BSOD Memory.dmp

Hi,

We are currently having one of our prod servers crashing once a week.

I have downloaded windbg and read the memory.dmp and as below:

1: kd> !analyze -v -hang
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: 8b183648
Arg2: 89b9bd88
Arg3: 00000001
Arg4: 00000000

Debugging Details:
------------------

Page 118e23 not present in the dump file. Type ".hh dbgerr004" for details
Page 118f77 not present in the dump file. Type ".hh dbgerr004" for details
Scanning for threads blocked on locks ...

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x5

PROCESS_NAME: Apache.exe

CURRENT_IRQL: 0

BLOCKED_THREAD: 8944a3c0

LAST_CONTROL_TRANSFER: from 808266a0 to 80827c63

STACK_TEXT:
b92a2b8c 808266a0 00000005 8b183648 89b9bd88 nt!KeBugCheckEx+0x1b
b92a2bb8 ba0a4344 8b183648 89b4a558 ba0a892c nt!KeAttachProcess+0x7c
WARNING: Stack unwind information not available. Following frames may be wrong.
b92a2bc4 ba0a892c 89afc028 00000000 ba0a7e11 afpa+0x4344
b92a2bd0 ba0a7e11 89afc028 00000000 00000000 afpa+0x892c
00000000 00000000 00000000 00000000 00000000 afpa+0x7e11


STACK_COMMAND: kb


Any help will be greatly appreciated.

Thanks.

 

Hi,

Log as below:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Jan 29 13:58:10.671 2008 (GMT+11)
System Uptime: 0 days 0:24:47.301
Loading Kernel Symbols
..........................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Loading unloaded module list
..
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 5, {8b183648, 89b9bd88, 1, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for afpa.sys -
Page 118e23 not present in the dump file. Type ".hh dbgerr004" for details
Page 118f77 not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Probably caused by : afpa.sys ( afpa+4344 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: 8b183648
Arg2: 89b9bd88
Arg3: 00000001
Arg4: 00000000

Debugging Details:
------------------

Page 118e23 not present in the dump file. Type ".hh dbgerr004" for details
Page 118f77 not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x5

PROCESS_NAME: Apache.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 808266a0 to 80827c63

STACK_TEXT:
b92a2b8c 808266a0 00000005 8b183648 89b9bd88 nt!KeBugCheckEx+0x1b
b92a2bb8 ba0a4344 8b183648 89b4a558 ba0a892c nt!KeAttachProcess+0x7c
WARNING: Stack unwind information not available. Following frames may be wrong.
b92a2bc4 ba0a892c 89afc028 00000000 ba0a7e11 afpa+0x4344
b92a2bd0 ba0a7e11 89afc028 00000000 00000000 afpa+0x892c
00000000 00000000 00000000 00000000 00000000 afpa+0x7e11


STACK_COMMAND: kb

FOLLOWUP_IP:
afpa+4344
ba0a4344 f786c400000000008000 test dword ptr [esi+0C4h],800000h

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: afpa+4344

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afpa

IMAGE_NAME: afpa.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3deb9e1d

FAILURE_BUCKET_ID: 0x5_afpa+4344

BUCKET_ID: 0x5_afpa+4344

Followup: MachineOwner
---------

eax=f773713c ebx=89b9bd88 ecx=00000001 edx=00000000 esi=f7737120 edi=89b4a5c8
eip=80827c63 esp=b92a2b74 ebp=b92a2b8c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80827c63 5d pop ebp
ChildEBP RetAddr Args to Child
b92a2b8c 808266a0 00000005 8b183648 89b9bd88 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b92a2bb8 ba0a4344 8b183648 89b4a558 ba0a892c nt!KeAttachProcess+0x7c (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
b92a2bc4 ba0a892c 89afc028 00000000 ba0a7e11 afpa+0x4344
b92a2bd0 ba0a7e11 89afc028 00000000 00000000 afpa+0x892c
00000000 00000000 00000000 00000000 00000000 afpa+0x7e11
start end module name
80800000 80a56000 nt ntkrpamp.exe Mon Mar 05 23:16:25 2007 (45EC0A19)
80a56000 80a82000 hal halmacpi.dll Sat Feb 17 16:48:26 2007 (45D6972A)
b85a4000 b85cf000 RDPWD RDPWD.SYS Sat Feb 17 16:44:38 2007 (45D69646)
b891f000 b892a000 TDTCP TDTCP.SYS Sat Feb 17 16:44:32 2007 (45D69640)
b9c77000 b9ca1000 Fastfat Fastfat.SYS Sat Feb 17 17:27:55 2007 (45D6A06B)
b9dc3000 b9e20000 srv srv.sys Sat Feb 17 17:27:20 2007 (45D6A048)
ba0a0000 ba0b9de0 afpa afpa.sys Tue Dec 03 04:53:33 2002 (3DEB9E1D)
ba5e2000 ba5f7000 Cdfs Cdfs.SYS Sat Feb 17 17:27:08 2007 (45D6A03C)
ba61f000 ba630000 Fips Fips.SYS Sat Feb 17 17:26:33 2007 (45D6A019)
ba630000 ba6a6000 mrxsmb mrxsmb.sys Sat Feb 17 17:28:15 2007 (45D6A07F)
ba6ce000 ba6fe000 rdbss rdbss.sys Sat Feb 17 17:27:37 2007 (45D6A059)
ba6fe000 ba728000 afd afd.sys Sat Feb 17 17:28:16 2007 (45D6A080)
ba728000 ba759000 netbt netbt.sys Sat Feb 17 17:28:57 2007 (45D6A0A9)
ba759000 ba7e9000 tcpip tcpip.sys Sat Feb 17 17:28:05 2007 (45D6A075)
ba7e9000 ba802000 ipsec ipsec.sys Sat Feb 17 17:29:28 2007 (45D6A0C8)
ba8c2000 ba8dab00 savonaccesscontrol savonaccesscontrol.sys Mon Sep 10 21:09:23 2007 (46E525E3)
ba9ad000 ba9c2000 usbhub usbhub.sys Sat Feb 17 17:13:05 2007 (45D69CF1)
baaa2000 bab01000 update update.sys Mon May 28 22:15:16 2007 (465AC7D4)
bab29000 bab60000 rdpdr rdpdr.sys Sat Feb 17 16:51:00 2007 (45D697C4)
bab60000 bab72000 raspptp raspptp.sys Sat Feb 17 17:29:20 2007 (45D6A0C0)
bab72000 bab8b000 ndiswan ndiswan.sys Sat Feb 17 17:29:22 2007 (45D6A0C2)
bab8b000 bab9f000 rasl2tp rasl2tp.sys Sat Feb 17 17:29:02 2007 (45D6A0AE)
babbf000 babc6000 sysmgmt sysmgmt.sys Sat Dec 17 05:11:56 2005 (43A3036C)
babef000 bac20000 cpqteam cpqteam.sys Thu Feb 02 03:22:51 2006 (43E0E05B)
bac20000 bac47000 ks ks.sys Sat Feb 17 17:30:40 2007 (45D6A110)
bac47000 bac5b000 redbook redbook.sys Sat Feb 17 17:07:26 2007 (45D69B9E)
bac5b000 bac70000 cdrom cdrom.sys Sat Feb 17 17:07:48 2007 (45D69BB4)
bac70000 bac85000 serial serial.sys Sat Feb 17 17:06:46 2007 (45D69B76)
bac85000 bac98000 i8042prt i8042prt.sys Sat Feb 17 17:30:40 2007 (45D6A110)
bac98000 baca2000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
bacb8000 bacc2000 dump_diskdump dump_diskdump.sys Sat Feb 17 17:07:44 2007 (45D69BB0)
bace8000 bacf5000 netbios netbios.sys Sat Feb 17 16:58:29 2007 (45D69985)
bacf8000 bad05000 wanarp wanarp.sys Sat Feb 17 16:59:17 2007 (45D699B5)
bad08000 bad16000 msgpc msgpc.sys Sat Feb 17 16:58:37 2007 (45D6998D)
bad18000 bad25000 Npfs Npfs.SYS Sat Feb 17 16:50:36 2007 (45D697AC)
bad28000 bad33000 Msfs Msfs.SYS Sat Feb 17 16:50:33 2007 (45D697A9)
bad38000 bad7d000 cpqasm2 cpqasm2.sys Sat Dec 17 05:11:57 2005 (43A3036D)
bad7d000 bad99000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 17:10:30 2007 (45D69C56)
bad99000 badecd80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
bae15000 bae3f000 USBPORT USBPORT.SYS Sat Feb 17 17:12:59 2007 (45D69CEB)
bae3f000 bae62200 q57xp32 q57xp32.sys Fri Jan 13 11:28:45 2006 (43C6F43D)
bae63000 bae89a00 n1000325 n1000325.sys Thu Dec 14 17:06:38 2006 (4580E9EE)
bf800000 bf9cf000 win32k win32k.sys Fri Mar 02 01:59:28 2007 (45E6EA50)
bf9cf000 bf9e6000 dxg dxg.sys Sat Feb 17 17:14:39 2007 (45D69D4F)
bf9e6000 bfa3c680 ati2drad ati2drad.dll Sun Feb 18 00:59:26 2007 (45D70A3E)
bff60000 bff7e000 RDPDD RDPDD.dll Sun Feb 18 01:01:19 2007 (45D70AAF)
f7206000 f7225000 Mup Mup.sys Sat Feb 17 17:27:41 2007 (45D6A05D)
f7225000 f724b000 KSecDD KSecDD.sys Sat Feb 17 16:46:32 2007 (45D696B8)
f724b000 f7270000 fltmgr fltmgr.sys Sat Feb 17 16:51:08 2007 (45D697CC)
f7270000 f7283000 CLASSPNP CLASSPNP.SYS Sat Feb 17 17:28:16 2007 (45D6A080)
f7283000 f72a2000 SCSIPORT SCSIPORT.SYS Sat Feb 17 17:28:41 2007 (45D6A099)
f72a2000 f72bf000 atapi atapi.sys Sat Feb 17 17:07:34 2007 (45D69BA6)
f72bf000 f72e9000 volsnap volsnap.sys Sat Feb 17 17:08:23 2007 (45D69BD7)
f72e9000 f7315000 dmio dmio.sys Sat Feb 17 17:10:44 2007 (45D69C64)
f7315000 f733c000 ftdisk ftdisk.sys Sat Feb 17 17:08:05 2007 (45D69BC5)
f733c000 f7352000 pci pci.sys Sat Feb 17 16:59:03 2007 (45D699A7)
f7352000 f7386000 ACPI ACPI.sys Sat Feb 17 16:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 16:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 17:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 17:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 17:29:25 2007 (45D6A0C5)
f74d7000 f74e7000 disk disk.sys Sat Feb 17 17:07:51 2007 (45D69BB7)
f74e7000 f74f2120 vsp vsp.sys Sat Sep 06 02:36:50 2003 (3F58BBA2)
f74f7000 f7503000 Dfs Dfs.sys Sat Feb 17 16:51:17 2007 (45D697D5)
f7507000 f7511000 crcdisk crcdisk.sys Sat Feb 17 17:09:50 2007 (45D69C2E)
f7547000 f7551000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f7557000 f7562000 ptilink ptilink.sys Sat Feb 17 17:06:38 2007 (45D69B6E)
f7577000 f7584d00 CPQCISSE CPQCISSE.sys Sat Jan 14 05:05:49 2006 (43C7EBFD)
f7587000 f7590000 ndistapi ndistapi.sys Sat Feb 17 16:59:19 2007 (45D699B7)
f7597000 f75a1000 serenum serenum.sys Sat Feb 17 17:06:44 2007 (45D69B74)
f75c7000 f75d5000 NDProxy NDProxy.SYS Sat Feb 17 16:59:21 2007 (45D699B9)
f75d7000 f75e1000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f75e7000 f75f0000 raspti raspti.sys Sat Feb 17 16:59:23 2007 (45D699BB)
f7617000 f7626000 intelppm intelppm.sys Sat Feb 17 16:48:30 2007 (45D6972E)
f7627000 f762f280 savonaccessfilter savonaccessfilter.sys Mon Sep 10 21:08:52 2007 (46E525C4)
f7647000 f7650000 mssmbios mssmbios.sys Sat Feb 17 16:59:12 2007 (45D699B0)
f7657000 f7666000 termdd termdd.sys Sat Feb 17 16:44:32 2007 (45D69640)
f7667000 f7670000 watchdog watchdog.sys Sat Feb 17 17:11:45 2007 (45D69CA1)
f7677000 f7683000 vga vga.sys Sat Feb 17 17:10:30 2007 (45D69C56)
f7687000 f7692000 fdc fdc.sys Sat Feb 17 17:07:16 2007 (45D69B94)
f7697000 f76a6000 raspppoe raspppoe.sys Sat Feb 17 16:59:23 2007 (45D699BB)
f76a7000 f76b2000 TDI TDI.SYS Sat Feb 17 17:01:19 2007 (45D69A2F)
f76b7000 f76c2000 kbdclass kbdclass.sys Sat Feb 17 17:05:39 2007 (45D69B33)
f76c8000 f7707000 NDIS NDIS.sys Sat Feb 17 17:28:49 2007 (45D6A0A1)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f7717000 f771e000 PCIIde PCIIde.sys Tue Mar 25 18:04:46 2003 (3E7FFF8E)
f771f000 f7726000 intelide intelide.sys Sat Feb 17 17:07:32 2007 (45D69BA4)
f7727000 f772e000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f772f000 f7733080 cpqcissm cpqcissm.sys Sat Aug 20 04:10:55 2005 (430620AF)
f774f000 f7756000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f777f000 f7784180 usbuhci usbuhci.sys Sat Feb 17 17:13:02 2007 (45D69CEE)
f778f000 f7795b80 usbehci usbehci.sys Sat Feb 17 17:12:56 2007 (45D69CE8)
f7797000 f779f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
f77a7000 f77ad600 cpqcidrv cpqcidrv.sys Sat Dec 10 05:13:23 2005 (4399C943)
f77af000 f77b7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f77df000 f77e7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f77e7000 f77ee000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f77ef000 f77f6000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f77f7000 f77ff000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f77ff000 f7807000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f7807000 f780f000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f780f000 f7813080 dump_cpqcissm dump_cpqcissm.sys Sat Aug 20 04:10:55 2005 (430620AF)
f7999000 f799a280 swenum swenum.sys Sat Feb 17 17:05:56 2007 (45D69B44)
f799b000 f799c580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)
f7b4a000 f7bdf000 Ntfs Ntfs.sys Sat Feb 17 17:27:23 2007 (45D6A04B)

Unloaded modules:
bacd8000 bace6000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77c7000 f77cf000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt