SBS 2008 Server UNEXPECTED_KERNEL_MODE_TRAP

letooth
letooth used Ask the Experts™
on
Having never previously crashed our SBS 2008 server blue screened on Monday afternoon. The stop condition was

UNEXPECTED_KERNEL_MODE_TRAP
STOP: 0x0000007f (0x0000000000000008, 0x0000000080050031, 0x00000000000006f8,
0xfffff80003ca8628)
 *** ntoskrnl.exe - Address 0xfffff80003c6f490 base at 0xfffff80003c15000

On each subsequent restart the same BSOD and error was repeated.

The minidumps are attached along with the windows debugging of the memory.dmp file.

It seems that the system starts to shut itself down (various services stopping messages appear) before the BSOD.

The system is stable in Safe Mode.

Steps taken so far:
All removable cards have been reseated.
Manufacturer hardware diagnostics run and indicates all hardware functioning correctly.
Memory from a working machine swapped in - no change.
Full av scan run (Kaspersky) - nothing detected.
Rootkit scan run (TDSKiller) - nothing detected.


April 2012 Windows updates had been installed the previous evening. Having uninstalled these updates we no longer get the BSOD. However, when attempting to run in normal mode, the system still shuts itself down - logs out the user and then stops services without any user interaction. Again the system seems to be stable in safe mode.

I'm no expert in dump file analysis and would appreciate any help in diagnosing / fixing the error.

The full kernel mode crash dump file is too big to post here but I can make it available if needed.

thanks,

Simon
Minidump.zip
WindowsDebugging.txt
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
How is event viewer looking, anything standing out for the time its shutting down?
Commented:
Analyzing the dump file its definitely a third party driver
Blue screen result, check you got all the updates and event viewer

---------------------------------------------------------------------------------------------------------
On Tue 4/17/2012 1:17:30 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\Mini041712-02.dmp
This was probably caused by the following module: Unknown ()
Bugcheck code: 0x7F (0x8, 0x80050031, 0x6F8, 0xFFFFF80003CA8628)
Error: UNEXPECTED_KERNEL_MODE_TRAP
Bug check description: This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: Unknown .
Google query: Unknown UNEXPECTED_KERNEL_MODE_TRAP
-------------------------------------------------------------------------------------------------------

Author

Commented:
Red herring - on checking the event viewer (thanks) I found that the APC Powerchute software was prematurely shutting down the server (server moved to lab and no longer connected to configured UPS).

Uninstalled Powerchute and we are back to the same UNEXPECTED_KERNEL_MODE_TRAP BSOD.

I've attached the system and application log error and warning entries but nothing to my uneducated eye gives a hint towards which driver could be at fault.

BTW - I haven't updated any drivers recently and WSUS is set not to download drivers from Windows Update.
system-log.txt
application-log.txt

Commented:
Before uninstalling the powerchute software I would ask the question why was it shutting down the server, there should also be some indication of this in the powerchute logs. however as its removed lets deal with the current issue

I presume you are able to boot the server in safe mode ok? if so then go to start run- msconfig and disable all start up services, does the server now boot?
if so look closer at the services that are disabled, it will be a little process of elimination. le

Author

Commented:
thanks - will do but server does boot normally - just crashes after 5 - 10 minutes whether left at log in screen or logged in.
Commented:
Thats ok you should be able to disable ALL start up services through msconfig and then reboot and see if the issue persists, if you don't get enough time to disable the services in normal mode before crashing then boot into safe mode

Author

Commented:
Thanks. Following your suggestions I rechecked the windows debugger of Memory,dmp and found that I had not analysed it properly. Proper analysis told me the driver causing the default! Driver in error was BackupAssist Service. I disabled this service in msconfig in safe mode as suggested and server is now stable in normal mode. Of course I still need to address the BackupAssist problem but that is another issue.

Although improbable, Just in case someone else has the same issue I've attached the windows debugger results for information.

cheers,

Simon
win-dbg.txt

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial