Windows 2000Post your Windows 2000 related questions here.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
I have a Win2k3 Web Edition machine that crash frequently with this error code: 1000007f.
have read to the interesting article of the forum "Dump Data collection directions for NT-W2k-XP-W2k3 " and have executed all the described steps. Here the content of the rows debug.txt, than to me turns out incomprensibile.
Someone can help me? Thanks...
Mauro
Opened log file 'c:\debug.txt'
Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\minidump\Mini072904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS Blade
Built by: 3790.srv03_rtm.030324-2048
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Wed Jul 28 19:35:06 2004
System Uptime: 0 days 1:49:14.546
Loading Kernel Symbols
........................................................................... ..........................
Loading unloaded module list
..
Loading User Symbols
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, 80042000, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeReleaseQueuedSpinLockFromDpcLevel+1c )
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000
You've run the tool successfully and collected good data. Im walking out the door right now, but ill post back later today. That stack looks familar to me.
What is the history of this machine? has it been bluescreening a lot lately? Go thru your event log and grab the stop codes from the other crashes.
I need the Stop 50 (00000000,0000000,000000,00000) information only.
Depending on what your other bugchecks are, this could be bad ram, pool corruption, or a malfunctioning peice of hardware (cpu, motherboard). Lets see what else you got in the event log.
Also, please paste the portion of the debug log in the [...] section, I dont need all that loaded module information, but i need the registers and the stack info. Thanks.
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8b098d70, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804f0b6a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 80bfffe8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804f1978, address which referenced memory
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7737ef0
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from e1660b50 to 804f0b79
STACK_TEXT:
e214e2f0 e1660b50 00000000 88cffed8 e214e300 nt!ObfDereferenceObject+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
e214e2f8 88cffed8 e214e300 e214e300 00000a80 0xe1660b50
00000000 00000000 00000000 00000000 00000000 0x88cffed8
FOLLOWUP_IP:
nt!ObfDereferenceObject+59
804f0b79 5d pop ebp
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ObfDereferenceObject+59
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: kb
BUCKET_ID: ZEROED_STACK
MODULE_NAME: Unknown_Module
Followup: MachineOwner
---------
eax=00000001 ebx=00000000 ecx=e214e2f0 edx=6b630001 esi=88d45c54 edi=e2064880
eip=804f0b79 esp=ba5b1c94 ebp=e214e2f0 iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010203
nt!ObfDereferenceObject+0x59:
804f0b79 5d pop ebp
ChildEBP RetAddr Args to Child
e214e2f0 e1660b50 00000000 88cffed8 e214e300 nt!ObfDereferenceObject+0x59 (FPO: [EBP 0xe214e2f4] [0,0,0])
WARNING: Frame IP not in any known module. Following frames may be wrong.
e214e2f8 88cffed8 e214e300 e214e300 00000a80 0xe1660b50
00000000 00000000 00000000 00000000 00000000 0x88cffed8
start end module name
804de000 80744000 nt ntkrnlmp.exe Tue Mar 25 09:39:34 2003 (3E8015C6)
80744000 8076c000 hal halmacpi.dll Tue Mar 25 08:07:28 2003 (3E800030)
b9968000 b9995000 Fastfat Fastfat.SYS Tue Mar 25 09:00:16 2003 (3E800C90)
b9ebd000 b9edf000 RDPWD RDPWD.SYS Tue Mar 25 08:03:00 2003 (3E7FFF24)
b9fd7000 b9fe1000 TDTCP TDTCP.SYS Tue Mar 25 08:02:52 2003 (3E7FFF1C)
ba227000 ba286000 srv srv.sys Tue Mar 25 09:49:51 2003 (3E80182F)
ba2d6000 ba32e000 HTTP HTTP.sys Tue Mar 25 09:55:21 2003 (3E801979)
ba6c6000 ba6f5000 afd afd.sys Tue Mar 25 08:40:50 2003 (3E800802)
ba8e9000 ba901000 Cdfs Cdfs.SYS Tue Mar 25 09:17:19 2003 (3E80108F)
ba929000 ba93c000 Fips Fips.SYS Tue Mar 25 09:54:59 2003 (3E801963)
ba93c000 ba9a9000 mrxsmb mrxsmb.sys Tue Mar 25 08:09:09 2003 (3E800095)
ba9a9000 ba9d5000 rdbss rdbss.sys Tue Mar 25 08:09:06 2003 (3E800092)
ba9d5000 baa0a000 netbt netbt.sys Tue Mar 25 09:17:46 2003 (3E8010AA)
baa32000 baa94000 tcpip tcpip.sys Tue Mar 25 09:04:01 2003 (3E800D71)
baa94000 baab0000 ipsec ipsec.sys Tue Mar 25 08:55:45 2003 (3E800B81)
bab70000 bab83000 usbhub usbhub.sys Tue Mar 25 08:10:46 2003 (3E8000F6)
bac4b000 bac7e000 update update.sys Tue Mar 25 09:59:59 2003 (3E801A8F)
bac7e000 bacb2000 rdpdr rdpdr.sys Tue Mar 25 08:09:30 2003 (3E8000AA)
bacb2000 bad09000 wlbs wlbs.sys Tue Mar 25 09:41:10 2003 (3E801626)
bad09000 bad1e000 raspptp raspptp.sys Tue Mar 25 09:19:09 2003 (3E8010FD)
bad26000 bad29e20 dump_cpqcissm dump_cpqcissm.sys Mon Feb 02 21:01:16 2004 (401EAC8C)
bad46000 bad61000 ndiswan ndiswan.sys Tue Mar 25 09:48:19 2003 (3E8017D3)
badd1000 baddb000 Dxapi Dxapi.sys Tue Mar 25 08:06:01 2003 (3E7FFFD9)
bade1000 badea000 dump_scsiport dump_scsiport.sys Tue Mar 25 08:05:15 2003 (3E7FFFAB)
bae01000 bae18000 rasl2tp rasl2tp.sys Tue Mar 25 08:54:46 2003 (3E800B46)
bae68000 bae83a00 q57xp32 q57xp32.sys Tue Feb 03 03:19:08 2004 (401F051C)
baea5000 baec6e80 USBPORT USBPORT.SYS Tue Mar 25 08:10:43 2003 (3E8000F3)
baec7000 baef1000 ks ks.sys Tue Mar 25 09:47:36 2003 (3E8017A8)
baef1000 baf05000 redbook redbook.sys Tue Mar 25 08:04:38 2003 (3E7FFF86)
baf05000 baf19000 cdrom cdrom.sys Tue Mar 25 08:05:18 2003 (3E7FFFAE)
baf19000 baf31000 serial serial.sys Tue Mar 25 08:40:08 2003 (3E8007D8)
baf31000 baf47000 i8042prt i8042prt.sys Tue Mar 25 10:01:43 2003 (3E801AF7)
baf47000 baf93000 cpqasm2 cpqasm2.sys Tue May 18 19:59:39 2004 (40AA4F0B)
baf93000 bafac000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 08:08:02 2003 (3E800052)
bafac000 bafffd80 ati2mpad ati2mpad.sys Fri Jul 19 03:13:20 2002 (3D3767B0)
bf800000 bf9c6000 win32k win32k.sys Tue Mar 25 09:40:49 2003 (3E801611)
bf9c6000 bfa1c680 ati2drad ati2drad.dll Tue Mar 25 10:43:37 2003 (3E8024C9)
bff60000 bff7b000 RDPDD RDPDD.dll Tue Mar 25 21:12:05 2003 (3E80B815)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 10:46:23 2003 (3E80256F)
f7237000 f7259000 Mup Mup.sys Tue Mar 25 09:55:58 2003 (3E80199E)
f7259000 f729a000 NDIS NDIS.sys Tue Mar 25 09:45:35 2003 (3E80172F)
f729a000 f7337000 Ntfs Ntfs.sys Tue Mar 25 08:40:05 2003 (3E8007D5)
f7337000 f7358000 KSecDD KSecDD.sys Tue Mar 25 08:05:39 2003 (3E7FFFC3)
f7358000 f736e000 CLASSPNP CLASSPNP.SYS Tue Mar 25 08:38:14 2003 (3E800766)
f736e000 f7394000 SCSIPORT SCSIPORT.SYS Tue Mar 25 09:01:25 2003 (3E800CD5)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 08:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 08:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 08:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 08:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 08:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 08:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 08:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 08:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 08:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 08:03:05 2003 (3E7FFF29)
f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 09:04:02 2003 (3E800D72)
f74d7000 f74e6000 disk disk.sys Tue Mar 25 08:05:20 2003 (3E7FFFB0)
f74e7000 f74f3000 Dfs Dfs.sys Tue Mar 25 08:09:52 2003 (3E8000C0)
f74f7000 f7500000 crcdisk crcdisk.sys Tue Mar 25 08:07:23 2003 (3E80002B)
f7537000 f7543000 processr processr.sys Tue Mar 25 08:07:36 2003 (3E800038)
f7547000 f7550000 watchdog watchdog.sys Tue Mar 25 08:09:01 2003 (3E80008D)
f7557000 f7564580 CPQCISSE CPQCISSE.sys Thu Mar 11 22:50:26 2004 (4050DF22)
f7567000 f7571000 flpydisk flpydisk.sys Tue Mar 25 08:04:32 2003 (3E7FFF80)
f7577000 f7583000 vga vga.sys Tue Mar 25 08:08:03 2003 (3E800053)
f7587000 f7591000 Msfs Msfs.SYS Tue Mar 25 08:08:56 2003 (3E800088)
f7597000 f75a3000 Npfs Npfs.SYS Tue Mar 25 08:08:59 2003 (3E80008B)
f75a7000 f75b6000 msgpc msgpc.sys Tue Mar 25 08:10:12 2003 (3E8000D4)
f75b7000 f75c4000 wanarp wanarp.sys Tue Mar 25 08:11:22 2003 (3E80011A)
f75c7000 f75d4000 netbios netbios.sys Tue Mar 25 08:09:53 2003 (3E8000C1)
f7607000 f7611000 kbdclass kbdclass.sys Tue Mar 25 08:03:10 2003 (3E7FFF2E)
f7617000 f7621000 mouclass mouclass.sys Tue Mar 25 08:03:09 2003 (3E7FFF2D)
f7627000 f7631000 serenum serenum.sys Tue Mar 25 08:04:01 2003 (3E7FFF61)
f7637000 f7642000 fdc fdc.sys Tue Mar 25 08:04:31 2003 (3E7FFF7F)
f7647000 f7650000 ndistapi ndistapi.sys Tue Mar 25 08:11:28 2003 (3E800120)
f7657000 f7665000 raspppoe raspppoe.sys Tue Mar 25 08:11:37 2003 (3E800129)
f7667000 f7672000 TDI TDI.SYS Tue Mar 25 08:14:28 2003 (3E8001D4)
f7677000 f7682000 ptilink ptilink.sys Tue Mar 25 08:03:51 2003 (3E7FFF57)
f7687000 f7690000 raspti raspti.sys Tue Mar 25 08:11:36 2003 (3E800128)
f7697000 f76a6000 termdd termdd.sys Tue Mar 25 08:02:52 2003 (3E7FFF1C)
f76b7000 f76c5000 NDProxy NDProxy.SYS Tue Mar 25 08:11:30 2003 (3E800122)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 08:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 08:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 08:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 08:08:08 2003 (3E800058)
f7797000 f779f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 08:16:25 2003 (3E800249)
f77af000 f77b3a20 CpqCiDrv CpqCiDrv.sys Fri Jul 11 17:32:03 2003 (3F0ED873)
f77b7000 f77bb200 usbohci usbohci.sys Tue Mar 25 08:10:41 2003 (3E8000F1)
f77bf000 f77c7000 audstub audstub.sys Tue Mar 25 08:09:12 2003 (3E800098)
f77d7000 f77df000 Fs_Rec Fs_Rec.SYS Tue Mar 25 08:08:36 2003 (3E800074)
f77df000 f77e6000 Null Null.SYS Tue Mar 25 08:03:05 2003 (3E7FFF29)
f77e7000 f77ee000 Beep Beep.SYS Tue Mar 25 08:03:04 2003 (3E7FFF28)
f77ef000 f77f7000 mnmdd mnmdd.SYS Tue Mar 25 08:07:53 2003 (3E800049)
f77f7000 f77ff000 RDPCDD RDPCDD.sys Tue Mar 25 08:03:05 2003 (3E7FFF29)
f77ff000 f7807000 rasacd rasacd.sys Tue Mar 25 08:11:50 2003 (3E800136)
f7817000 f781e000 dxgthk dxgthk.sys Tue Mar 25 08:05:52 2003 (3E7FFFD0)
f7897000 f789ae20 cpqcissm cpqcissm.sys Mon Feb 02 21:01:16 2004 (401EAC8C)
f798f000 f7990200 swenum swenum.sys Tue Mar 25 08:03:22 2003 (3E7FFF3A)
f7991000 f7992580 USBD USBD.SYS Tue Mar 25 08:10:39 2003 (3E8000EF)
holy moley. theres something seriously wrong on this box. Those dumps are all over the board. Something is fishy in denmark.
If i had to play your chances, i'd say its 80% bad ram( or related hardware, motherobard etc), 20% pool corruption. Do you have spare ram to try a swapout? That would be my first action.
If that doesnt work, you probably have a particurlly nasty form of memory corruption. I am having a hard time beleiving a driver is rampaging on your machine with this scattered a signature.
If i were in your shoes, I'd swap the ram out with a new set of sticks. If the problem continues, you should give microsoft a call. You should tell them you suspect pool corruption, and they can walk you through the process. Its pretty involved, and quite dangerous, i'd hesitate to help you with it over the boards, because if it goes bad, it goes big
After to have controlled all I have decided to call HP for having the
support of they technical. Also I task that is a problem hardware, we will then see of what draft.
Thanks for the aid, I will hold to you informed...
Mauro
Quote:
Originally Posted by JoeHobart
holy moley. theres something seriously wrong on this box. Those dumps are all over the board. Something is fishy in denmark.
If i had to play your chances, i'd say its 80% bad ram( or related hardware, motherobard etc), 20% pool corruption. Do you have spare ram to try a swapout? That would be my first action.
If that doesnt work, you probably have a particurlly nasty form of memory corruption. I am having a hard time beleiving a driver is rampaging on your machine with this scattered a signature.
If i were in your shoes, I'd swap the ram out with a new set of sticks. If the problem continues, you should give microsoft a call. You should tell them you suspect pool corruption, and they can walk you through the process. Its pretty involved, and quite dangerous, i'd hesitate to help you with it over the boards, because if it goes bad, it goes big
