BugCheck 1E, Caused by: ntkrnlmp.exe (nt!IopMountVolume+1c3)

Thanks in advance for any and all help. This ones got me stumped!

------------------------------------------------------------------
Loading Dump File [\\dc201fic02b\c$\winnt\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is: srv*DownstreamStore*\\roc08dev119\symstore*http://msdl.microsoft.com/download/symbols
Executable search path is: \\dc201fic02b\c$\winnt\
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485ac0
Debug session time: Thu Oct 6 14:01:00.323 2005 (GMT-4)
System Uptime: 45 days 19:10:27.476
Loading Kernel Symbols
........................................................................................................
Loading unloaded module list
.................................
Loading User Symbols
..................................................................Unable to read NT module Base Name string at 01900870 - HRESULT 0x80004005
Missing image name, possible corrupt data.
.Unable to read LDR_DATA_TABLE_ENTRY at 0191e038 - HRESULT 0x80004005

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {c0000005, 804b2185, 0, b0}

Probably caused by : ntkrnlmp.exe ( nt!IopMountVolume+1c3 )

Followup: MachineOwner
---------

2: kd> .reload
Loading Kernel Symbols
........................................................................................................
Loading unloaded module list
.................................
Loading User Symbols
..................................................................Unable to read NT module Base Name string at 01900870 - HRESULT 0x80004005
Missing image name, possible corrupt data.
.Unable to read LDR_DATA_TABLE_ENTRY at 0191e038 - HRESULT 0x80004005

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 804b2185, The address that the exception occurred at
Arg3: 00000000, Parameter 0 of the exception
Arg4: 000000b0, Parameter 1 of the exception

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!IopMountVolume+1c3
804b2185 8b89b0000000 mov ecx,[ecx+0xb0]

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 000000b0

READ_ADDRESS: 000000b0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x1E

LAST_CONTROL_TRANSFER: from 80429d3f to 804b2185

TRAP_FRAME: bce837d4 -- (.trap ffffffffbce837d4)
ErrCode = 00000000
eax=88e15e28 ebx=89078e44 ecx=00000000 edx=00000000 esi=88e14dd0 edi=00000000
eip=804b2185 esp=bce83848 ebp=bce83884 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!IopMountVolume+0x1c3:
804b2185 8b89b0000000 mov ecx,[ecx+0xb0] ds:0023:000000b0=????????
Resetting default scope

STACK_TEXT:
bce83884 80429d3f 00000000 00000001 00000000 nt!IopMountVolume+0x1c3
bce838ac 804c3c3b bce83c34 88e14dd0 bce83a88 nt!IopCheckVpbMounted+0x5f
bce83a44 804535bc 88e14dd0 00000000 bce83afc nt!IopParseDevice+0x409
bce83abc 804da36a 00000000 89054a00 00000040 nt!ObpLookupObjectName+0x504
bce83bcc 804a43e7 00000000 00000000 00000001 nt!ObOpenObjectByName+0xc8
bce83ca8 804a3f8c 2786f898 00100081 2786f834 nt!IopCreateFile+0x407
bce83cf0 804ab9c4 2786f898 00100081 2786f834 nt!IoCreateFile+0x36
bce83d30 804682f9 2786f898 00100081 2786f834 nt!NtCreateFile+0x2e
bce83d30 77f87cb7 2786f898 00100081 2786f834 nt!KiSystemService+0xc9
2786f7f4 7c58c520 2786f898 00100081 2786f834 ntdll!NtCreateFile+0xb
2786f8cc 65c73bea 00004008 2786f908 185aa220 KERNEL32!CreateFileW+0x343
2786f8d8 185aa220 77f82a06 00830000 185aa218 wbemcomn!CType:oesCIMTYPEMatchVARTYPE+0x38
WARNING: Frame IP not in any known module. Following frames may be wrong.
2786f908 77fcc71e 00830778 185aa220 00000000 0x185aa220
2786f9ac ffffffff 2786fa58 77fcc71e 003e07d8 ntdll!RtlFreeHeap+0xf8
77f82a40 77fb779d 77fb77a2 6aec8b55 2ad068ff 0xffffffff
ffffffff 00000000 00000000 00000000 00000000 ntdll!RtlpAllocateFromHeapLookaside+0x5d

FOLLOWUP_IP:
nt!IopMountVolume+1c3
804b2185 8b89b0000000 mov ecx,[ecx+0xb0]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!IopMountVolume+1c3

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42258bf7

STACK_COMMAND: .trap ffffffffbce837d4 ; kb

FAILURE_BUCKET_ID: 0x1E_nt!IopMountVolume+1c3

BUCKET_ID: 0x1E_nt!IopMountVolume+1c3

Followup: MachineOwner
---------

 

I found the fix myself at:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q898114&

Hope this can help anyone else who might run into this problem.


Regards,

Head