Windows 2003 server BSOD

szabomester · 19th February 2009

Hello,

I have a W2003 server that STOPs sometimes with the following Stop error:

Stop error
Reason Code: 0x805000f
Bugcheck String: 0x0000000a (0xfffffffb, 0x00000002, 0x00000000, 0x8082006c)

The server is a virtual server hosted on a MS Virtual Server 2005 SP1.

I would greatly appreciate any help with this issue. I am attaching the last memory dump.

Thank you in advance for your help.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini021909-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp2_gdr.080813-1204
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Thu Feb 19 10:37:46.742 2009 (GMT+1)
System Uptime: 4 days 22:46:00.507
Loading Kernel Symbols
...............................................................
.....................................
Loading User Symbols
Loading unloaded module list
...
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffffb, 2, 0, 8082006c}

*** WARNING: Unable to verify checksum for mssmbios.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffb, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8082006c, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: fffffffb

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertTimerTable+31
8082006c 3b42fc cmp eax,dword ptr [edx-4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xA

PROCESS_NAME: sqlservr.exe

TRAP_FRAME: f353bc3c -- (.trap 0xfffffffff353bc3c)
.trap 0xfffffffff353bc3c
ESP EDITED! New esp=00000000
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=00000000 esp=f353bcb0 ebp=00000000 iopl=0 nv up di pl nz na po nc
cs=0000 ss=0010 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
00000000 ?? ???
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 00000000 to 80826693

STACK_TEXT:
f353bc3c 00000000 00000000 00000000 00000000 nt!KiTrap0E+0x2a1
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x0

STACK_COMMAND: .bugcheck ; kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
!chkimg -lo 50 -d !nt
808264a2-808264a7 6 bytes - nt!KiTrap0E+b0

[ fb f7 45 70 00 02:90 e9 7a 4c 01 09 ]
6 errors : !nt (808264a2-808264a7)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

eax=ffdff13c ebx=00000002 ecx=00000001 edx=40000000 esi=ffdff120 edi=fffffffb
eip=80826693 esp=f353bc24 ebp=f353bc3c iopl=0 nv up ei ng nz na pe nc
cs=0009 ss=0011 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a1:
80826693 833dc0828a8000 cmp dword ptr [nt!KiFreezeFlag (808a82c0)],0 ds:0023:808a82c0=????????
ChildEBP RetAddr Args to Child
f353bc3c 00000000 00000000 00000000 00000000 nt!KiTrap0E+0x2a1 (FPO: [0,0] TrapFrame-EDITED @ f353bc3c)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x0
start end module name
80800000 80a73000 nt ntoskrnl.exe Wed Aug 13 12:49:25 2008 (48A2BC35)
80a73000 80a92000 hal halacpi.dll Sat Feb 17 06:48:25 2007 (45D69729)
bf800000 bf9d0000 win32k win32k.sys Mon Sep 15 15:22:02 2008 (48CE617A)
bf9d0000 bf9e7000 dxg dxg.sys Sat Feb 17 07:14:39 2007 (45D69D4F)
bf9e7000 bfa00000 vpc_s3_bf9e7000 vpc-s3.dll Tue Apr 24 22:18:48 2007 (462E6628)
bffa0000 bffea000 ATMFD ATMFD.DLL Sat Feb 17 14:59:31 2007 (45D70A43)
f2943000 f296d000 Fastfat Fastfat.SYS unavailable (00000000)
f2e45000 f2e70000 RDPWD RDPWD.SYS unavailable (00000000)
f34d8000 f34e3000 TDTCP TDTCP.SYS unavailable (00000000)
f3a00000 f3a5e000 srv srv.sys unavailable (00000000)
f3a5e000 f3a7a000 MRxVPC MRxVPC.sys unavailable (00000000)
f3aa2000 f3af2000 HTTP HTTP.sys unavailable (00000000)
f3bba000 f3c07000 eamon eamon.sys unavailable (00000000)
f3e5f000 f3e73000 epfw epfw.sys unavailable (00000000)
f3fcb000 f3fd5000 ndisuio ndisuio.sys unavailable (00000000)
f4023000 f4038000 Cdfs Cdfs.SYS unavailable (00000000)
f643a000 f644e000 vmsrvc vmsrvc.sys unavailable (00000000)
f649e000 f64af000 Fips Fips.SYS unavailable (00000000)
f64af000 f6525000 mrxsmb mrxsmb.sys unavailable (00000000)
f654d000 f657d000 rdbss rdbss.sys unavailable (00000000)
f657d000 f65a7000 afd afd.sys unavailable (00000000)
f65a7000 f65d8000 netbt netbt.sys unavailable (00000000)
f65d8000 f65ea000 epfwtdi epfwtdi.sys unavailable (00000000)
f65ea000 f667a000 tcpip tcpip.sys unavailable (00000000)
f667a000 f6693000 ipsec ipsec.sys unavailable (00000000)
f6753000 f67b2000 update update.sys unavailable (00000000)
f67b2000 f67d9000 ks ks.sys unavailable (00000000)
f6801000 f6838000 rdpdr rdpdr.sys unavailable (00000000)
f6838000 f684a000 raspptp raspptp.sys unavailable (00000000)
f686a000 f6874000 Dxapi Dxapi.sys unavailable (00000000)
f687a000 f6884000 dump_scsiport dump_scsiport.sys unavailable (00000000)
f68ca000 f68d7000 wanarp wanarp.sys unavailable (00000000)
f68ea000 f6903000 ndiswan ndiswan.sys unavailable (00000000)
f6903000 f6917000 rasl2tp rasl2tp.sys unavailable (00000000)
f6917000 f6928000 dc21x4 dc21x4.sys unavailable (00000000)
f6928000 f6944000 VIDEOPRT VIDEOPRT.SYS unavailable (00000000)
f6944000 f695b000 vpc_s3 vpc-s3.sys unavailable (00000000)
f695b000 f6970000 cdrom cdrom.sys unavailable (00000000)
f6987000 f699f000 parport parport.sys unavailable (00000000)
f699f000 f69b4000 serial serial.sys unavailable (00000000)
f69b4000 f69c7000 i8042prt i8042prt.sys unavailable (00000000)
f7212000 f7231000 Mup Mup.sys unavailable (00000000)
f7231000 f7270000 NDIS NDIS.sys unavailable (00000000)
f7270000 f7305000 Ntfs Ntfs.sys unavailable (00000000)
f7305000 f732b000 KSecDD KSecDD.sys unavailable (00000000)
f732b000 f7350000 fltMgr fltMgr.sys unavailable (00000000)
f7350000 f7363000 CLASSPNP CLASSPNP.SYS unavailable (00000000)
f7363000 f7382000 SCSIPORT SCSIPORT.SYS unavailable (00000000)
f7382000 f739f000 atapi atapi.sys unavailable (00000000)
f739f000 f73c9000 volsnap volsnap.sys unavailable (00000000)
f73c9000 f73f5000 dmio dmio.sys unavailable (00000000)
f73f5000 f741c000 ftdisk ftdisk.sys unavailable (00000000)
f741c000 f7432000 pci pci.sys unavailable (00000000)
f7432000 f7466000 ACPI ACPI.sys unavailable (00000000)
f7487000 f7490000 WMILIB WMILIB.SYS unavailable (00000000)
f7497000 f74a6000 isapnp isapnp.sys unavailable (00000000)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS unavailable (00000000)
f74b7000 f74c7000 MountMgr MountMgr.sys unavailable (00000000)
f74c7000 f74d2000 PartMgr PartMgr.sys unavailable (00000000)
f74d7000 f74e5000 aic78xx aic78xx.sys unavailable (00000000)
f74e7000 f74f7000 disk disk.sys unavailable (00000000)
f74f7000 f7503000 Dfs Dfs.sys unavailable (00000000)
f7507000 f7511000 crcdisk crcdisk.sys unavailable (00000000)
f7527000 f7531000 flpydisk flpydisk.sys unavailable (00000000)
f7537000 f7543000 vga vga.sys unavailable (00000000)
f7547000 f7552000 Msfs Msfs.SYS unavailable (00000000)
f7557000 f7564000 Npfs Npfs.SYS unavailable (00000000)
f7567000 f7575000 msgpc msgpc.sys unavailable (00000000)
f7577000 f7584000 netbios netbios.sys unavailable (00000000)
f7597000 f75a6000 easdrv easdrv.sys unavailable (00000000)
f75a7000 f75b2000 kbdclass kbdclass.sys unavailable (00000000)
f75b7000 f75c1000 mouclass mouclass.sys unavailable (00000000)
f75c7000 f75d1000 serenum serenum.sys unavailable (00000000)
f75d7000 f75e2000 fdc fdc.sys unavailable (00000000)
f75e7000 f75f0000 watchdog watchdog.sys unavailable (00000000)
f75f7000 f7602000 Epfwndis Epfwndis.sys unavailable (00000000)
f7607000 f7610000 ndistapi ndistapi.sys unavailable (00000000)
f7647000 f7656000 raspppoe raspppoe.sys unavailable (00000000)
f7657000 f7662000 TDI TDI.SYS unavailable (00000000)
f7667000 f7672000 ptilink ptilink.sys unavailable (00000000)
f7677000 f7680000 raspti raspti.sys unavailable (00000000)
f7687000 f7696000 termdd termdd.sys unavailable (00000000)
f7697000 f76a0000 mssmbios mssmbios.sys unavailable (00000000)
f76a7000 f76b5000 NDProxy NDProxy.SYS unavailable (00000000)
f7707000 f770f000 kdcom kdcom.dll unavailable (00000000)
f770f000 f7717000 BOOTVID BOOTVID.dll unavailable (00000000)
f7717000 f771e000 intelide intelide.sys unavailable (00000000)
f771f000 f7726000 dmload dmload.sys unavailable (00000000)
f7727000 f772f000 msvmscsi msvmscsi.sys unavailable (00000000)
f777f000 f7787000 msvmmouf msvmmouf.sys unavailable (00000000)
f7787000 f778f000 audstub audstub.sys unavailable (00000000)
f7797000 f779e000 parvdm parvdm.sys unavailable (00000000)
f77bf000 f77c7000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
f77c7000 f77ce000 Null Null.SYS unavailable (00000000)
f77cf000 f77d6000 Beep Beep.SYS unavailable (00000000)
f77d7000 f77df000 mnmdd mnmdd.SYS unavailable (00000000)
f77df000 f77e7000 RDPCDD RDPCDD.sys unavailable (00000000)
f77e7000 f77ef000 rasacd rasacd.sys unavailable (00000000)
f77f7000 f77ff000 dump_msvmscsi dump_msvmscsi.sys unavailable (00000000)
f7807000 f780e000 dxgthk dxgthk.sys unavailable (00000000)
f7993000 f7995000 swenum swenum.sys unavailable (00000000)

Unloaded modules:
f7587000 f7595000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6569000 f657d000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77b7000 f77bf000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

**Arie** · 19th February 2009

Quote:

Originally Posted by szabomester

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

Start by testing your memory. Run Memtest86 or Windows Memory Diagnostic.

Please note:

Quote:

Memory checking programs are not adequate because they don't test the memory the way that Windows uses it. Most, if not all, memory checkers use read/write cycles when scanning memory. Since Windows is executing code from the memory, it uses execute cycles. Execute cycles are physically different from read/write cycles and are more vulnerable to parity errors. It is possible for memory checking programs to find parity errors if the memory is extremely faulty.

**PeteC** · 19th February 2009

Additional info .....

The only satisfactory way of testing RAM is to test the installed RAM in various configurations. If you have a single module swap it around the slots. If you have a pair of modules run each one singly, swapping between slots; then run them in pairs swapping between pairs of slots. If you have 2 sets of matched modules do not get them mixed up.