windows server 2003 BSOD srv.sys driver_fault

kirchiri
kirchiri used Ask the Experts™
on
Hello everyone,

I am having troubles with one of our client's windows server 2003 sp2, it appears to BSOD and reboot about once every 16-30 days like clockwork, not cool since we just replaced their old server about 6 months and he shelled out a pretty penny for the replacement.

The server is an HP ProLiant ML350 G5 standard .  Have been scouring the web for awhile now looking for different solutions/suggestions, so far I've been considering bad memory, overheating, some issues with windows update (noticed that in the bug file), or problems with srv.sys itself (doubt that, looks like pretty recent version - 5.2.3790.4425 (srv03_sp2_gdr.081211-1204))

Any thoughts greatly appreciated!!

Thanks!

The system log error shows: System Error Cat: (102) EventID: 1003
Error code 00000050, parameter1 fffffffa, parameter2 00000000, parameter3 b9a4635f, parameter4 00000000.

Memory.DMP shows in winDBG:
--------------------------------------------------------

0: kd> .reload;!analyze -v;r;kv;lmnt;
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd600c).  Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffa, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b9a4635f, If non-zero, the instruction address which referenced the bad memory
      address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

Page ca018 not present in the dump file. Type ".hh dbgerr004" for details
Page ca32c not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 7ffd600c).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd600c).  Type ".hh dbgerr001" for details

READ_ADDRESS:  fffffffa

FAULTING_IP:
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

MM_INTERNAL_CODE:  0

IMAGE_NAME:  srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4940fb1f

MODULE_NAME: srv

FAULTING_MODULE: b9a22000 srv

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  b9cbb9e0 -- (.trap 0xffffffffb9cbb9e0)
ErrCode = 00000000
eax=ffffff34 ebx=01ca92c6 ecx=fffffffa edx=00000000 esi=b9cbba70 edi=b9a37a40
eip=b9a4635f esp=b9cbba54 ebp=b9cbba64 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
srv!UpdateSessionLastUseTime+0x3c:
b9a4635f 803900          cmp     byte ptr [ecx],0           ds:0023:fffffffa=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 808692ab to 8087c4a0

STACK_TEXT:  
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c


STACK_COMMAND:  kb

FOLLOWUP_IP:
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  srv!UpdateSessionLastUseTime+3c

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000000 ecx=00000000 edx=00000000 esi=ffdff120 edi=808b4160
eip=8087c4a0 esp=b9cbb960 ebp=b9cbb978 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!KeBugCheckEx+0x1b:
8087c4a0 5d              pop     ebp
ChildEBP RetAddr  Args to Child              
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b (FPO: [5,0,0])
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813 (FPO: [4,10,4])
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ b9cbb9e0)
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c (FPO: [1,1,0])
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a (FPO: [3,2,0])
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8 (FPO: [SEH])
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77 (FPO: [2,1,4])
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45 (FPO: [0,0,4])
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b (FPO: [7,0,4])
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f (FPO: [SEH])
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a (FPO: [10,0,0])
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b9cbbd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c
start    end        module name
80800000 80a7e000   nt       ntkrnlmp.exe Wed Aug 05 11:36:42 2009 (4A79A70A)
80a7e000 80aaa000   hal      halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b7fca000 b7fdd180   NAVENG   NAVENG.SYS   Sat Aug 22 01:31:12 2009 (4A8F82A0)
b7fde000 b811f800   NAVEX15  NAVEX15.SYS  Sat Aug 22 01:37:19 2009 (4A8F840F)
b8816000 b8841000   RDPWD    RDPWD.SYS    Sat Feb 17 00:44:38 2007 (45D69646)
b9622000 b962d000   TDTCP    TDTCP.SYS    Sat Feb 17 00:44:32 2007 (45D69640)
b9a22000 b9a80000   srv      srv.sys      Thu Dec 11 06:35:59 2008 (4940FB1F)
ba020000 ba03c000   dump_HpCISSs2 dump_HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
ba03c000 ba051000   Cdfs     Cdfs.SYS     Sat Feb 17 01:27:08 2007 (45D6A03C)
ba099000 ba0a3000   ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
ba119000 ba136000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Mon Aug 17 19:05:39 2009 (4A89E243)
ba136000 ba194000   eeCtrl   eeCtrl.sys   Mon Aug 17 19:05:39 2009 (4A89E243)
ba194000 ba1a5000   Fips     Fips.SYS     Sat Feb 17 01:26:33 2007 (45D6A019)
ba1a5000 ba21b000   mrxsmb   mrxsmb.sys   Fri Sep 05 11:26:52 2008 (48C14FBC)
ba21b000 ba24b000   rdbss    rdbss.sys    Sat Feb 17 01:27:37 2007 (45D6A059)
ba24b000 ba2b4000   SPBBCDrv SPBBCDrv.sys Wed May 14 22:14:28 2008 (482B9C84)
ba2b4000 ba2de000   afd      afd.sys      Thu Oct 16 11:44:36 2008 (48F76164)
ba2de000 ba30f000   netbt    netbt.sys    Sat Feb 17 01:28:57 2007 (45D6A0A9)
ba30f000 ba3a3000   tcpip    tcpip.sys    Sat Aug 15 05:53:38 2009 (4A8685A2)
ba3a3000 ba3bc000   ipsec    ipsec.sys    Sat Feb 17 01:29:28 2007 (45D6A0C8)
ba3f0000 ba415000   SYMEVENT SYMEVENT.SYS Mon Jan 14 18:29:24 2008 (478BF054)
ba42d000 ba434f60   WGX      WGX.SYS      Mon Dec 08 23:57:05 2008 (493DFAA1)
ba44d000 ba455000   mouhid   mouhid.sys   Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba455000 ba45cd80   usbccgp  usbccgp.sys  Sat Feb 17 01:13:08 2007 (45D69CF4)
ba5a7000 ba5f1000   SRTSP    SRTSP.SYS    Wed Oct 08 17:00:38 2008 (48ED1F76)
ba631000 ba63a000   kbdhid   kbdhid.sys   Sat Feb 17 01:05:42 2007 (45D69B36)
ba759000 ba76e000   usbhub   usbhub.sys   Sat Feb 17 01:13:05 2007 (45D69CF1)
ba796000 ba7f5000   update   update.sys   Mon May 28 08:15:16 2007 (465AC7D4)
ba7f5000 ba82c000   rdpdr    rdpdr.sys    Sat Feb 17 00:51:00 2007 (45D697C4)
ba82c000 ba83e000   raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
ba89e000 ba8a8000   Dxapi    Dxapi.sys    Tue Mar 25 03:06:01 2003 (3E7FFFD9)
ba8ae000 ba8b8000   dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
ba8ce000 ba8db000   netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
ba8de000 ba8f7000   ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
ba8f7000 ba90b000   rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
ba90b000 ba932000   ks       ks.sys       Sat Feb 17 01:30:40 2007 (45D6A110)
ba932000 ba946000   redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
ba946000 ba95b000   cdrom    cdrom.sys    Sat Feb 17 01:07:48 2007 (45D69BB4)
ba95b000 ba970000   serial   serial.sys   Sat Feb 17 01:06:46 2007 (45D69B76)
ba970000 ba983000   i8042prt i8042prt.sys Sat Feb 17 01:30:40 2007 (45D6A110)
ba983000 ba99f000   VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
ba99f000 bab07000   ati2mtag ati2mtag.sys Wed Apr 01 22:18:07 2009 (49D4205F)
bab07000 bab31000   USBPORT  USBPORT.SYS  Sat Feb 17 01:12:59 2007 (45D69CEB)
bab31000 bab43000   bxnd52x  bxnd52x.sys  Wed Aug 13 02:16:32 2008 (48A27C40)
bafd2000 bafd5500   scsichng scsichng.sys Wed May 03 16:08:19 2006 (44590DB3)
bf800000 bf9d1000   win32k   win32k.sys   Thu Aug 13 09:39:50 2009 (4A8417A6)
bf9d1000 bf9e8000   dxg      dxg.sys      Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9e8000 bfa2b000   ati2dvag ati2dvag.dll Wed Apr 01 22:18:20 2009 (49D4206C)
bfa2b000 bfa6a000   ati2cqag ati2cqag.dll Wed Apr 01 21:27:46 2009 (49D41492)
bfa6a000 bfaa0000   atikvmag atikvmag.dll Wed Apr 01 21:51:28 2009 (49D41A20)
bff60000 bff7e000   RDPDD    RDPDD.dll    Sat Feb 17 09:01:19 2007 (45D70AAF)
bffa0000 bffea000   ATMFD    ATMFD.DLL    Sat Feb 17 08:59:31 2007 (45D70A43)
f7007000 f700f080   0dlttape 0dlttape.sys Fri Jan 12 08:42:41 2007 (45A79051)
f7017000 f7020000   hidusb   hidusb.sys   Tue Mar 25 03:10:17 2003 (3E8000D9)
f7027000 f7031000   mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7047000 f7052000   ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f70c7000 f70eb000   hpqilo2  hpqilo2.sys  Tue Jul 07 16:25:42 2009 (4A53AF46)
f70eb000 f710a000   Mup      Mup.sys      Sat Feb 17 01:27:41 2007 (45D6A05D)
f710a000 f7149000   NDIS     NDIS.sys     Sat Feb 17 01:28:49 2007 (45D6A0A1)
f7149000 f71de000   Ntfs     Ntfs.sys     Sat Feb 17 01:27:23 2007 (45D6A04B)
f71de000 f724f000   bxvbdx   bxvbdx.sys   Tue Aug 12 19:41:10 2008 (48A21F96)
f724f000 f7275000   KSecDD   KSecDD.sys   Mon Jun 15 13:45:11 2009 (4A3688A7)
f7275000 f729a000   fltmgr   fltmgr.sys   Sat Feb 17 00:51:08 2007 (45D697CC)
f729a000 f72ad000   CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f72ad000 f72cb000   storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72cb000 f72e7000   HpCISSs2 HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
f72e7000 f7306000   SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f7306000 f7323000   atapi    atapi.sys    Sat Feb 17 01:07:34 2007 (45D69BA6)
f7323000 f734d000   volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f734d000 f7379000   dmio     dmio.sys     Sat Feb 17 01:10:44 2007 (45D69C64)
f7379000 f73a0000   ftdisk   ftdisk.sys   Sat Feb 17 01:08:05 2007 (45D69BC5)
f73a0000 f741c000   wdf01000 wdf01000.sys Sat Jan 19 00:52:21 2008 (47919015)
f741c000 f7432000   pci      pci.sys      Sat Feb 17 00:59:03 2007 (45D699A7)
f7432000 f7466000   ACPI     ACPI.sys     Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000   WDFLDR   WDFLDR.SYS   Sat Jan 19 00:52:19 2008 (47919013)
f74b7000 f74c4000   PCIIDEX  PCIIDEX.SYS  Sat Feb 17 01:07:32 2007 (45D69BA4)
f74c7000 f74d7000   MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74d7000 f74e2000   PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74e7000 f74f2000   sym_u3   sym_u3.sys   Fri Oct 29 18:15:26 2004 (4182C0FE)
f74f7000 f7507000   disk     disk.sys     Sat Feb 17 01:07:51 2007 (45D69BB7)
f7507000 f7513000   Dfs      Dfs.sys      Sat Feb 17 00:51:17 2007 (45D697D5)
f7517000 f7521000   crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574000   Npfs     Npfs.SYS     Sat Feb 17 00:50:36 2007 (45D697AC)
f7577000 f7586000   intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
f7587000 f7595000   msgpc    msgpc.sys    Sat Feb 17 00:58:37 2007 (45D6998D)
f75b7000 f75c2000   fdc      fdc.sys      Sat Feb 17 01:07:16 2007 (45D69B94)
f75c7000 f75d0000   mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
f75d7000 f75e6000   raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f4000   wanarp   wanarp.sys   Sat Feb 17 00:59:17 2007 (45D699B5)
f75f7000 f7601000   serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
f7607000 f7615000   NDProxy  NDProxy.SYS  Sat Feb 17 00:59:21 2007 (45D699B9)
f7627000 f7636000   termdd   termdd.sys   Sat Feb 17 00:44:32 2007 (45D69640)
f7637000 f7645000   imapi    imapi.sys    Sat Feb 17 01:08:22 2007 (45D69BD6)
f7647000 f7650000   ndistapi ndistapi.sys Sat Feb 17 00:59:19 2007 (45D699B7)
f7657000 f7662000   kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f7667000 f7670100   SRTSPX   SRTSPX.SYS   Wed Oct 08 17:02:46 2008 (48ED1FF6)
f7677000 f7680000   raspti   raspti.sys   Sat Feb 17 00:59:23 2007 (45D699BB)
f7697000 f76a2000   Msfs     Msfs.SYS     Sat Feb 17 00:50:33 2007 (45D697A9)
f76a7000 f76b3000   vga      vga.sys      Sat Feb 17 01:10:30 2007 (45D69C56)
f76b7000 f76c0000   watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f76d7000 f76e5000   HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
f76e7000 f76f3000   cpqcidrv cpqcidrv.sys Mon May 11 18:07:43 2009 (4A08A1AF)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000   pciide   pciide.sys   Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 03:08:08 2003 (3E800058)
f776f000 f7777000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 03:08:36 2003 (3E800074)
f7777000 f777e000   Null     Null.SYS     Tue Mar 25 03:03:05 2003 (3E7FFF29)
f777f000 f7786000   Beep     Beep.SYS     Tue Mar 25 03:03:04 2003 (3E7FFF28)
f7787000 f778f000   mnmdd    mnmdd.SYS    Tue Mar 25 03:07:53 2003 (3E800049)
f778f000 f7797000   RDPCDD   RDPCDD.sys   Tue Mar 25 03:03:05 2003 (3E7FFF29)
f7797000 f779f000   rasacd   rasacd.sys   Tue Mar 25 03:11:50 2003 (3E800136)
f77b7000 f77bd500   tpfilter tpfilter.sys Wed Jan 31 15:08:43 2007 (45C0F74B)
f77c7000 f77cc180   usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f77d7000 f77ddb80   usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
f77df000 f77e7000   audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f77e7000 f77ee000   dxgthk   dxgthk.sys   Tue Mar 25 03:05:52 2003 (3E7FFFD0)
f77ff000 f7805300   HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
f7887000 f7892000   TDI      TDI.SYS      Sat Feb 17 01:01:19 2007 (45D69A2F)
f7897000 f7899980   compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900   BATTC    BATTC.SYS    Sat Feb 17 00:58:46 2007 (45D69996)
f7993000 f7994280   swenum   swenum.sys   Sat Feb 17 01:05:56 2007 (45D69B44)
f7995000 f7996580   USBD     USBD.SYS     Tue Mar 25 03:10:39 2003 (3E8000EF)
f7ac2000 f7ac2680   giveio   giveio.sys   Wed Apr 03 22:33:25 1996 (316334F5)

Unloaded modules:
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000



Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
*** Hopeleonie ***IT Manager

Commented:
can you post some more minidumps?

Author

Commented:
Sure, this is a minidump from the same date/time.
New to debugging, let me know if you want me to post the files too.


0: kd> .reload;!analyze -v;r;kv;lmnt;
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffa, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b9a4635f, If non-zero, the instruction address which referenced the bad memory
      address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffffa

FAULTING_IP:
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  b9cbb9e0 -- (.trap 0xffffffffb9cbb9e0)
ErrCode = 00000000
eax=ffffff34 ebx=01ca92c6 ecx=fffffffa edx=00000000 esi=b9cbba70 edi=b9a37a40
eip=b9a4635f esp=b9cbba54 ebp=b9cbba64 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
srv!UpdateSessionLastUseTime+0x3c:
b9a4635f 803900          cmp     byte ptr [ecx],0           ds:0023:fffffffa=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 808692ab to 8087c4a0

STACK_TEXT:  
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c


STACK_COMMAND:  kb

FOLLOWUP_IP:
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  srv!UpdateSessionLastUseTime+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv

IMAGE_NAME:  srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4940fb1f

FAILURE_BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000000 ecx=00000000 edx=00000000 esi=ffdff120 edi=808b4160
eip=8087c4a0 esp=b9cbb960 ebp=b9cbb978 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!KeBugCheckEx+0x1b:
8087c4a0 5d              pop     ebp
ChildEBP RetAddr  Args to Child              
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b (FPO: [5,0,0])
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813 (FPO: [4,10,4])
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ b9cbb9e0)
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c (FPO: [1,1,0])
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a (FPO: [3,2,0])
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8 (FPO: [SEH])
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77 (FPO: [2,1,4])
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45 (FPO: [0,0,4])
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b (FPO: [7,0,4])
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f (FPO: [SEH])
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a (FPO: [10,0,0])
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b9cbbd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c
start    end        module name
80800000 80a7e000   nt       ntkrnlmp.exe Wed Aug 05 11:36:42 2009 (4A79A70A)
80a7e000 80aaa000   hal      halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b7fca000 b7fdd180   NAVENG   NAVENG.SYS   Sat Aug 22 01:31:12 2009 (4A8F82A0)
b7fde000 b811f800   NAVEX15  NAVEX15.SYS  Sat Aug 22 01:37:19 2009 (4A8F840F)
b8816000 b8841000   RDPWD    RDPWD.SYS    Sat Feb 17 00:44:38 2007 (45D69646)
b9622000 b962d000   TDTCP    TDTCP.SYS    Sat Feb 17 00:44:32 2007 (45D69640)
b9a22000 b9a80000   srv      srv.sys      Thu Dec 11 06:35:59 2008 (4940FB1F)
ba020000 ba03c000   dump_HpCISSs2 dump_HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
ba03c000 ba051000   Cdfs     Cdfs.SYS     Sat Feb 17 01:27:08 2007 (45D6A03C)
ba099000 ba0a3000   ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
ba119000 ba136000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Mon Aug 17 19:05:39 2009 (4A89E243)
ba136000 ba194000   eeCtrl   eeCtrl.sys   Mon Aug 17 19:05:39 2009 (4A89E243)
ba194000 ba1a5000   Fips     Fips.SYS     Sat Feb 17 01:26:33 2007 (45D6A019)
ba1a5000 ba21b000   mrxsmb   mrxsmb.sys   Fri Sep 05 11:26:52 2008 (48C14FBC)
ba21b000 ba24b000   rdbss    rdbss.sys    Sat Feb 17 01:27:37 2007 (45D6A059)
ba24b000 ba2b4000   SPBBCDrv SPBBCDrv.sys Wed May 14 22:14:28 2008 (482B9C84)
ba2b4000 ba2de000   afd      afd.sys      Thu Oct 16 11:44:36 2008 (48F76164)
ba2de000 ba30f000   netbt    netbt.sys    Sat Feb 17 01:28:57 2007 (45D6A0A9)
ba30f000 ba3a3000   tcpip    tcpip.sys    Sat Aug 15 05:53:38 2009 (4A8685A2)
ba3a3000 ba3bc000   ipsec    ipsec.sys    Sat Feb 17 01:29:28 2007 (45D6A0C8)
ba3f0000 ba415000   SYMEVENT SYMEVENT.SYS Mon Jan 14 18:29:24 2008 (478BF054)
ba42d000 ba434f60   WGX      WGX.SYS      Mon Dec 08 23:57:05 2008 (493DFAA1)
ba44d000 ba455000   mouhid   mouhid.sys   Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba455000 ba45cd80   usbccgp  usbccgp.sys  Sat Feb 17 01:13:08 2007 (45D69CF4)
ba5a7000 ba5f1000   SRTSP    SRTSP.SYS    Wed Oct 08 17:00:38 2008 (48ED1F76)
ba631000 ba63a000   kbdhid   kbdhid.sys   Sat Feb 17 01:05:42 2007 (45D69B36)
ba759000 ba76e000   usbhub   usbhub.sys   Sat Feb 17 01:13:05 2007 (45D69CF1)
ba796000 ba7f5000   update   update.sys   Mon May 28 08:15:16 2007 (465AC7D4)
ba7f5000 ba82c000   rdpdr    rdpdr.sys    Sat Feb 17 00:51:00 2007 (45D697C4)
ba82c000 ba83e000   raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
ba89e000 ba8a8000   Dxapi    Dxapi.sys    Tue Mar 25 03:06:01 2003 (3E7FFFD9)
ba8ae000 ba8b8000   dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
ba8ce000 ba8db000   netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
ba8de000 ba8f7000   ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
ba8f7000 ba90b000   rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
ba90b000 ba932000   ks       ks.sys       Sat Feb 17 01:30:40 2007 (45D6A110)
ba932000 ba946000   redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
ba946000 ba95b000   cdrom    cdrom.sys    Sat Feb 17 01:07:48 2007 (45D69BB4)
ba95b000 ba970000   serial   serial.sys   Sat Feb 17 01:06:46 2007 (45D69B76)
ba970000 ba983000   i8042prt i8042prt.sys Sat Feb 17 01:30:40 2007 (45D6A110)
ba983000 ba99f000   VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
ba99f000 bab07000   ati2mtag ati2mtag.sys Wed Apr 01 22:18:07 2009 (49D4205F)
bab07000 bab31000   USBPORT  USBPORT.SYS  Sat Feb 17 01:12:59 2007 (45D69CEB)
bab31000 bab43000   bxnd52x  bxnd52x.sys  Wed Aug 13 02:16:32 2008 (48A27C40)
bafd2000 bafd5500   scsichng scsichng.sys Wed May 03 16:08:19 2006 (44590DB3)
bf800000 bf9d1000   win32k   win32k.sys   Thu Aug 13 09:39:50 2009 (4A8417A6)
bf9d1000 bf9e8000   dxg      dxg.sys      Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9e8000 bfa2b000   ati2dvag ati2dvag.dll Wed Apr 01 22:18:20 2009 (49D4206C)
bfa2b000 bfa6a000   ati2cqag ati2cqag.dll Wed Apr 01 21:27:46 2009 (49D41492)
bfa6a000 bfaa0000   atikvmag atikvmag.dll Wed Apr 01 21:51:28 2009 (49D41A20)
bff60000 bff7e000   RDPDD    RDPDD.dll    Sat Feb 17 09:01:19 2007 (45D70AAF)
bffa0000 bffea000   ATMFD    ATMFD.DLL    Sat Feb 17 08:59:31 2007 (45D70A43)
f7007000 f700f080   0dlttape 0dlttape.sys Fri Jan 12 08:42:41 2007 (45A79051)
f7017000 f7020000   hidusb   hidusb.sys   Tue Mar 25 03:10:17 2003 (3E8000D9)
f7027000 f7031000   mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7047000 f7052000   ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f70c7000 f70eb000   hpqilo2  hpqilo2.sys  Tue Jul 07 16:25:42 2009 (4A53AF46)
f70eb000 f710a000   Mup      Mup.sys      Sat Feb 17 01:27:41 2007 (45D6A05D)
f710a000 f7149000   NDIS     NDIS.sys     Sat Feb 17 01:28:49 2007 (45D6A0A1)
f7149000 f71de000   Ntfs     Ntfs.sys     Sat Feb 17 01:27:23 2007 (45D6A04B)
f71de000 f724f000   bxvbdx   bxvbdx.sys   Tue Aug 12 19:41:10 2008 (48A21F96)
f724f000 f7275000   KSecDD   KSecDD.sys   Mon Jun 15 13:45:11 2009 (4A3688A7)
f7275000 f729a000   fltmgr   fltmgr.sys   Sat Feb 17 00:51:08 2007 (45D697CC)
f729a000 f72ad000   CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f72ad000 f72cb000   storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72cb000 f72e7000   HpCISSs2 HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
f72e7000 f7306000   SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f7306000 f7323000   atapi    atapi.sys    Sat Feb 17 01:07:34 2007 (45D69BA6)
f7323000 f734d000   volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f734d000 f7379000   dmio     dmio.sys     Sat Feb 17 01:10:44 2007 (45D69C64)
f7379000 f73a0000   ftdisk   ftdisk.sys   Sat Feb 17 01:08:05 2007 (45D69BC5)
f73a0000 f741c000   wdf01000 wdf01000.sys Sat Jan 19 00:52:21 2008 (47919015)
f741c000 f7432000   pci      pci.sys      Sat Feb 17 00:59:03 2007 (45D699A7)
f7432000 f7466000   ACPI     ACPI.sys     Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000   WDFLDR   WDFLDR.SYS   Sat Jan 19 00:52:19 2008 (47919013)
f74b7000 f74c4000   PCIIDEX  PCIIDEX.SYS  Sat Feb 17 01:07:32 2007 (45D69BA4)
f74c7000 f74d7000   MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74d7000 f74e2000   PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74e7000 f74f2000   sym_u3   sym_u3.sys   Fri Oct 29 18:15:26 2004 (4182C0FE)
f74f7000 f7507000   disk     disk.sys     Sat Feb 17 01:07:51 2007 (45D69BB7)
f7507000 f7513000   Dfs      Dfs.sys      Sat Feb 17 00:51:17 2007 (45D697D5)
f7517000 f7521000   crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574000   Npfs     Npfs.SYS     Sat Feb 17 00:50:36 2007 (45D697AC)
f7577000 f7586000   intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
f7587000 f7595000   msgpc    msgpc.sys    Sat Feb 17 00:58:37 2007 (45D6998D)
f75b7000 f75c2000   fdc      fdc.sys      Sat Feb 17 01:07:16 2007 (45D69B94)
f75c7000 f75d0000   mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
f75d7000 f75e6000   raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f4000   wanarp   wanarp.sys   Sat Feb 17 00:59:17 2007 (45D699B5)
f75f7000 f7601000   serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
f7607000 f7615000   NDProxy  NDProxy.SYS  Sat Feb 17 00:59:21 2007 (45D699B9)
f7627000 f7636000   termdd   termdd.sys   Sat Feb 17 00:44:32 2007 (45D69640)
f7637000 f7645000   imapi    imapi.sys    Sat Feb 17 01:08:22 2007 (45D69BD6)
f7647000 f7650000   ndistapi ndistapi.sys Sat Feb 17 00:59:19 2007 (45D699B7)
f7657000 f7662000   kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f7667000 f7670100   SRTSPX   SRTSPX.SYS   Wed Oct 08 17:02:46 2008 (48ED1FF6)
f7677000 f7680000   raspti   raspti.sys   Sat Feb 17 00:59:23 2007 (45D699BB)
f7697000 f76a2000   Msfs     Msfs.SYS     Sat Feb 17 00:50:33 2007 (45D697A9)
f76a7000 f76b3000   vga      vga.sys      Sat Feb 17 01:10:30 2007 (45D69C56)
f76b7000 f76c0000   watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f76d7000 f76e5000   HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
f76e7000 f76f3000   cpqcidrv cpqcidrv.sys Mon May 11 18:07:43 2009 (4A08A1AF)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000   pciide   pciide.sys   Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 03:08:08 2003 (3E800058)
f776f000 f7777000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 03:08:36 2003 (3E800074)
f7777000 f777e000   Null     Null.SYS     Tue Mar 25 03:03:05 2003 (3E7FFF29)
f777f000 f7786000   Beep     Beep.SYS     Tue Mar 25 03:03:04 2003 (3E7FFF28)
f7787000 f778f000   mnmdd    mnmdd.SYS    Tue Mar 25 03:07:53 2003 (3E800049)
f778f000 f7797000   RDPCDD   RDPCDD.sys   Tue Mar 25 03:03:05 2003 (3E7FFF29)
f7797000 f779f000   rasacd   rasacd.sys   Tue Mar 25 03:11:50 2003 (3E800136)
f77b7000 f77bd500   tpfilter tpfilter.sys Wed Jan 31 15:08:43 2007 (45C0F74B)
f77c7000 f77cc180   usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f77d7000 f77ddb80   usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
f77df000 f77e7000   audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f77e7000 f77ee000   dxgthk   dxgthk.sys   Tue Mar 25 03:05:52 2003 (3E7FFFD0)
f77ff000 f7805300   HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
f7887000 f7892000   TDI      TDI.SYS      Sat Feb 17 01:01:19 2007 (45D69A2F)
f7897000 f7899980   compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900   BATTC    BATTC.SYS    Sat Feb 17 00:58:46 2007 (45D69996)
f7993000 f7994280   swenum   swenum.sys   Sat Feb 17 01:05:56 2007 (45D69B44)
f7995000 f7996580   USBD     USBD.SYS     Tue Mar 25 03:10:39 2003 (3E8000EF)
f7ac2000 f7ac2680   giveio   giveio.sys   Wed Apr 03 22:33:25 1996 (316334F5)

Unloaded modules:
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
*** Hopeleonie ***IT Manager

Commented:
can you post all this dump files for us?
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Author

Commented:
Those are the only two dump files I have for that date/time.

I can't attach the memory dump because it's too big.  If you want me to run a different command in winDBG I can, just let me know which you one you'd like.

Thanks
*** Hopeleonie ***IT Manager

Commented:
post both dump files here http://www.megaupload.com & give me the link...

Author

Commented:
OK I will, it will take a few hours to get it uploaded, will post when it's done,

Author

Commented:
http://www.megaupload.com/?d=BWKOMYVY
Memory.dmp here and attached minidump.



Mini011110-01.dmp
*** Hopeleonie ***IT Manager

Commented:
hi

please give me some time to analyse

leonie
*** Hopeleonie ***IT Manager

Commented:
can you post some informations about the server?
version of server 2003?
DC?
up to date? (software, drivers & windows)
which applications are you running? (antivirus, .... )

Author

Commented:
-HP ProLiant ML350 G5
-Windows Server 2003 Standard SP2
-Symantec Endpoint Client Unmanaged
-Symantec Backup Exec 11d
-PracticeWorks DICOM Server v2.1.276 [dental imaging software]
-PracticeWorks Server v1.5.4.74 [dental practice management software]
-Softdent Software [dental practice management client]
-SQL 2005 [BackupExec]


For the most part it is up to date up until the errors started.  Since then I have disabled automatic update w/ notification upon reading of similar errors happening as a result of automatic update malfunctioning.  Recently had to replace a bad hdd in a raid mirror array.

Hard to update the server and reboot because with practiceworks server you have to be at physical server to start the server app, server app for whatever reason will not start at console session of rdp, some sort of limitation in the programming.  So I haven't had a chance to schedule time to go out there and have them be down for updates.
*** Hopeleonie ***IT Manager

Commented:
I'm in asia for training, because of that i cant download a large file here. Internet is too slow. Therefore i will tell another specialist to have a look at your case.

Author

Commented:
Cool, I appreciate it thanks.
Hi -

I am downloading the FULL kernel dump now, but have processed the mini kernel dump in the meantime.  I believe at this time that Norton is the prime suspect in the BSODs.
Remove Norton using the Norton Removal tool.  Download the NRT and SAVE to desktop.  
NRT --> ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe
Boot into SAFEMODE and run the NRT; re-boot; reset the Windows Firewall to its default settings.
I would recommend Microsoft Security Essentials - it is free.  Try it and see if BSODs persist -
Microsoft Security Essentials --> http://www.microsoft.com/Security_Essentials/
Regards. . .
jcgriff2


Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [A:\D\!!_Kernel_Dumps\_EE_kirchiri_02-09-10__jcgriff2__\Mini011110-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.090805-1438
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Mon Jan 11 09:03:17.789 2010 (GMT-5)
System Uptime: 30 days 19:19:39.203
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffa, 0, b9a4635f, 0}


Could not read faulting driver name
Probably caused by : srv.sys ( srv!UpdateSessionLastUseTime+3c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffa, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b9a4635f, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffffa 

FAULTING_IP: 
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  b9cbb9e0 -- (.trap 0xffffffffb9cbb9e0)
ErrCode = 00000000
eax=ffffff34 ebx=01ca92c6 ecx=fffffffa edx=00000000 esi=b9cbba70 edi=b9a37a40
eip=b9a4635f esp=b9cbba54 ebp=b9cbba64 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
srv!UpdateSessionLastUseTime+0x3c:
b9a4635f 803900          cmp     byte ptr [ecx],0           ds:0023:fffffffa=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 808692ab to 8087c4a0

STACK_TEXT:  
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
srv!UpdateSessionLastUseTime+3c
b9a4635f 803900          cmp     byte ptr [ecx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  srv!UpdateSessionLastUseTime+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: srv

IMAGE_NAME:  srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4940fb1f

FAILURE_BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

BUCKET_ID:  0x50_srv!UpdateSessionLastUseTime+3c

Followup: MachineOwner
---------

0: kd> lmvm srv
start    end        module name
b9a22000 b9a80000   srv        (pdb symbols)          c:\symbols\srv.pdb\36A3BEB1677845B2A1285F64E20035A12\srv.pdb
    Loaded symbol image file: srv.sys
    Mapped memory image file: C:\symbols\srv.sys\4940FB1F5e000\srv.sys
    Image path: \SystemRoot\system32\DRIVERS\srv.sys
    Image name: srv.sys
    Timestamp:        Thu Dec 11 06:35:59 2008 (4940FB1F)
    CheckSum:         0005C06F
    ImageSize:        0005E000
    File version:     5.2.3790.4425
    Product version:  5.2.3790.4425
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     SRV.SYS
    OriginalFilename: SRV.SYS
    ProductVersion:   5.2.3790.4425
    FileVersion:      5.2.3790.4425 (srv03_sp2_gdr.081211-1204)
    FileDescription:  Server driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
0: kd> k
ChildEBP RetAddr  
b9cbb978 808692ab nt!KeBugCheckEx+0x1b
b9cbb9c8 80836c32 nt!MmAccessFault+0x813
b9cbb9c8 b9a4635f nt!KiTrap0E+0xdc
b9cbba64 b9a7379b srv!UpdateSessionLastUseTime+0x3c
b9cbba78 b9a39c16 srv!SrvNetSessionEnum+0x1a
b9cbbc18 b9a39cf6 srv!SrvFsdDispatchFsControl+0xfd8
b9cbbc3c 80840153 srv!SrvFsdDispatch+0x77
b9cbbc50 8092b51f nt!IofCallDriver+0x45
b9cbbc64 8092b454 nt!IopSynchronousServiceTail+0x10b
b9cbbd00 809389a7 nt!IopXxxControlFile+0x60f
b9cbbd34 80833bef nt!NtFsControlFile+0x2a
b9cbbd34 7c82860c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 0x7c82860c
0: kd> kb
ChildEBP RetAddr  Args to Child              
b9cbb978 808692ab 00000050 fffffffa 00000000 nt!KeBugCheckEx+0x1b
b9cbb9c8 80836c32 00000000 fffffffa 00000000 nt!MmAccessFault+0x813
b9cbb9c8 b9a4635f 00000000 fffffffa 00000000 nt!KiTrap0E+0xdc
b9cbba64 b9a7379b b9cbba70 d3316f18 01ca92c6 srv!UpdateSessionLastUseTime+0x3c
b9cbba78 b9a39c16 e879a498 0756cc00 00002000 srv!SrvNetSessionEnum+0x1a
b9cbbc18 b9a39cf6 88d81560 884869c8 88486a38 srv!SrvFsdDispatchFsControl+0xfd8
b9cbbc3c 80840153 88d81560 884869c8 878711d8 srv!SrvFsdDispatch+0x77
b9cbbc50 8092b51f 88486a38 88dd1b58 884869c8 nt!IofCallDriver+0x45
b9cbbc64 8092b454 88d81560 884869c8 88dd1b58 nt!IopSynchronousServiceTail+0x10b
b9cbbd00 809389a7 00000508 000011e8 00000000 nt!IopXxxControlFile+0x60f
b9cbbd34 80833bef 00000508 000011e8 00000000 nt!NtFsControlFile+0x2a
b9cbbd34 7c82860c 00000508 000011e8 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0168f8c8 00000000 00000000 00000000 00000000 0x7c82860c
0: kd> kd
b9cbb978  b9cbb9c8
b9cbb97c  808692ab nt!MmAccessFault+0x813
b9cbb980  00000050
b9cbb984  fffffffa
b9cbb988  00000000
b9cbb98c  b9cbb9e0
b9cbb990  00000000
b9cbb994  fffffffa
b9cbb998  b9cbba70
b9cbb99c  b9cbba64
b9cbb9a0  808b41a0 nt!MmSystemCacheWs+0x40
b9cbb9a4  808b41a0 nt!MmSystemCacheWs+0x40
b9cbb9a8  809256a9 nt!SeReleaseSubjectContext+0x2f
b9cbb9ac  c03ffffc
b9cbb9b0  87f1e288
b9cbb9b4  00000000
b9cbb9b8  00146027
b9cbb9bc  00000000
b9cbb9c0  00000000
b9cbb9c4  00cbbb78
0: kd> kr
*** WARNING: Unable to verify timestamp for NAVENG.SYS
*** ERROR: Module load completed but symbols could not be loaded for NAVENG.SYS
*** WARNING: Unable to verify timestamp for NAVEX15.SYS
*** ERROR: Module load completed but symbols could not be loaded for NAVEX15.SYS
*** WARNING: Unable to verify timestamp for dump_HpCISSs2.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_HpCISSs2.sys
*** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys
*** WARNING: Unable to verify timestamp for eeCtrl.sys
*** ERROR: Module load completed but symbols could not be loaded for eeCtrl.sys
*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for SPBBCDrv.sys
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
*** WARNING: Unable to verify timestamp for WGX.SYS
*** ERROR: Module load completed but symbols could not be loaded for WGX.SYS
*** WARNING: Unable to verify timestamp for SRTSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP.SYS
*** WARNING: Unable to verify timestamp for ati2mtag.sys
*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys
*** WARNING: Unable to verify timestamp for bxnd52x.sys
*** ERROR: Module load completed but symbols could not be loaded for bxnd52x.sys
*** WARNING: Unable to verify timestamp for scsichng.sys
*** ERROR: Module load completed but symbols could not be loaded for scsichng.sys
*** WARNING: Unable to verify timestamp for ati2dvag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati2dvag.dll
*** WARNING: Unable to verify timestamp for ati2cqag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati2cqag.dll
*** WARNING: Unable to verify timestamp for atikvmag.dll
*** ERROR: Module load completed but symbols could not be loaded for atikvmag.dll
*** WARNING: Unable to verify timestamp for ATMFD.DLL
*** ERROR: Module load completed but symbols could not be loaded for ATMFD.DLL
*** WARNING: Unable to verify timestamp for 0dlttape.sys
*** ERROR: Module load completed but symbols could not be loaded for 0dlttape.sys
*** WARNING: Unable to verify timestamp for ptilink.sys
*** ERROR: Module load completed but symbols could not be loaded for ptilink.sys
*** WARNING: Unable to verify timestamp for hpqilo2.sys
*** ERROR: Module load completed but symbols could not be loaded for hpqilo2.sys
*** WARNING: Unable to verify timestamp for bxvbdx.sys
*** ERROR: Module load completed but symbols could not be loaded for bxvbdx.sys
*** WARNING: Unable to verify timestamp for HpCISSs2.sys
*** ERROR: Module load completed but symbols could not be loaded for HpCISSs2.sys
*** WARNING: Unable to verify timestamp for SRTSPX.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSPX.SYS
*** WARNING: Unable to verify timestamp for cpqcidrv.sys
*** ERROR: Module load completed but symbols could not be loaded for cpqcidrv.sys
*** WARNING: Unable to verify timestamp for tpfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for tpfilter.sys
*** WARNING: Unable to verify timestamp for giveio.sys
*** ERROR: Module load completed but symbols could not be loaded for giveio.sys
Couldn't resolve error at 'r'
0: kd> lmntsm
start    end        module name
f7007000 f700f080   0dlttape 0dlttape.sys Fri Jan 12 08:42:41 2007 (45A79051)
f7432000 f7466000   ACPI     ACPI.sys     Sat Feb 17 00:58:47 2007 (45D69997)
ba2b4000 ba2de000   afd      afd.sys      Thu Oct 16 11:44:36 2008 (48F76164)
f7306000 f7323000   atapi    atapi.sys    Sat Feb 17 01:07:34 2007 (45D69BA6)
bfa2b000 bfa6a000   ati2cqag ati2cqag.dll Wed Apr 01 21:27:46 2009 (49D41492)
bf9e8000 bfa2b000   ati2dvag ati2dvag.dll Wed Apr 01 22:18:20 2009 (49D4206C)
ba99f000 bab07000   ati2mtag ati2mtag.sys Wed Apr 01 22:18:07 2009 (49D4205F)
bfa6a000 bfaa0000   atikvmag atikvmag.dll Wed Apr 01 21:51:28 2009 (49D41A20)
bffa0000 bffea000   ATMFD    ATMFD.DLL    Sat Feb 17 08:59:31 2007 (45D70A43)
f77df000 f77e7000   audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f789b000 f789e900   BATTC    BATTC.SYS    Sat Feb 17 00:58:46 2007 (45D69996)
f777f000 f7786000   Beep     Beep.SYS     Tue Mar 25 03:03:04 2003 (3E7FFF28)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
bab31000 bab43000   bxnd52x  bxnd52x.sys  Wed Aug 13 02:16:32 2008 (48A27C40)
f71de000 f724f000   bxvbdx   bxvbdx.sys   Tue Aug 12 19:41:10 2008 (48A21F96)
ba03c000 ba051000   Cdfs     Cdfs.SYS     Sat Feb 17 01:27:08 2007 (45D6A03C)
ba946000 ba95b000   cdrom    cdrom.sys    Sat Feb 17 01:07:48 2007 (45D69BB4)
f729a000 f72ad000   CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f7897000 f7899980   compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f76e7000 f76f3000   cpqcidrv cpqcidrv.sys Mon May 11 18:07:43 2009 (4A08A1AF)
f7517000 f7521000   crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7507000 f7513000   Dfs      Dfs.sys      Sat Feb 17 00:51:17 2007 (45D697D5)
f74f7000 f7507000   disk     disk.sys     Sat Feb 17 01:07:51 2007 (45D69BB7)
f734d000 f7379000   dmio     dmio.sys     Sat Feb 17 01:10:44 2007 (45D69C64)
f771f000 f7726000   dmload   dmload.sys   Tue Mar 25 03:08:08 2003 (3E800058)
ba8ae000 ba8b8000   dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
ba020000 ba03c000   dump_HpCISSs2 dump_HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
ba89e000 ba8a8000   Dxapi    Dxapi.sys    Tue Mar 25 03:06:01 2003 (3E7FFFD9)
bf9d1000 bf9e8000   dxg      dxg.sys      Sat Feb 17 01:14:39 2007 (45D69D4F)
f77e7000 f77ee000   dxgthk   dxgthk.sys   Tue Mar 25 03:05:52 2003 (3E7FFFD0)
ba136000 ba194000   eeCtrl   eeCtrl.sys   Mon Aug 17 19:05:39 2009 (4A89E243)
ba119000 ba136000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Mon Aug 17 19:05:39 2009 (4A89E243)
f75b7000 f75c2000   fdc      fdc.sys      Sat Feb 17 01:07:16 2007 (45D69B94)
ba194000 ba1a5000   Fips     Fips.SYS     Sat Feb 17 01:26:33 2007 (45D6A019)
f7275000 f729a000   fltmgr   fltmgr.sys   Sat Feb 17 00:51:08 2007 (45D697CC)
f776f000 f7777000   Fs_Rec   Fs_Rec.SYS   Tue Mar 25 03:08:36 2003 (3E800074)
f7379000 f73a0000   ftdisk   ftdisk.sys   Sat Feb 17 01:08:05 2007 (45D69BC5)
f7ac2000 f7ac2680   giveio   giveio.sys   Wed Apr 03 22:33:25 1996 (316334F5)
80a7e000 80aaa000   hal      halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
f76d7000 f76e5000   HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
f77ff000 f7805300   HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
f7017000 f7020000   hidusb   hidusb.sys   Tue Mar 25 03:10:17 2003 (3E8000D9)
f72cb000 f72e7000   HpCISSs2 HpCISSs2.sys Fri Jul 24 20:11:05 2009 (4A6A4D99)
f70c7000 f70eb000   hpqilo2  hpqilo2.sys  Tue Jul 07 16:25:42 2009 (4A53AF46)
ba970000 ba983000   i8042prt i8042prt.sys Sat Feb 17 01:30:40 2007 (45D6A110)
f7637000 f7645000   imapi    imapi.sys    Sat Feb 17 01:08:22 2007 (45D69BD6)
f7577000 f7586000   intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
ba3a3000 ba3bc000   ipsec    ipsec.sys    Sat Feb 17 01:29:28 2007 (45D6A0C8)
f7497000 f74a6000   isapnp   isapnp.sys   Sat Feb 17 00:58:57 2007 (45D699A1)
f7657000 f7662000   kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
ba631000 ba63a000   kbdhid   kbdhid.sys   Sat Feb 17 01:05:42 2007 (45D69B36)
f7707000 f770f000   kdcom    kdcom.dll    Tue Mar 25 03:08:00 2003 (3E800050)
ba90b000 ba932000   ks       ks.sys       Sat Feb 17 01:30:40 2007 (45D6A110)
f724f000 f7275000   KSecDD   KSecDD.sys   Mon Jun 15 13:45:11 2009 (4A3688A7)
f7787000 f778f000   mnmdd    mnmdd.SYS    Tue Mar 25 03:07:53 2003 (3E800049)
f7027000 f7031000   mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
ba44d000 ba455000   mouhid   mouhid.sys   Tue Mar 25 03:03:12 2003 (3E7FFF30)
f74c7000 f74d7000   MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
ba1a5000 ba21b000   mrxsmb   mrxsmb.sys   Fri Sep 05 11:26:52 2008 (48C14FBC)
f7697000 f76a2000   Msfs     Msfs.SYS     Sat Feb 17 00:50:33 2007 (45D697A9)
f7587000 f7595000   msgpc    msgpc.sys    Sat Feb 17 00:58:37 2007 (45D6998D)
f75c7000 f75d0000   mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
f70eb000 f710a000   Mup      Mup.sys      Sat Feb 17 01:27:41 2007 (45D6A05D)
b7fca000 b7fdd180   NAVENG   NAVENG.SYS   Sat Aug 22 01:31:12 2009 (4A8F82A0)
b7fde000 b811f800   NAVEX15  NAVEX15.SYS  Sat Aug 22 01:37:19 2009 (4A8F840F)
f710a000 f7149000   NDIS     NDIS.sys     Sat Feb 17 01:28:49 2007 (45D6A0A1)
f7647000 f7650000   ndistapi ndistapi.sys Sat Feb 17 00:59:19 2007 (45D699B7)
ba099000 ba0a3000   ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
ba8de000 ba8f7000   ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
f7607000 f7615000   NDProxy  NDProxy.SYS  Sat Feb 17 00:59:21 2007 (45D699B9)
ba8ce000 ba8db000   netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
ba2de000 ba30f000   netbt    netbt.sys    Sat Feb 17 01:28:57 2007 (45D6A0A9)
f7567000 f7574000   Npfs     Npfs.SYS     Sat Feb 17 00:50:36 2007 (45D697AC)
80800000 80a7e000   nt       ntkrnlmp.exe Wed Aug 05 11:36:42 2009 (4A79A70A)
f7149000 f71de000   Ntfs     Ntfs.sys     Sat Feb 17 01:27:23 2007 (45D6A04B)
f7777000 f777e000   Null     Null.SYS     Tue Mar 25 03:03:05 2003 (3E7FFF29)
f74d7000 f74e2000   PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f741c000 f7432000   pci      pci.sys      Sat Feb 17 00:59:03 2007 (45D699A7)
f7717000 f771e000   pciide   pciide.sys   Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f74b7000 f74c4000   PCIIDEX  PCIIDEX.SYS  Sat Feb 17 01:07:32 2007 (45D69BA4)
f7047000 f7052000   ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f7797000 f779f000   rasacd   rasacd.sys   Tue Mar 25 03:11:50 2003 (3E800136)
ba8f7000 ba90b000   rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
f75d7000 f75e6000   raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
ba82c000 ba83e000   raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
f7677000 f7680000   raspti   raspti.sys   Sat Feb 17 00:59:23 2007 (45D699BB)
ba21b000 ba24b000   rdbss    rdbss.sys    Sat Feb 17 01:27:37 2007 (45D6A059)
f778f000 f7797000   RDPCDD   RDPCDD.sys   Tue Mar 25 03:03:05 2003 (3E7FFF29)
bff60000 bff7e000   RDPDD    RDPDD.dll    Sat Feb 17 09:01:19 2007 (45D70AAF)
ba7f5000 ba82c000   rdpdr    rdpdr.sys    Sat Feb 17 00:51:00 2007 (45D697C4)
b8816000 b8841000   RDPWD    RDPWD.SYS    Sat Feb 17 00:44:38 2007 (45D69646)
ba932000 ba946000   redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
bafd2000 bafd5500   scsichng scsichng.sys Wed May 03 16:08:19 2006 (44590DB3)
f72e7000 f7306000   SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f75f7000 f7601000   serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
ba95b000 ba970000   serial   serial.sys   Sat Feb 17 01:06:46 2007 (45D69B76)
ba24b000 ba2b4000   SPBBCDrv SPBBCDrv.sys Wed May 14 22:14:28 2008 (482B9C84)
ba5a7000 ba5f1000   SRTSP    SRTSP.SYS    Wed Oct 08 17:00:38 2008 (48ED1F76)
f7667000 f7670100   SRTSPX   SRTSPX.SYS   Wed Oct 08 17:02:46 2008 (48ED1FF6)
b9a22000 b9a80000   srv      srv.sys      Thu Dec 11 06:35:59 2008 (4940FB1F)
f72ad000 f72cb000   storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f7993000 f7994280   swenum   swenum.sys   Sat Feb 17 01:05:56 2007 (45D69B44)
f74e7000 f74f2000   sym_u3   sym_u3.sys   Fri Oct 29 18:15:26 2004 (4182C0FE)
ba3f0000 ba415000   SYMEVENT SYMEVENT.SYS Mon Jan 14 18:29:24 2008 (478BF054)
ba30f000 ba3a3000   tcpip    tcpip.sys    Sat Aug 15 05:53:38 2009 (4A8685A2)
f7887000 f7892000   TDI      TDI.SYS      Sat Feb 17 01:01:19 2007 (45D69A2F)
b9622000 b962d000   TDTCP    TDTCP.SYS    Sat Feb 17 00:44:32 2007 (45D69640)
f7627000 f7636000   termdd   termdd.sys   Sat Feb 17 00:44:32 2007 (45D69640)
f77b7000 f77bd500   tpfilter tpfilter.sys Wed Jan 31 15:08:43 2007 (45C0F74B)
ba796000 ba7f5000   update   update.sys   Mon May 28 08:15:16 2007 (465AC7D4)
ba455000 ba45cd80   usbccgp  usbccgp.sys  Sat Feb 17 01:13:08 2007 (45D69CF4)
f7995000 f7996580   USBD     USBD.SYS     Tue Mar 25 03:10:39 2003 (3E8000EF)
f77d7000 f77ddb80   usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
ba759000 ba76e000   usbhub   usbhub.sys   Sat Feb 17 01:13:05 2007 (45D69CF1)
bab07000 bab31000   USBPORT  USBPORT.SYS  Sat Feb 17 01:12:59 2007 (45D69CEB)
f77c7000 f77cc180   usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f76a7000 f76b3000   vga      vga.sys      Sat Feb 17 01:10:30 2007 (45D69C56)
ba983000 ba99f000   VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
f7323000 f734d000   volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f75e7000 f75f4000   wanarp   wanarp.sys   Sat Feb 17 00:59:17 2007 (45D699B5)
f76b7000 f76c0000   watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f73a0000 f741c000   wdf01000 wdf01000.sys Sat Jan 19 00:52:21 2008 (47919015)
f74a7000 f74b4000   WDFLDR   WDFLDR.SYS   Sat Jan 19 00:52:19 2008 (47919013)
ba42d000 ba434f60   WGX      WGX.SYS      Mon Dec 08 23:57:05 2008 (493DFAA1)
bf800000 bf9d1000   win32k   win32k.sys   Thu Aug 13 09:39:50 2009 (4A8417A6)
f7487000 f7490000   WMILIB   WMILIB.SYS   Tue Mar 25 03:13:00 2003 (3E80017C)

Unloaded modules:
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fca000 b7fde000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b7fde000 b8120000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8260000 b8274000   NAVENG.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b8274000 b83b6000   NAVEX15.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
0: kd> .bugcheck
Bugcheck code 00000050
Arguments fffffffa 00000000 b9a4635f 00000000

Open in new window

Author

Commented:
Alright I'll give that a shot and see what happens.

Any particular reason you believe it's Symantec Endpoint?  I don't doubt that it most likely caused the issue considering Symantec is usually at the root of our troubles but we have that suite on practically every office with the same setup with no similar occurrences in regards to the server.

It will be awhile before I am able to get to that site and try this out so I'm going to award you the solution.  If it happens after that I'll make a new question and message you if that's cool.

Thanks

Author

Commented:
Be awhile till I can schedule time to go out to that office and try the solution, will close in the meantime with points to the only solution given to try.
*** Hopeleonie ***IT Manager

Commented:
hi kirchiri

we can only tell you the cause! because we don’t have the source codes for microsoft or symantec. in your case contact symantec!
Please apply the below hotfix in QFE mode and check how it goes. I could see that the Srv.sys is in GDR.

http://support.microsoft.com/kb/969432

-        Download the Hotfix and extract it to a folder          
-        Open up a command prompt with Admin privileges and go to the folder where the hotfix is saved
-        Run the following command to install the security update in QFE mode
          C:\<Patch Extracted Location>\<Patch_File_Name> /B:SP2QFE
          Example C:\ENU.exe /B:SP2QFE (where ENU.exe id the patch)
-        This will install the Srv.sys hotfix in QFE mode
-        Reboot the box and test

Uninstalling Symantec is definitely a good plan to narrow down the problem

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial