Solved

Reboot due to bugcheck 0x00000044, W2K Professional

Posted on 2004-10-27
1,505 Views
Last Modified: 2011-09-20
I have three computers loaded with W2K Professional OS.  All computers are similiar, but not identical - sample configuration:

P4, 800
512 RAM
Intel Network Card
RAID Drives with 80GB HD

Systems are up and running 24 x 7, in production.  All three are experiencing reboot problems, some more than others.  Reboots usually happen at night and always create a dump file referencing bugcheck error 0x00000044 (MULTIPLE_IRP_COMPLETE_REQUESTS).  A sample of the parameters:

bugcheck code: 0x00000044
parameter 1: 0xff26609c
parameter 2: 0x00000cca
parameter 3: 0x00000000
parameter 4: 0x00000000

I have checked the bugcheck save dump files on 27 different reboot occassions and every parameter is exactly the same, except parameter 1 - it is always different.

I tried to run the debug through WinDbg - here are my results:

Microsoft (R) Windows Debugger  Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\temp\Mini100604-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\I386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e1b8
Debug session time: Wed Oct 06 00:45:36 2004
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
......................................................................................................
Loading unloaded module list
.....................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {ff293a9c, cca, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : ntoskrnl.exe ( nt+1fcca )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: ff293a9c, Address of the IRP
Arg2: 00000cca
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


IRP_ADDRESS:  ff293a9c

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x44

LAST_CONTROL_TRANSFER:  from 00000044 to 8041fcca

STACK_TEXT:  
804739b4 00000044 ff293a9c 00000cca 00000000 nt+0x1fcca


FOLLOWUP_IP:
nt+1fcca
8041fcca ??               ???

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt+1fcca

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee6c002

STACK_COMMAND:  kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner


I appreciate any assistance, advice or direction you may have.  These are the things I have tried:

1.  I have added memory to the units.  Upto 1024MB and the problem still occurs.
2.  I have replaced the memory all together.  Problem still occurs.
3.  I have tried a different UPS as a backup power source.  Problem still occurs.
4.  I have reinstalled the OS on one unit, and the problem hasn't occurred yet - but I'm not sure this is a valid test.  I only loaded the base software back on and I'm concerned that once we load the big brother monitoring software and the veritas backup software the problem will start again OR I haven't waited long enough on the reinstall testing to see if that really was the solution.

All of my research points this to be a driver problem, but how do I find it?  I am not very technical, so advice in lay-man terms would be appreciated.

Thank you.
Audrey
0
Question by:AnixonIMS
    3 Comments
     
    LVL 9

    Expert Comment

    by:BigC666
    howdy,

    yes it's a driver problem, i would load the monitoring software on the fresh install and wait a couple of days, if no problem then load the veritas, looks like one or the other is trying to sieze a packet thats already used.

    hope that this helps
    0
     
    LVL 15

    Accepted Solution

    by:
    Are you loading the Veritas Backup Remote Agent?

    http://support.microsoft.com/default.aspx?scid=kb;en-us;296734 - it is VERY possible some files are overwritten from the service pack when you install third-party applications.  After installing thrid-party applications, reapply the latest service pack and see if the problems continue.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;867774

    http://support.microsoft.com/default.aspx?scid=kb;en-us;832212

    I hope this helps,

    Walkabout
    0
     

    Author Comment

    by:AnixonIMS
    Thanks for the feedback.  We have reapplied SP4 to one of the units.  We are slowly adding back in the third party software on another.  We're monitoring both now.  I'll let you know how it goes.
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Course: Foundations of Front-End Development

    Jump-start a lucrative career in front-end web development, with zero previous coding experience required. This course covers the basic programming concepts and languages required for creating engaging websites from scratch.

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    Read about why website design really matters in today's demanding market.
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!

    931 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now