compsupport
asked on
Windows Server 2003 SBS SP2 BSOD ntkrpamp
Hi
We have a Windows SBS 2003 SP2 on a Dell PE1900 which had a few BSODs recently.
I have run windbg for crashes on 07/01/2013 and 05/30/2013 and both point to ntkrpamp.exe but both have different strings.
Controller is Perc 5/i with RAID5
Dumps are attached.
I ran debug with Analyze and then lmnt:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\Mini070113-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\WindbgSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.120411- 0334
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Jul  1 20:01:39.674 2013 (UTC - 4:00)
System Uptime: 0 days 4:12:27.351
Loading Kernel Symbols
.......................... .......... .......... .......... .......
.......................... .......... .......... .......... ........
.................
Loading User Symbols
Loading unloaded module list
......
************************** ********** ********** ********** ********** ********** ***
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
*             Bugcheck Analysis                   *
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
************************** ********** ********** ********** ********** ********** ***
Use !analyze -v to get detailed debugging information.
BugCheck A, {4, d0000002, 0, 8080f5f3}
Probably caused by : ntkrpamp.exe ( nt!CcFlushCache+a3 )
Followup: MachineOwner
---------
1: kd> !analyze -v
************************** ********** ********** ********** ********** ********** ***
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
*             Bugcheck Analysis                   *
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
************************** ********** ********** ********** ********** ********** ***
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. Â This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8080f5f3, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: Â 00000004
CURRENT_IRQL: Â 2
FAULTING_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004      mov   eax,dword ptr [eax+4]
CUSTOMER_CRASH_COUNT: Â 1
DEFAULT_BUCKET_ID: Â DRIVER_FAULT_SERVER_MINIDU MP
BUGCHECK_STR: Â 0xA
PROCESS_NAME: Â System
TRAP_FRAME: Â f78d2c1c -- (.trap 0xfffffffff78d2c1c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=808b4000 edx=00000000 esi=8734bd2c edi=00000000
eip=8080f5f3 esp=f78d2c90 ebp=f78d2cfc iopl=0 Â Â Â Â nv up ei pl zr na pe nc
cs=0008 Â ss=0010 Â ds=0023 Â es=0023 Â fs=0030 Â gs=0000 Â Â Â Â Â Â efl=00010246
nt!CcFlushCache+0xa3:
8080f5f3 8b4004      mov   eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope
LAST_CONTROL_TRANSFER: Â from 8080f5f3 to 8088c9fb
STACK_TEXT: Â
f78d2c1c 8080f5f3 badb0d00 00000000 8b4697e0 nt!KiTrap0E+0x2a7
f78d2cfc 8080fc6f 8a1fa55c 00000000 00000001 nt!CcFlushCache+0xa3
f78d2d40 808127ba 8b57fc10 808ae5c0 8b577100 nt!CcWriteBehind+0x11b
f78d2d80 808804ab 8b577100 00000000 8b57fc10 nt!CcWorkerThread+0x15a
f78d2dac 80949c7a 8b577100 00000000 00000000 nt!ExpWorkerThread+0xeb
f78d2ddc 8088e0f2 808803c0 00000000 00000000 nt!PspSystemThreadStartup+ 0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: Â kb
FOLLOWUP_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004      mov   eax,dword ptr [eax+4]
SYMBOL_STACK_INDEX: Â 1
SYMBOL_NAME: Â nt!CcFlushCache+a3
FOLLOWUP_NAME: Â MachineOwner
MODULE_NAME: nt
IMAGE_NAME: Â ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: Â 4f857c1d
FAILURE_BUCKET_ID: Â 0xA_nt!CcFlushCache+a3
BUCKET_ID: Â 0xA_nt!CcFlushCache+a3
Followup: MachineOwner
---------
1: kd> lmnt
start   end     module name
80800000 80a5a000  nt    ntkrpamp.exe Wed Apr 11 08:42:05 2012 (4F857C1D)
80a5a000 80a86000  hal    halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b6306000 b6330000  Fastfat  Fastfat.SYS  Sat Feb 17 01:27:55 2007 (45D6A06B)
b67b8000 b67e3000 Â RDPWD Â Â RDPWD.SYS Â Â Fri Jun 24 09:05:10 2011 (4E048B86)
b72fb000 b735a000 Â IDSxpx86 IDSxpx86.sys Tue Aug 28 22:48:13 2012 (503D82ED)
b7906000 b7908d00  wdcsam  wdcsam.sys  Wed Apr 16 04:27:02 2008 (4805B856)
b8282000 b828d000 Â TDTCP Â Â TDTCP.SYS Â Â Sat Feb 17 00:44:32 2007 (45D69640)
b852a000 b8558000  sfmsrv  sfmsrv.sys  Sat Feb 17 00:59:53 2007 (45D699D9)
b8840000 b884a000 Â LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:22 2008 (487B7E2E)
b8878000 b88c9000  HTTP   HTTP.sys   Wed Apr 14 13:37:09 2010 (4BC5FD45)
b8c39000 b8c55c00 Â VirtFile VirtFile.sys Wed Aug 24 11:42:47 2011 (4E551BF7)
b8ed6000 b8f3a000  srv    srv.sys    Thu Feb 17 11:58:17 2011 (4D5D53A9)
b8f62000 b8f95000  mrxdav  mrxdav.sys  Mon Dec 17 05:49:07 2007 (47665423)
b90fd000 b912b000 Â sfmatalk sfmatalk.sys Sat Feb 17 00:59:55 2007 (45D699DB)
b91dd000 b920ce60  exifs   exifs.sys   Thu Aug 25 20:29:05 2005 (430E6251)
b9235000 b926f000 Â CpsFsJnl CpsFsJnl.sys Tue Sep 15 07:45:46 2009 (4AAF7E6A)
b92f7000 b9301000  ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
b93af000 b93c4000  Cdfs   Cdfs.SYS   Sat Feb 17 01:27:08 2007 (45D6A03C)
b93ec000 b94e4000 Â BHDrvx86 BHDrvx86.sys Mon May 20 15:17:36 2013 (519A76D0)
b94e4000 b9543000  eeCtrl  eeCtrl.sys  Tue Jul 31 19:33:30 2012 (50186B4A)
b9543000 b9554000  Fips   Fips.SYS   Sat Feb 17 01:26:33 2007 (45D6A019)
b9554000 b95ca000  mrxsmb  mrxsmb.sys  Wed Jul 06 10:34:54 2011 (4E14728E)
b95ca000 b95fa000  rdbss   rdbss.sys   Wed Feb 24 10:54:03 2010 (4B854B9B)
b96ea000 b9714000  afd    afd.sys    Tue Dec 27 09:11:19 2011 (4EF9D207)
b9714000 b9745000  netbt   netbt.sys   Sat Feb 17 01:28:57 2007 (45D6A0A9)
b97a4000 b97fcd00 Â SYMTDI Â SYMTDI.SYS Â Fri Mar 09 17:55:26 2012 (4F5A8A5E)
b9825000 b98b9000  tcpip   tcpip.sys   Sat Aug 15 05:53:38 2009 (4A8685A2)
b98b9000 b98d2000  ipsec   ipsec.sys   Sat Feb 17 01:29:28 2007 (45D6A0C8)
b98f2000 b9907000 Â NAVENG Â NAVENG.SYS Â Fri Apr 26 01:27:07 2013 (517A102B)
b9907000 b9a8ec80 Â NAVEX15 Â NAVEX15.SYS Â Fri Apr 26 01:25:25 2013 (517A0FC5)
b9a8f000 b9ab9000 Â SYMEVENT SYMEVENT.SYS Tue Nov 22 13:30:26 2011 (4ECBEA42)
b9ab9000 b9add000 Â Ironx86 Â Ironx86.SYS Â Fri Sep 09 19:24:24 2011 (4E6AA028)
b9b0d000 b9b17000 Â dump_percsas dump_percsas.sys Fri Jun 08 13:15:54 2007 (46698ECA)
b9b1d000 b9b27000 Â dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
b9b3d000 b9b4b000  msgpc   msgpc.sys   Sat Feb 17 00:58:37 2007 (45D6998D)
b9b4d000 b9b5a000  Npfs   Npfs.SYS   Sat Feb 17 00:50:36 2007 (45D697AC)
b9b5d000 b9b68000  Msfs   Msfs.SYS   Sat Feb 17 00:50:33 2007 (45D697A9)
b9b6d000 b9b79000  vga    vga.sys    Sat Feb 17 01:10:30 2007 (45D69C56)
b9b7d000 b9c05000 Â SRTSP Â Â SRTSP.SYS Â Â Thu Mar 01 13:40:52 2012 (4F4FC2B4)
b9c05000 b9c1a000  usbhub  usbhub.sys  Sat Feb 17 01:13:05 2007 (45D69CF1)
b9c82000 b9ce1000  update  update.sys  Mon May 28 08:15:16 2007 (465AC7D4)
b9ce1000 b9cfd380  teefer  teefer.sys  Tue Aug 16 05:24:45 2011 (4E4A375D)
b9d1e000 b9d2b000  wanarp  wanarp.sys  Sat Feb 17 00:59:17 2007 (45D699B5)
b9d2e000 b9d39000 Â dcdbas32 dcdbas32.sys Tue Aug 07 17:33:21 2007 (46B8E521)
b9d4e000 b9d57000  kbdhid  kbdhid.sys  Sat Feb 17 01:05:42 2007 (45D69B36)
b9d7e000 b9d87000 Â mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
b9d8e000 b9d9c000 Â HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
b9d9e000 b9dd5000  rdpdr   rdpdr.sys   Sat Feb 17 00:51:00 2007 (45D697C4)
b9dd5000 b9de7000  raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
b9de7000 b9e00000  ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
b9e00000 b9e14000  rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
b9e14000 b9e3b000  ks    ks.sys    Sat Feb 17 01:30:40 2007 (45D6A110)
b9e3b000 b9e4f000  redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
b9e4f000 b9e64000  cdrom   cdrom.sys   Sat Feb 17 01:07:48 2007 (45D69BB4)
b9e64000 b9e79000  serial  serial.sys  Sat Feb 17 01:06:46 2007 (45D69B76)
b9e79000 b9e95000 Â VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
b9e95000 b9ffd000 Â ati2mtag ati2mtag.sys Wed Apr 05 23:03:52 2006 (44348518)
b9ffd000 ba027000 Â USBPORT Â USBPORT.SYS Â Sat Feb 17 01:12:59 2007 (45D69CEB)
ba027000 ba098000 Â Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
ba098000 ba100000  bxvbdx  bxvbdx.sys  Fri Aug 10 20:12:01 2007 (46BCFED1)
ba100000 ba142000  e1e5132  e1e5132.sys  Thu Jun 14 15:15:06 2007 (467193BA)
ba162000 ba16a000  mouhid  mouhid.sys  Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba16a000 ba170300 Â HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
ba18a000 ba191000  dxgthk  dxgthk.sys  Tue Mar 25 03:05:52 2003 (3E7FFFD0)
bad6d000 bad7c000 Â intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
bad7d000 bad8c000 Â raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
bad9d000 bada8000  fdc    fdc.sys    Sat Feb 17 01:07:16 2007 (45D69B94)
badad000 badb6000  hidusb  hidusb.sys  Tue Mar 25 03:10:17 2003 (3E8000D9)
badbd000 badc7000  Dxapi   Dxapi.sys   Tue Mar 25 03:06:01 2003 (3E7FFFD9)
badcd000 baddb000  imapi   imapi.sys   Sat Feb 17 01:08:22 2007 (45D69BD6)
baded000 badfb000  NDProxy  NDProxy.SYS  Wed Nov 03 09:25:59 2010 (4CD162E7)
bae49000 bae4c500 Â scsichng scsichng.sys Thu Aug 23 22:59:47 2007 (46CE49A3)
baea5000 baec4000  Mup    Mup.sys    Tue Apr 12 15:05:46 2011 (4DA4A28A)
baec4000 baf03000  NDIS   NDIS.sys   Sat Feb 17 01:28:49 2007 (45D6A0A1)
baf03000 baf98000  Ntfs   Ntfs.sys   Sat Feb 17 01:27:23 2007 (45D6A04B)
bf800000 bf9d3000  win32k  win32k.sys  Wed Apr 11 10:38:23 2012 (4F85975F)
bf9d3000 bf9ea000  dxg    dxg.sys    Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9ea000 bfa2d000 Â ati2dvag ati2dvag.dll Wed Apr 05 23:04:15 2006 (4434852F)
bfa2d000 bfa6c000 Â ati2cqag ati2cqag.dll Wed Apr 05 21:57:18 2006 (4434757E)
bfa6c000 bfaa2000 Â atikvmag atikvmag.dll Wed Apr 05 22:25:29 2006 (44347C19)
bfaa2000 bfd2c0c0 Â ati3duag ati3duag.dll Wed Apr 05 22:47:35 2006 (44348147)
bfd2d000 bfe41180 Â ativvaxx ativvaxx.dll Wed Apr 05 22:40:57 2006 (44347FB9)
bfe42000 bfe8d000 Â ATMFD Â Â ATMFD.DLL Â Â Tue Feb 15 08:19:22 2011 (4D5A7D5A)
bff60000 bff7e000  RDPDD   RDPDD.dll   Sat Feb 17 09:01:19 2007 (45D70AAF)
f7206000 f722b000  fltMgr  fltMgr.sys  Sat Feb 17 00:51:08 2007 (45D697CC)
f722b000 f723e000 Â CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f723e000 f725d000 Â SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f725d000 f7284000  adpu320  adpu320.sys  Wed Mar 07 13:43:42 2007 (45EF07DE)
f7284000 f72a2000 Â storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72a2000 f72bf000  atapi   atapi.sys   Sat Feb 17 01:07:34 2007 (45D69BA6)
f72bf000 f72e9000  volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f72e9000 f7315000  dmio   dmio.sys   Sat Feb 17 01:10:44 2007 (45D69C64)
f7315000 f733c000  ftdisk  ftdisk.sys  Sat Feb 17 01:08:05 2007 (45D69BC5)
f733c000 f7352000  pci    pci.sys    Sat Feb 17 00:59:03 2007 (45D699A7)
f7352000 f7386000  ACPI   ACPI.sys   Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000 Â WMILIB Â WMILIB.SYS Â Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000  isapnp  isapnp.sys  Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000 Â PCIIDEX Â PCIIDEX.SYS Â Sat Feb 17 01:07:32 2007 (45D69BA4)
f74b7000 f74c7000 Â MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74c7000 f74d2000  PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74d7000 f74e1000  percsas  percsas.sys  Fri Jun 08 13:15:54 2007 (46698ECA)
f74e7000 f74f7000  disk   disk.sys   Sat Feb 17 01:07:51 2007 (45D69BB7)
f74f7000 f7503000  Dfs    Dfs.sys    Sat Feb 17 00:51:17 2007 (45D697D5)
f7507000 f7512000  ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f7517000 f7521000  crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574a60  SCDEmu  SCDEmu.SYS  Mon Apr 12 04:44:34 2010 (4BC2DD72)
f7577000 f7586000  termdd  termdd.sys  Sat Feb 17 00:44:32 2007 (45D69640)
f75a7000 f75b2000 Â kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f75d7000 f75e0000  raspti  raspti.sys  Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f1000  serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
f75f7000 f7601000 Â mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7607000 f7612000 Â TDI Â Â Â TDI.SYS Â Â Â Sat Feb 17 01:01:19 2007 (45D69A2F)
f7617000 f7624000  netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
f7627000 f7630000 Â watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f7647000 f7650000 Â ndistapi ndistapi.sys Fri Jul 08 10:08:19 2011 (4E170F53)
f7657000 f7663000 Â USBSTOR Â USBSTOR.SYS Â Sat Feb 17 01:13:05 2007 (45D69CF1)
f7667000 f766f680  04mmdat  04mmdat.sys  Tue Feb 12 08:35:47 2008 (47B1A0B3)
f7677000 f7685000 Â WDFLDR Â WDFLDR.SYS Â Mon Jul 13 19:11:25 2009 (4A5BBF1D)
f7687000 f7693c80 Â GenericMount GenericMount.sys Mon Jan 18 08:49:10 2010 (4B5466D6)
f76b7000 f76c7000 Â SRTSPX Â SRTSPX.SYS Â Thu Mar 01 13:40:59 2012 (4F4FC2BB)
f76e6000 f7706b00  symsnap  symsnap.sys  Mon Jun 21 11:37:35 2010 (4C1F873F)
f7707000 f770f000  kdcom   kdcom.dll   Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000  BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000  pciide  pciide.sys  Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000  dmload  dmload.sys  Tue Mar 25 03:08:08 2003 (3E800058)
f773f000 f7744280 Â GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
f7757000 f775db80  usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
f775f000 f7764180  usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f7777000 f777f000  audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f77c7000 f77cf000  Fs_Rec  Fs_Rec.SYS  Tue Mar 25 03:08:36 2003 (3E800074)
f77cf000 f77d6000  Null   Null.SYS   Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77d7000 f77de000  Beep   Beep.SYS   Tue Mar 25 03:03:04 2003 (3E7FFF28)
f77df000 f77e7000  mnmdd   mnmdd.SYS   Tue Mar 25 03:07:53 2003 (3E800049)
f77e7000 f77ef000  RDPCDD  RDPCDD.sys  Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77ef000 f77f7000  rasacd  rasacd.sys  Tue Mar 25 03:11:50 2003 (3E800136)
f781f000 f7824680 Â tpfilter tpfilter.sys Thu May 13 15:49:52 2010 (4BEC57E0)
f7840000 f7897000 Â SYMDS Â Â SYMDS.SYS Â Â Thu Apr 28 18:39:23 2011 (4DB9EC9B)
f7897000 f7899980 Â compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900 Â BATTC Â Â BATTC.SYS Â Â Sat Feb 17 00:58:46 2007 (45D69996)
f7961000 f7987000  KSecDD  KSecDD.sys  Mon Jun 15 13:45:11 2009 (4A3688A7)
f7995000 f7996680  RaInfo  RaInfo.sys  Fri Jan 11 04:20:41 2013 (50EFD969)
f79ad000 f79ae280  swenum  swenum.sys  Sat Feb 17 01:05:56 2007 (45D69B44)
f79af000 f79b0580 Â USBD Â Â USBD.SYS Â Â Tue Mar 25 03:10:39 2003 (3E8000EF)
f7a7a000 f7a7ac80  lmimirr  lmimirr.sys  Tue Apr 10 18:32:11 2007 (461C106B)
f7b20000 f7bdf000 Â SYMEFA Â SYMEFA.SYS Â Wed Feb 22 12:38:08 2012 (4F452800)
Unloaded modules:
b9745000 b97a4000 Â IDSxpx86.sys
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0005F000
b98df000 b98f2000 Â i8042prt.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00013000
ba182000 ba18a000 Â Sfloppy.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00008000
f7567000 f7571000 Â Flpydisk.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0000A000
f7507000 f7515000 Â WDFLDR.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0000E000
baf98000 bb000000 Â bxvbdx.sys
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00068000
Mini053013-01.dmp
Mini070113-01.dmp
We have a Windows SBS 2003 SP2 on a Dell PE1900 which had a few BSODs recently.
I have run windbg for crashes on 07/01/2013 and 05/30/2013 and both point to ntkrpamp.exe but both have different strings.
Controller is Perc 5/i with RAID5
Dumps are attached.
I ran debug with Analyze and then lmnt:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\Mini070113-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\WindbgSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.120411-
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Jul  1 20:01:39.674 2013 (UTC - 4:00)
System Uptime: 0 days 4:12:27.351
Loading Kernel Symbols
..........................
..........................
.................
Loading User Symbols
Loading unloaded module list
......
**************************
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
*             Bugcheck Analysis                   *
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {4, d0000002, 0, 8080f5f3}
Probably caused by : ntkrpamp.exe ( nt!CcFlushCache+a3 )
Followup: MachineOwner
---------
1: kd> !analyze -v
**************************
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
*             Bugcheck Analysis                   *
* Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â *
**************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. Â This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8080f5f3, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: Â 00000004
CURRENT_IRQL: Â 2
FAULTING_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004      mov   eax,dword ptr [eax+4]
CUSTOMER_CRASH_COUNT: Â 1
DEFAULT_BUCKET_ID: Â DRIVER_FAULT_SERVER_MINIDU
BUGCHECK_STR: Â 0xA
PROCESS_NAME: Â System
TRAP_FRAME: Â f78d2c1c -- (.trap 0xfffffffff78d2c1c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=808b4000 edx=00000000 esi=8734bd2c edi=00000000
eip=8080f5f3 esp=f78d2c90 ebp=f78d2cfc iopl=0 Â Â Â Â nv up ei pl zr na pe nc
cs=0008 Â ss=0010 Â ds=0023 Â es=0023 Â fs=0030 Â gs=0000 Â Â Â Â Â Â efl=00010246
nt!CcFlushCache+0xa3:
8080f5f3 8b4004      mov   eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope
LAST_CONTROL_TRANSFER: Â from 8080f5f3 to 8088c9fb
STACK_TEXT: Â
f78d2c1c 8080f5f3 badb0d00 00000000 8b4697e0 nt!KiTrap0E+0x2a7
f78d2cfc 8080fc6f 8a1fa55c 00000000 00000001 nt!CcFlushCache+0xa3
f78d2d40 808127ba 8b57fc10 808ae5c0 8b577100 nt!CcWriteBehind+0x11b
f78d2d80 808804ab 8b577100 00000000 8b57fc10 nt!CcWorkerThread+0x15a
f78d2dac 80949c7a 8b577100 00000000 00000000 nt!ExpWorkerThread+0xeb
f78d2ddc 8088e0f2 808803c0 00000000 00000000 nt!PspSystemThreadStartup+
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: Â kb
FOLLOWUP_IP:
nt!CcFlushCache+a3
8080f5f3 8b4004      mov   eax,dword ptr [eax+4]
SYMBOL_STACK_INDEX: Â 1
SYMBOL_NAME: Â nt!CcFlushCache+a3
FOLLOWUP_NAME: Â MachineOwner
MODULE_NAME: nt
IMAGE_NAME: Â ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: Â 0xA_nt!CcFlushCache+a3
BUCKET_ID: Â 0xA_nt!CcFlushCache+a3
Followup: MachineOwner
---------
1: kd> lmnt
start   end     module name
80800000 80a5a000  nt    ntkrpamp.exe Wed Apr 11 08:42:05 2012 (4F857C1D)
80a5a000 80a86000  hal    halmacpi.dll Sat Feb 17 00:48:26 2007 (45D6972A)
b6306000 b6330000  Fastfat  Fastfat.SYS  Sat Feb 17 01:27:55 2007 (45D6A06B)
b67b8000 b67e3000 Â RDPWD Â Â RDPWD.SYS Â Â Fri Jun 24 09:05:10 2011 (4E048B86)
b72fb000 b735a000 Â IDSxpx86 IDSxpx86.sys Tue Aug 28 22:48:13 2012 (503D82ED)
b7906000 b7908d00  wdcsam  wdcsam.sys  Wed Apr 16 04:27:02 2008 (4805B856)
b8282000 b828d000 Â TDTCP Â Â TDTCP.SYS Â Â Sat Feb 17 00:44:32 2007 (45D69640)
b852a000 b8558000  sfmsrv  sfmsrv.sys  Sat Feb 17 00:59:53 2007 (45D699D9)
b8840000 b884a000 Â LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:22 2008 (487B7E2E)
b8878000 b88c9000  HTTP   HTTP.sys   Wed Apr 14 13:37:09 2010 (4BC5FD45)
b8c39000 b8c55c00 Â VirtFile VirtFile.sys Wed Aug 24 11:42:47 2011 (4E551BF7)
b8ed6000 b8f3a000  srv    srv.sys    Thu Feb 17 11:58:17 2011 (4D5D53A9)
b8f62000 b8f95000  mrxdav  mrxdav.sys  Mon Dec 17 05:49:07 2007 (47665423)
b90fd000 b912b000 Â sfmatalk sfmatalk.sys Sat Feb 17 00:59:55 2007 (45D699DB)
b91dd000 b920ce60  exifs   exifs.sys   Thu Aug 25 20:29:05 2005 (430E6251)
b9235000 b926f000 Â CpsFsJnl CpsFsJnl.sys Tue Sep 15 07:45:46 2009 (4AAF7E6A)
b92f7000 b9301000  ndisuio  ndisuio.sys  Sat Feb 17 00:58:25 2007 (45D69981)
b93af000 b93c4000  Cdfs   Cdfs.SYS   Sat Feb 17 01:27:08 2007 (45D6A03C)
b93ec000 b94e4000 Â BHDrvx86 BHDrvx86.sys Mon May 20 15:17:36 2013 (519A76D0)
b94e4000 b9543000  eeCtrl  eeCtrl.sys  Tue Jul 31 19:33:30 2012 (50186B4A)
b9543000 b9554000  Fips   Fips.SYS   Sat Feb 17 01:26:33 2007 (45D6A019)
b9554000 b95ca000  mrxsmb  mrxsmb.sys  Wed Jul 06 10:34:54 2011 (4E14728E)
b95ca000 b95fa000  rdbss   rdbss.sys   Wed Feb 24 10:54:03 2010 (4B854B9B)
b96ea000 b9714000  afd    afd.sys    Tue Dec 27 09:11:19 2011 (4EF9D207)
b9714000 b9745000  netbt   netbt.sys   Sat Feb 17 01:28:57 2007 (45D6A0A9)
b97a4000 b97fcd00 Â SYMTDI Â SYMTDI.SYS Â Fri Mar 09 17:55:26 2012 (4F5A8A5E)
b9825000 b98b9000  tcpip   tcpip.sys   Sat Aug 15 05:53:38 2009 (4A8685A2)
b98b9000 b98d2000  ipsec   ipsec.sys   Sat Feb 17 01:29:28 2007 (45D6A0C8)
b98f2000 b9907000 Â NAVENG Â NAVENG.SYS Â Fri Apr 26 01:27:07 2013 (517A102B)
b9907000 b9a8ec80 Â NAVEX15 Â NAVEX15.SYS Â Fri Apr 26 01:25:25 2013 (517A0FC5)
b9a8f000 b9ab9000 Â SYMEVENT SYMEVENT.SYS Tue Nov 22 13:30:26 2011 (4ECBEA42)
b9ab9000 b9add000 Â Ironx86 Â Ironx86.SYS Â Fri Sep 09 19:24:24 2011 (4E6AA028)
b9b0d000 b9b17000 Â dump_percsas dump_percsas.sys Fri Jun 08 13:15:54 2007 (46698ECA)
b9b1d000 b9b27000 Â dump_diskdump dump_diskdump.sys Sat Feb 17 01:07:44 2007 (45D69BB0)
b9b3d000 b9b4b000  msgpc   msgpc.sys   Sat Feb 17 00:58:37 2007 (45D6998D)
b9b4d000 b9b5a000  Npfs   Npfs.SYS   Sat Feb 17 00:50:36 2007 (45D697AC)
b9b5d000 b9b68000  Msfs   Msfs.SYS   Sat Feb 17 00:50:33 2007 (45D697A9)
b9b6d000 b9b79000  vga    vga.sys    Sat Feb 17 01:10:30 2007 (45D69C56)
b9b7d000 b9c05000 Â SRTSP Â Â SRTSP.SYS Â Â Thu Mar 01 13:40:52 2012 (4F4FC2B4)
b9c05000 b9c1a000  usbhub  usbhub.sys  Sat Feb 17 01:13:05 2007 (45D69CF1)
b9c82000 b9ce1000  update  update.sys  Mon May 28 08:15:16 2007 (465AC7D4)
b9ce1000 b9cfd380  teefer  teefer.sys  Tue Aug 16 05:24:45 2011 (4E4A375D)
b9d1e000 b9d2b000  wanarp  wanarp.sys  Sat Feb 17 00:59:17 2007 (45D699B5)
b9d2e000 b9d39000 Â dcdbas32 dcdbas32.sys Tue Aug 07 17:33:21 2007 (46B8E521)
b9d4e000 b9d57000  kbdhid  kbdhid.sys  Sat Feb 17 01:05:42 2007 (45D69B36)
b9d7e000 b9d87000 Â mssmbios mssmbios.sys Sat Feb 17 00:59:12 2007 (45D699B0)
b9d8e000 b9d9c000 Â HIDCLASS HIDCLASS.SYS Tue Mar 25 03:10:17 2003 (3E8000D9)
b9d9e000 b9dd5000  rdpdr   rdpdr.sys   Sat Feb 17 00:51:00 2007 (45D697C4)
b9dd5000 b9de7000  raspptp  raspptp.sys  Sat Feb 17 01:29:20 2007 (45D6A0C0)
b9de7000 b9e00000  ndiswan  ndiswan.sys  Sat Feb 17 01:29:22 2007 (45D6A0C2)
b9e00000 b9e14000  rasl2tp  rasl2tp.sys  Sat Feb 17 01:29:02 2007 (45D6A0AE)
b9e14000 b9e3b000  ks    ks.sys    Sat Feb 17 01:30:40 2007 (45D6A110)
b9e3b000 b9e4f000  redbook  redbook.sys  Sat Feb 17 01:07:26 2007 (45D69B9E)
b9e4f000 b9e64000  cdrom   cdrom.sys   Sat Feb 17 01:07:48 2007 (45D69BB4)
b9e64000 b9e79000  serial  serial.sys  Sat Feb 17 01:06:46 2007 (45D69B76)
b9e79000 b9e95000 Â VIDEOPRT VIDEOPRT.SYS Sat Feb 17 01:10:30 2007 (45D69C56)
b9e95000 b9ffd000 Â ati2mtag ati2mtag.sys Wed Apr 05 23:03:52 2006 (44348518)
b9ffd000 ba027000 Â USBPORT Â USBPORT.SYS Â Sat Feb 17 01:12:59 2007 (45D69CEB)
ba027000 ba098000 Â Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
ba098000 ba100000  bxvbdx  bxvbdx.sys  Fri Aug 10 20:12:01 2007 (46BCFED1)
ba100000 ba142000  e1e5132  e1e5132.sys  Thu Jun 14 15:15:06 2007 (467193BA)
ba162000 ba16a000  mouhid  mouhid.sys  Tue Mar 25 03:03:12 2003 (3E7FFF30)
ba16a000 ba170300 Â HIDPARSE HIDPARSE.SYS Sat Feb 17 01:12:35 2007 (45D69CD3)
ba18a000 ba191000  dxgthk  dxgthk.sys  Tue Mar 25 03:05:52 2003 (3E7FFFD0)
bad6d000 bad7c000 Â intelppm intelppm.sys Sat Feb 17 00:48:30 2007 (45D6972E)
bad7d000 bad8c000 Â raspppoe raspppoe.sys Sat Feb 17 00:59:23 2007 (45D699BB)
bad9d000 bada8000  fdc    fdc.sys    Sat Feb 17 01:07:16 2007 (45D69B94)
badad000 badb6000  hidusb  hidusb.sys  Tue Mar 25 03:10:17 2003 (3E8000D9)
badbd000 badc7000  Dxapi   Dxapi.sys   Tue Mar 25 03:06:01 2003 (3E7FFFD9)
badcd000 baddb000  imapi   imapi.sys   Sat Feb 17 01:08:22 2007 (45D69BD6)
baded000 badfb000  NDProxy  NDProxy.SYS  Wed Nov 03 09:25:59 2010 (4CD162E7)
bae49000 bae4c500 Â scsichng scsichng.sys Thu Aug 23 22:59:47 2007 (46CE49A3)
baea5000 baec4000  Mup    Mup.sys    Tue Apr 12 15:05:46 2011 (4DA4A28A)
baec4000 baf03000  NDIS   NDIS.sys   Sat Feb 17 01:28:49 2007 (45D6A0A1)
baf03000 baf98000  Ntfs   Ntfs.sys   Sat Feb 17 01:27:23 2007 (45D6A04B)
bf800000 bf9d3000  win32k  win32k.sys  Wed Apr 11 10:38:23 2012 (4F85975F)
bf9d3000 bf9ea000  dxg    dxg.sys    Sat Feb 17 01:14:39 2007 (45D69D4F)
bf9ea000 bfa2d000 Â ati2dvag ati2dvag.dll Wed Apr 05 23:04:15 2006 (4434852F)
bfa2d000 bfa6c000 Â ati2cqag ati2cqag.dll Wed Apr 05 21:57:18 2006 (4434757E)
bfa6c000 bfaa2000 Â atikvmag atikvmag.dll Wed Apr 05 22:25:29 2006 (44347C19)
bfaa2000 bfd2c0c0 Â ati3duag ati3duag.dll Wed Apr 05 22:47:35 2006 (44348147)
bfd2d000 bfe41180 Â ativvaxx ativvaxx.dll Wed Apr 05 22:40:57 2006 (44347FB9)
bfe42000 bfe8d000 Â ATMFD Â Â ATMFD.DLL Â Â Tue Feb 15 08:19:22 2011 (4D5A7D5A)
bff60000 bff7e000  RDPDD   RDPDD.dll   Sat Feb 17 09:01:19 2007 (45D70AAF)
f7206000 f722b000  fltMgr  fltMgr.sys  Sat Feb 17 00:51:08 2007 (45D697CC)
f722b000 f723e000 Â CLASSPNP CLASSPNP.SYS Sat Feb 17 01:28:16 2007 (45D6A080)
f723e000 f725d000 Â SCSIPORT SCSIPORT.SYS Sat Feb 17 01:28:41 2007 (45D6A099)
f725d000 f7284000  adpu320  adpu320.sys  Wed Mar 07 13:43:42 2007 (45EF07DE)
f7284000 f72a2000 Â storport storport.sys Sat Feb 17 01:07:48 2007 (45D69BB4)
f72a2000 f72bf000  atapi   atapi.sys   Sat Feb 17 01:07:34 2007 (45D69BA6)
f72bf000 f72e9000  volsnap  volsnap.sys  Sat Feb 17 01:08:23 2007 (45D69BD7)
f72e9000 f7315000  dmio   dmio.sys   Sat Feb 17 01:10:44 2007 (45D69C64)
f7315000 f733c000  ftdisk  ftdisk.sys  Sat Feb 17 01:08:05 2007 (45D69BC5)
f733c000 f7352000  pci    pci.sys    Sat Feb 17 00:59:03 2007 (45D699A7)
f7352000 f7386000  ACPI   ACPI.sys   Sat Feb 17 00:58:47 2007 (45D69997)
f7487000 f7490000 Â WMILIB Â WMILIB.SYS Â Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000  isapnp  isapnp.sys  Sat Feb 17 00:58:57 2007 (45D699A1)
f74a7000 f74b4000 Â PCIIDEX Â PCIIDEX.SYS Â Sat Feb 17 01:07:32 2007 (45D69BA4)
f74b7000 f74c7000 Â MountMgr MountMgr.sys Sat Feb 17 01:05:35 2007 (45D69B2F)
f74c7000 f74d2000  PartMgr  PartMgr.sys  Sat Feb 17 01:29:25 2007 (45D6A0C5)
f74d7000 f74e1000  percsas  percsas.sys  Fri Jun 08 13:15:54 2007 (46698ECA)
f74e7000 f74f7000  disk   disk.sys   Sat Feb 17 01:07:51 2007 (45D69BB7)
f74f7000 f7503000  Dfs    Dfs.sys    Sat Feb 17 00:51:17 2007 (45D697D5)
f7507000 f7512000  ptilink  ptilink.sys  Sat Feb 17 01:06:38 2007 (45D69B6E)
f7517000 f7521000  crcdisk  crcdisk.sys  Sat Feb 17 01:09:50 2007 (45D69C2E)
f7567000 f7574a60  SCDEmu  SCDEmu.SYS  Mon Apr 12 04:44:34 2010 (4BC2DD72)
f7577000 f7586000  termdd  termdd.sys  Sat Feb 17 00:44:32 2007 (45D69640)
f75a7000 f75b2000 Â kbdclass kbdclass.sys Sat Feb 17 01:05:39 2007 (45D69B33)
f75d7000 f75e0000  raspti  raspti.sys  Sat Feb 17 00:59:23 2007 (45D699BB)
f75e7000 f75f1000  serenum  serenum.sys  Sat Feb 17 01:06:44 2007 (45D69B74)
f75f7000 f7601000 Â mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7607000 f7612000 Â TDI Â Â Â TDI.SYS Â Â Â Sat Feb 17 01:01:19 2007 (45D69A2F)
f7617000 f7624000  netbios  netbios.sys  Sat Feb 17 00:58:29 2007 (45D69985)
f7627000 f7630000 Â watchdog watchdog.sys Sat Feb 17 01:11:45 2007 (45D69CA1)
f7647000 f7650000 Â ndistapi ndistapi.sys Fri Jul 08 10:08:19 2011 (4E170F53)
f7657000 f7663000 Â USBSTOR Â USBSTOR.SYS Â Sat Feb 17 01:13:05 2007 (45D69CF1)
f7667000 f766f680  04mmdat  04mmdat.sys  Tue Feb 12 08:35:47 2008 (47B1A0B3)
f7677000 f7685000 Â WDFLDR Â WDFLDR.SYS Â Mon Jul 13 19:11:25 2009 (4A5BBF1D)
f7687000 f7693c80 Â GenericMount GenericMount.sys Mon Jan 18 08:49:10 2010 (4B5466D6)
f76b7000 f76c7000 Â SRTSPX Â SRTSPX.SYS Â Thu Mar 01 13:40:59 2012 (4F4FC2BB)
f76e6000 f7706b00  symsnap  symsnap.sys  Mon Jun 21 11:37:35 2010 (4C1F873F)
f7707000 f770f000  kdcom   kdcom.dll   Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000  BOOTVID  BOOTVID.dll  Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000  pciide  pciide.sys  Tue Mar 25 03:04:46 2003 (3E7FFF8E)
f771f000 f7726000  dmload  dmload.sys  Tue Mar 25 03:08:08 2003 (3E800058)
f773f000 f7744280 Â GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
f7757000 f775db80  usbehci  usbehci.sys  Sat Feb 17 01:12:56 2007 (45D69CE8)
f775f000 f7764180  usbuhci  usbuhci.sys  Sat Feb 17 01:13:02 2007 (45D69CEE)
f7777000 f777f000  audstub  audstub.sys  Tue Mar 25 03:09:12 2003 (3E800098)
f77c7000 f77cf000  Fs_Rec  Fs_Rec.SYS  Tue Mar 25 03:08:36 2003 (3E800074)
f77cf000 f77d6000  Null   Null.SYS   Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77d7000 f77de000  Beep   Beep.SYS   Tue Mar 25 03:03:04 2003 (3E7FFF28)
f77df000 f77e7000  mnmdd   mnmdd.SYS   Tue Mar 25 03:07:53 2003 (3E800049)
f77e7000 f77ef000  RDPCDD  RDPCDD.sys  Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77ef000 f77f7000  rasacd  rasacd.sys  Tue Mar 25 03:11:50 2003 (3E800136)
f781f000 f7824680 Â tpfilter tpfilter.sys Thu May 13 15:49:52 2010 (4BEC57E0)
f7840000 f7897000 Â SYMDS Â Â SYMDS.SYS Â Â Thu Apr 28 18:39:23 2011 (4DB9EC9B)
f7897000 f7899980 Â compbatt compbatt.sys Sat Feb 17 00:58:51 2007 (45D6999B)
f789b000 f789e900 Â BATTC Â Â BATTC.SYS Â Â Sat Feb 17 00:58:46 2007 (45D69996)
f7961000 f7987000  KSecDD  KSecDD.sys  Mon Jun 15 13:45:11 2009 (4A3688A7)
f7995000 f7996680  RaInfo  RaInfo.sys  Fri Jan 11 04:20:41 2013 (50EFD969)
f79ad000 f79ae280  swenum  swenum.sys  Sat Feb 17 01:05:56 2007 (45D69B44)
f79af000 f79b0580 Â USBD Â Â USBD.SYS Â Â Tue Mar 25 03:10:39 2003 (3E8000EF)
f7a7a000 f7a7ac80  lmimirr  lmimirr.sys  Tue Apr 10 18:32:11 2007 (461C106B)
f7b20000 f7bdf000 Â SYMEFA Â SYMEFA.SYS Â Wed Feb 22 12:38:08 2012 (4F452800)
Unloaded modules:
b9745000 b97a4000 Â IDSxpx86.sys
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0005F000
b98df000 b98f2000 Â i8042prt.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00013000
ba182000 ba18a000 Â Sfloppy.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00008000
f7567000 f7571000 Â Flpydisk.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0000A000
f7507000 f7515000 Â WDFLDR.SYS
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  0000E000
baf98000 bb000000 Â bxvbdx.sys
  Timestamp: unavailable (00000000)
  Checksum:  00000000
  ImageSize:  00068000
Mini053013-01.dmp
Mini070113-01.dmp
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
We did suspect something related to Symantec but we also have Symantec Mail Security on this server but thanks for pointing us to Endpoint.