Advertisement

01.21.2008 at 12:27PM PST, ID: 23099275
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
3.8

Trend causing server to crash (CSM for SMB 3.6)

Asked by djMundy in Anti-Virus Applications, Windows Network Security, Windows 2003 Server

Tags: , ,

I recently installed the latest version of Trend CSM for SMB 3.6 for a client, replacing the CA software they were using. Ever since the upgrade, it has been crashing the server regularly  almost every day.

It would crash at just after 3:00pm every day, which was causing everyone to lose their work. I disabled the Trend services on the server which fixed the issue. However this is not a good workaround as the client PCs would no longer receive antivirus updates.

As a temporary workaround I set up a script on the server to automatically shut down the Trend services (just on the server) at 2:00pm every day, and another script to start them up again after everyone has left the office (8:00pm). This stopped people from losing their work, but after the Trend services have started again the server crashes. This causes our backups to fail...

It seems to crash about an hour after the Trend services start again, at almost exactly the same time every night. The Trend service start at 20:00 and then the server crashes at eg. 21:08, 21:06, 21:10.

I have attached the crash dump analysis in case it is helpful.

I should also mention that I applied patch 1 for CSM 3.6 when it came out, hoping that it would fix these problems  but it did not.

Thanks,
DanielStart Free Trial 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
 
Symbol search path is: SRV*C:\WebSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Jan 18 21:03:54.189 2008 (GMT+11)
System Uptime: 1 days 13:05:48.929
WARNING: Process directory table base 3FBE1620 doesn't match CR3 00506000
WARNING: Process directory table base 3FBE1620 doesn't match CR3 00506000
Loading Kernel Symbols
.............................................................................................................
Loading User Symbols
...............................Unable to read NT module Base Name string at 0019fc78 - NTSTATUS 0xC0000147
.....Unable to read NT module Base Name string at 001a60b0 - NTSTATUS 0xC0000147
Missing image name, possible paged-out or corrupt data.
.Unable to read NT module Base Name string at 001a5eaa - NTSTATUS 0xC0000147
Missing image name, possible paged-out or corrupt data.
...
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 7F, {8, 80042000, 0, 0}
 
*** ERROR: Module load completed but symbols could not be loaded for TmPreFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for ofant.sys
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
Probably caused by : storport.sys ( storport!StorPortDebugPrint+1c )
 
Followup: MachineOwner
---------
 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000
 
Debugging Details:
------------------
 
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
 
BUGCHECK_STR:  0x7f_8
 
TSS:  00000028 -- (.tss 0x28)
eax=80871f39 ebx=8641d2c8 ecx=8641d288 edx=f74f20bc esi=8641d288 edi=86800000
eip=80883973 esp=b6ef0000 ebp=b6ef0244 iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
nt!_SEH_prolog+0x23:
80883973 50              push    eax
Resetting default scope
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
PROCESS_NAME:  NTRtScan.exe
 
CURRENT_IRQL:  2
 
LAST_CONTROL_TRANSFER:  from 80872237 to 80883973
 
STACK_TEXT:  
b6ef0244 80872237 f726c85c 0000005a 00000004 nt!_SEH_prolog+0x23
b6ef0264 f726c888 f726c85c 0000005a 00000004 nt!vDbgPrintExWithPrefix+0x1b
b6ef0280 f74eb852 00000004 f74eb7ca 8641d2c8 storport!StorPortDebugPrint+0x1c
b6ef02b4 f74f03ba 86759004 0141d288 b6ef02e0 arc!RxPushMessageUnitQueueFib+0x28
b6ef02c4 f74ed05e 8641d288 8641d288 85270000 arc!SendMessageUnitQueueFib+0x16
b6ef02e0 f74ed6dc 000001f6 8641d288 00000000 arc!SendFib+0xf6
b6ef0304 f74eda72 000001f6 0141d288 00000000 arc!SendRawIoFib+0xa8
b6ef0344 f7266090 86759004 8527c82c b6ef037c arc!StartIo+0x102
b6ef0354 f7266d15 8673c1a0 8527c82c 00000000 storport!RaCallMiniportStartIo+0x1e
b6ef037c f7266dad 8673c0e8 86760de0 866aee18 storport!RaidAdapterPostScatterGatherExecute+0xab
b6ef0394 80a5b147 8673c030 00000000 8641d05c storport!RaidpAdapterContinueScatterGather+0x3f
b6ef03c0 f726a3f0 8641d05c 8673c030 866aedf8 hal!HalBuildScatterGatherList+0x1c7
b6ef03f0 f7266e2d 8673c2ac 8673c030 866aedf8 storport!RaidDmaBuildScatterGatherList+0x2c
b6ef042c f7266e7f 8673c2ac 8641d000 b6ef045c storport!RaidAdapterScatterGatherExecute+0x49
b6ef043c f7271ae0 8673c0e8 8641d010 85362d10 storport!RaidAdapterExecuteXrb+0x21
b6ef045c f726b80b 00000000 00000001 b6ef047c storport!RaUnitStartIo+0x98
b6ef0490 f7270179 8527c82c 01362d10 00000000 storport!RaidStartIoPacket+0x85
b6ef04b0 f7272083 86760d68 85362d10 f7274510 storport!RaidUnitSubmitRequest+0x47
b6ef04cc f726a62e 86760d68 85362d10 84f4ae20 storport!RaUnitScsiIrp+0xc1
b6ef04e8 8081df65 86760cb0 85362d10 8527c780 storport!RaDriverScsiIrp+0x5c
b6ef04fc f7242607 8527c780 9bde7000 b6ef0540 nt!IofCallDriver+0x45
b6ef050c f72422b2 8527c780 863490e8 84f4af44 CLASSPNP!SubmitTransferPacket+0xbb
b6ef0540 f7242533 00000000 00001000 84f4ae20 CLASSPNP!ServiceTransferRequest+0x1e4
b6ef0564 8081df65 86349030 00000000 8673ff38 CLASSPNP!ClassReadWrite+0x159
b6ef0578 f74c80cf 86725e00 84f4af68 b6ef059c nt!IofCallDriver+0x45
b6ef0588 8081df65 8675ed00 84f4ae20 84f4af8c PartMgr!PmReadWrite+0x95
b6ef059c f7317053 84f4ae20 86742a20 84f4ae20 nt!IofCallDriver+0x45
b6ef05b8 8081df65 86725d48 84f4ae20 84f4afb0 ftdisk!FtDiskReadWrite+0x1a9
b6ef05cc f72c08bc 867641c0 866fcb48 8671fb88 nt!IofCallDriver+0x45
b6ef05e4 8081df65 8671fb88 84f4ae20 84f4ae20 volsnap!VolSnapRead+0x52
b6ef05f8 f7b50a62 b6ef08dc b6ef07dc f7b508d9 nt!IofCallDriver+0x45
b6ef0604 f7b508d9 b6ef08dc 8671fb88 c0be7000 Ntfs!NtfsSingleAsync+0x91
b6ef07dc f7b51156 b6ef08dc 84f4ae20 866fcb48 Ntfs!NtfsNonCachedIo+0x2db
b6ef08c8 f7b51079 b6ef08dc 84f4ae20 00000001 Ntfs!NtfsCommonRead+0xaf5
b6ef0a74 8081df65 861fe020 84f4ae20 866eddf0 Ntfs!NtfsFsdRead+0x113
b6ef0a88 f7220c45 866eddf0 84f4afd4 00000000 nt!IofCallDriver+0x45
b6ef0ab0 8081df65 86703c70 84f4ae20 863f1f38 fltmgr!FltpDispatch+0x6f
b6ef0ac4 f75b8bfe b6ef0ae0 8081df65 86472b48 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b6ef0acc 8081df65 86472b48 84f4ae20 84f4ae20 TmPreFlt+0x1bfe
b6ef0ae0 b9efdd40 85b96020 84f4ae20 b6ef0b40 nt!IofCallDriver+0x45
b6ef0af4 b9efd8c8 85b96020 84f4ae20 00000000 ofant+0xdd40
00000000 00000000 00000000 00000000 00000000 ofant+0xd8c8
 
 
STACK_COMMAND:  .tss 0x28 ; kb
 
FOLLOWUP_IP: 
storport!StorPortDebugPrint+1c
f726c888 5d              pop     ebp
 
SYMBOL_STACK_INDEX:  2
 
SYMBOL_NAME:  storport!StorPortDebugPrint+1c
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: storport
 
IMAGE_NAME:  storport.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP:  45d69bb4
 
FAILURE_BUCKET_ID:  0x7f_8_storport!StorPortDebugPrint+1c
 
BUCKET_ID:  0x7f_8_storport!StorPortDebugPrint+1c
 
Followup: MachineOwner
---------
[+][-]01.21.2008 at 09:49PM PST, ID: 20712167

Assisted solutions are selected by the member who asked the question as a comment that contributed to their question's solution.

Start your 7-day free trial to view this Assisted Solution or ask the Experts your question.

 
[+][-]01.21.2008 at 09:54PM PST, ID: 20712180

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]01.21.2008 at 10:42PM PST, ID: 20712343

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 05:01PM PST, ID: 20719955

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 05:50PM PST, ID: 20720268

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 07:53PM PST, ID: 20720691

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 07:58PM PST, ID: 20720707

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 08:06PM PST, ID: 20720742

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.22.2008 at 10:53PM PST, ID: 20721291

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]01.23.2008 at 09:08AM PST, ID: 20725145

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.23.2008 at 09:24AM PST, ID: 20725297

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.23.2008 at 09:16PM PST, ID: 20730809

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.25.2008 at 07:39PM PST, ID: 20748364

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.25.2008 at 08:01PM PST, ID: 20748403

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]01.25.2008 at 08:23PM PST, ID: 20748442

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]01.29.2008 at 07:27PM PST, ID: 20774414

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]02.01.2008 at 03:20AM PST, ID: 20795695

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]02.01.2008 at 03:32AM PST, ID: 20795754

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]02.01.2008 at 03:46AM PST, ID: 20795805

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]02.01.2008 at 07:40AM PST, ID: 20797446

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]02.05.2008 at 12:54PM PST, ID: 20826820

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]02.05.2008 at 02:10PM PST, ID: 20827608

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]03.06.2008 at 10:55PM PST, ID: 21067893

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Anti-Virus Applications, Windows Network Security, Windows 2003 Server
Tags: Trend Micro, CSM for SMB, 3.6 Patch 1
Sign Up Now!
Solution Provided By: djMundy
Participating Experts: 2
Solution Grade: A
 
 
[+][-]03.08.2008 at 09:00AM PST, ID: 21077731

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]03.08.2008 at 09:48AM PST, ID: 21077937

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]03.08.2008 at 09:51AM PST, ID: 21077957

Assisted solutions are selected by the member who asked the question as a comment that contributed to their question's solution.

Start your 7-day free trial to view this Assisted Solution or ask the Experts your question.

 
[+][-]03.08.2008 at 04:23PM PST, ID: 21079352

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 7-day free trial to view this Administrative Comment or ask the Experts your question.

 
[+][-]03.09.2008 at 06:12PM PDT, ID: 21083511

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]03.09.2008 at 07:01PM PDT, ID: 21083672

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 7-day free trial to view this Administrative Comment or ask the Experts your question.

 
[+][-]03.10.2008 at 06:02PM PDT, ID: 21092071

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628