asked on

Windows Server 2003 SBS SP2 BSOD ntkrpamp

Hi
We have a Windows SBS 2003 SP2 on a Dell PE1900 which had a few BSODs recently.
I have run windbg for crashes on 07/01/2013 and 05/30/2013 and both point to ntkrpamp.exe but both have different strings.

Controller is Perc 5/i with RAID5
Dumps are attached.

I ran debug with Analyze and then lmnt:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [G:\Mini070113-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\WindbgSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.120411-0334
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Jul 1 20:01:39.674 2013 (UTC - 4:00)
System Uptime: 0 days 4:12:27.351
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, d0000002, 0, 8080f5f3}

Probably caused by : ntkrpamp.exe ( nt!CcFlushCache+a3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8080f5f3, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004 mov eax,dword ptr [eax+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: f78d2c1c -- (.trap 0xfffffffff78d2c1c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=808b4000 edx=00000000 esi=8734bd2c edi=00000000
eip=8080f5f3 esp=f78d2c90 ebp=f78d2cfc iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CcFlushCache+0xa3:
8080f5f3 8b4004 mov eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8080f5f3 to 8088c9fb

STACK_TEXT:
f78d2c1c 8080f5f3 badb0d00 00000000 8b4697e0 nt!KiTrap0E+0x2a7
f78d2cfc 8080fc6f 8a1fa55c 00000000 00000001 nt!CcFlushCache+0xa3
f78d2d40 808127ba 8b57fc10 808ae5c0 8b577100 nt!CcWriteBehind+0x11b
f78d2d80 808804ab 8b577100 00000000 8b57fc10 nt!CcWorkerThread+0x15a
f78d2dac 80949c7a 8b577100 00000000 00000000 nt!ExpWorkerThread+0xeb
f78d2ddc 8088e0f2 808803c0 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004 mov eax,dword ptr [eax+4]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!CcFlushCache+a3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4f857c1d

FAILURE_BUCKET_ID: 0xA_nt!CcFlushCache+a3

BUCKET_ID: 0xA_nt!CcFlushCache+a3

Followup: MachineOwner
---------

1: kd> lmnt
start end module name
80800000 80a5a000 nt ntkrpamp.exe Wed Apr 11 08:42:05 2012 (4F857C1D)
80a5a000 80a86000 hal halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b6306000 b6330000 Fastfat Fastfat.SYS Sat Feb 17 01:27:55 2007 (45D6A06B)
b67b8000 b67e3000 RDPWD RDPWD.SYS Fri Jun 24 09:05:10 2011 (4E048B86)
b72fb000 b735a000 IDSxpx86 IDSxpx86.sys Tue Aug 28 22:48:13 2012 (503D82ED)
b7906000 b7908d00 wdcsam wdcsam.sys Wed Apr 16 04:27:02 2008 (4805B856)
b8282000 b828d000 TDTCP TDTCP.SYS Sat Feb 17 00:44:32 2007 (45D69640)
b852a000 b8558000 sfmsrv sfmsrv.sys Sat Feb 17 00:59:53 2007 (45D699D9)
b8840000 b884a000 LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:22 2008 (487B7E2E)
b8878000 b88c9000 HTTP HTTP.sys Wed Apr 14 13:37:09 2010 (4BC5FD45)
b8c39000 b8c55c00 VirtFile VirtFile.sys Wed Aug 24 11:42:47 2011 (4E551BF7)
b8ed6000 b8f3a000 srv srv.sys Thu Feb 17 11:58:17 2011 (4D5D53A9)
b8f62000 b8f95000 mrxdav mrxdav.sys Mon Dec 17 05:49:07 2007 (47665423)
b90fd000 b912b000 sfmatalk sfmatalk.sys Sat Feb 17 00:59:55 2007 (45D699DB)
b91dd000 b920ce60 exifs exifs.sys Thu Aug 25 20:29:05 2005 (430E6251)
b9235000 b926f000 CpsFsJnl CpsFsJnl.sys Tue Sep 15 07:45:46 2009 (4AAF7E6A)
b92f7000 b9301000 ndisuio ndisuio.sys Sat Feb 17 00:58:25 2007 (45D69981)
b93af000 b93c4000 Cdfs Cdfs.SYS Sat Feb 17 01:27:08 2007 (45D6A03C)
b93ec000 b94e4000 BHDrvx86 BHDrvx86.sys Mon May 20 15:17:36 2013 (519A76D0)
b94e4000 b9543000 eeCtrl eeCtrl.sys Tue Jul 31 19:33:30 2012 (50186B4A)
b9543000 b9554000 Fips Fips.SYS Sat Feb 17 01:26:33 2007 (45D6A019)
b9554000 b95ca000 mrxsmb mrxsmb.sys Wed Jul 06 10:34:54 2011 (4E14728E)
b95ca000 b95fa000 rdbss rdbss.sys Wed Feb 24 10:54:03 2010 (4B854B9B)
b96ea000 b9714000 afd afd.sys Tue Dec 27 09:11:19 2011 (4EF9D207)
b9714000 b9745000 netbt netbt.sys Sat Feb 17 01:28:57 2007 (45D6A0A9)
b97a4000 b97fcd00 SYMTDI SYMTDI.SYS Fri Mar 09 17:55:26 2012 (4F5A8A5E)
b9825000 b98b9000 tcpip tcpip.sys Sat Aug 15 05:53:38 2009 (4A8685A2)
b98b9000 b98d2000 ipsec ipsec.sys Sat Feb 17 01:29:28 2007 (45D6A0C8)
b98f2000 b9907000 NAVENG NAVENG.SYS Fri Apr 26 01:27:07 2013 (517A102B)
b9907000 b9a8ec80 NAVEX15 NAVEX15.SYS Fri Apr 26 01:25:25 2013 (517A0FC5)
b9a8f000 b9ab9000 SYMEVENT SYMEVENT.SYS Tue Nov 22 13:30:26 2011 (4ECBEA42)
b9ab9000 b9add000 Ironx86 Ironx86.SYS Fri Sep 09 19:24:24 2011 (4E6AA028)
b9b0d000 b9b17000 dump_percsas dump_percsas.sys Fri Jun 08 13:15:54 2007 (46698ECA)
b9b1d000 b9b27000 dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
b9b3d000 b9b4b000 msgpc msgpc.sys Sat Feb 17 00:58:37 2007 (45D6998D)
b9b4d000 b9b5a000 Npfs Npfs.SYS Sat Feb 17 00:50:36 2007 (45D697AC)
b9b5d000 b9b68000 Msfs Msfs.SYS Sat Feb 17 00:50:33 2007 (45D697A9)
b9b6d000 b9b79000 vga vga.sys Sat Feb 17 01:10:30 2007 (45D69C56)
b9b7d000 b9c05000 SRTSP SRTSP.SYS Thu Mar 01 13:40:52 2012 (4F4FC2B4)
b9c05000 b9c1a000 usbhub usbhub.sys Sat Feb 17 01:13:05 2007 (45D69CF1)
b9c82000 b9ce1000 update update.sys Mon May 28 08:15:16 2007 (465AC7D4)
b9ce1000 b9cfd380 teefer teefer.sys Tue Aug 16 05:24:45 2011 (4E4A375D)
b9d1e000 b9d2b000 wanarp wanarp.sys Sat Feb 17 00:59:17 2007 (45D699B5)
b9d2e000 b9d39000 dcdbas32 dcdbas32.sys Tue Aug 07 17:33:21 2007 (46B8E521)
b9d4e000 b9d57000 kbdhid kbdhid.sys Sat Feb 17 01:05:42 2007 (45D69B36)
b9d7e000 b9d87000 mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
b9d8e000 b9d9c000 HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
b9d9e000 b9dd5000 rdpdr rdpdr.sys Sat Feb 17 00:51:00 2007 (45D697C4)
b9dd5000 b9de7000 raspptp raspptp.sys Sat Feb 17 01:29:20 2007 (45D6A0C0)
b9de7000 b9e00000 ndiswan ndiswan.sys Sat Feb 17 01:29:22 2007 (45D6A0C2)
b9e00000 b9e14000 rasl2tp rasl2tp.sys Sat Feb 17 01:29:02 2007 (45D6A0AE)
b9e14000 b9e3b000 ks ks.sys Sat Feb 17 01:30:40 2007 (45D6A110)
b9e3b000 b9e4f000 redbook redbook.sys Sat Feb 17 01:07:26 2007 (45D69B9E)
b9e4f000 b9e64000 cdrom cdrom.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
b9e64000 b9e79000 serial serial.sys Sat Feb 17 01:06:46 2007 (45D69B76)
b9e79000 b9e95000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
b9e95000 b9ffd000 ati2mtag ati2mtag.sys Wed Apr 05 23:03:52 2006 (44348518)
b9ffd000 ba027000 USBPORT USBPORT.SYS Sat Feb 17 01:12:59 2007 (45D69CEB)
ba027000 ba098000 Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
ba098000 ba100000 bxvbdx bxvbdx.sys Fri Aug 10 20:12:01 2007 (46BCFED1)
ba100000 ba142000 e1e5132 e1e5132.sys Thu Jun 14 15:15:06 2007 (467193BA)
ba162000 ba16a000 mouhid mouhid.sys Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba16a000 ba170300 HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
ba18a000 ba191000 dxgthk dxgthk.sys Tue Mar 25 03:05:52 2003 (3E7FFFD0)
bad6d000 bad7c000 intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
bad7d000 bad8c000 raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
bad9d000 bada8000 fdc fdc.sys Sat Feb 17 01:07:16 2007 (45D69B94)
badad000 badb6000 hidusb hidusb.sys Tue Mar 25 03:10:17 2003 (3E8000D9)
badbd000 badc7000 Dxapi Dxapi.sys Tue Mar 25 03:06:01 2003 (3E7FFFD9)
badcd000 baddb000 imapi imapi.sys Sat Feb 17 01:08:22 2007 (45D69BD6)
baded000 badfb000 NDProxy NDProxy.SYS Wed Nov 03 09:25:59 2010 (4CD162E7)
bae49000 bae4c500 scsichng scsichng.sys Thu Aug 23 22:59:47 2007 (46CE49A3)
baea5000 baec4000 Mup Mup.sys Tue Apr 12 15:05:46 2011 (4DA4A28A)
baec4000 baf03000 NDIS NDIS.sys Sat Feb 17 01:28:49 2007 (45D6A0A1)
baf03000 baf98000 Ntfs Ntfs.sys Sat Feb 17 01:27:23 2007 (45D6A04B)
bf800000 bf9d3000 win32k win32k.sys Wed Apr 11 10:38:23 2012 (4F85975F)
bf9d3000 bf9ea000 dxg dxg.sys Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9ea000 bfa2d000 ati2dvag ati2dvag.dll Wed Apr 05 23:04:15 2006 (4434852F)
bfa2d000 bfa6c000 ati2cqag ati2cqag.dll Wed Apr 05 21:57:18 2006 (4434757E)
bfa6c000 bfaa2000 atikvmag atikvmag.dll Wed Apr 05 22:25:29 2006 (44347C19)
bfaa2000 bfd2c0c0 ati3duag ati3duag.dll Wed Apr 05 22:47:35 2006 (44348147)
bfd2d000 bfe41180 ativvaxx ativvaxx.dll Wed Apr 05 22:40:57 2006 (44347FB9)
bfe42000 bfe8d000 ATMFD ATMFD.DLL Tue Feb 15 08:19:22 2011 (4D5A7D5A)
bff60000 bff7e000 RDPDD RDPDD.dll Sat Feb 17 09:01:19 2007 (45D70AAF)
f7206000 f722b000 fltMgr fltMgr.sys Sat Feb 17 00:51:08 2007 (45D697CC)
f722b000 f723e000 CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f723e000 f725d000 SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f725d000 f7284000 adpu320 adpu320.sys Wed Mar 07 13:43:42 2007 (45EF07DE)
f7284000 f72a2000 storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72a2000 f72bf000 atapi atapi.sys Sat Feb 17 01:07:34 2007 (45D69BA6)
f72bf000 f72e9000 volsnap volsnap.sys Sat Feb 17 01:08:23 2007 (45D69BD7)
f72e9000 f7315000 dmio dmio.sys Sat Feb 17 01:10:44 2007 (45D69C64)
f7315000 f733c000 ftdisk ftdisk.sys Sat Feb 17 01:08:05 2007 (45D69BC5)
f733c000 f7352000 pci pci.sys Sat Feb 17 00:59:03 2007 (45D699A7)
f7352000 f7386000 ACPI ACPI.sys Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 01:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74d7000 f74e1000 percsas percsas.sys Fri Jun 08 13:15:54 2007 (46698ECA)
f74e7000 f74f7000 disk disk.sys Sat Feb 17 01:07:51 2007 (45D69BB7)
f74f7000 f7503000 Dfs Dfs.sys Sat Feb 17 00:51:17 2007 (45D697D5)
f7507000 f7512000 ptilink ptilink.sys Sat Feb 17 01:06:38 2007 (45D69B6E)
f7517000 f7521000 crcdisk crcdisk.sys Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574a60 SCDEmu SCDEmu.SYS Mon Apr 12 04:44:34 2010 (4BC2DD72)
f7577000 f7586000 termdd termdd.sys Sat Feb 17 00:44:32 2007 (45D69640)
f75a7000 f75b2000 kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f75d7000 f75e0000 raspti raspti.sys Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f1000 serenum serenum.sys Sat Feb 17 01:06:44 2007 (45D69B74)
f75f7000 f7601000 mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7607000 f7612000 TDI TDI.SYS Sat Feb 17 01:01:19 2007 (45D69A2F)
f7617000 f7624000 netbios netbios.sys Sat Feb 17 00:58:29 2007 (45D69985)
f7627000 f7630000 watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f7647000 f7650000 ndistapi ndistapi.sys Fri Jul 08 10:08:19 2011 (4E170F53)
f7657000 f7663000 USBSTOR USBSTOR.SYS Sat Feb 17 01:13:05 2007 (45D69CF1)
f7667000 f766f680 04mmdat 04mmdat.sys Tue Feb 12 08:35:47 2008 (47B1A0B3)
f7677000 f7685000 WDFLDR WDFLDR.SYS Mon Jul 13 19:11:25 2009 (4A5BBF1D)
f7687000 f7693c80 GenericMount GenericMount.sys Mon Jan 18 08:49:10 2010 (4B5466D6)
f76b7000 f76c7000 SRTSPX SRTSPX.SYS Thu Mar 01 13:40:59 2012 (4F4FC2BB)
f76e6000 f7706b00 symsnap symsnap.sys Mon Jun 21 11:37:35 2010 (4C1F873F)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 03:08:08 2003 (3E800058)
f773f000 f7744280 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
f7757000 f775db80 usbehci usbehci.sys Sat Feb 17 01:12:56 2007 (45D69CE8)
f775f000 f7764180 usbuhci usbuhci.sys Sat Feb 17 01:13:02 2007 (45D69CEE)
f7777000 f777f000 audstub audstub.sys Tue Mar 25 03:09:12 2003 (3E800098)
f77c7000 f77cf000 Fs_Rec Fs_Rec.SYS Tue Mar 25 03:08:36 2003 (3E800074)
f77cf000 f77d6000 Null Null.SYS Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77d7000 f77de000 Beep Beep.SYS Tue Mar 25 03:03:04 2003 (3E7FFF28)
f77df000 f77e7000 mnmdd mnmdd.SYS Tue Mar 25 03:07:53 2003 (3E800049)
f77e7000 f77ef000 RDPCDD RDPCDD.sys Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77ef000 f77f7000 rasacd rasacd.sys Tue Mar 25 03:11:50 2003 (3E800136)
f781f000 f7824680 tpfilter tpfilter.sys Thu May 13 15:49:52 2010 (4BEC57E0)
f7840000 f7897000 SYMDS SYMDS.SYS Thu Apr 28 18:39:23 2011 (4DB9EC9B)
f7897000 f7899980 compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900 BATTC BATTC.SYS Sat Feb 17 00:58:46 2007 (45D69996)
f7961000 f7987000 KSecDD KSecDD.sys Mon Jun 15 13:45:11 2009 (4A3688A7)
f7995000 f7996680 RaInfo RaInfo.sys Fri Jan 11 04:20:41 2013 (50EFD969)
f79ad000 f79ae280 swenum swenum.sys Sat Feb 17 01:05:56 2007 (45D69B44)
f79af000 f79b0580 USBD USBD.SYS Tue Mar 25 03:10:39 2003 (3E8000EF)
f7a7a000 f7a7ac80 lmimirr lmimirr.sys Tue Apr 10 18:32:11 2007 (461C106B)
f7b20000 f7bdf000 SYMEFA SYMEFA.SYS Wed Feb 22 12:38:08 2012 (4F452800)

Unloaded modules:
b9745000 b97a4000 IDSxpx86.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0005F000
b98df000 b98f2000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
ba182000 ba18a000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00008000
f7567000 f7571000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000A000
f7507000 f7515000 WDFLDR.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
baf98000 bb000000 bxvbdx.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00068000
Mini053013-01.dmp
Mini070113-01.dmp

ASKER CERTIFIED SOLUTION

Davis McCarn

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

compsupport

ASKER

We have removed the Network Threat Protection and so far so good.
We did suspect something related to Symantec but we also have Symantec Mail Security on this server but thanks for pointing us to Endpoint.