2003 Terminal Server BSOD and Reboot

matt8454 · 3rd March 2006

Hello, please see if you can give me a little help. I have a 2003 Server STD running TS and hosting a couple shares. The box also have SAV running. The machine has been solid until 2 weeks ago. Now is reboots on its own a couple times per week. I have read thru the dumps but I am unsure of the cause of my issue. Below is the minidump. thanks
Opened log file 'c:\debuglog.txt'

1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

Loading Kernel Symbols

........................................................................... ...................................

Loading User Symbols

Loading unloaded module list

...............

*************************************************************************** ****

* *

* Bugcheck Analysis *

* *

*************************************************************************** ****

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: edc8b002, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: f66843d9, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000001, (reserved)

Debugging Details:

------------------

Could not read faulting driver name

READ_ADDRESS: edc8b002

FAULTING_IP:

srv!RemoveDuplicateCoreSearches+39

f66843d9 668b4e52 mov cx,[esi+0x52]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x50

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from 8052fa2f to 80543ac9

STACK_TEXT:

f78c2b30 8052fa2f 00000050 edc8b002 00000000 nt!KeBugCheckEx+0x19

f78c2b80 804e2dfc 00000000 edc8b002 00000000 nt!MmAccessFault+0x796

f78c2b80 f66843d9 00000000 edc8b002 00000000 nt!KiTrap0E+0xc8

f78c2c24 f6676364 00000001 f6668004 f78c2cec srv!RemoveDuplicateCoreSearches+0x39

f78c2c68 f6671ce3 85df6e14 f78c2cec f78c2cb4 srv!CloseIdleConnection+0x394

f78c2cc4 f6671aec 85df6cc8 804f1d00 f6667a88 srv!TimeoutSessions+0xf3

f78c2d4c f6656b4f 89ba0180 890c5a68 89126008 srv!ScavengerAlgorithm+0x21e

f78c2d70 80585e7f 890c5a68 00000000 80582d80 srv!ScavengerThread+0x78

f78c2d80 804eeabb 89126008 00000000 89ba0180 nt!IopProcessWorkItem+0xf

f78c2dac 80596ffe 89126008 00000000 00000000 nt!ExpWorkerThread+0xe9

f78c2ddc 805008c6 804ee9f0 00000000 00000000 nt!PspSystemThreadStartup+0x2e

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:

srv!RemoveDuplicateCoreSearches+39

f66843d9 668b4e52 mov cx,[esi+0x52]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: srv!RemoveDuplicateCoreSearches+39

MODULE_NAME: srv

IMAGE_NAME: srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e80182f

FAILURE_BUCKET_ID: 0x50_srv!RemoveDuplicateCoreSearches+39

BUCKET_ID: 0x50_srv!RemoveDuplicateCoreSearches+39

Followup: MachineOwner

---------

eax=f772f13c ebx=00000050 ecx=89ba0180 edx=804e5bb0 esi=f772f120 edi=89ba0180

eip=80543ac9 esp=f78c2b18 ebp=f78c2b30 iopl=0 nv up ei ng nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286

nt!KeBugCheckEx+0x19:

80543ac9 5d pop ebp

ChildEBP RetAddr Args to Child

f78c2b30 8052fa2f 00000050 edc8b002 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])

f78c2b80 804e2dfc 00000000 edc8b002 00000000 nt!MmAccessFault+0x796 (FPO: [Non-Fpo])

f78c2b80 f66843d9 00000000 edc8b002 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFrame @ f78c2b98)

f78c2c24 f6676364 00000001 f6668004 f78c2cec srv!RemoveDuplicateCoreSearches+0x39 (FPO: [Non-Fpo])

f78c2c68 f6671ce3 85df6e14 f78c2cec f78c2cb4 srv!CloseIdleConnection+0x394 (FPO: [Non-Fpo])

f78c2cc4 f6671aec 85df6cc8 804f1d00 f6667a88 srv!TimeoutSessions+0xf3 (FPO: [Non-Fpo])

f78c2d4c f6656b4f 89ba0180 890c5a68 89126008 srv!ScavengerAlgorithm+0x21e (FPO: [Non-Fpo])

f78c2d70 80585e7f 890c5a68 00000000 80582d80 srv!ScavengerThread+0x78 (FPO: [Non-Fpo])

f78c2d80 804eeabb 89126008 00000000 89ba0180 nt!IopProcessWorkItem+0xf (FPO: [1,0,0])

f78c2dac 80596ffe 89126008 00000000 00000000 nt!ExpWorkerThread+0xe9 (FPO: [Non-Fpo])

f78c2ddc 805008c6 804ee9f0 00000000 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

start end module name

804de000 80745000 nt ntkrnlmp.exe Wed May 26 20:32:57 2004 (40B53739)

80745000 8076d000 hal halmacpi.dll Tue Mar 25 02:07:28 2003 (3E800030)

bf800000 bf9c7000 win32k win32k.sys Mon Aug 09 18:48:07 2004 (4117FF27)

bf9c7000 bfa11080 ati2drad ati2drad.dll Mon Feb 18 09:22:10 2002 (3C710E12)

bff60000 bff7b000 RDPDD RDPDD.dll Tue Mar 25 15:12:05 2003 (3E80B815)

bff80000 bff96000 dxg dxg.sys Tue Mar 25 04:46:23 2003 (3E80256F)

f3a81000 f3a92980 naveng naveng.sys Mon Nov 28 19:03:55 2005 (438B9AEB)

f3a93000 f3b48ec0 navex15 navex15.sys Mon Nov 28 18:52:12 2005 (438B982C)

f3e19000 f3e46000 Fastfat Fastfat.SYS Tue Mar 25 03:00:16 2003 (3E800C90)

f5168000 f5176000 EraserUtilDrv10502 EraserUtilDrv10502.sys Tue Jan 24 19:00:56 2006 (43D6BFB8)

f5386000 f53d9000 eeCtrl eeCtrl.sys Tue Jan 24 19:00:57 2006 (43D6BFB9)

f581f000 f5821f60 SYMREDRV SYMREDRV.SYS Tue Apr 05 14:11:10 2005 (4252D4BE)

f5a69000 f5abe000 savrt savrt.sys Fri Feb 04 23:03:24 2005 (4204458C)

f5abe000 f5ad2000 Savrtpel Savrtpel.sys Fri Feb 04 23:03:26 2005 (4204458E)

f5ad2000 f5aeeac0 SYMEVENT SYMEVENT.SYS Mon Mar 21 22:19:36 2005 (423F8EC8)

f5aef000 f5b2ece0 SYMTDI SYMTDI.SYS Tue Apr 05 14:10:52 2005 (4252D4AC)

f60f7000 f6119000 RDPWD RDPWD.SYS Tue Mar 25 02:03:00 2003 (3E7FFF24)

f61d1000 f61db000 TDTCP TDTCP.SYS Tue Mar 25 02:02:52 2003 (3E7FFF1C)

f63c1000 f6419000 HTTP HTTP.sys Tue Mar 25 03:55:21 2003 (3E801979)

f6653000 f66b2000 srv srv.sys Tue Mar 25 03:49:51 2003 (3E80182F)

f681a000 f6821000 parvdm parvdm.sys Tue Mar 25 02:03:49 2003 (3E7FFF55)

f6932000 f6961000 afd afd.sys Tue Mar 25 02:40:50 2003 (3E800802)

f6aa1000 f6ab9000 Cdfs Cdfs.SYS Tue Mar 25 03:17:19 2003 (3E80108F)

f6ae1000 f6af4000 Fips Fips.SYS Tue Mar 25 03:54:59 2003 (3E801963)

f6af4000 f6b5f000 mrxsmb mrxsmb.sys Mon Oct 11 20:38:12 2004 (416B2774)

f6b5f000 f6b8a000 rdbss rdbss.sys Mon Oct 11 20:38:09 2004 (416B2771)

f6b8a000 f6bbf000 netbt netbt.sys Fri Jul 18 13:16:03 2003 (3F182B53)

f6bbf000 f6c21000 tcpip tcpip.sys Tue Mar 25 03:04:01 2003 (3E800D71)

f6cc1000 f6cdd000 ipsec ipsec.sys Tue Mar 25 02:55:45 2003 (3E800B81)

f6d05000 f6d099a0 dump_dpti2o dump_dpti2o.sys Thu May 02 10:49:25 2002 (3CD151F5)

f6d45000 f6d4af00 HIDPARSE HIDPARSE.SYS Tue Mar 25 02:10:13 2003 (3E8000D5)

f6d6d000 f6d80000 usbhub usbhub.sys Tue Mar 25 02:10:46 2003 (3E8000F6)

f6dc8000 f6dfb000 update update.sys Tue Mar 25 03:59:59 2003 (3E801A8F)

f6dfb000 f6e2f000 rdpdr rdpdr.sys Tue Mar 25 02:09:30 2003 (3E8000AA)

f6e6f000 f6e78000 ndisuio ndisuio.sys Tue Mar 25 02:09:47 2003 (3E8000BB)

f6e9f000 f6ea9000 Dxapi Dxapi.sys Tue Mar 25 02:06:01 2003 (3E7FFFD9)

f6ecf000 f6ee4000 raspptp raspptp.sys Tue Mar 25 03:19:09 2003 (3E8010FD)

f6ee4000 f6eff000 ndiswan ndiswan.sys Tue Mar 25 03:48:19 2003 (3E8017D3)

f6eff000 f6f16000 rasl2tp rasl2tp.sys Tue Mar 25 02:54:46 2003 (3E800B46)

f6f3e000 f6f5dd00 ks ks.sys Wed Dec 04 12:09:38 2002 (3DEE36D2)

f6f5e000 f6f72000 redbook redbook.sys Tue Mar 25 02:04:38 2003 (3E7FFF86)

f6f72000 f6f86000 cdrom cdrom.sys Tue Mar 25 02:05:18 2003 (3E7FFFAE)

f6f86000 f6f9d000 parport parport.sys Tue Mar 25 02:03:56 2003 (3E7FFF5C)

f6f9d000 f6fb5000 serial serial.sys Tue Mar 25 02:40:08 2003 (3E8007D8)

f6fb5000 f6fcb000 i8042prt i8042prt.sys Tue Mar 25 04:01:43 2003 (3E801AF7)

f6fcb000 f6fe4000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 02:08:02 2003 (3E800052)

f6fe4000 f7037d80 ati2mpad ati2mpad.sys Thu Jul 18 21:13:20 2002 (3D3767B0)

f7038000 f7059e80 USBPORT USBPORT.SYS Tue Mar 25 02:10:43 2003 (3E8000F3)

f705a000 f7072c00 e1000325 e1000325.sys Mon Jan 13 14:12:12 2003 (3E230F8C)

f720b000 f722d000 Mup Mup.sys Tue Mar 25 03:55:58 2003 (3E80199E)

f722d000 f726e000 NDIS NDIS.sys Tue Mar 25 03:45:35 2003 (3E80172F)

f726e000 f730b000 Ntfs Ntfs.sys Tue Mar 25 02:40:05 2003 (3E8007D5)

f730b000 f732c000 KSecDD KSecDD.sys Tue Mar 25 02:05:39 2003 (3E7FFFC3)

f732c000 f7340000 sis sis.sys Tue Mar 25 02:09:33 2003 (3E8000AD)

f7340000 f7356000 CLASSPNP CLASSPNP.SYS Tue Mar 25 02:38:14 2003 (3E800766)

f7356000 f736de80 SI3112r SI3112r.sys Fri Aug 27 19:18:49 2004 (412FC159)

f736e000 f7394000 SCSIPORT SCSIPORT.SYS Tue Mar 25 03:01:25 2003 (3E800CD5)

f7394000 f73b0000 atapi atapi.sys Tue Mar 25 02:04:48 2003 (3E7FFF90)

f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 02:05:47 2003 (3E7FFFCB)

f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 02:08:14 2003 (3E80005E)

f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 02:05:26 2003 (3E7FFFB6)

f7420000 f7435000 pci pci.sys Tue Mar 25 02:16:40 2003 (3E800258)

f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 02:16:21 2003 (3E800245)

f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 02:13:00 2003 (3E80017C)

f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 02:16:35 2003 (3E800253)

f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 02:04:44 2003 (3E7FFF8C)

f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)

f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 03:04:02 2003 (3E800D72)

f74d7000 f74e6000 disk disk.sys Tue Mar 25 02:05:20 2003 (3E7FFFB0)

f74e7000 f74f3000 Dfs Dfs.sys Tue Mar 25 02:09:52 2003 (3E8000C0)

f74f7000 f7500000 crcdisk crcdisk.sys Tue Mar 25 02:07:23 2003 (3E80002B)

f7507000 f7516000 termdd termdd.sys Tue Mar 25 02:02:52 2003 (3E7FFF1C)

f7517000 f7525000 NDProxy NDProxy.SYS Tue Mar 25 02:11:30 2003 (3E800122)

f7537000 f7541000 flpydisk flpydisk.sys Tue Mar 25 02:04:32 2003 (3E7FFF80)

f7547000 f7553000 vga vga.sys Tue Mar 25 02:08:03 2003 (3E800053)

f7557000 f7561000 Msfs Msfs.SYS Tue Mar 25 02:08:56 2003 (3E800088)

f7567000 f7573000 Npfs Npfs.SYS Tue Mar 25 02:08:59 2003 (3E80008B)

f7577000 f7586000 msgpc msgpc.sys Tue Mar 25 02:10:12 2003 (3E8000D4)

f7587000 f7594000 wanarp wanarp.sys Tue Mar 25 02:11:22 2003 (3E80011A)

f7597000 f75a4000 netbios netbios.sys Tue Mar 25 02:09:53 2003 (3E8000C1)

f75a7000 f75b0000 hidusb hidusb.sys Tue Mar 25 02:10:17 2003 (3E8000D9)

f75b7000 f75c5000 HIDCLASS HIDCLASS.SYS Tue Mar 25 02:10:17 2003 (3E8000D9)

f7607000 f7610000 dump_diskdump dump_diskdump.sys Tue Mar 25 02:05:15 2003 (3E7FFFAB)

f7617000 f7620000 watchdog watchdog.sys Tue Mar 25 02:09:01 2003 (3E80008D)

f7627000 f7631000 kbdclass kbdclass.sys Tue Mar 25 02:03:10 2003 (3E7FFF2E)

f7637000 f7641000 mouclass mouclass.sys Tue Mar 25 02:03:09 2003 (3E7FFF2D)

f7647000 f7651000 serenum serenum.sys Tue Mar 25 02:04:01 2003 (3E7FFF61)

f7657000 f7662000 fdc fdc.sys Tue Mar 25 02:04:31 2003 (3E7FFF7F)

f7667000 f7673000 processr processr.sys Tue Mar 25 02:07:36 2003 (3E800038)

f7677000 f7680000 ndistapi ndistapi.sys Tue Mar 25 02:11:28 2003 (3E800120)

f7687000 f7695000 raspppoe raspppoe.sys Tue Mar 25 02:11:37 2003 (3E800129)

f7697000 f76a2000 TDI TDI.SYS Tue Mar 25 02:14:28 2003 (3E8001D4)

f76a7000 f76b2000 ptilink ptilink.sys Tue Mar 25 02:03:51 2003 (3E7FFF57)

f76b7000 f76c0000 raspti raspti.sys Tue Mar 25 02:11:36 2003 (3E800128)

f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 02:08:00 2003 (3E800050)

f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 02:07:58 2003 (3E80004E)

f7717000 f771e000 intelide intelide.sys Tue Mar 25 02:04:45 2003 (3E7FFF8D)

f771f000 f7726000 dmload dmload.sys Tue Mar 25 02:08:08 2003 (3E800058)

f7727000 f772b9a0 dpti2o dpti2o.sys Thu May 02 10:49:25 2002 (3CD151F5)

f773f000 f7746000 Beep Beep.SYS Tue Mar 25 02:03:04 2003 (3E7FFF28)

f7747000 f774e000 Null Null.SYS Tue Mar 25 02:03:05 2003 (3E7FFF29)

f7777000 f777f000 mnmdd mnmdd.SYS Tue Mar 25 02:07:53 2003 (3E800049)

f777f000 f7783e80 usbuhci usbuhci.sys Tue Mar 25 02:10:43 2003 (3E8000F3)

f7787000 f778f000 RDPCDD RDPCDD.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)

f77a7000 f77af000 rasacd rasacd.sys Tue Mar 25 02:11:50 2003 (3E800136)

f77b7000 f77be000 dxgthk dxgthk.sys Tue Mar 25 02:05:52 2003 (3E7FFFD0)

f7817000 f781f000 audstub audstub.sys Tue Mar 25 02:09:12 2003 (3E800098)

f781f000 f7827000 Fs_Rec Fs_Rec.SYS Tue Mar 25 02:08:36 2003 (3E800074)

f7897000 f7899800 SiWinAcc SiWinAcc.sys Thu May 20 14:38:49 2004 (40ACFB39)

f79c9000 f79ca580 USBD USBD.SYS Tue Mar 25 02:10:39 2003 (3E8000EF)

f7a81000 f7a82000 swenum swenum.sys Wed Dec 04 12:10:07 2002 (3DEE36EF)

Unloaded modules:

f468e000 f46a0000 naveng.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f46a0000 f4756000 navex15.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f4b7e000 f4b8c000 EraserUtilDr

Timestamp: unavailable (00000000)

Checksum: 00000000

f5497000 f54a9000 naveng.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f54a9000 f555f000 navex15.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f5e07000 f5e15000 EraserUtilDr

Timestamp: unavailable (00000000)

Checksum: 00000000

f59bf000 f59d0000 naveng.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f59d0000 f5a69000 navex15.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f59bf000 f59d0000 naveng.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f59d0000 f5a69000 navex15.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f59bf000 f59d0000 naveng.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f59d0000 f5a69000 navex15.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f679b000 f67f2000 wlbs.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f75c7000 f75d5000 imapi.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

f780f000 f7817000 Sfloppy.SYS

Timestamp: unavailable (00000000)

Checksum: 00000000

Closing open log file c:\debuglog.txt

cpc2004 · 3rd March 2006

Hi,

Your version of Norton AV is unstable. Upgrade Norton AV to latest patch. Run memtest to stress test the ram to make sure that the ram is at the good shape.

matt8454 · 13th March 2006

The SAV was the root cause of the issue, an upgrade resolved the errors.

thanks