.SYS    Fri Jun 17 12:11:40 2005 (42B270A4)
bb02b000 bb0457c0   naiavf5x naiavf5x.sys Tue Nov 02 23:02:39 2004 (4187C4B7)
bb2a6000 bb2b5a20   ipsec    ipsec.sys    Wed Apr 30 04:34:59 2003 (3EAF051B)
bbad1000 bbad3100   EntDrv50 EntDrv50.sys Wed Oct 06 04:53:47 2004 (41632D03)
bbeca000 bbed9600   Cdfs     Cdfs.SYS     Sat Apr 02 06:53:36 2005 (424DF418)
bbeea000 bbef2a60   termdd   termdd.sys   Sat Mar 22 03:13:08 2003 (3E7B876C)
bc186000 bc188f20   spud     spud.sys     Sat Nov 20 05:06:27 1999 (3835DEFB)
bc6ca000 bc704440   srv      srv.sys      Tue May 03 13:40:42 2005 (42773202)
bc759000 bc75b600   lm78nt   lm78nt.sys   Fri Apr 04 16:54:52 2003 (3E8D6B84)
bca4d000 bca6c140   afd      afd.sys      Tue Apr 12 03:01:21 2005 (425AECA9)
bf9b7000 bf9d9ac0   Fastfat  Fastfat.SYS  Tue Jul 19 16:14:42 2005 (42DCD99A)
bf9ea000 bf9ed6c0   dump_scsiport dump_scsiport.sys Wed Feb 26 00:48:04 2003 (3E5BC16C)
bfa02000 bfa6ba40   mrxsmb   mrxsmb.sys   Sat Apr 02 06:53:32 2005 (424DF414)
bfa7e000 bfaaaac0   rdbss    rdbss.sys    Tue Apr 12 03:01:22 2005 (425AECAA)
bfaab000 bfad5d00   netbt    netbt.sys    Sat Apr 02 06:53:24 2005 (424DF40C)
bfad6000 bfb241a0   tcpip    tcpip.sys    Thu May 12 15:54:58 2005 (42832EFA)
bfb55000 bfb5c000   TWGGrab  TWGGrab.SYS  Thu Apr 03 23:20:38 2003 (3E8C746E)
bfb6d000 bfb718c0   TDTCP    TDTCP.SYS    Sat Mar 22 03:13:08 2003 (3E7B876C)
bfc2d000 bfc35240   Fips     Fips.SYS     Tue May 09 20:58:29 2000 (39182E9D)
bfccd000 bfcf73a0   update   update.sys   Wed Apr 16 09:52:01 2003 (3E9CDA69)
bfcf8000 bfd13b40   ks       ks.sys       Wed Apr 16 09:32:11 2003 (3E9CD5C3)
bfd26000 bfd49060   rdpdr    rdpdr.sys    Sat Mar 22 03:13:14 2003 (3E7B8772)
bfd4a000 bfd60ba0   ndiswan  ndiswan.sys  Wed Apr 30 04:35:01 2003 (3EAF051D)
bfd61000 bfd83000   e100bnt5 e100bnt5.sys Mon Feb 25 21:22:28 2002 (3C7A5DBC)
bfd83000 bfd9c800   IBMTRP   IBMTRP.SYS   Tue Apr 04 03:46:21 2000 (38E91835)
bfd9d000 bfdbee80   S3gsav4m S3gsav4m.sys Thu May 23 13:57:05 2002 (3CECA7D9)
bfddf000 bfde1820   awlegacy awlegacy.sys Tue Nov 18 04:36:47 2003 (3FB95487)
bfdeb000 bfdee580   vga      vga.sys      Sun Sep 26 00:07:40 1999 (37ED1674)
bfe33000 bfe36e60   TDI      TDI.SYS      Thu Jan 16 01:26:26 2003 (3E25BCEA)
bfe57000 bfe6cbe0   Mup      Mup.sys      Fri Dec 03 09:07:23 2004 (41AFDF73)
bfe6d000 bfe96aa0   NDIS     NDIS.sys     Wed Apr 30 04:35:01 2003 (3EAF051D)
bfe97000 bff14480   Ntfs     Ntfs.sys     Tue May 10 14:50:29 2005 (42807CDD)
bff15000 bff267c0   KSecDD   KSecDD.sys   Sun Sep 21 06:02:19 2003 (3F6CF193)
bff27000 bff391c0   Dfs      Dfs.sys      Wed Feb 12 07:49:06 2003 (3E49AF1A)
bff3a000 bff5c000   fltmgr   fltmgr.sys   unavailable (FFFFFFFE)
bff5c000 bff6e180   SCSIPORT SCSIPORT.SYS Thu Jul 14 17:54:06 2005 (42D65966)
bff6f000 bff82d00   adpu160m adpu160m.sys Tue Aug 08 18:44:37 2000 (399007BD)
bff83000 bff98180   atapi    atapi.sys    Tue Apr 01 23:38:25 2003 (3E89D599)
bff99000 bffba9c0   dmio     dmio.sys     Thu Jan 16 01:17:04 2003 (3E25BAB8)
bffbb000 bffd75a0   ftdisk   ftdisk.sys   Fri Dec 03 08:59:58 2004 (41AFDDB6)
bffd8000 bffffc20   ACPI     ACPI.sys     Thu Jan 16 01:14:22 2003 (3E25BA16)
f6400000 f640e6a0   pci      pci.sys      Thu Jan 16 01:14:07 2003 (3E25BA07)
f6410000 f641b680   isapnp   isapnp.sys   Thu Jan 16 01:13:47 2003 (3E25B9F3)
f6420000 f64295c0   nfrd960  nfrd960.sys  Sat Sep 14 21:31:59 2002 (3D835D77)
f6430000 f6438700   CLASSPNP CLASSPNP.SYS Thu Jan 16 01:12:51 2003 (3E25B9BB)
f6460000 f646c4c0   VIDEOPRT VIDEOPRT.SYS Thu Jan 16 01:17:20 2003 (3E25BAC8)
f6470000 f6478a00   pcntpci5 pcntpci5.sys Tue Oct 17 04:14:31 2000 (39EB84CF)
f6480000 f648b680   i8042prt i8042prt.sys Wed Apr 16 09:30:59 2003 (3E9CD57B)
f6490000 f649f400   serial   serial.sys   Wed Apr 16 09:49:39 2003 (3E9CD9DB)
f64a0000 f64a9080   ibmspw   ibmspw.sys   Wed Apr 02 21:57:57 2003 (3E8B0F8D)
f64b0000 f64bca80   rasl2tp  rasl2tp.sys  Wed Apr 30 04:35:06 2003 (3EAF0522)
f64c0000 f64cbc40   raspptp  raspptp.sys  Thu May 15 05:17:00 2003 (3EC2D574)
f64d0000 f64dea20   parallel parallel.sys Thu Jan 16 01:17:14 2003 (3E25BAC2)
f64e0000 f64e9d00   smbushc  smbushc.sys  Wed Dec 05 16:20:32 2001 (3C0DFBF8)
f6510000 f6519be0   usbhub   usbhub.sys   Wed Mar 19 05:00:41 2003 (3E77AC21)
f6520000 f6529ce0   NDProxy  NDProxy.SYS  Fri Oct 01 04:55:35 1999 (37F3F16F)
f6530000 f6538fa0   Npfs     Npfs.SYS     Sun Oct 10 05:28:07 1999 (37FFD68F)
f6540000 f6548680   msgpc    msgpc.sys    Thu Jan 16 01:24:25 2003 (3E25BC71)
f6550000 f655e460   mvstdi5x mvstdi5x.sys Thu Oct 07 22:05:49 2004 (41657065)
f6560000 f65681a0   netbios  netbios.sys  Wed Oct 13 01:04:19 1999 (38038D3B)
f6580000 f65895c0   dump_nfrd960 dump_nfrd960.sys Sat Sep 14 21:31:59 2002 (3D835D77)
f6680000 f6685520   PCIIDEX  PCIIDEX.SYS  Wed Feb 26 00:01:08 2003 (3E5BB66C)
f6688000 f668f4c0   MountMgr MountMgr.sys Tue Aug 16 14:10:55 2005 (4301A697)
f6690000 f6697720   disk     disk.sys     Thu Jan 16 01:13:05 2003 (3E25B9C9)
f66a8000 f66ad240   Msfs     Msfs.SYS     Wed Oct 27 04:51:32 1999 (3816377C)
f66b8000 f66bdec0   kbdclass kbdclass.sys Thu Feb 20 22:07:30 2003 (3E55044A)
f66c8000 f66cd400   mouclass mouclass.sys Thu Feb 20 22:07:45 2003 (3E550459)
f66d8000 f66df000   fdc      fdc.sys      unavailable (FFFFFFFE)
f66e8000 f66ee100   parport  parport.sys  Thu Jan 16 01:17:13 2003 (3E25BAC1)
f66f0000 f66f6000   TWGSYSIN TWGSYSIN.SYS Thu Apr 03 23:07:58 2003 (3E8C7176)
f6720000 f6726c40   cdrom    cdrom.sys    Thu Jan 16 01:13:04 2003 (3E25B9C8)
f6730000 f6735fc0   openhci  openhci.sys  Sat Mar 01 05:58:59 2003 (3E5FFECB)
f6748000 f674cfc0   USBD     USBD.SYS     Wed Jan 22 22:35:33 2003 (3E2ECF5D)
f6760000 f6765000   flpydisk flpydisk.sys unavailable (FFFFFFFE)
f6768000 f676fd00   wanarp   wanarp.sys   Fri Aug 16 17:55:01 2002 (3D5CEF1D)
f6770000 f6777000   CCDevice CCDevice.SYS Thu Mar 24 05:44:39 2005 (4242066F)
f6780000 f6786a20   EFS      EFS.SYS      Thu Jan 16 01:16:55 2003 (3E25BAAF)
f6788000 f678c400   ptilink  ptilink.sys  Thu Jan 16 01:17:15 2003 (3E25BAC3)
f6790000 f6795320   USBSTOR  USBSTOR.SYS  Thu Jan 16 01:15:52 2003 (3E25BA70)
f6798000 f679c0e0   raspti   raspti.sys   Sat Oct 09 02:15:10 1999 (37FE57D6)
f6810000 f6812a20   BOOTVID  BOOTVID.dll  Thu Nov 04 06:54:33 1999 (3820E051)
f6814000 f6816d00   PartMgr  PartMgr.sys  Thu Jan 16 01:13:07 2003 (3E25B9CB)
f6818000 f681b320   Gernuwa  Gernuwa.sys  Mon Apr 21 22:30:31 2003 (3EA423AF)
f6898000 f689bd80   aw_host5 aw_host5.sys Thu Oct 23 20:02:19 2003 (3F97E673)
f68ac000 f68af640   serenum  serenum.sys  Thu Jan 16 01:17:01 2003 (3E25BAB5)
f68b8000 f68ba2e0   ndistapi ndistapi.sys Thu Jan 16 01:24:15 2003 (3E25BC67)
f6900000 f6901d20   Diskperf Diskperf.sys Thu Feb 13 03:04:38 2003 (3E4ABDEE)
f6902000 f6904000   dmload   dmload.sys   unavailable (FFFFFFFE)
f6912000 f6914000   Fs_Rec   Fs_Rec.SYS   unavailable (FFFFFFFE)
f6914000 f6915de0   awechomd awechomd.sys Fri Mar 05 23:22:22 2004 (4048BE56)
f691c000 f691de40   rasacd   rasacd.sys   Sun Sep 26 00:11:23 1999 (37ED1753)
f693c000 f693e000   ParVdm   ParVdm.SYS   unavailable (FFFFFFFE)
f6980000 f6981400   pmemnt   pmemnt.sys   Fri Apr 04 16:53:05 2003 (3E8D6B19)
f69c8000 f69c8f80   WMILIB   WMILIB.SYS   Sun Sep 26 00:06:47 1999 (37ED163F)
f69c9000 f69c9b00   pciide   pciide.sys   Thu Jan 16 01:13:03 2003 (3E25B9C7)
f69ef000 f69efa40   audstub  audstub.sys  Sun Sep 26 00:05:33 1999 (37ED15F5)
f69fb000 f69fbd80   swenum   swenum.sys   Sun Sep 26 00:06:31 1999 (37ED162F)
f6a08000 f6a09000   Null     Null.SYS     unavailable (FFFFFFFE)
f6a0a000 f6a0aee0   Beep     Beep.SYS     Thu Oct 21 03:48:59 1999 (380E3FD3)
f6a0f000 f6a0ff80   mnmdd    mnmdd.SYS    Sun Sep 26 00:07:40 1999 (37ED1674)
f6a2f000 f6a2f7c0   AlKernel AlKernel.sys Sat Aug 25 04:01:42 2001 (3B86D5CE)

Unloaded modules:
bb7f8000 bb7fb000   EntDrv50.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6570000 f6579000   redbook.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6698000 f669d000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bfdf3000 bfdf6000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000

windows 2000k (server) didn't yet have the best USB support. Maybe if you check the IBM homepage for a more current chipset driver, that might help.

Hi Rindi,

The firmware looks fine.

Thanks

Can any one help me on this to troubleshoot it.

Thanks beforehand.

Try this software

http://allwaysync.com/

Ded9

Have you tried a PCI USB 2 card and then connecting the USB disk to that?

How to check in the windebuging tool, which process is using highest no of pages.
And aslo please guide me how to analyse the same.

Thanks

Hi rindi,
No I have not tried. I think there should be some work around without this.

Regards

The stop error you get indicates incompatible hardware / Unsuitable drivers. This could possibly be overcome with using other hardware or drivers. Also your Hardware probably only supports USB 1, a USB disk should be used at USB 2 speeds to get usable speeds.

From the looks of it, it's a vast memory protection that failed with "unitialized Operand."

"POISONED_TB: nt!MmPoisonedTb is non-zero:"

Expected a zero value in operand location.

Unless some drivers initialize operand areas properly, location contents are "unpredictible" which means probably not zero, or, data valid bit not set, unitialized Tag Bits set, and so on.

It is most likely the driver set.

Rindi,
On server the disk is connected to USB 2.0 controller.

Ginric,
The driver i'm  not gettting on Samsumg website. Do you know any location from where I can download the same.
Regards.

Have you tried using a pci usb controller? They are cheap and it may work.

vijyant

Funny, my cellphone is Samsung and they're drivers don't work on my 64-bit machines either.

The cellphone connects through one of the front panel USB ports.  For the 32-bit machine it installed and whenever I plug in the Blade phone, it automatically asks me if I want to upload pictures from the phone.  On the 64-bit Operating System, it detects the new hardware, tries to find the drivers, and can't.  Some drivers are available at Sprint, and some at Samsung.  I think it's simply that they are not yet prepared for 64-bit machines.

Using AMD XP +3200 processor and Asus K8V SE Deluxe and A8N5X motherboards.  Asus seems to have most drivers, one Via one nVidia, but I don't recall the nVidia set, although I think the Asus CD came with the proper drivers which have to be installed post Operating System install.  These don't cross the 32/64 bit software boundary either.

Like I said, they don't know 64-bit architecture and software yet.

Its a 32bit OS installed on the server

The 32-bit Operating System may have gotten a new driver update that the folks at Samsung thought worked with both 64-bit and 32-bit systems, but doesn't.

What I don't see in your debug is "Probably caused by" which is usually stated in most dumps.

It's having problems with locks and pagefiles.

You might try moving your pagefile, by changing it.  According to your dump, you're out of pagefile memory.  A dead mutex is a dead thread, for whatever reasons.  There are some problems with multithreading on some systems.  Point (5.) above in your analysis: someone is not freeing up memory, bad driver.

If the process ends before all threads report in, this can happen, locks don't get unlocked and free up memory.

Maybe something else was in the way, an antivirus, or, perhaps the USB was erroneously pagefiled as if it were an internal IDE.  In any case, you can try some tricks, like moving the page file, doing some chkdisks, scandisks, defrags, and moving the pagefile again.  If you have a weak disk storage area, even on your hard drives, this will often exercise the disks [increase hysterises] and the problem will dissolve.

But if it's a driver conflict, or your machine is thrashing somewhere in memory, or you have a definite bad driver, it won't dissolve.

Finding the drivers really is a chore; everyone gives their products three names, three model names, and none of them cross-reference, so, in the end, you can hardly find the right driver.  You have one advantage, the USB drive is external; now to figure out the real model number.

What USB drive do you have?

In the end though, I think the fault is Windows 2000 because it's somewhat older, perhaps almost at its end of life.

The USB Disk connected to the server is SP1604N - Samsung USB disk, I have searched for the driver I did not find the same on Samsumg and in google.

You don't need drivers for the disk. just for the USB port.

Now can anybody suggest what should be the version of USBSTOR.sys

That depends on the USB hardware.

Now still I am struggling to get the answers

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/DevTest_g/hh/DevTest_g/t04_bugs_00_b0cefb2e-2489-43ca-b95e-5a01070abfe7.xml.asp