zonealarm & stop [DUMP DATA]

I've got a windows 2000 server booting at least 3 times a day.. really want .. I think it could be vsdatant.sys but the dump says the buggy driver is ntkrnlmp.exe..

any assistance would help !! thx


kd> !analyze -v;r;kv;lmtn
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8006543a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000014

CURRENT_IRQL: 2

FAULTING_IP:
hal!KfAcquireSpinLock+1a
8006543a f00fba2900 lock bts dword ptr [ecx],0x0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from ffffffff to 80469eec

STACK_TEXT:
f670eac0 ffffffff 804617d0 80401d20 ffffffff nt!KiCoprocessorError+0x18
0000003d 00000000 00000000 00000000 00000000 0xffffffff


FOLLOWUP_IP:
nt!KiCoprocessorError+18
80469eec f7457000000200 test dword ptr [ebp+0x70],0x20000

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiCoprocessorError+18

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41773335

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_W_VFL_VRF_nt!KiCoprocessorError+18

BUCKET_ID: 0xA_W_VFL_VRF_nt!KiCoprocessorError+18

Followup: MachineOwner
---------

eax=ffdff13c ebx=0000000a ecx=00000001 edx=40000000 esi=8006543a edi=00000014
eip=80469eec esp=f670eaac ebp=f670eac0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiCoprocessorError+0x18:
80469eec f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:f670eb30=00010246
ChildEBP RetAddr Args to Child
f670eac0 ffffffff 804617d0 80401d20 ffffffff nt!KiCoprocessorError+0x18
0000003d 00000000 00000000 00000000 00000000 0xffffffff
start end module name
00400000 00546000 vsmon vsmon.exe Wed Jan 26 09:29:41 2005 (41F76305)
01150000 01162000 vsdb vsdb.dll Wed Jan 26 11:56:19 2005 (41F78563)
01c80000 01c97000 vsxml vsxml.dll Wed Jan 26 11:56:51 2005 (41F78583)
01cc0000 01cde000 VSINIT VSINIT.dll Wed Jan 26 11:56:47 2005 (41F7857F)
02350000 02363000 vsavpro vsavpro.dll Wed Jan 26 11:56:15 2005 (41F7855F)
04000000 04012000 vsdata vsdata.dll Wed Jan 26 11:56:16 2005 (41F78560)
50000000 50067000 VSUTIL VSUTIL.dll Wed Jan 26 11:56:45 2005 (41F7857D)
50200000 502ff000 VSRULEDB VSRULEDB.DLL Wed Jan 26 11:56:41 2005 (41F78579)
50a00000 50a34000 vsvault vsvault.dll Wed Jan 26 11:56:50 2005 (41F78582)
50e00000 50e6e000 SSLEAY32 SSLEAY32.dll Wed Jan 26 11:56:13 2005 (41F7855D)
52600000 52611000 zlcomm zlcomm.dll Wed Jan 26 11:56:55 2005 (41F78587)
52800000 5280f000 ZLCommDB ZLCommDB.dll Wed Jan 26 11:56:55 2005 (41F78587)
53200000 53214000 camupd camupd.dll Wed Jan 26 11:56:16 2005 (41F78560)
63000000 63096000 Wininet Wininet.dll Wed Dec 08 00:36:55 2004 (41B64CA7)
690a0000 690ab000 psapi psapi.dll Tue Nov 30 09:34:02 1999 (38439A0A)
69bf0000 69c0d000 NTMARTA NTMARTA.DLL Fri Jun 20 03:44:11 2003 (3EF274FB)
70a70000 70ad6000 SHLWAPI SHLWAPI.dll Wed Dec 08 02:11:49 2004 (41B662E5)
71710000 71794000 COMCTL32 COMCTL32.dll Thu Aug 29 15:13:07 2002 (3D6E2BF3)
74fd0000 74fee000 msafd msafd.dll Fri Jun 20 03:44:06 2003 (3EF274F6)
75010000 75017000 wshtcpip wshtcpip.dll Fri Jun 20 03:44:22 2003 (3EF27506)
75020000 75028000 WS2HELP WS2HELP.DLL Tue Nov 30 09:31:09 1999 (3843995D)
75030000 75044000 WS2_32 WS2_32.DLL Fri Jun 20 03:44:22 2003 (3EF27506)
75050000 75058000 WSOCK32 WSOCK32.dll Fri Jun 20 03:44:22 2003 (3EF27506)
75150000 7515f000 SAMLIB SAMLIB.dll Wed Mar 24 02:17:02 2004 (4060EF9E)
75170000 751bf000 NETAPI32 NETAPI32.DLL Thu Jun 10 17:58:10 2004 (40C89322)
751c0000 751c6000 NETRAP NETRAP.dll Tue Nov 30 09:31:07 1999 (3843995B)
759b0000 759b6000 LZ32 LZ32.DLL Fri Jun 20 03:43:46 2003 (3EF274E2)
75ab0000 75ab5000 sensapi sensapi.dll Fri Jun 20 03:43:46 2003 (3EF274E2)
76620000 76630000 MPR MPR.dll Tue Jun 22 02:35:10 2004 (40D78CCE)
77320000 77337000 MPRAPI MPRAPI.DLL Wed Dec 01 07:37:29 1999 (3844D039)
77340000 77353000 iphlpapi iphlpapi.dll Fri Jun 20 03:43:42 2003 (3EF274DE)
77360000 77379000 DHCPCSVC DHCPCSVC.DLL Fri Jun 20 03:43:42 2003 (3EF274DE)
77380000 773a3000 ADSLDPC ADSLDPC.DLL Fri Jun 20 03:43:42 2003 (3EF274DE)
773b0000 773df000 ACTIVEDS ACTIVEDS.DLL Fri Jun 20 03:43:42 2003 (3EF274DE)
77430000 77440000 MSASN1 MSASN1.DLL Wed Mar 24 02:17:00 2004 (4060EF9C)
774c0000 774d1000 RASMAN RASMAN.DLL Fri May 02 01:39:13 2003 (3EB1BE31)
774e0000 77513000 rasapi32 rasapi32.dll Fri Jun 20 03:43:42 2003 (3EF274DE)
77520000 77525000 ICMP ICMP.DLL Wed Dec 01 07:37:29 1999 (3844D039)
77530000 77552000 TAPI32 TAPI32.DLL Fri Jun 20 03:43:42 2003 (3EF274DE)
777e0000 777e8000 winrnr winrnr.dll Wed Dec 01 07:37:27 1999 (3844D037)
777f0000 777f5000 rasadhlp rasadhlp.dll Wed Dec 01 07:37:27 1999 (3844D037)
77800000 7781e000 WINSPOOL WINSPOOL.DRV Fri Jun 20 03:43:41 2003 (3EF274DD)
77820000 77827000 VERSION VERSION.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
77830000 7783e000 RTUTILS RTUTILS.DLL Wed Dec 01 07:37:27 1999 (3844D037)
77880000 7790e000 SETUPAPI SETUPAPI.DLL Fri Jun 20 03:43:41 2003 (3EF274DD)
77950000 7797a000 WLDAP32 WLDAP32.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
77980000 779a4000 DNSAPI DNSAPI.DLL Wed Mar 24 02:17:00 2004 (4060EF9C)
779b0000 77a4b000 OLEAUT32 OLEAUT32.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
77a50000 77b3f000 ole32 ole32.dll Tue Jan 18 04:47:38 2005 (41EC94EA)
77bf0000 77c01000 NTDSAPI NTDSAPI.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
77d30000 77da1000 RPCRT4 RPCRT4.DLL Thu Mar 11 21:29:21 2004 (4050DA31)
77e10000 77e6f000 USER32 USER32.dll Wed Dec 29 09:14:10 2004 (41D27562)
77f40000 77f7b000 GDI32 GDI32.dll Tue Jun 22 02:35:10 2004 (40D78CCE)
77f80000 77ffd000 ntdll ntdll.dll Wed Mar 24 02:16:59 2004 (4060EF9B)
78000000 78045000 MSVCRT MSVCRT.dll Tue Mar 11 18:55:17 2003 (3E6E3115)
782c0000 782cc000 rnr20 rnr20.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
782f0000 78535000 SHELL32 SHELL32.dll Fri Dec 10 09:27:29 2004 (41B96C01)
7c0f0000 7c151000 USERENV USERENV.dll Tue Aug 05 23:14:10 2003 (3F302C32)
7c2d0000 7c332000 ADVAPI32 ADVAPI32.dll Wed Mar 24 02:17:00 2004 (4060EF9C)
7c340000 7c34f000 Secur32 Secur32.dll Fri Jun 20 03:43:41 2003 (3EF274DD)
7c570000 7c623000 KERNEL32 KERNEL32.dll Tue Jun 22 02:35:10 2004 (40D78CCE)
7c740000 7c7c7000 Crypt32 Crypt32.dll Wed Mar 24 02:17:00 2004 (4060EF9C)
7ca00000 7ca23000 rsaenh rsaenh.dll Fri Oct 18 07:17:02 2002 (3DAFA75E)
80062000 80076460 hal halmacpi.dll Fri Mar 21 02:04:42 2003 (3E7A733A)
80400000 805a0340 nt ntkrnlmp.exe Thu Oct 21 04:55:33 2004 (41773335)
a0000000 a018ec40 win32k win32k.sys Fri Dec 24 17:23:30 2004 (41CC5092)
a018f000 a01bc500 ati2drad ati2drad.dll Tue Sep 26 21:10:36 2000 (39D102BC)
f1c00000 f1c0e6a0 pci pci.sys Wed Jan 15 19:44:07 2003 (3E25BA07)
f1c10000 f1c1b680 isapnp isapnp.sys Wed Jan 15 19:43:47 2003 (3E25B9F3)
f1c20000 f1c2faa0 adpu160m adpu160m.sys Wed Jan 15 19:42:27 2003 (3E25B9A3)
f1c30000 f1c38140 perc2 perc2.sys Mon Oct 29 17:21:24 2001 (3BDD9014)
f1c40000 f1c48700 CLASSPNP CLASSPNP.SYS Wed Jan 15 19:42:51 2003 (3E25B9BB)
f1c60000 f1c6c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 19:47:20 2003 (3E25BAC8)
f1c70000 f1c7b680 i8042prt i8042prt.sys Wed Apr 16 05:00:59 2003 (3E9CD57B)
f1c80000 f1c8f400 serial serial.sys Wed Apr 16 05:19:39 2003 (3E9CD9DB)
f1c90000 f1c9ca80 rasl2tp rasl2tp.sys Wed Apr 30 00:05:06 2003 (3EAF0522)
f1ca0000 f1cabc40 raspptp raspptp.sys Thu May 15 00:47:00 2003 (3EC2D574)
f1cc0000 f1cc9be0 usbhub usbhub.sys Tue Mar 18 23:30:41 2003 (3E77AC21)
f1ce0000 f1ce9ce0 NDProxy NDProxy.SYS Fri Oct 01 00:25:35 1999 (37F3F16F)
f1cf0000 f1cf8fa0 Npfs Npfs.SYS Sun Oct 10 00:58:07 1999 (37FFD68F)
f1d00000 f1d08680 msgpc msgpc.sys Wed Jan 15 19:54:25 2003 (3E25BC71)
f1d10000 f1d181a0 netbios netbios.sys Tue Oct 12 20:34:19 1999 (38038D3B)
f1d50000 f1d58140 dump_perc2 dump_perc2.sys Mon Oct 29 17:21:24 2001 (3BDD9014)
f1dc0000 f1dc8a60 termdd termdd.sys Fri Mar 21 21:43:08 2003 (3E7B876C)
f1e60000 f1e6efe0 Cdfs Cdfs.SYS Wed Apr 16 04:58:53 2003 (3E9CD4FD)
f1e80000 f1e85520 PCIIDEX PCIIDEX.SYS Tue Feb 25 18:31:08 2003 (3E5BB66C)
f1e88000 f1e8f4c0 MountMgr MountMgr.sys Tue Feb 10 19:47:53 2004 (40293569)
f1e90000 f1e97720 disk disk.sys Wed Jan 15 19:43:05 2003 (3E25B9C9)
f1ee0000 f1ee4400 ptilink ptilink.sys Wed Jan 15 19:47:15 2003 (3E25BAC3)
f1ef0000 f1ef40e0 raspti raspti.sys Fri Oct 08 21:45:10 1999 (37FE57D6)
f1f10000 f1f17d00 wanarp wanarp.sys Fri Aug 16 13:25:01 2002 (3D5CEF1D)
f1f68000 f1f6e580 fdc fdc.sys Wed Jan 15 19:42:51 2003 (3E25B9BB)
f1f70000 f1f74a60 flpydisk flpydisk.sys Wed Jan 15 19:42:52 2003 (3E25B9BC)
f1f80000 f1f85ec0 kbdclass kbdclass.sys Thu Feb 20 16:37:30 2003 (3E55044A)
f1f90000 f1f95400 mouclass mouclass.sys Thu Feb 20 16:37:45 2003 (3E550459)
f1f98000 f1f9c8c0 TDTCP TDTCP.SYS Fri Mar 21 21:43:08 2003 (3E7B876C)
f1fa0000 f1fa6a20 EFS EFS.SYS Wed Jan 15 19:46:55 2003 (3E25BAAF)
f1fb0000 f1fb6c40 cdrom cdrom.sys Wed Jan 15 19:43:04 2003 (3E25B9C8)
f1fb8000 f1fbdfa0 HIDCLASS HIDCLASS.SYS Wed Jan 15 19:45:26 2003 (3E25BA56)
f1fc0000 f1fc5fc0 openhci openhci.sys Sat Mar 01 00:28:59 2003 (3E5FFECB)
f1fd8000 f1fdcfc0 USBD USBD.SYS Wed Jan 22 17:05:33 2003 (3E2ECF5D)
f1fe0000 f1fe5900 HIDPARSE HIDPARSE.SYS Tue Apr 08 18:34:46 2003 (3E930836)
f2000000 f2005240 Msfs Msfs.SYS Wed Oct 27 00:21:32 1999 (3816377C)
f2010000 f2012a20 BOOTVID BOOTVID.dll Thu Nov 04 01:24:33 1999 (3820E051)
f2014000 f2016d00 PartMgr PartMgr.sys Wed Jan 15 19:43:07 2003 (3E25B9CB)
f208c000 f208f6c0 dump_diskdump dump_diskdump.sys Tue Feb 25 19:18:04 2003 (3E5BC16C)
f2090000 f2093640 serenum serenum.sys Wed Jan 15 19:47:01 2003 (3E25BAB5)
f209c000 f209e2e0 ndistapi ndistapi.sys Wed Jan 15 19:54:15 2003 (3E25BC67)
f20ac000 f20afe60 TDI TDI.SYS Wed Jan 15 19:56:26 2003 (3E25BCEA)
f20fc000 f20ff580 vga vga.sys Sat Sep 25 19:37:40 1999 (37ED1674)
f2100000 f2101d20 Diskperf Diskperf.sys Wed Feb 12 21:34:38 2003 (3E4ABDEE)
f2102000 f2103b80 dmload dmload.sys Wed Jan 15 19:47:06 2003 (3E25BABA)
f2104000 f21056e0 perc2hib perc2hib.sys Mon Oct 29 17:21:36 2001 (3BDD9020)
f210e000 f210fca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 19:53:30 2003 (3E25BC3A)
f2116000 f2117e40 rasacd rasacd.sys Sat Sep 25 19:41:23 1999 (37ED1753)
f21c8000 f21c8f80 WMILIB WMILIB.SYS Sat Sep 25 19:36:47 1999 (37ED163F)
f21c9000 f21c9b00 pciide pciide.sys Wed Jan 15 19:43:03 2003 (3E25B9C7)
f21e8000 f21e8a40 audstub audstub.sys Sat Sep 25 19:35:33 1999 (37ED15F5)
f21f2000 f21f2d80 swenum swenum.sys Sat Sep 25 19:36:31 1999 (37ED162F)
f2204000 f22049e0 Null Null.SYS Sat Sep 25 19:34:58 1999 (37ED15D2)
f2206000 f2206ee0 Beep Beep.SYS Wed Oct 20 23:18:59 1999 (380E3FD3)
f2209000 f2209f80 mnmdd mnmdd.SYS Sat Sep 25 19:37:40 1999 (37ED1674)
f5de9000 f5ded4a0 asyncmac asyncmac.sys Wed Jan 15 19:54:23 2003 (3E25BC6F)
f6099000 f60aef00 RDPWD RDPWD.SYS Wed Jan 21 19:50:25 2004 (400ED801)
f60af000 f60c2ac0 ipsec ipsec.sys Mon Apr 21 19:19:40 2003 (3EA4363C)
f6323000 f6325f20 spud spud.sys Fri Nov 19 23:36:27 1999 (3835DEFB)
f65c3000 f65febc0 srv srv.sys Wed Apr 30 00:05:07 2003 (3EAF0523)
f673f000 f675c4a0 afd afd.sys Wed Apr 30 09:45:29 2003 (3EAF8D29)
f6845000 f684d240 Fips Fips.SYS Tue May 09 16:28:29 2000 (39182E9D)
f68ed000 f690f3c0 Fastfat Fastfat.SYS Wed Jan 15 19:48:39 2003 (3E25BB17)
f6910000 f6974ca0 mrxsmb mrxsmb.sys Thu Jan 20 07:25:21 2005 (41EF5CE1)
f69af000 f69d8900 rdbss rdbss.sys Fri Dec 03 03:37:11 2004 (41AFDF67)
f69d9000 f6a1c000 vsdatant vsdatant.sys Wed Jan 26 09:14:04 2005 (41F75F5C)
f6a1c000 f6a43e00 netbt netbt.sys Wed Jul 16 20:44:26 2003 (3F15AB1A)
f6a44000 f6a95060 tcpip tcpip.sys Wed Apr 30 00:05:31 2003 (3EAF053B)
f731e000 f73483a0 update update.sys Wed Apr 16 05:22:01 2003 (3E9CDA69)
f7349000 f7364b40 ks ks.sys Wed Apr 16 05:02:11 2003 (3E9CD5C3)
f7377000 f739a060 rdpdr rdpdr.sys Fri Mar 21 21:43:14 2003 (3E7B8772)
f739b000 f73b1ba0 ndiswan ndiswan.sys Wed Apr 30 00:05:01 2003 (3EAF051D)
f73b2000 f73d0e00 e1000nt5 e1000nt5.sys Fri Mar 12 18:44:28 2004 (4052050C)
f73f9000 f7439ac0 ati2mpad ati2mpad.sys Tue Sep 26 21:10:58 2000 (39D102D2)
f746b000 f7480640 Mup Mup.sys Wed Jan 15 19:54:01 2003 (3E25BC59)
f7481000 f74aaaa0 NDIS NDIS.sys Wed Apr 30 00:05:01 2003 (3EAF051D)
f74ab000 f7528800 Ntfs Ntfs.sys Wed Jun 04 23:11:33 2003 (3EDE6E95)
f7529000 f753a7c0 KSecDD KSecDD.sys Sun Sep 21 01:32:19 2003 (3F6CF193)
f753b000 f754d1c0 Dfs Dfs.sys Wed Feb 12 02:19:06 2003 (3E49AF1A)
f754e000 f75600c0 SCSIPORT SCSIPORT.SYS Sat May 17 02:11:02 2003 (3EC58C26)
f7561000 f7576180 atapi atapi.sys Tue Apr 01 19:08:25 2003 (3E89D599)
f7577000 f75989c0 dmio dmio.sys Wed Jan 15 19:47:04 2003 (3E25BAB8)
f7599000 f75b5220 ftdisk ftdisk.sys Mon Mar 31 23:21:58 2003 (3E88BF86)
f75b6000 f75ddc20 ACPI ACPI.sys Wed Jan 15 19:44:22 2003 (3E25BA16)

Unloaded modules:
f20e4000 f20e8000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f20ec000 f20f0000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1fc8000 f1fcf000 Parport.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f1d20000 f1d29000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1ff0000 f1ff5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f20f4000 f20f7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 

Can you post a second dump. This one is very strange and before we go too deep into assuming this really is the problem, i'd like to see another one. (you can trim off the drivers information to save space)

 

Hi Ben,

thanks for the feedback - I am not sure what you mean by another dump ... if I do a !analyze -v;r;kv;lmtn I get the same results that I pasted in my post.

(the last line is :

f20f4000 f20f7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
)


Do you want me to run another command.. maybe ?

I can attach the mini-dump but I am not sure how to do this on this forum ?

 

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: symbols timestamp is wrong 0x41773335 0x3ee6c002 for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80484b80
Debug session time: Tue Mar 29 09:54:53.906 2005 (GMT+1)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: symbols timestamp is wrong 0x41773335 0x3ee6c002 for ntoskrnl.exe
Loading Kernel Symbols
.......................................................................................
Loading unloaded module list
.......
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {14, 2, 1, 8006543a}

*** WARNING: symbols timestamp is wrong 0x3e7a733a 0x3e25b985 for hal.dll
Probably caused by : ntoskrnl.exe ( nt!ExRaiseException+58 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8006543a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: unable to read from 80482fac
unable to read from 80482a08
unable to read from 804828e0
unable to read from 80474e00
unable to read from 804828f8
unable to read from 80482a04
unable to read from 80474e04
unable to read from 80482ac4
unable to read from 80482f80
00000014

CURRENT_IRQL: 2

FAULTING_IP:
hal!CpSendModemString+9e
8006543a ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 00000000 to 80469eec

STACK_TEXT:
bec44aa8 00000000 00000014 00000002 00000001 nt!ExRaiseException+0x58


FOLLOWUP_IP:
nt!ExRaiseException+58
80469eec ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExRaiseException+58

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41773335

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_W_nt!ExRaiseException+58

BUCKET_ID: 0xA_W_nt!ExRaiseException+58

Followup: MachineOwner
---------

 

I beleive ben was wanting you to let it crash again, generate a new dump file, and rerun the tool. The specific crash you posted in your original post was indicating the CPU may be bad. We'd like to see a few dumps that all confirm that diagnosis, before advice is given.

 

Thanks Joe,

The mini-dump I pasted above (today) was a mini-dump that happened this morning. Will the mini dump do or should I let windows log the full dump when it crashes again ?

thx.

 

youll need to leave it setup for full or kernel dumps. These dumps are not really actionable.. they are crashing in places that are really generic. get two more, making sure to save each one, and we'll start guessing if we dont get some better stacks.

 

Ok - the server behaved all day until a few min ago - here is the full kernel dump:It seem that uncle ZoneAlarm is indeed the culprit (vsdatant)

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8006543a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000014

CURRENT_IRQL: 2

FAULTING_IP:
hal!KfAcquireSpinLock+1a
8006543a f00fba2900 lock bts dword ptr [ecx],0x0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from bf19090a to 8006543a

TRAP_FRAME: bedacac0 -- (.trap ffffffffbedacac0)
.trap ffffffffbedacac0
ErrCode = 00000002
eax=00000000 ebx=859bb001 ecx=00000014 edx=00000000 esi=85537568 edi=00000000
eip=8006543a esp=bedacb34 ebp=bedacb4c iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
hal!KfAcquireSpinLock+0x1a:
8006543a f00fba2900 lock bts dword ptr [ecx],0x0 ds:0023:00000014=????????
.trap
Resetting default scope

STACK_TEXT:
bedacb30 bf19090a 859bb001 854f0008 859bb0f4 hal!KfAcquireSpinLock+0x1a
bedacb4c bf424bd5 85551008 85537568 00000000 afd!AfdDisconnectEventHandler+0x2b
WARNING: Stack unwind information not available. Following frames may be wrong.
804660b4 c10ff000 90c34001 ffffffb8 c10ff0ff vsdatant+0x29bd5
804660b4 c10ff000 90c34001 ffffffb8 c10ff0ff 0xc10ff000
000001b8 00000000 00000000 00000000 00000000 0xc10ff000


FOLLOWUP_IP:
vsdatant+29bd5
bf424bd5 6a07 push 0x7

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: vsdatant+29bd5

MODULE_NAME: vsdatant

IMAGE_NAME: vsdatant.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41f75f5c

STACK_COMMAND: .trap ffffffffbedacac0 ; kb

FAILURE_BUCKET_ID: 0xA_W_vsdatant+29bd5

BUCKET_ID: 0xA_W_vsdatant+29bd5

Followup: MachineOwner
---------

eax=85e7613c ebx=0000000a ecx=00000001 edx=40000000 esi=8006543a edi=00000014
eip=80469eec esp=bedacaac ebp=bedacac0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x210:
80469eec f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:bedacb30=00010246
ChildEBP RetAddr Args to Child
bedacac0 8006543a 804617d0 80401d20 ffffffff nt!KiTrap0E+0x210 (FPO: [0,0] TrapFrame @ bedacac0)
bedacb30 bf19090a 859bb001 854f0008 859bb0f4 hal!KfAcquireSpinLock+0x1a (FPO: [0,0,0])
bedacb4c bf424bd5 85551008 85537568 00000000 afd!AfdDisconnectEventHandler+0x2b (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
804660b4 c10ff000 90c34001 ffffffb8 c10ff0ff vsdatant+0x29bd5
804660b4 c10ff000 90c34001 ffffffb8 c10ff0ff 0xc10ff000
000001b8 00000000 00000000 00000000 00000000 0xc10ff000

 

ok, we are getting more interesting. I'd need to do some research in the code, but its possible the spinlock we are processing was allocated by that driver. Its hard to say for sure though without debugging it.

Can't you just crash normally so i can fix you