1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

win 2003 server dump file help, please!

Discussion in 'Windows Server System' started by lizculver, 2007/02/06.

  1. 2007/02/06
    lizculver

    lizculver Inactive Thread Starter

    Joined:
    2007/02/01
    Messages:
    1
    Likes Received:
    0
    Below is a dump file from our server that keeps crashing indicating that mfehidk.sys is responsible. I researched this and found that McAfee could be conflicting with daemon tools relating to cd imaging etc. We uninstalled Magic ISO as it's never used and also a program with ISO/imaging called Paragon. We also took McAfee off. (Yes, I know...) The server crashed again after that saying mfetdik.sys is but the file does not exist in System32/drivers anymore.

    Can anyone help me with what is going on on this server? It's about a year old - Dell Intel Xeon. I just started working at this place in Nov and was told the person before me used to play games on the server - would anything be left over from that conflicting with McAfee? My boss thinks that maybe a problem with a user logon or client pc is causing the crashes but I can't see that.

    I don't know if I've attached all I can from the dump file as I'm a newbie on anything like this.

    Thanks.....

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\minidump\Mini013107-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: c:\windows\symbols
    Executable search path is: c:\windows\symbols
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Wed Jan 31 12:42:53.390 2007 (GMT+0)
    System Uptime: 0 days 20:58:35.005
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Loading Kernel Symbols
    .............................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    ERROR: FindPlugIns 8007007b
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {0, 2, 8, 0}

    Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for mfehidk.sys
    *** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
    Probably caused by : mfehidk.sys ( mfehidk+24f2 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    ERROR: FindPlugIns 8007007b
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000008, value 0 = read operation, 1 = write operation
    Arg4: 00000000, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 00000000

    CURRENT_IRQL: 2

    FAULTING_IP:
    +0
    00000000 ?? ???

    PROCESS_NAME: Idle

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 00000000 to 8088bdd3

    SYMBOL_ON_RAW_STACK: 1

    STACK_ADDR_RAW_STACK_SYMBOL: 17002000010004

    STACK_COMMAND: dds 80899F74-0x20 ; kb

    STACK_TEXT:
    80899f54 00000000
    80899f58 80899f5c nt!PopAcProcessorPolicy+0x24
    80899f5c 8089a064 nt!PopPowerStateHandlers+0x34
    80899f60 00000000
    80899f64 badb0d00
    80899f68 89a0ea70
    80899f6c 80899fcc nt!PopDcProcessorPolicy+0x44
    80899f70 b594c4f2 mfehidk+0x24f2
    80899f74 896a6000
    80899f78 80899fa4 nt!PopDcProcessorPolicy+0x1c
    80899f7c b595d068 mfehidk+0x13068
    80899f80 896a6000
    80899f84 887eadfc
    80899f88 00000000
    80899f8c 02960000
    80899f90 80890023 nt!KdPitchDebugger+0x177b
    80899f94 b5950023 mfehidk+0x6023
    80899f98 89a0ea70
    80899f9c 8089a00c nt!PopAction+0x34
    80899fa0 882abb60
    80899fa4 b5960954 mfehidk+0x16954
    80899fa8 ffffffff
    80899fac b5960030 mfehidk+0x16030
    80899fb0 896a6000
    80899fb4 8089a0cc nt!PopHiberFileDebug+0x8
    80899fb8 8089a0d4 nt!PopHiberFileDebug+0x10
    80899fbc 8089a064 nt!PopPowerStateHandlers+0x34
    80899fc0 00000010
    80899fc4 00000000
    80899fc8 00000008
    80899fcc 00010246
    80899fd0 b881d272 mfetdik+0x2272


    FOLLOWUP_IP:
    mfehidk+24f2
    b594c4f2 ?? ???

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: mfehidk

    IMAGE_NAME: mfehidk.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4456568b

    SYMBOL_NAME: mfehidk+24f2

    FAILURE_BUCKET_ID: 0xD1_W_mfehidk+24f2

    BUCKET_ID: 0xD1_W_mfehidk+24f2

    Followup: MachineOwner
    ---------
     
  2. 2007/02/06
    cpc2004

    cpc2004 Inactive

    Joined:
    2005/07/08
    Messages:
    366
    Likes Received:
    0

  3. to hide this advert.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.