netsmart1
asked on
SERVER 2003 keeps crashing..
Hi I am running a server 2003 standard x86. Ther server reboots itself as often as every 4 hours.
The following is the dump file. Any help will be appreciated.
System Uptime: 0 days 3:48:18.812
Loading Kernel Symbols
.......................... .......... .......... .......... .......... .......... .......... .......... ....
......................
Loading User Symbols
Loading unloaded module list
....
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 8082c64e, f714fbd8, f714f8d4}
Probably caused by : srv.sys ( srv!SrvTerminateWorkerThre ad+57 )
Followup: MachineOwner
---------
3: kd> -v
^ Syntax error in '-v'
3: kd> !analyze -v
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
SYSTEM_THREAD_EXCEPTION_NO T_HANDLED_ M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8082c64e, The address that the exception occurred at
Arg3: f714fbd8, Exception Record Address
Arg4: f714f8d4, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx".
The memory could not be "%s".
FAULTING_IP:
nt!MmDeleteTeb+54
8082c64e f6432702 test byte ptr [ebx+27h],2
EXCEPTION_RECORD: f714fbd8 -- (.exr 0xfffffffff714fbd8)
ExceptionAddress: 8082c64e (nt!MmDeleteTeb+0x00000054 )
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000027
Attempt to read from address 00000027
CONTEXT: f714f8d4 -- (.cxr 0xfffffffff714f8d4)
eax=00000000 ebx=00000000 ecx=8a375358 edx=f714fc94 esi=8a39a648 edi=886f6a40
eip=8082c64e esp=f714fca0 ebp=f714fcb8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmDeleteTeb+0x54:
8082c64e f6432702 test byte ptr [ebx+27h],2 ds:0023:00000027=00
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The
memory could not be "%s".
READ_ADDRESS: 00000027
BUGCHECK_STR: 0x7E
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from 8091f8d6 to 8082c64e
STACK_TEXT:
f714fcb8 8091f8d6 8a39a728 887ae68c 886f6a40 nt!MmDeleteTeb+0x54
f714fd44 809206e4 00000000 00000102 00000000 nt!PspExitThread+0x4ea
f714fd5c 808feaa7 886f6a40 00000000 00000001 nt!PspTerminateThreadByPoi nter+0x4b
f714fd70 b6c8491d 00000000 89f730e0 00000010 nt!PsTerminateSystemThread +0x26
f714fd84 b6c9f245 00000000 886f6a40 00000000 srv!SrvTerminateWorkerThre ad+0x57
f714fdac 80920833 00f730e0 00000000 00000000 srv!WorkerThread+0xa1
f714fddc 8083fe9f b6c98602 89f730e0 00000000 nt!PspSystemThreadStartup+ 0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
srv!SrvTerminateWorkerThre ad+57
b6c8491d 5e pop esi
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: srv!SrvTerminateWorkerThre ad+57
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: srv
IMAGE_NAME: srv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48b558b6
STACK_COMMAND: .cxr 0xfffffffff714f8d4 ; kb
FAILURE_BUCKET_ID: 0x7E_srv!SrvTerminateWorke rThread+57
BUCKET_ID: 0x7E_srv!SrvTerminateWorke rThread+57
Followup: MachineOwner
---------
The following is the dump file. Any help will be appreciated.
System Uptime: 0 days 3:48:18.812
Loading Kernel Symbols
..........................
......................
Loading User Symbols
Loading unloaded module list
....
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 8082c64e, f714fbd8, f714f8d4}
Probably caused by : srv.sys ( srv!SrvTerminateWorkerThre
Followup: MachineOwner
---------
3: kd> -v
^ Syntax error in '-v'
3: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
SYSTEM_THREAD_EXCEPTION_NO
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8082c64e, The address that the exception occurred at
Arg3: f714fbd8, Exception Record Address
Arg4: f714f8d4, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx".
The memory could not be "%s".
FAULTING_IP:
nt!MmDeleteTeb+54
8082c64e f6432702 test byte ptr [ebx+27h],2
EXCEPTION_RECORD: f714fbd8 -- (.exr 0xfffffffff714fbd8)
ExceptionAddress: 8082c64e (nt!MmDeleteTeb+0x00000054
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000027
Attempt to read from address 00000027
CONTEXT: f714f8d4 -- (.cxr 0xfffffffff714f8d4)
eax=00000000 ebx=00000000 ecx=8a375358 edx=f714fc94 esi=8a39a648 edi=886f6a40
eip=8082c64e esp=f714fca0 ebp=f714fcb8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmDeleteTeb+0x54:
8082c64e f6432702 test byte ptr [ebx+27h],2 ds:0023:00000027=00
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The
memory could not be "%s".
READ_ADDRESS: 00000027
BUGCHECK_STR: 0x7E
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from 8091f8d6 to 8082c64e
STACK_TEXT:
f714fcb8 8091f8d6 8a39a728 887ae68c 886f6a40 nt!MmDeleteTeb+0x54
f714fd44 809206e4 00000000 00000102 00000000 nt!PspExitThread+0x4ea
f714fd5c 808feaa7 886f6a40 00000000 00000001 nt!PspTerminateThreadByPoi
f714fd70 b6c8491d 00000000 89f730e0 00000010 nt!PsTerminateSystemThread
f714fd84 b6c9f245 00000000 886f6a40 00000000 srv!SrvTerminateWorkerThre
f714fdac 80920833 00f730e0 00000000 00000000 srv!WorkerThread+0xa1
f714fddc 8083fe9f b6c98602 89f730e0 00000000 nt!PspSystemThreadStartup+
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
srv!SrvTerminateWorkerThre
b6c8491d 5e pop esi
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: srv!SrvTerminateWorkerThre
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: srv
IMAGE_NAME: srv.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xfffffffff714f8d4 ; kb
FAILURE_BUCKET_ID: 0x7E_srv!SrvTerminateWorke
BUCKET_ID: 0x7E_srv!SrvTerminateWorke
Followup: MachineOwner
---------
The latest version of SRV.SYS can be found here:
http://support.microsoft.com/kb/950298
I found a similar post, with similar stop error:
https://www.experts-exchange.com/questions/23744416/SRV-sys-BSOD.html
http://support.microsoft.com/kb/950298
I found a similar post, with similar stop error:
https://www.experts-exchange.com/questions/23744416/SRV-sys-BSOD.html
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Found issue on my own, it was a bad driver.
Is your sever fully patched?