Solved

Multiple, simultaneous server stop errors - blue screens

Posted on 2007-03-29
5
926 Views
Last Modified: 2010-05-18
Hi,  

We had an issue yesterday where 5 out of about 30 servers all rebooted at exactly the same time.  About 3 days ago we implemented whatsup gold v11 and suspect that it caused the reboots somehow.  It performs WMI polls on the servers for performance stats and also monitors some critical server states.  It maybe something else altogether though.  The whatsup server rebooted itself along with 4 others.  If it was whatsup, it would be nice to know why it only caused 4 servers to reboot and not all servers as they all have the same monitoring configured.  dump files are the same on each of the servers and details are below.

From the event log:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000008e (0xc0000005, 0xf7156421, 0xb6ebb798, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

From the whatsup server dump:


*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7156421, The address that the exception occurred at
Arg3: b6ebb798, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
Ntfs!NtfsAcquireResourceExclusive+8
f7156421 6681380207      cmp     word ptr [eax],702h

TRAP_FRAME:  b6ebb798 -- (.trap ffffffffb6ebb798)
ErrCode = 00000000
eax=00000000 ebx=89436008 ecx=000012ed edx=8a2ad718 esi=89436174 edi=00000000
eip=f7156421 esp=b6ebb80c ebp=b6ebb80c iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x8:
f7156421 6681380207      cmp     word ptr [eax],702h      ds:0023:00000000=????
Resetting default scope

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  wmiprvse.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8085b4b3 to 8087b6be

STACK_TEXT:  
b6ebb364 8085b4b3 0000008e c0000005 f7156421 nt!KeBugCheckEx+0x1b
b6ebb728 808357a4 b6ebb744 00000000 b6ebb798 nt!KiDispatchException+0x3a2
b6ebb790 80835758 b6ebb80c f7156421 badb0d00 nt!CommonDispatchException+0x4a
b6ebb80c f719bf85 8962a7e0 00000000 00000001 nt!Kei386EoiHelper+0x186
b6ebb80c f719bf85 8962a7e0 00000000 00000001 Ntfs!NtfsFsdCreate+0x362
b6ebb910 8083f9d0 8a2ad718 89436008 89436008 Ntfs!NtfsFsdCreate+0x362
b6ebb924 f721c51e 8a046798 00000000 8a358030 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b6ebb954 8083f9d0 8a324950 89436008 b6ebb9b8 fltMgr!FltProcessFileLock+0x214c
b6ebb968 ba293163 b6ebb9b8 b604b900 00000000 nt!IofCallDriver+0x45
b6ebb9e8 f720eb43 00000000 89436008 894361bc SYMEVENT!SYMEvent_GetVMDataPtr+0x87c3
b6ebba0c f721c5af b6ebba2c 8a1d2020 00000000 fltMgr!FltGetIrpName+0x10dd
b6ebba48 8083f9d0 8a1d2020 89436008 89436008 fltMgr!FltProcessFileLock+0x21dd
b6ebba5c 8092e269 b6ebbc04 8a35a360 00000000 nt!IofCallDriver+0x45
b6ebbb44 80936caa 8a35a378 00000000 898ebbc8 nt!IopParseDevice+0xa35
b6ebbbc4 80936aa5 00000000 b6ebbc04 00000040 nt!ObpLookupObjectName+0x5a9
b6ebbc18 80936f27 00000000 00000000 00006801 nt!ObOpenObjectByName+0xea
b6ebbc94 80936ff8 015bc510 02100080 015bc4ac nt!IopCreateFile+0x447
b6ebbcf0 8092ed98 015bc510 02100080 015bc4ac nt!IoCreateFile+0xa3
b6ebbd30 80834d3f 015bc510 02100080 015bc4ac nt!NtCreateFile+0x30
b6ebbd30 7c82ed54 015bc510 02100080 015bc4ac nt!KiFastCallEntry+0xfc
015bc508 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND:  kb

FOLLOWUP_IP:
SYMEVENT!SYMEvent_GetVMDataPtr+87c3
ba293163 6a00            push    0

SYMBOL_STACK_INDEX:  9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME:  SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  423f8ec8

SYMBOL_NAME:  SYMEVENT!SYMEvent_GetVMDataPtr+87c3

FAILURE_BUCKET_ID:  0x8E_SYMEVENT!SYMEvent_GetVMDataPtr+87c3

BUCKET_ID:  0x8E_SYMEVENT!SYMEvent_GetVMDataPtr+87c3

Followup: MachineOwner

-----------------------------------------------------------------------------

And here is the memory dump from one of the other servers:


1: kd> !anlayze -v;r;kv;lmnt
No export anlayze found
eax=f773713c ebx=f7126421 ecx=00000009 edx=8083b58c esi=f7737120 edi=00000000
eip=8087b6be esp=b8efe34c ebp=b8efe364 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!KeBugCheckEx+0x1b:
8087b6be 5d              pop     ebp
ChildEBP RetAddr  Args to Child              
b8efe364 8085b4b3 0000008e c0000005 f7126421 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b8efe728 808357a4 b8efe744 00000000 b8efe798 nt!KiDispatchException+0x3a2 (FPO: [Non-Fpo])
b8efe790 80835758 b8efe80c f7126421 badb0d00 nt!CommonDispatchException+0x4a (FPO: [0,20,0])
b8efe80c f716bf85 874c6a20 00000000 00000001 nt!Kei386EoiHelper+0x186
b8efe80c f716bf85 874c6a20 00000000 00000001 Ntfs!NtfsFsdCreate+0x362 (FPO: [Non-Fpo])
b8efe910 8083f9d0 8a2ae020 89a171e0 89a171e0 Ntfs!NtfsFsdCreate+0x362 (FPO: [Non-Fpo])
b8efe924 f71ec51e 8a0fcc80 00000000 8a32d958 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
b8efe954 8083f9d0 8a353c70 89a171e0 b8efe9b8 fltMgr!FltProcessFileLock+0x214c
b8efe968 b9404163 b8efe9b8 b804e900 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
b8efe9e8 f71deb43 00000000 89a171e0 89a17394 SYMEVENT!SYMEvent_GetVMDataPtr+0x87c3
b8efea0c f71ec5af b8efea2c 8a0017f0 00000000 fltMgr!FltGetIrpName+0x10dd
b8efea48 8083f9d0 8a0017f0 89a171e0 89a171e0 fltMgr!FltProcessFileLock+0x21dd
b8efea5c 8092e269 b8efec04 8a354018 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
b8efeb44 80936caa 8a354030 00000000 8993e6d8 nt!IopParseDevice+0xa35 (FPO: [Non-Fpo])
b8efebc4 80936aa5 00000000 b8efec04 00000040 nt!ObpLookupObjectName+0x5a9 (FPO: [Non-Fpo])
b8efec18 80936f27 00000000 00000000 00006801 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
b8efec94 80936ff8 017fc510 02100080 017fc4ac nt!IopCreateFile+0x447 (FPO: [Non-Fpo])
b8efecf0 8092ed98 017fc510 02100080 017fc4ac nt!IoCreateFile+0xa3 (FPO: [Non-Fpo])
b8efed30 80834d3f 017fc510 02100080 017fc4ac nt!NtCreateFile+0x30 (FPO: [Non-Fpo])
b8efed30 7c82ed54 017fc510 02100080 017fc4ac nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b8efed64)
start    end        module name
80800000 80a75000   nt       ntkrnlmp.exe Thu Mar 24 20:42:08 2005 (42435E60)
80a75000 80aa1000   hal      halmacpi.dll Thu Mar 24 20:28:37 2005 (42435B35)
b69ef000 b6a00f20   naveng   naveng.sys   Mon Jan 22 20:05:17 2007 (45B55F4D)
b6a01000 b6acf740   navex15  navex15.sys  Mon Jan 22 20:39:38 2007 (45B5675A)
b6ad0000 b6aed000   EraserUtilDrvI1 EraserUtilDrvI1.sys Wed Jan 31 19:54:39 2007 (45C13A4F)
b7bef000 b7c1c000   RDPWD    RDPWD.SYS    Wed Jun 15 11:33:14 2005 (42B04A3A)
b8539000 b8544000   TDTCP    TDTCP.SYS    Thu Mar 24 20:27:15 2005 (42435AE3)
b8689000 b86b3000   Fastfat  Fastfat.SYS  Thu Mar 24 20:40:20 2005 (42435DF4)
b881b000 b8887000   srv      srv.sys      Fri Sep 01 10:32:26 2006 (44F8447A)
b8fdf000 b8ff4000   Cdfs     Cdfs.SYS     Thu Mar 24 20:40:55 2005 (42435E17)
b901c000 b907d000   eeCtrl   eeCtrl.sys   Wed Jan 31 19:54:39 2007 (45C13A4F)
b907d000 b908e000   Fips     Fips.SYS     Thu Mar 24 20:40:33 2005 (42435E01)
b912e000 b91ae000   mrxsmb   mrxsmb.sys   Mon May 08 13:18:45 2006 (445F7D75)
b91d6000 b920f000   rdbss    rdbss.sys    Mon May 08 13:18:53 2006 (445F7D7D)
b920f000 b9239000   afd      afd.sys      Thu Mar 24 20:40:43 2005 (42435E0B)
b9239000 b926a000   netbt    netbt.sys    Thu Mar 24 20:40:31 2005 (42435DFF)
b926a000 b92cb000   tcpip    tcpip.sys    Tue May 23 21:02:22 2006 (4473B09E)
b92cb000 b92e4000   ipsec    ipsec.sys    Thu Mar 24 20:40:49 2005 (42435E11)
b93e5000 b93f9000   Savrtpel Savrtpel.sys Fri Feb 04 23:03:26 2005 (4204458E)
b93f9000 b9415ac0   SYMEVENT SYMEVENT.SYS Mon Mar 21 23:19:36 2005 (423F8EC8)
b9416000 b946b000   savrt    savrt.sys    Fri Feb 04 23:03:24 2005 (4204458C)
b9533000 b9547000   usbhub   usbhub.sys   Thu Mar 24 20:30:46 2005 (42435BB6)
b95a7000 b95b1000   Dxapi    Dxapi.sys    Tue Mar 25 03:06:01 2003 (3E7FFFD9)
b95d7000 b95e1000   dump_diskdump dump_diskdump.sys Thu Mar 24 20:28:56 2005 (42435B48)
b960f000 b964f000   update   update.sys   Thu Mar 24 20:40:27 2005 (42435DFB)
b964f000 b9686000   rdpdr    rdpdr.sys    Thu Mar 24 20:30:20 2005 (42435B9C)
b9686000 b9699000   raspptp  raspptp.sys  Thu Mar 24 20:40:43 2005 (42435E0B)
b9699000 b96b3000   ndiswan  ndiswan.sys  Thu Mar 24 20:40:46 2005 (42435E0E)
b96b3000 b96c8000   rasl2tp  rasl2tp.sys  Thu Mar 24 20:40:29 2005 (42435DFD)
b96c8000 b96f0000   ks       ks.sys       Thu Mar 24 20:41:03 2005 (42435E1F)
b96f0000 b9704000   redbook  redbook.sys  Thu Mar 24 20:28:46 2005 (42435B3E)
b9704000 b9719000   cdrom    cdrom.sys    Thu Mar 24 20:28:57 2005 (42435B49)
b9719000 b972e000   serial   serial.sys   Thu Mar 24 20:28:29 2005 (42435B2D)
b972e000 b9741000   i8042prt i8042prt.sys Thu Mar 24 20:41:05 2005 (42435E21)
b9741000 b9786000   cpqasm2  cpqasm2.sys  Fri Jul 14 14:57:28 2006 (44B7E918)
b9786000 b97a1000   VIDEOPRT VIDEOPRT.SYS Thu Mar 24 20:29:53 2005 (42435B81)
b97a1000 b97f4d80   ati2mpad ati2mpad.sys Thu Jul 18 21:13:20 2002 (3D3767B0)
b97f5000 b981f000   USBPORT  USBPORT.SYS  Thu Mar 24 20:30:43 2005 (42435BB3)
b981f000 b9848000   q57xp32  q57xp32.sys  Thu Mar 09 20:20:41 2006 (4410D469)
baa49000 baa54000   fdc      fdc.sys      Thu Mar 24 20:28:43 2005 (42435B3B)
baa59000 baa63000   serenum  serenum.sys  Thu Mar 24 20:28:27 2005 (42435B2B)
baa69000 baa73000   mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
baa79000 baa83000   kbdclass kbdclass.sys Tue Mar 25 03:03:10 2003 (3E7FFF2E)
baad9000 baae2000   watchdog watchdog.sys Thu Mar 24 20:30:19 2005 (42435B9B)
bab44000 bab4c000   RDPCDD   RDPCDD.sys   Tue Mar 25 03:03:05 2003 (3E7FFF29)
bab54000 bab5c000   mnmdd    mnmdd.SYS    Tue Mar 25 03:07:53 2003 (3E800049)
bab5c000 bab63000   Beep     Beep.SYS     Tue Mar 25 03:03:04 2003 (3E7FFF28)
bab64000 bab6b000   Null     Null.SYS     Tue Mar 25 03:03:05 2003 (3E7FFF29)
bab6c000 bab74000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 03:08:36 2003 (3E800074)
bf800000 bf9d0000   win32k   win32k.sys   Wed Oct 05 20:37:08 2005 (434471B4)
bf9d0000 bf9e6000   dxg      dxg.sys      Thu Mar 24 20:27:25 2005 (42435AED)
bf9e6000 bfa3c680   ati2drad ati2drad.dll Thu Mar 24 22:30:34 2005 (424377CA)
bff60000 bff7e000   RDPDD    RDPDD.dll    Thu Mar 24 22:30:48 2005 (424377D8)
f706d000 f7070d80   aw_host5 aw_host5.sys Thu Oct 23 10:32:19 2003 (3F97E673)
f7095000 f7097820   awlegacy awlegacy.sys Mon Nov 17 18:06:47 2003 (3FB95487)
f70c9000 f70e8000   Mup      Mup.sys      Thu Mar 24 20:40:49 2005 (42435E11)
f70e8000 f711e000   NDIS     NDIS.sys     Thu Mar 24 20:40:26 2005 (42435DFA)
f711e000 f71b3000   Ntfs     Ntfs.sys     Thu Mar 24 20:40:29 2005 (42435DFD)
f71b3000 f71da000   KSecDD   KSecDD.sys   Thu Mar 24 20:28:53 2005 (42435B45)
f71da000 f71ff000   fltMgr   fltMgr.sys   Mon Aug 21 05:59:45 2006 (44E98411)
f71ff000 f7212000   CLASSPNP CLASSPNP.SYS Thu Mar 24 20:40:23 2005 (42435DF7)
f7212000 f7231000   SCSIPORT SCSIPORT.SYS Thu Mar 24 20:40:26 2005 (42435DFA)
f7231000 f724b000   storport storport.sys Thu Mar 24 20:28:57 2005 (42435B49)
f724b000 f7383000   ql2300   ql2300.sys   Tue Oct 11 20:07:20 2005 (434C53B8)
f7383000 f739f000   atapi    atapi.sys    Thu Mar 24 20:28:49 2005 (42435B41)
f739f000 f73c9000   volsnap  volsnap.sys  Thu Mar 24 20:29:10 2005 (42435B56)
f73c9000 f73f5000   dmio     dmio.sys     Thu Mar 24 20:30:02 2005 (42435B8A)
f73f5000 f741c000   ftdisk   ftdisk.sys   Thu Mar 24 20:29:00 2005 (42435B4C)
f741c000 f7432000   pci      pci.sys      Thu Mar 24 20:34:14 2005 (42435C86)
f7432000 f7466000   ACPI     ACPI.sys     Thu Mar 24 20:34:09 2005 (42435C81)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Tue Mar 25 03:16:35 2003 (3E800253)
f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Thu Mar 24 20:28:48 2005 (42435B40)
f74b7000 f74c7000   MountMgr MountMgr.sys Thu Mar 24 20:27:23 2005 (42435AEB)
f74c7000 f74d2000   PartMgr  PartMgr.sys  Thu Mar 24 20:40:34 2005 (42435E02)
f74d7000 f74e7000   disk     disk.sys     Thu Mar 24 20:28:58 2005 (42435B4A)
f74e7000 f74f3000   Dfs      Dfs.sys      Thu Mar 24 20:30:28 2005 (42435BA4)
f74f7000 f7501000   crcdisk  crcdisk.sys  Thu Mar 24 20:29:40 2005 (42435B74)
f7537000 f7545000   NDProxy  NDProxy.SYS  Thu Mar 24 20:34:13 2005 (42435C85)
f7547000 f7550000   ndisuio  ndisuio.sys  Thu Mar 24 20:33:16 2005 (42435C4C)
f7567000 f7570000   raspti   raspti.sys   Thu Mar 24 20:34:16 2005 (42435C88)
f7577000 f7582000   ptilink  ptilink.sys  Thu Mar 24 20:28:25 2005 (42435B29)
f7587000 f7594000   wanarp   wanarp.sys   Thu Mar 24 20:34:07 2005 (42435C7F)
f7597000 f75a1000   flpydisk flpydisk.sys Tue Mar 25 03:04:32 2003 (3E7FFF80)
f75a7000 f75b4000   netbios  netbios.sys  Thu Mar 24 20:33:21 2005 (42435C51)
f75c7000 f75d3000   vga      vga.sys      Thu Mar 24 20:29:54 2005 (42435B82)
f75d7000 f75e6000   intelppm intelppm.sys Thu Mar 24 20:28:40 2005 (42435B38)
f75f7000 f7602000   TDI      TDI.SYS      Thu Mar 24 20:35:34 2005 (42435CD6)
f7607000 f7610000   ndistapi ndistapi.sys Thu Mar 24 20:34:11 2005 (42435C83)
f7617000 f7625580   CPQCISSE CPQCISSE.sys Fri Jun 16 13:13:23 2006 (4492E6B3)
f7637000 f7642000   Msfs     Msfs.SYS     Thu Mar 24 20:30:04 2005 (42435B8C)
f7647000 f7656000   raspppoe raspppoe.sys Thu Mar 24 20:34:16 2005 (42435C88)
f7657000 f7666000   termdd   termdd.sys   Thu Mar 24 20:27:15 2005 (42435AE3)
f7667000 f7675000   msgpc    msgpc.sys    Thu Mar 24 20:33:31 2005 (42435C5B)
f7677000 f7680000   mssmbios mssmbios.sys Thu Mar 24 20:34:14 2005 (42435C86)
f7687000 f7694000   Npfs     Npfs.SYS     Thu Mar 24 20:30:04 2005 (42435B8C)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000   PCIIde   PCIIde.sys   Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000   intelide intelide.sys Thu Mar 24 20:28:48 2005 (42435B40)
f7727000 f772e000   dmload   dmload.sys   Tue Mar 25 03:08:08 2003 (3E800058)
f772f000 f7733080   cpqcissm cpqcissm.sys Fri May 19 13:12:50 2006 (446DFC92)
f7787000 f778f000   rasacd   rasacd.sys   Tue Mar 25 03:11:50 2003 (3E800136)
f77cf000 f77d4180   usbuhci  usbuhci.sys  Thu Mar 24 20:30:45 2005 (42435BB5)
f77d7000 f77dda00   usbehci  usbehci.sys  Thu Mar 24 20:30:43 2005 (42435BB3)
f77df000 f77e3080   dump_cpqcissm dump_cpqcissm.sys Fri May 19 13:12:50 2006 (446DFC92)
f77e7000 f77ef000   OPRGHDLR OPRGHDLR.SYS Tue Mar 25 03:16:25 2003 (3E800249)
f77f7000 f77fd900   cpqcidrv cpqcidrv.sys Fri Mar 10 14:40:39 2006 (4411D637)
f77ff000 f7807000   audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f7807000 f780e000   sysmgmt  sysmgmt.sys  Fri Jul 14 14:57:28 2006 (44B7E918)
f781f000 f7826000   dxgthk   dxgthk.sys   Tue Mar 25 03:05:52 2003 (3E7FFFD0)
f7897000 f7899800   compbatt compbatt.sys Tue Mar 25 03:16:28 2003 (3E80024C)
f789b000 f789e900   BATTC    BATTC.SYS    Thu Mar 24 20:34:07 2005 (42435C7F)
f789f000 f78a2320   Gernuwa  Gernuwa.sys  Mon Apr 21 13:00:31 2003 (3EA423AF)
f79c1000 f79c2280   swenum   swenum.sys   Thu Mar 24 20:27:42 2005 (42435AFE)
f79c3000 f79c4580   USBD     USBD.SYS     Tue Mar 25 03:10:39 2003 (3E8000EF)
f79d3000 f79d4de0   awechomd awechomd.sys Fri Mar 05 12:52:22 2004 (4048BE56)

Unloaded modules:
b6aed000 b6aff000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6aff000 b6bce000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6bce000 b6beb000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6d2b000 b6d3d000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6d3d000 b6e0c000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6e0c000 b6e29000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6e29000 b6e3b000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6e3b000 b6f0a000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6f0a000 b6f27000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6f27000 b6f39000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6f39000 b7008000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7008000 b7025000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7025000 b7037000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7037000 b7106000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7106000 b7123000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b74cf000 b74e1000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b74e1000 b75b0000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b75b0000 b75cd000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b789d000 b78af000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b78af000 b797e000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7e24000 b7e41000   EraserUtilDr
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7a6e000 b7a80000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7a80000 b7b4f000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b9304000 b9316000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b9316000 b93e5000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f76b7000 f76c5000   imapi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f774f000 f7757000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
----------------------------------------------------------------

Any help or advice to help confirm what caused this would be greatly appreciated!

thanks,

Ian
0
Comment
Question by:Matsco
  • 2
5 Comments
 
LVL 3

Expert Comment

by:itsireland
ID: 18814804
The bit here:
Ntfs!NtfsAcquireResourceExclusive+8

points at a NTFS file location that needs exclusive access. That could be anything, for instance the virtual memory file(s), but maybe you can find out elsewhere which file and give you some form of clue.

I don't know what whatsup is but can you disable it temporarily and see if the errors stop?

Good luck!
0
 
LVL 1

Author Comment

by:Matsco
ID: 18815173
Thanks.  I found the problem.  One of the guys was running some auditing software called Total Network Inventory and it and Whatsup Gold were accessing the wmiprvse.exe process at the same time causing the blue screen and reboot.
0
 
LVL 3

Expert Comment

by:itsireland
ID: 20231443
is fine by me.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 20286970
PAQed with points refunded (250)

Computer101
EE Admin
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now