Link to home
Start Free TrialLog in
Avatar of letooth
letoothFlag for United Kingdom of Great Britain and Northern Ireland

asked on

SBS 2008 Server UNEXPECTED_KERNEL_MODE_TRAP

Having never previously crashed our SBS 2008 server blue screened on Monday afternoon. The stop condition was

UNEXPECTED_KERNEL_MODE_TRAP
STOP: 0x0000007f (0x0000000000000008, 0x0000000080050031, 0x00000000000006f8,
0xfffff80003ca8628)
 *** ntoskrnl.exe - Address 0xfffff80003c6f490 base at 0xfffff80003c15000

On each subsequent restart the same BSOD and error was repeated.

The minidumps are attached along with the windows debugging of the memory.dmp file.

It seems that the system starts to shut itself down (various services stopping messages appear) before the BSOD.

The system is stable in Safe Mode.

Steps taken so far:
All removable cards have been reseated.
Manufacturer hardware diagnostics run and indicates all hardware functioning correctly.
Memory from a working machine swapped in - no change.
Full av scan run (Kaspersky) - nothing detected.
Rootkit scan run (TDSKiller) - nothing detected.


April 2012 Windows updates had been installed the previous evening. Having uninstalled these updates we no longer get the BSOD. However, when attempting to run in normal mode, the system still shuts itself down - logs out the user and then stops services without any user interaction. Again the system seems to be stable in safe mode.

I'm no expert in dump file analysis and would appreciate any help in diagnosing / fixing the error.

The full kernel mode crash dump file is too big to post here but I can make it available if needed.

thanks,

Simon
Minidump.zip
WindowsDebugging.txt
SOLUTION
Avatar of Sid_F
Sid_F

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of letooth

ASKER

Red herring - on checking the event viewer (thanks) I found that the APC Powerchute software was prematurely shutting down the server (server moved to lab and no longer connected to configured UPS).

Uninstalled Powerchute and we are back to the same UNEXPECTED_KERNEL_MODE_TRAP BSOD.

I've attached the system and application log error and warning entries but nothing to my uneducated eye gives a hint towards which driver could be at fault.

BTW - I haven't updated any drivers recently and WSUS is set not to download drivers from Windows Update.
system-log.txt
application-log.txt
Avatar of Sid_F
Sid_F

Before uninstalling the powerchute software I would ask the question why was it shutting down the server, there should also be some indication of this in the powerchute logs. however as its removed lets deal with the current issue

I presume you are able to boot the server in safe mode ok? if so then go to start run- msconfig and disable all start up services, does the server now boot?
if so look closer at the services that are disabled, it will be a little process of elimination. le
Avatar of letooth

ASKER

thanks - will do but server does boot normally - just crashes after 5 - 10 minutes whether left at log in screen or logged in.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of letooth

ASKER

Thanks. Following your suggestions I rechecked the windows debugger of Memory,dmp and found that I had not analysed it properly. Proper analysis told me the driver causing the default! Driver in error was BackupAssist Service. I disabled this service in msconfig in safe mode as suggested and server is now stable in normal mode. Of course I still need to address the BackupAssist problem but that is another issue.

Although improbable, Just in case someone else has the same issue I've attached the windows debugger results for information.

cheers,

Simon
win-dbg.txt