troubleshooting Question

2003 Server Std BSOD and reboot

Avatar of systemssupply
systemssupply asked on
Windows Server 2003
12 Comments2 Solutions920 ViewsLast Modified:
Hi, I have a terminal server which continues to BSOD and reboot on its own. Before we all thought it was a SAV issue, I have upgraded to the latest SAV and patches but the issue persists. The server runs for a while then the BSOD. I have attached the bug check, please help.

thanks

Opened log file 'c:\debuglog031506.txt'
1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/downloads/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/downloads/symbols
1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e9683002, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f639b3d9, If non-zero, the instruction address which referenced the bad memory
      address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  e9683002

FAULTING_IP:
srv!RemoveDuplicateCoreSearches+39
f639b3d9 668b4e52         mov     cx,[esi+0x52]

MM_INTERNAL_CODE:  1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x50

CURRENT_IRQL:  1

LAST_CONTROL_TRANSFER:  from 8052fa2f to 80543ac9

STACK_TEXT:  
f78cab30 8052fa2f 00000050 e9683002 00000000 nt!KeBugCheckEx+0x19
f78cab80 804e2dfc 00000000 e9683002 00000000 nt!MmAccessFault+0x796
f78cab80 f639b3d9 00000000 e9683002 00000000 nt!KiTrap0E+0xc8
f78cac24 f638d364 00000001 f637f004 f78cacec srv!RemoveDuplicateCoreSearches+0x39
f78cac68 f6388ce3 8444515c f78cacec f78cacb4 srv!CloseIdleConnection+0x394
f78cacc4 f6388aec 84445010 804f1d00 f637ea88 srv!TimeoutSessions+0xf3
f78cad4c f636db4f 89b9fda0 8904b918 8903b210 srv!ScavengerAlgorithm+0x21e
f78cad70 80585e7f 8904b918 00000000 80582d80 srv!ScavengerThread+0x78
f78cad80 804eeabb 8903b210 00000000 89b9fda0 nt!IopProcessWorkItem+0xf
f78cadac 80596ffe 8903b210 00000000 00000000 nt!ExpWorkerThread+0xe9
f78caddc 805008c6 804ee9f0 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
srv!RemoveDuplicateCoreSearches+39
f639b3d9 668b4e52         mov     cx,[esi+0x52]

SYMBOL_STACK_INDEX:  3

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  srv!RemoveDuplicateCoreSearches+39

MODULE_NAME:  srv

IMAGE_NAME:  srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  3e80182f

FAILURE_BUCKET_ID:  0x50_srv!RemoveDuplicateCoreSearches+39

BUCKET_ID:  0x50_srv!RemoveDuplicateCoreSearches+39

Followup: MachineOwner
---------

eax=f772f13c ebx=00000050 ecx=89b9fda0 edx=804e5bb0 esi=f772f120 edi=89b9fda0
eip=80543ac9 esp=f78cab18 ebp=f78cab30 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d               pop     ebp
ChildEBP RetAddr  Args to Child              
f78cab30 8052fa2f 00000050 e9683002 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])
f78cab80 804e2dfc 00000000 e9683002 00000000 nt!MmAccessFault+0x796 (FPO: [Non-Fpo])
f78cab80 f639b3d9 00000000 e9683002 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFrame @ f78cab98)
f78cac24 f638d364 00000001 f637f004 f78cacec srv!RemoveDuplicateCoreSearches+0x39 (FPO: [Non-Fpo])
f78cac68 f6388ce3 8444515c f78cacec f78cacb4 srv!CloseIdleConnection+0x394 (FPO: [Non-Fpo])
f78cacc4 f6388aec 84445010 804f1d00 f637ea88 srv!TimeoutSessions+0xf3 (FPO: [Non-Fpo])
f78cad4c f636db4f 89b9fda0 8904b918 8903b210 srv!ScavengerAlgorithm+0x21e (FPO: [Non-Fpo])
f78cad70 80585e7f 8904b918 00000000 80582d80 srv!ScavengerThread+0x78 (FPO: [Non-Fpo])
f78cad80 804eeabb 8903b210 00000000 89b9fda0 nt!IopProcessWorkItem+0xf (FPO: [1,0,0])
f78cadac 80596ffe 8903b210 00000000 00000000 nt!ExpWorkerThread+0xe9 (FPO: [Non-Fpo])
f78caddc 805008c6 804ee9f0 00000000 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start    end        module name
804de000 80745000   nt       ntkrnlmp.exe Wed May 26 20:32:57 2004 (40B53739)
80745000 8076d000   hal      halmacpi.dll Tue Mar 25 02:07:28 2003 (3E800030)
bf800000 bf9c7000   win32k   win32k.sys   Mon Aug 09 18:48:07 2004 (4117FF27)
bf9c7000 bfa11080   ati2drad ati2drad.dll Mon Feb 18 09:22:10 2002 (3C710E12)
bff60000 bff7b000   RDPDD    RDPDD.dll    Tue Mar 25 15:12:05 2003 (3E80B815)
bff80000 bff96000   dxg      dxg.sys      Tue Mar 25 04:46:23 2003 (3E80256F)
f3056000 f3067980   naveng   naveng.sys   Mon Nov 28 19:03:55 2005 (438B9AEB)
f3068000 f311dec0   navex15  navex15.sys  Mon Nov 28 18:52:12 2005 (438B982C)
f41ce000 f41dc000   EraserUtilDrv10502 EraserUtilDrv10502.sys Tue Jan 24 19:00:56 2006 (43D6BFB8)
f5eae000 f5ed0000   RDPWD    RDPWD.SYS    Tue Mar 25 02:03:00 2003 (3E7FFF24)
f5f90000 f5f9a000   TDTCP    TDTCP.SYS    Tue Mar 25 02:02:52 2003 (3E7FFF1C)
f6010000 f6068000   HTTP     HTTP.sys     Tue Mar 25 03:55:21 2003 (3E801979)
f636a000 f63c9000   srv      srv.sys      Tue Mar 25 03:49:51 2003 (3E80182F)
f6789000 f67b8000   afd      afd.sys      Tue Mar 25 02:40:50 2003 (3E800802)
f68f8000 f6910000   Cdfs     Cdfs.SYS     Tue Mar 25 03:17:19 2003 (3E80108F)
f6938000 f698b000   eeCtrl   eeCtrl.sys   Tue Jan 24 19:00:57 2006 (43D6BFB9)
f698b000 f699e000   Fips     Fips.SYS     Tue Mar 25 03:54:59 2003 (3E801963)
f699e000 f6a09000   mrxsmb   mrxsmb.sys   Mon Oct 11 20:38:12 2004 (416B2774)
f6a09000 f6a34000   rdbss    rdbss.sys    Mon Oct 11 20:38:09 2004 (416B2771)
f6a34000 f6a69000   netbt    netbt.sys    Fri Jul 18 13:16:03 2003 (3F182B53)
f6a69000 f6acb000   tcpip    tcpip.sys    Tue Mar 25 03:04:01 2003 (3E800D71)
f6acb000 f6ae7000   ipsec    ipsec.sys    Tue Mar 25 02:55:45 2003 (3E800B81)
f6cbf000 f6cd3000   Savrtpel Savrtpel.sys Fri Aug 26 17:11:25 2005 (430F857D)
f6cd3000 f6cf5000   SYMEVENT SYMEVENT.SYS Wed Aug 31 17:07:15 2005 (43161C03)
f6cf5000 f6d4d000   savrt    savrt.sys    Fri Aug 26 17:11:23 2005 (430F857B)
f6d6d000 f6d80000   usbhub   usbhub.sys   Tue Mar 25 02:10:46 2003 (3E8000F6)
f6dc8000 f6dfb000   update   update.sys   Tue Mar 25 03:59:59 2003 (3E801A8F)
f6dfb000 f6e2f000   rdpdr    rdpdr.sys    Tue Mar 25 02:09:30 2003 (3E8000AA)
f6e6f000 f6e7c000   netbios  netbios.sys  Tue Mar 25 02:09:53 2003 (3E8000C1)
f6e7f000 f6e88000   dump_diskdump dump_diskdump.sys Tue Mar 25 02:05:15 2003 (3E7FFFAB)
f6e9f000 f6eac000   wanarp   wanarp.sys   Tue Mar 25 02:11:22 2003 (3E80011A)
f6ecf000 f6ee4000   raspptp  raspptp.sys  Tue Mar 25 03:19:09 2003 (3E8010FD)
f6ee4000 f6eff000   ndiswan  ndiswan.sys  Tue Mar 25 03:48:19 2003 (3E8017D3)
f6eff000 f6f16000   rasl2tp  rasl2tp.sys  Tue Mar 25 02:54:46 2003 (3E800B46)
f6f3e000 f6f5dd00   ks       ks.sys       Wed Dec 04 12:09:38 2002 (3DEE36D2)
f6f5e000 f6f72000   redbook  redbook.sys  Tue Mar 25 02:04:38 2003 (3E7FFF86)
f6f72000 f6f86000   cdrom    cdrom.sys    Tue Mar 25 02:05:18 2003 (3E7FFFAE)
f6f86000 f6f9d000   parport  parport.sys  Tue Mar 25 02:03:56 2003 (3E7FFF5C)
f6f9d000 f6fb5000   serial   serial.sys   Tue Mar 25 02:40:08 2003 (3E8007D8)
f6fb5000 f6fcb000   i8042prt i8042prt.sys Tue Mar 25 04:01:43 2003 (3E801AF7)
f6fcb000 f6fe4000   VIDEOPRT VIDEOPRT.SYS Tue Mar 25 02:08:02 2003 (3E800052)
f6fe4000 f7037d80   ati2mpad ati2mpad.sys Thu Jul 18 21:13:20 2002 (3D3767B0)
f7038000 f7059e80   USBPORT  USBPORT.SYS  Tue Mar 25 02:10:43 2003 (3E8000F3)
f705a000 f7072c00   e1000325 e1000325.sys Mon Jan 13 14:12:12 2003 (3E230F8C)
f720b000 f722d000   Mup      Mup.sys      Tue Mar 25 03:55:58 2003 (3E80199E)
f722d000 f726e000   NDIS     NDIS.sys     Tue Mar 25 03:45:35 2003 (3E80172F)
f726e000 f730b000   Ntfs     Ntfs.sys     Tue Mar 25 02:40:05 2003 (3E8007D5)
f730b000 f732c000   KSecDD   KSecDD.sys   Tue Mar 25 02:05:39 2003 (3E7FFFC3)
f732c000 f7340000   sis      sis.sys      Tue Mar 25 02:09:33 2003 (3E8000AD)
f7340000 f7356000   CLASSPNP CLASSPNP.SYS Tue Mar 25 02:38:14 2003 (3E800766)
f7356000 f736de80   SI3112r  SI3112r.sys  Fri Aug 27 19:18:49 2004 (412FC159)
f736e000 f7394000   SCSIPORT SCSIPORT.SYS Tue Mar 25 03:01:25 2003 (3E800CD5)
f7394000 f73b0000   atapi    atapi.sys    Tue Mar 25 02:04:48 2003 (3E7FFF90)
f73b0000 f73d1000   volsnap  volsnap.sys  Tue Mar 25 02:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000   dmio     dmio.sys     Tue Mar 25 02:08:14 2003 (3E80005E)
f73fb000 f7420000   ftdisk   ftdisk.sys   Tue Mar 25 02:05:26 2003 (3E7FFFB6)
f7420000 f7435000   pci      pci.sys      Tue Mar 25 02:16:40 2003 (3E800258)
f7435000 f7466000   ACPI     ACPI.sys     Tue Mar 25 02:16:21 2003 (3E800245)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 02:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Tue Mar 25 02:16:35 2003 (3E800253)
f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Tue Mar 25 02:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000   MountMgr MountMgr.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)
f74c7000 f74d5000   PartMgr  PartMgr.sys  Tue Mar 25 03:04:02 2003 (3E800D72)
f74d7000 f74e6000   disk     disk.sys     Tue Mar 25 02:05:20 2003 (3E7FFFB0)
f74e7000 f74f3000   Dfs      Dfs.sys      Tue Mar 25 02:09:52 2003 (3E8000C0)
f74f7000 f7500000   crcdisk  crcdisk.sys  Tue Mar 25 02:07:23 2003 (3E80002B)
f7507000 f7516000   termdd   termdd.sys   Tue Mar 25 02:02:52 2003 (3E7FFF1C)
f7517000 f7525000   NDProxy  NDProxy.SYS  Tue Mar 25 02:11:30 2003 (3E800122)
f7537000 f7541000   flpydisk flpydisk.sys Tue Mar 25 02:04:32 2003 (3E7FFF80)
f7547000 f7550000   hidusb   hidusb.sys   Tue Mar 25 02:10:17 2003 (3E8000D9)
f7557000 f7565000   HIDCLASS HIDCLASS.SYS Tue Mar 25 02:10:17 2003 (3E8000D9)
f7597000 f75a0000   ndisuio  ndisuio.sys  Tue Mar 25 02:09:47 2003 (3E8000BB)
f75b7000 f75c1000   Dxapi    Dxapi.sys    Tue Mar 25 02:06:01 2003 (3E7FFFD9)
f75c7000 f75d3000   vga      vga.sys      Tue Mar 25 02:08:03 2003 (3E800053)
f75d7000 f75e1000   Msfs     Msfs.SYS     Tue Mar 25 02:08:56 2003 (3E800088)
f75e7000 f75f3000   Npfs     Npfs.SYS     Tue Mar 25 02:08:59 2003 (3E80008B)
f7607000 f7616000   msgpc    msgpc.sys    Tue Mar 25 02:10:12 2003 (3E8000D4)
f7617000 f7620000   watchdog watchdog.sys Tue Mar 25 02:09:01 2003 (3E80008D)
f7627000 f7631000   kbdclass kbdclass.sys Tue Mar 25 02:03:10 2003 (3E7FFF2E)
f7637000 f7641000   mouclass mouclass.sys Tue Mar 25 02:03:09 2003 (3E7FFF2D)
f7647000 f7651000   serenum  serenum.sys  Tue Mar 25 02:04:01 2003 (3E7FFF61)
f7657000 f7662000   fdc      fdc.sys      Tue Mar 25 02:04:31 2003 (3E7FFF7F)
f7667000 f7673000   processr processr.sys Tue Mar 25 02:07:36 2003 (3E800038)
f7677000 f7680000   ndistapi ndistapi.sys Tue Mar 25 02:11:28 2003 (3E800120)
f7687000 f7695000   raspppoe raspppoe.sys Tue Mar 25 02:11:37 2003 (3E800129)
f7697000 f76a2000   TDI      TDI.SYS      Tue Mar 25 02:14:28 2003 (3E8001D4)
f76a7000 f76b2000   ptilink  ptilink.sys  Tue Mar 25 02:03:51 2003 (3E7FFF57)
f76b7000 f76c0000   raspti   raspti.sys   Tue Mar 25 02:11:36 2003 (3E800128)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 02:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 02:07:58 2003 (3E80004E)
f7717000 f771e000   intelide intelide.sys Tue Mar 25 02:04:45 2003 (3E7FFF8D)
f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 02:08:08 2003 (3E800058)
f7727000 f772b9a0   dpti2o   dpti2o.sys   Thu May 02 10:49:25 2002 (3CD151F5)
f7747000 f774f000   RDPCDD   RDPCDD.sys   Tue Mar 25 02:03:05 2003 (3E7FFF29)
f776f000 f7777000   rasacd   rasacd.sys   Tue Mar 25 02:11:50 2003 (3E800136)
f777f000 f7783e80   usbuhci  usbuhci.sys  Tue Mar 25 02:10:43 2003 (3E8000F3)
f7787000 f778e000   dxgthk   dxgthk.sys   Tue Mar 25 02:05:52 2003 (3E7FFFD0)
f7797000 f779cf00   HIDPARSE HIDPARSE.SYS Tue Mar 25 02:10:13 2003 (3E8000D5)
f77af000 f77b39a0   dump_dpti2o dump_dpti2o.sys Thu May 02 10:49:25 2002 (3CD151F5)
f77b7000 f77be000   parvdm   parvdm.sys   Tue Mar 25 02:03:49 2003 (3E7FFF55)
f77f7000 f77ff000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 02:08:36 2003 (3E800074)
f7807000 f780e000   Null     Null.SYS     Tue Mar 25 02:03:05 2003 (3E7FFF29)
f780f000 f7816000   Beep     Beep.SYS     Tue Mar 25 02:03:04 2003 (3E7FFF28)
f7817000 f781f000   audstub  audstub.sys  Tue Mar 25 02:09:12 2003 (3E800098)
f781f000 f7827000   mnmdd    mnmdd.SYS    Tue Mar 25 02:07:53 2003 (3E800049)
f7897000 f7899800   SiWinAcc SiWinAcc.sys Thu May 20 14:38:49 2004 (40ACFB39)
f79c9000 f79ca580   USBD     USBD.SYS     Tue Mar 25 02:10:39 2003 (3E8000EF)
f7a66000 f7a67000   swenum   swenum.sys   Wed Dec 04 12:10:07 2002 (3DEE36EF)

Unloaded modules:
f3056000 f3068000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3068000 f311e000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3f16000 f3f24000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3056000 f3068000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3068000 f311e000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f387e000 f388c000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3056000 f3068000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3068000 f311e000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f361e000 f362c000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3056000 f3068000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3068000 f311e000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f31fe000 f320c000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f437e000 f4390000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f4390000 f4446000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f460e000 f461c000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f4b80000 f4b92000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f4b92000 f4c48000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f4e08000 f4e16000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5814000 f5826000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5826000 f58dc000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5f30000 f5f3e000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5904000 f5916000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5916000 f59cc000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6bf7000 f6c09000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6c09000 f6cbf000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6642000 f6699000   wlbs.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7567000 f7575000   imapi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f780f000 f7817000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Closing open log file c:\debuglog031506.txt
ASKER CERTIFIED SOLUTION
redseatechnologies

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 2 Answers and 12 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 12 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros