DUMP DATA - win2k sp4 bsod mystery!

Hi guys,
I've got a Win2000 Server (sp4 all patches) and it has had a history of crashing for nearly a year now (perhaps longer). Finally, management has gotten fed up and tired of having their development server crash at least 2-3 times a week and they have tasked me to identify the problem and fix it. I swaped the memory in the server with BRAND NEW crucial memory so I don't think it's bad RAM anymore *I've NEVER had a problem with crucial brand* Could you guys go over my crashdump analysis and give me some insight? GREATLY appreciated. Thanks!

Jeremy


==========================================================
Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows NT 4 Kernel Version 1381 (Service Pack 6) MP (2 procs) Free x86 compatible
Product: Server
Kernel base = 0x80100000 PsLoadedModuleList = 0x80155420
Debug session time: Mon Nov 03 08:44:13 2003
System Uptime: 5 days 19:29:24.827
Loading Kernel Symbols
.....................................................
Loading unloaded module list
No unloaded module list present
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {28, 2, 0, 80131df8}

Probably caused by : memory_corruption ( nt!MiReleasePageFileSpace+30 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000028, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80131df8, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000028

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiReleasePageFileSpace+30
80131df8 ff7128 push dword ptr [ecx+0x28]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80122c3a to 80131df8

TRAP_FRAME: f2453dfc -- (.trap fffffffff2453dfc)
.trap fffffffff2453dfc
ErrCode = 00000000
eax=000e12fc ebx=e358d5f4 ecx=00000000 edx=00000001 esi=00000004 edi=801548c0
eip=80131df8 esp=f2453e70 ebp=f2453ef8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!MiReleasePageFileSpace+0x30:
80131df8 ff7128 push dword ptr [ecx+0x28] ds:0023:00000028=????????
.trap
Resetting default scope

STACK_TEXT:
f2453e7c 80122c3a e12fc188 805f7cc8 00000000 nt!MiReleasePageFileSpace+0x30
f2453ef8 80123955 805f7cc8 00000000 80154ae0 nt!MiCleanSection+0x3b0
f2453f34 80122828 00000000 00000000 00000000 nt!MiRemoveUnusedSegments+0x2bf
f2453f4c 8013abcc 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0xe6
f2453f7c 8014699e 80122742 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!MiReleasePageFileSpace+30
80131df8 ff7128 push dword ptr [ecx+0x28]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiReleasePageFileSpace+30

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 3df90aa7

STACK_COMMAND: .trap fffffffff2453dfc ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID: 0xA_nt!MiReleasePageFileSpace+30

Followup: MachineOwner
---------

eax=ffdff13c ebx=e2a06000 ecx=00000000 edx=fffff3ff esi=80131df8 edi=00000028
eip=801453ac esp=f2453de8 ebp=f2453dfc iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x284:
801453ac f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:f2453e6c=00010202
ChildEBP RetAddr Args to Child
f2453dfc 80131df8 80194a35 815bfe68 e56c6946 nt!KiTrap0E+0x284 (FPO: [0,0] TrapFrame @ f2453dfc)
f2453e7c 80122c3a e12fc188 805f7cc8 00000000 nt!MiReleasePageFileSpace+0x30 (FPO: [1,0,2])
f2453ef8 80123955 805f7cc8 00000000 80154ae0 nt!MiCleanSection+0x3b0 (FPO: [Non-Fpo])
f2453f34 80122828 00000000 00000000 00000000 nt!MiRemoveUnusedSegments+0x2bf (FPO: [Non-Fpo])
f2453f4c 8013abcc 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0xe6 (FPO: [1,2,3])
f2453f7c 8014699e 80122742 00000000 00000000 nt!PspSystemThreadStartup+0x54 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
80001000 80011d60 hal halmps.dll Fri Feb 12 15:19:02 1999 (36C49AC6)
80012000 80013ca0 CpqSmgrK CpqSmgrK.sys Mon Aug 28 11:02:09 2000 (39AA8D01)
80014000 8001c6c0 cpqarray cpqarray.sys Mon Aug 06 14:56:04 2001 (3B6EF654)
8001d000 8001e7c0 intlfxsr intlfxsr.sys Tue Mar 09 22:20:44 1999 (36E5F31C)
80100000 801e0000 nt ntkrnlmp.exe Thu Dec 12 16:16:07 2002 (3DF90AA7)
801e0000 801e8a00 SCSIPORT SCSIPORT.SYS Wed Jun 27 16:42:34 2001 (3B3A534A)
801e9000 801efb20 atapi atapi.sys Tue May 11 19:07:16 1999 (3738C634)
801f0000 80201000 cpq32fs2 cpq32fs2.sys Tue Apr 25 15:20:50 2000 (3905FE22)
80201000 80204a80 Disk Disk.sys Fri Feb 12 15:44:14 1999 (36C4A0AE)
80205000 802084a0 CLASS2 CLASS2.SYS Thu Jun 03 17:42:45 1999 (375704E5)
80209000 80211000 Ftdisk Ftdisk.sys Thu May 13 16:25:05 1999 (373B4331)
80211000 80220000 otman4 otman4.sys Tue Jan 16 17:20:38 2001 (3A64D746)
80236000 80291000 Ntfs Ntfs.sys Thu Aug 26 11:50:36 1999 (37C5705C)
a0000000 a0132540 win32k win32k.sys Wed Oct 09 19:12:55 2002 (3DA4C607)
f02e2000 f0364700 NAVEX15 NAVEX15.sys Fri Oct 24 02:54:34 2003 (3F98DABA)
f038d000 f039ebc0 RASDD RASDD.DLL Fri Jul 26 14:19:25 1996 (31F91A3D)
f0a3a000 f0a72680 srv srv.sys Thu Mar 27 12:20:03 2003 (3E8340D3)
f0ab3000 f0ac2400 NAVENG NAVENG.sys Fri Oct 24 02:55:41 2003 (3F98DAFD)
f0bb3000 f0bd5a40 Fastfat Fastfat.SYS Thu Aug 26 12:14:32 1999 (37C575F8)
f0ca9000 f0cd0ea0 NAVAP NAVAP.sys Sun Sep 25 19:34:42 1988 (233D90A2)
f0e29000 f0e37ee0 Cdfs Cdfs.SYS Mon Jun 28 18:13:53 1999 (377801B1)
f105d000 f105fe00 spud spud.sys Sun Nov 16 17:23:04 1997 (346F8058)
f121a000 f1227ae0 SYMEVENT SYMEVENT.SYS Fri Sep 29 20:11:48 2000 (39D53DD4)
f1322000 f1335a60 mup mup.sys Tue Jan 22 17:43:05 2002 (3C4DF909)
f1336000 f1376ea0 rdr rdr.sys Wed Jun 13 16:37:25 2001 (3B27DD15)
f139f000 f13b59a0 xlnfs xlnfs.sys Tue Dec 11 13:59:09 2001 (3C16658D)
f13b6000 f13c6340 afd afd.sys Thu Mar 29 20:10:30 2001 (3AC3EB16)
f15c7000 f15dc800 N100NT N100NT.sys Mon Aug 20 13:09:07 2001 (3B815243)
f15dd000 f15fb620 netbt netbt.sys Mon Feb 12 20:51:51 2001 (3A88A147)
f15fc000 f1626a20 tcpip tcpip.sys Wed Jun 27 17:05:17 2001 (3B3A589D)
f165b000 f165d4e0 TDI TDI.SYS Tue Jul 16 23:39:08 1996 (31EC6E6C)
f168b000 f168e960 Parallel Parallel.SYS Thu Jun 21 02:01:27 2001 (3B319BC7)
f1693000 f1695640 Parport Parport.SYS Thu Jun 21 02:01:13 2001 (3B319BB9)
f1e9f000 f1ec5780 ati_f1e9f000 ati.dll Thu Apr 23 05:50:15 1998 (353F1CE7)
f1eee000 f1f79720 SYSMGMT SYSMGMT.SYS Wed May 31 16:27:18 2000 (393583B6)
f1f7a000 f1f97f60 NDIS NDIS.SYS Thu Aug 26 11:50:40 1999 (37C57060)
f1fb8000 f1fcf840 ati ati.sys Thu Apr 23 05:49:12 1998 (353F1CA8)
f2030000 f2039520 Npfs Npfs.SYS Mon Aug 16 21:09:28 1999 (37B8C458)
f21d0000 f21db0e0 Serial Serial.SYS Thu Jul 08 14:58:33 1999 (378502E9)
f22e0000 f22e7100 netbios netbios.sys Wed Jun 16 19:19:18 1999 (37683F06)
f22e8000 f22ec8e0 Floppy Floppy.SYS Tue Jun 12 18:40:05 2001 (3B26A855)
f22f8000 f22fd5a0 Cdrom Cdrom.SYS Fri Feb 12 15:44:05 1999 (36C4A0A5)
f2348000 f234f2e0 i8042prt i8042prt.sys Fri Feb 12 15:38:08 1999 (36C49F40)
f2360000 f2366100 VIDEOPRT VIDEOPRT.SYS Fri Feb 12 15:28:05 1999 (36C49CE5)
f23b0000 f23b5960 Msfs Msfs.SYS Mon Oct 30 17:16:24 2000 (39FE0148)
f24a4000 f24a64a0 KSecDD KSecDD.SYS Thu Jul 08 14:52:54 1999 (37850196)
f24ac000 f24ae400 mouclass mouclass.sys Tue Jun 29 14:54:41 1999 (37792481)
f24b4000 f24b63a0 kbdclass kbdclass.sys Tue Jun 29 14:53:46 1999 (3779244A)
f24c4000 f24c7860 vga vga.sys Fri Feb 12 15:32:22 1999 (36C49DE6)
f2518000 f2519820 Fs_Rec Fs_Rec.SYS Fri Feb 12 16:32:54 1999 (36C4AC16)
f2570000 f2571780 ParVdm ParVdm.SYS Tue Jul 16 23:31:25 1996 (31EC6C9D)
f259e000 f259fb60 NAVAPEL NAVAPEL.SYS Thu Sep 21 05:31:27 2000 (39C9E37F)
f25d4000 f25d49e0 Null Null.SYS Tue Jul 16 23:31:21 1996 (31EC6C99)
f25d5000 f25d5f00 Beep Beep.SYS Fri Feb 12 15:34:16 1999 (36C49E58)

No unloaded module list present
Closing open log file c:\debuglog.txt

 

Nobody can help me on this????

 

Sorry, i missed this first time around, probably because its nt4 and i tried to ignore it . Shame on you for running obsolete code!
http://support.microsoft.com/?scid=gp/lifean3
Microsoft decided to continue Windows NT Server 4.0 incident and security hotfix support through December 31, 2004. Support for non-security hotfixes will not be extended, and will end as previously announced on December 31, 2003.

Do you have any more dumps? This is corrupt memory. I can't tell with any authority the scope of the corruption without a few dumps to look at.

 

bbjones3 - as noted by Joe, the machine that gave you this dump seems to be NT4 SP6 and you speak of 2K SP4 crashing. Can you maybe unconfuse us?

For one thing, I'd like to put the thread in the proper section and for another, it really would help to know what the box is running or if you are maybe dual-booting an NT4 and a W2K OS.

 

ROFL ROFL ROFL

nice catch newt. i didnt even notice that

 

Sorry for the late reply - I was away from work for about a week during college graduation.

Anyways...yes this server is indeed Windows 2000, not NT4....HOWEVER, it was an upgrade installation (from NT4 - 2k server). We are now considering building a new fresh Win2K installed server and migrating the data over....but if it is possible to fix this one then I'd much much rather go that route since migration will take DAYS AND DAYS to complete! Thanks for the support guys - ya'll rock!

 

Windows NT 4 Kernel Version 1381 (Service Pack 6) MP (2 procs) Free x86 compatible

This dump is from NT4.

 

Would it say that because it is a Win2K upgrade from NT4sp6?? I swear that I took this dump from a Win2K server!!

 

no, it would not.

 

bbjones3 - it's beginning to seem like your server is schizophrenic or something. Could account for the problems you are seeing.

NT4 is still hanging around the box somewhere.