slemay2
asked on
Server rebooting with Error code Error code 000000d1, parameter1 00000004, parameter2 d0000009, parameter3 00000000, parameter4 f737bb85.
We have a server that has just started either locking up hard or rebooting a few times a day. We thought it might be the hard drives (as the RAID keeps going down) - so we replaced the hard drives all together and rebuild the array - but it still keeps going down.
The error logs show:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 3/14/2008
Time: 9:59:59 AM
User: N/A
Computer: SERVER
Description:
Error code 000000d1, parameter1 00000004, parameter2 d0000009, parameter3 00000000, parameter4 f737bb85.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 64 000000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 34 2c 20 000004,
0038: 64 30 30 30 30 30 30 39 d0000009
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 66 37 33 37 00, f737
0050: 62 62 38 35 bb85
and
Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 3/14/2008
Time: 9:59:30 AM
User: ALLCAREFORWOMEN\S&T-Admin
Computer: SERVER
Description:
The reason supplied by user ALLCAREFORWOMEN\S&T-Admin for the last unexpected shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x000000d1 (0x00000004, 0xd0000009, 0x00000000, 0xf737bb85)
Comment: 0x000000d1 (0x00000004, 0xd0000009, 0x00000000, 0xf737bb85)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08 ....
But searching this comes up with nothing. I am attaching a PSTAT dump in hopes that someone who can rip this apart better than I can give me some ideas as to where to look. We do have a COMPLETE dump (1gb) in size that I can give access to - I have also switched dumping over to MINI dumps and will capture a few of those if I can. Any advise would be GREATLY appreciated! Thanks!
Shawn
pstat.txt
The error logs show:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 3/14/2008
Time: 9:59:59 AM
User: N/A
Computer: SERVER
Description:
Error code 000000d1, parameter1 00000004, parameter2 d0000009, parameter3 00000000, parameter4 f737bb85.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 64 000000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 34 2c 20 000004,
0038: 64 30 30 30 30 30 30 39 d0000009
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 66 37 33 37 00, f737
0050: 62 62 38 35 bb85
and
Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 3/14/2008
Time: 9:59:30 AM
User: ALLCAREFORWOMEN\S&T-Admin
Computer: SERVER
Description:
The reason supplied by user ALLCAREFORWOMEN\S&T-Admin for the last unexpected shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x000000d1 (0x00000004, 0xd0000009, 0x00000000, 0xf737bb85)
Comment: 0x000000d1 (0x00000004, 0xd0000009, 0x00000000, 0xf737bb85)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08 ....
But searching this comes up with nothing. I am attaching a PSTAT dump in hopes that someone who can rip this apart better than I can give me some ideas as to where to look. We do have a COMPLETE dump (1gb) in size that I can give access to - I have also switched dumping over to MINI dumps and will capture a few of those if I can. Any advise would be GREATLY appreciated! Thanks!
Shawn
pstat.txt
I can't find a post I was working on that looks similar to this error.
My recommendations to the author were to look for spyware, mallware. The HaxDoor virus will cause a BSOD and errors like this.
Also, I looked at the log and declared mismatched RAM. The author had mismatched RAM and it was fixed.
In either case, they had similar errors to this one.
As a tag that is the very lower numbers of Hex. It it usually a RAM issue. But, check your computer first for the HaxDoor virus. Especially if this server worked for a while before it started showing issues.
.
My recommendations to the author were to look for spyware, mallware. The HaxDoor virus will cause a BSOD and errors like this.
Also, I looked at the log and declared mismatched RAM. The author had mismatched RAM and it was fixed.
In either case, they had similar errors to this one.
As a tag that is the very lower numbers of Hex. It it usually a RAM issue. But, check your computer first for the HaxDoor virus. Especially if this server worked for a while before it started showing issues.
.
Hey Rindi:
I went away and pressed submit when I came back without refreshing the page. Sorry about the redundancy, all. Please credit Rindi if this is a RAM issue.
I went away and pressed submit when I came back without refreshing the page. Sorry about the redundancy, all. Please credit Rindi if this is a RAM issue.
ASKER
OK - I'm trying to bring the server down for maintenance and move it to another box (temporary / old hardware) - I'll bring it up online for memory testing tomorrow. I already "thought" memory - so I re-seated the memory (swapping the sticks around) - but I guess it could still be. Thanks for the ideas.
ASKER
I've put a temp. server online and it's holding it's own while I try and figure this guy out... I've had it running diagnostics for the past 24 hours now (7 passes so far) - and not one error... running a program we bought a few years ago called "Micro-Scope 2005" - and it does a very in depth hardware test... so I don't think it's a memory error or anything like that. I will try and bring the server back online later today (in the lab) and see if I can test the next theory of it being a virus or something.
FYI - the memory is matched (it's from the factory - but I verified it).
FYI - the memory is matched (it's from the factory - but I verified it).
Have you checked the computer for instances of the Haxdoor virus?
ASKER
Yes - I've run TWO online virus scanners (Trend Micro and McAfee) to verify nothing is infected on this server (ontop of the installed Symantec AntiVirus Corporate). All came up empty. I'm still thinking it's a driver or hardware - but I'm unsure. We thought there might be a problem with the hard drives (as one of the RAID drives keeps knocking itself offline) - but we replaced BOTH drives (mirror) and no improvements (it's a hardware raid - NOT software). Here is the mini dump that I promised. Thanks again!
(Rename .log to .dmp)
Mini032408-01.log
(Rename .log to .dmp)
Mini032408-01.log
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Microsoft site claims that it's in the latest service pack (which is installed). I'm trying a few other theories - starting with replacing all hard drive cables and have re-downloaded / installed the RAID driver. I've also upgraded the RAID software from v4.x to v5.x. I'll continue running tests today to see if any / all of these changes have helped. Thanks for the advice so far.
ASKER
Well - it's been two days and no crashes yet... I'm hammering on the hard drives - shutting it down, booting it up etc... still no blue screens yet... I'll continue this through this weekend and if all goes well - we'll put it back into production on Monday.
ASKER
Well this guy hasn't died once in the week of testing we've been putting it through - so I think you guys put us on the right track with the raid driver!! Thanks! I'm going to guess this is fixed!
ASKER
We didn't have a Dell - so the answer wasn't 100% for us - but it did put us on the right track where to look and THAT did solve the problem!
You'll find memtest86+ and other usefull tools on the UBCD.
http://ultimatebootcd.com