Windows SBS 2003 BSOD

Hello all. I am having an issue where my server is crashing every few days during a backup with the listed error. Error code 000000c5, parameter1 00000000, parameter2 d0000002, parameter3 00000001, parameter4 808921dd. I've also attached the mini dump below.

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\allan.NWMNS\Desktop\Mini053008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri May 30 23:02:30.771 2008 (GMT-6)
System Uptime: 9 days 6:54:57.042
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {0, d0000002, 1, 808921dd}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1d7 )

Followup: Pool_corruption
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 808921dd, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_D0000002

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1d7
808921dd 8937 mov dword ptr [edi],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: System

IRP_ADDRESS: 8b2278a0

TRAP_FRAME: f791e6cc -- (.trap 0xfffffffff791e6cc)
ErrCode = 00000002
eax=8b798348 ebx=00000000 ecx=000001ff edx=8b798220 esi=8b797008 edi=00000000
eip=808921dd esp=f791e740 ebp=f791e778 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x1d7:
808921dd 8937 mov dword ptr [edi],esi ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 808921dd to 8088c963

STACK_TEXT:
f791e6cc 808921dd badb0d00 8b798220 f791e804 nt!KiTrap0E+0x2a7
f791e778 808928c3 808aeae0 00000000 893784a0 nt!ExDeferredFreePool+0x1d7
f791e7d0 80821675 89378470 00000000 8b2278e0 nt!ExFreePoolWithTag+0x57f
f791e824 8082dfc3 8b2278e0 f791e870 f791e864 nt!IopCompleteRequest+0xf9
f791e874 80a5c199 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
f791e894 80a5c3d9 8bd76001 00000000 00000000 hal!HalpDispatchSoftwareInterrupt+0x49
f791e8b0 80a5c456 00000001 8bd76000 f791e8dc hal!HalpCheckForSoftwareInterrupt+0x81
f791e8c0 8083129e 8bd76020 8b2278e0 808934f8 hal!KfLowerIrql+0x62
f791e8dc 8082ab7b 8b2278e0 8b2278a0 00000000 nt!KiExitDispatcher+0x130
f791e8fc 8081e237 8b2278e0 00000000 00000000 nt!KeInsertQueueApc+0x57
f791e930 f7326d4b 8ba5ebc8 8bd39898 8ba2a510 nt!IopfCompleteRequest+0x201
f791e964 8081df65 8ba5ebc8 8b2279c4 00000000 ftdisk!FtDiskDeviceControl+0xdeb
f791e978 f72c9288 8ba5b0d8 8bb47808 005c002e nt!IofCallDriver+0x45
f791ebcc f72d3707 8ba5a0d8 8ba5a334 8ba5a0d8 volsnap!VspFlushFileSystemLog+0x5c
f791ebf8 f72dcceb 00000000 12c00000 00000000 volsnap!VspCreateInitialDiffAreaFile+0x1b7
f791ed50 f72cbac7 8ba5b0d8 8924fdb8 8bd76020 volsnap!VspPrepareForSnapshot+0x4c5
f791ed6c 808ec1eb 89789860 88db3b40 808ae5fc volsnap!VspPostWorker+0x1f
f791ed80 8088043d 89789860 00000000 8bd76020 nt!IopProcessWorkItem+0x13
f791edac 80949b7c 89789860 00000000 00000000 nt!ExpWorkerThread+0xeb
f791eddc 8088e062 80880352 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+1d7
808921dd 8937 mov dword ptr [edi],esi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+1d7

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+1d7

BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+1d7

Followup: Pool_corruption
---------

Other running software...
Symantec Backup Exec 11D
Symantec AV 10.1.5.5000
Symantec Mail Security for Microsoft Exchange 5.0
Exchange 2003
SQL 2005
Intel server board S500PSL
4GB RAM

Any help would be greatly appreciated. Thank you.

Below is the full memory dump

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\allan.NWMNS\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri May 30 23:02:30.771 2008 (GMT-6)
System Uptime: 9 days 6:54:57.042
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols

Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {0, d0000002, 1, 808921dd}

Probably caused by : ftdisk.sys ( ftdisk!FtDiskDeviceControl+deb )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 808921dd, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_D0000002

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1d7
808921dd 8937 mov dword ptr [edi],esi

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

IRP_ADDRESS: 8b2278a0

DEVICE_OBJECT: 8ba5ebc8

DRIVER_OBJECT: 8bd39898

IMAGE_NAME: ftdisk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45d69bc5

MODULE_NAME: ftdisk

FAULTING_MODULE: f7315000 ftdisk

TRAP_FRAME: f791e6cc -- (.trap 0xfffffffff791e6cc)
ErrCode = 00000002
eax=8b798348 ebx=00000000 ecx=000001ff edx=8b798220 esi=8b797008 edi=00000000
eip=808921dd esp=f791e740 ebp=f791e778 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x1d7:
808921dd 8937 mov dword ptr [edi],esi ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 808921dd to 8088c963

STACK_TEXT:
f791e6cc 808921dd badb0d00 8b798220 f791e804 nt!KiTrap0E+0x2a7
f791e778 808928c3 808aeae0 00000000 893784a0 nt!ExDeferredFreePool+0x1d7
f791e7d0 80821675 89378470 00000000 8b2278e0 nt!ExFreePoolWithTag+0x57f
f791e824 8082dfc3 8b2278e0 f791e870 f791e864 nt!IopCompleteRequest+0xf9
f791e874 80a5c199 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
f791e894 80a5c3d9 8bd76001 00000000 00000000 hal!HalpDispatchSoftwareInterrupt+0x49
f791e8b0 80a5c456 00000001 8bd76000 f791e8dc hal!HalpCheckForSoftwareInterrupt+0x81
f791e8c0 8083129e 8bd76020 8b2278e0 808934f8 hal!KfLowerIrql+0x62
f791e8dc 8082ab7b 8b2278e0 8b2278a0 00000000 nt!KiExitDispatcher+0x130
f791e8fc 8081e237 8b2278e0 00000000 00000000 nt!KeInsertQueueApc+0x57
f791e930 f7326d4b 8ba5ebc8 8bd39898 8ba2a510 nt!IopfCompleteRequest+0x201
f791e964 8081df65 8ba5ebc8 8b2279c4 00000000 ftdisk!FtDiskDeviceControl+0xdeb
f791e978 f72c9288 8ba5b0d8 8bb47808 005c002e nt!IofCallDriver+0x45
f791ebcc f72d3707 8ba5a0d8 8ba5a334 8ba5a0d8 volsnap!VspFlushFileSystemLog+0x5c
f791ebf8 f72dcceb 00000000 12c00000 00000000 volsnap!VspCreateInitialDiffAreaFile+0x1b7
f791ed50 f72cbac7 8ba5b0d8 8924fdb8 8bd76020 volsnap!VspPrepareForSnapshot+0x4c5
f791ed6c 808ec1eb 89789860 88db3b40 808ae5fc volsnap!VspPostWorker+0x1f
f791ed80 8088043d 89789860 00000000 8bd76020 nt!IopProcessWorkItem+0x13
f791edac 80949b7c 89789860 00000000 00000000 nt!ExpWorkerThread+0xeb
f791eddc 8088e062 80880352 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
ftdisk!FtDiskDeviceControl+deb
f7326d4b 8bc6 mov eax,esi

SYMBOL_STACK_INDEX: b

SYMBOL_NAME: ftdisk!FtDiskDeviceControl+deb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xC5_D0000002_ftdisk!FtDiskDeviceControl+deb

BUCKET_ID: 0xC5_D0000002_ftdisk!FtDiskDeviceControl+deb

Followup: MachineOwner

 

see post 4

 

Quick Question

In step 6. you say check special pool. That is not an option at that point. I noticed in another post you say to check all drivers that are not Microsoft. Is this how I should proceed at this step. Thank you very much for your time. I am very grateful.

 

Sorry I modified the wrong step in the directions. Let's try again.

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Next time the box crashes, upload the dumps. Driver verifier adds a bunch of checks to help us identify the culprit.

 

Thanks man

My one shot at a reboot is Monday. I'll get that set and post the dump when it crashes again. Thanks again for your time.

 

Where or how do I find "Post 4 "?
Hi, I'm new to the forum. I have the exact same System Error message.
And, where/how do I find "Driver Verifier "?

Thank you so much.

 

verifier

You can just go to start>run> then type "verifier.exe" minus the quotes. However I was unable to get the server to come up without blue screen with the driver verifier enabled. So I didn't get to try it out. Luckilly I have been blue screen free for 16 days. I made a bunch of adjustments at once. I tried disabling and then re-enabling shadow copies, I turned off the Open file option on my Symantec backup exec, and updated my raid driver. The blue screens only seemed to happen when I ran a backup. I backup every 4 hours on this peticular server so I find myself holding my breath every 4 hours. Let me know if any of this info helps.
Allan