Solved

Bluescreen of Death error on 2003 SP1 server

Posted on 2006-11-21
10
738 Views
Last Modified: 2012-06-21
Hi!

We are getting blue screen errors on our company webserver since yesterday - We have runned the ms debugger tool to analyse the debug results.

This is not my strong side... so could you guys be kind and help us Interpret the analysis result from the ms debugger tool?
                                                                                    ----------------------------------------


Is the server hardware tosted/do we need a new server or can we fix this?


Thanx in advance guys!


Microsoft (R) Windows Debugger  Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Tue Nov 21 12:50:49.421 2006 (GMT+1)
System Uptime: 0 days 21:38:50.984
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {b91d4030, 2, 0, b91d4030}

Probably caused by : hardware

Followup: MachineOwner
---------
 *** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDpc+0x220 )
 *** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendingRequest+0x0 )

kd> .reload
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
....
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: b91d4030, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b91d4030, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'mrxsmb' and 'NetBurn.sys' overlap

READ_ADDRESS:  b91d4030

CURRENT_IRQL:  2

FAULTING_IP:
+ffffffffb91d4030
b91d4030 ??               ???

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

LAST_CONTROL_TRANSFER:  from b9dd95bd to b91d4030

FAILED_INSTRUCTION_ADDRESS:
+ffffffffb91d4030
b91d4030 ??               ???

POSSIBLE_INVALID_CONTROL_TRANSFER:  from b9dd95b8 to b9dd4030

TWO_BIT_ERROR:  1

TRAP_FRAME:  8089d460 -- (.trap ffffffff8089d460)
ErrCode = 00000000
eax=00000041 ebx=80a6ee01 ecx=00000041 edx=00000002 esi=89a4b730 edi=89a4b028
eip=b91d4030 esp=8089d4d4 ebp=8089d4f8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
b91d4030 ??               ???
Resetting default scope

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
8089d4d0 b9dd95bd 89a4b028 00000000 00000000 0xb91d4030
8089d4f8 8082f7c9 89a4b70c 89a4b028 49c991fe USBPORT!USBPORT_DM_TimerDpc+0x225
8089d5b0 808287ad 00000000 00000000 024c1abe nt!KiTimerExpiration+0x2d0
8089d600 80820a6a 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
8089d604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x2f


STACK_COMMAND:  .trap 0xffffffff8089d460 ; kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME:  hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  TWO_BIT_CPU_CALL_ERROR

Followup: MachineOwner
---------
 *** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDpc+0x220 )
 *** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendingRequest+0x0 )














------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------





Addtional info:



We have also a fax server installed on the server and its also reporting a exception - which might be linked to the blue screen error? - Se below for the exception report that the  fax server is mailing us:

An exception occurred in RelayFax Server.
The service may need to be restarted.

Stack trace:
Parsing Thread: Exception C0000005 ACCESS_VIOLATION in Run() RelayFax version: 6.7.0 OS version: 5.2 Platform ID: 2 Build: 3790
77E6A937  01F6B3B8  0001:00029937 C:\WINDOWS\system32\kernel32.dll
77E461D9  01F6B644  0001:000051D9 C:\WINDOWS\system32\kernel32.dll 00466F9E  01F6FC54  0001:00065F9E C:\PROGRA~1\RelayFax\App\RFEngine.exe
00466BFD  01F6FF08  0001:00065BFD C:\PROGRA~1\RelayFax\App\RFEngine.exe
004B52D0  01F6FF7C  0001:000B42D0 C:\PROGRA~1\RelayFax\App\RFEngine.exe
004B4FFB  01F6FF84  0001:000B3FFB C:\PROGRA~1\RelayFax\App\RFEngine.exe
004C673C  01F6FFB8  0001:000C573C C:\PROGRA~1\RelayFax\App\RFEngine.exe
77E6608B  01F6FFEC  0001:0002508B C:\WINDOWS\system32\kernel32.dll
----------


Please notice that we wish to have the debug anlysis professionally explained , into "plain english" :-) -  So please dont just link the the 2 errors together at once.
-----------------------------------------------------------------------------------

Thanks a lot, again!
 
0
Comment
Question by:whatisthesolution
  • 6
  • 2
  • 2
10 Comments
 
LVL 69

Expert Comment

by:Callandor
Comment Utility
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This is typically a bad RAM problem or a system DLL corruption.  If you run the diagnostic from www.memtest.org and it fails, you have bad RAM.  You can check for a bad Windows driver by running a non-Windows system such as Knoppix: http://www.knopper.net/knoppix/index-en.html
0
 
LVL 30

Assisted Solution

by:pgm554
pgm554 earned 250 total points
Comment Utility
It's calling out a HW error,could be memory or MOBO.

I see a reference to a USB port,are you using it?

Is this a name brand server?

HP and Dell have standalone diags you could run to test.
0
 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility

MOBO? <---?

Yes we have a usb keyboard (manufactures own) and mouse attched to it. The server is from fujitsu siemens.
0
 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility
ahh ok MOBO--> motherboard?
0
 
LVL 30

Expert Comment

by:pgm554
Comment Utility
I would run their own diags if they got em'.

You might try a different keyboard and see what happens.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility
We have looked for it without any luck..

So i guess the best is to run the mem test as proposed by Callandor9... + testing the keyboard thing..

Since im not very good at thees kind of errors i was little bit afraid of that the CPu was damaged to .. --> BUCKET_ID:  TWO_BIT_CPU_CALL_ERROR  ...
But thats not the case?

Lets see how it goes..

0
 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility
Hi!

We took the webserver offline at midnight and runned the memtest for testing memory for corrupted ram. - The test returned no errors!

So what can be wrong then?
0
 
LVL 69

Accepted Solution

by:
Callandor earned 250 total points
Comment Utility
The test is not 100% guaranteed to detect errors, but if it detected an error, it means you definitely have bad RAM.  You would have to swap with known working RAM to be absolutely sure.  Now if the errors started after installing the fax server software, that would be a strong indication that the error is caused by the other source: a corrupt or inappropriate device driver.  Uninstall the fax server and see if the problem is resolved.
0
 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility
Ok  - Thanks!

I for got to tell that we upgraded Relay fax to latest version in the process, and until now relay fax hasn't sendt out any exception mail reports to us so that part seams to be solved.

I will try to test you suggestion with swapping ram. I'll get out to morrow to fetch some new ram blocks tomorrow from our distibutor and we'll see how it works...

Oh by the way - the usb slot reference:

 *** Possible invalid call from b9dd95b8 ( USBPORT!USBPORT_DM_TimerDpc+0x220 )
 *** Expected target b9dd4030 ( USBPORT!USBPORT_TrackPendingRequest+0x0 )

What can be the cause of this?
I'm thinking..... it's the manufactures own products attached to the usb ports, and they should be compatible right? (Anyway - we have change it, as suggested and we havn'nt got any malfunction errors yet.)

Cheers!
whats the solution.
0
 
LVL 1

Author Comment

by:whatisthesolution
Comment Utility
Hi!

We been testing the week/end through with new gbs ram blocks installed on the server and it runs without a glitch, (and lets hope it continues that way).

SO....

It seems like the case is solved! - Thanks to you guys - so we'll split the pts between you!


Thanks a lot for the help and have nice day!

Sincerly,
What is the solution.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Stuck in voice control mode on your Amazon Firestick?  Here is how to turn it off!!!
In the modern office, employees tend to move around the workplace a lot more freely. Conferences, collaborative groups, flexible seating and working from home require a new level of mobility. Technology has not only changed the behavior and the expe…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now