Windows 2003 Enterprise Crashing.. Memory dump

I have a windows 2003 enterprise server that keeps crashing and from what I can tell it's related to a device driver but I'm not sure which one.

Can someone please help me to analyze the memory dump to see what's causing it.

I am The error I saw is:

BCCode : a BCP1 : B8000074 BCP2 : 00000002 BCP3 : 00000001
BCP4 : 80852E87 OSVer : 5_2_3790 SP : 1_0 Product : 274_3

Error code 0000000a, parameter1 b8000074, parameter2 00000002, parameter3 00000001, parameter4 80852e87.


The reason supplied by user USER-79HDI4I1Y8\Administrator for the last unexpected shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID: ugg
Bugcheck String: 0x0000000a (0xb8000074, 0x00000002, 0x00000001, 0x80852e87)
Comment: 0x0000000a (0xb8000074, 0x00000002, 0x00000001, 0x80852e87)

For more information, see Help and Support Center at

How do I take a memory dump and paste it here so someone can help me locate the driver causing the issue?

I'm absolutely lost in trying to find a solution to this and it's a production server! all drivers are up to date.

Thank you for your help!

-tzulo

 

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed May 24 00:30:09.828 2006 (GMT-5)
System Uptime: 0 days 1:47:11.646
Loading Kernel Symbols
...........................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {b8000074, 2, 1, 80852e87}

*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
Probably caused by : SiWinAcc.sys ( SiWinAcc+863 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b8000074, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80852e87, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: b8000074

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiAddViewsForSection+2d
80852e87 897904 mov [ecx+0x4],edi

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80852e87 to 8088bdd3

STACK_TEXT:
b749d950 80852e87 badb0d00 00000000 3266f921 nt!KiTrap0E+0x2a7
b749d9d0 80857c56 8948db50 00000040 00000000 nt!MiAddViewsForSection+0x2d
b749da0c 80813d97 00000000 8ad77588 b749da38 nt!MmMapViewInSystemCache+0x104
b749da74 808140af 899ac7a0 04f00000 00000000 nt!CcGetVacbMiss+0x3dd
b749dab0 808b57f1 899ac7a0 04f00000 00000000 nt!CcGetVirtualAddress+0xb7
b749db4c f7b83431 89b882d0 04f00000 00000b59 nt!CcFastCopyRead+0x26f
b749dba4 f7897863 89b882d0 b749dc4c 00000f10 Ntfs!NtfsCopyReadA+0x1c1
WARNING: Stack unwind information not available. Following frames may be wrong.
b749dbdc f7223cc0 89b882d0 b749dc4c 00000f10 SiWinAcc+0x863
b749dc10 f72308b3 00000003 00000000 b749dc44 fltmgr!FltpPerformFastIoCall+0x230
b749dc64 f7897863 89b882d0 b749dcd8 00000f10 fltmgr!FltpFastIoRead+0xa9
b749dc9c 808f1661 89b882d0 b749dcd8 00000f10 SiWinAcc+0x863
b749dd38 80888c6c 0000032c 00000000 00000000 nt!NtReadFile+0x2c5
b749dd38 7c82ed54 0000032c 00000000 00000000 nt!KiFastCallEntry+0xfc
0006d4e4 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND: kb

FOLLOWUP_IP:
SiWinAcc+863
f7897863 8845ff mov [ebp-0x1],al

SYMBOL_STACK_INDEX: a

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SiWinAcc+863

MODULE_NAME: SiWinAcc

IMAGE_NAME: SiWinAcc.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3ee50a3e

FAILURE_BUCKET_ID: 0xA_W_SiWinAcc+863

BUCKET_ID: 0xA_W_SiWinAcc+863
Followup: MachineOwner
---------

eax=ffdff13c ebx=00000002 ecx=00000001 edx=00000000 esi=ffdff120 edi=b8000074
eip=8088bdd3 esp=b749d938 ebp=b749d950 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a7:
8088bdd3 833da0628a8000 cmp dword ptr [nt!KiFreezeFlag (808a62a0)],0x0 ds:0023:808a62a0=00000000
ChildEBP RetAddr Args to Child
b749d950 80852e87 badb0d00 00000000 3266f921 nt!KiTrap0E+0x2a7 (FPO: [0,0] TrapFrame @ b749d950)
b749d9d0 80857c56 8948db50 00000040 00000000 nt!MiAddViewsForSection+0x2d (FPO: [Non-Fpo])
b749da0c 80813d97 00000000 8ad77588 b749da38 nt!MmMapViewInSystemCache+0x104 (FPO: [Non-Fpo])
b749da74 808140af 899ac7a0 04f00000 00000000 nt!CcGetVacbMiss+0x3dd (FPO: [Non-Fpo])
b749dab0 808b57f1 899ac7a0 04f00000 00000000 nt!CcGetVirtualAddress+0xb7 (FPO: [Non-Fpo])
b749db4c f7b83431 89b882d0 04f00000 00000b59 nt!CcFastCopyRead+0x26f (FPO: [Non-Fpo])
b749dba4 f7897863 89b882d0 b749dc4c 00000f10 Ntfs!NtfsCopyReadA+0x1c1 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
b749dbdc f7223cc0 89b882d0 b749dc4c 00000f10 SiWinAcc+0x863
b749dc10 f72308b3 00000003 00000000 b749dc44 fltmgr!FltpPerformFastIoCall+0x230 (FPO: [Non-Fpo])
b749dc64 f7897863 89b882d0 b749dcd8 00000f10 fltmgr!FltpFastIoRead+0xa9 (FPO: [Non-Fpo])
b749dc9c 808f1661 89b882d0 b749dcd8 00000f10 SiWinAcc+0x863
b749dd38 80888c6c 0000032c 00000000 00000000 nt!NtReadFile+0x2c5 (FPO: [Non-Fpo])
b749dd38 7c82ed54 0000032c 00000000 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b749dd64)
0006d4e4 00000000 00000000 00000000 00000000 0x7c82ed54
start end module name
80800000 80a53000 nt ntkrpamp.exe Thu Mar 24 18:28:04 2005 (42435B14)
80a53000 80a7f000 hal halmacpi.dll Thu Mar 24 18:28:37 2005 (42435B35)
b7936000 b7963000 RDPWD RDPWD.SYS Wed Jun 15 10:33:14 2005 (42B04A3A)
b7af3000 b7b51000 srv srv.sys Tue May 03 21:44:01 2005 (427836F1)
b81b7000 b81be000 parvdm parvdm.sys Tue Mar 25 01:03:49 2003 (3E7FFF55)
b8bc2000 b8bcc000 Dxapi Dxapi.sys Tue Mar 25 01:06:01 2003 (3E7FFFD9)
b9099000 b90a0000 dxgthk dxgthk.sys Tue Mar 25 01:05:52 2003 (3E7FFFD0)
b98be000 b98c8000 dump_diskdump dump_diskdump.sys Thu Mar 24 18:28:56 2005 (42435B48)
b98de000 b98e7000 ndisuio ndisuio.sys Thu Mar 24 18:33:16 2005 (42435C4C)
ba275000 ba286000 Fips Fips.SYS Thu Mar 24 18:40:33 2005 (42435E01)
ba2d6000 ba34c000 mrxsmb mrxsmb.sys Thu Mar 24 18:41:13 2005 (42435E29)
ba385000 ba3b5000 rdbss rdbss.sys Thu Mar 24 18:40:49 2005 (42435E11)
ba3da000 ba404000 afd afd.sys Thu Mar 24 18:40:43 2005 (42435E0B)
ba404000 ba435000 netbt netbt.sys Thu Mar 24 18:40:31 2005 (42435DFF)
ba435000 ba496000 tcpip tcpip.sys Thu Jan 12 20:12:43 2006 (43C70C9B)
ba547000 ba560000 ipsec ipsec.sys Thu Mar 24 18:40:49 2005 (42435E11)
ba769000 ba776000 netbios netbios.sys Thu Mar 24 18:33:21 2005 (42435C51)
ba779000 ba786000 wanarp wanarp.sys Thu Mar 24 18:34:07 2005 (42435C7F)
ba789000 ba797000 msgpc msgpc.sys Thu Mar 24 18:33:31 2005 (42435C5B)
ba799000 ba7a6000 Npfs Npfs.SYS Thu Mar 24 18:30:04 2005 (42435B8C)
ba895000 ba8d5000 update update.sys Thu Mar 24 18:40:27 2005 (42435DFB)
ba8d5000 ba8fd000 ks ks.sys Thu Mar 24 18:41:03 2005 (42435E1F)
ba90e000 ba919000 TDTCP TDTCP.SYS Thu Mar 24 18:27:15 2005 (42435AE3)
ba91e000 ba928000 flpydisk flpydisk.sys Tue Mar 25 01:04:32 2003 (3E7FFF80)
baa81000 baab8000 rdpdr rdpdr.sys Thu Mar 24 18:30:20 2005 (42435B9C)
baab8000 baacb000 raspptp raspptp.sys Thu Mar 24 18:40:43 2005 (42435E0B)
baacb000 baae5000 ndiswan ndiswan.sys Thu Mar 24 18:40:46 2005 (42435E0E)
baae5000 baafa000 rasl2tp rasl2tp.sys Thu Mar 24 18:40:29 2005 (42435DFD)
baafa000 bab1ac80 b57xp32 b57xp32.sys Thu Jul 21 19:12:32 2005 (42E039F0)
bab1b000 bab33000 parport parport.sys Thu Mar 24 18:28:25 2005 (42435B29)
bab33000 bab48000 serial serial.sys Thu Mar 24 18:28:29 2005 (42435B2D)
bab48000 bab63000 VIDEOPRT VIDEOPRT.SYS Thu Mar 24 18:29:53 2005 (42435B81)
bab63000 babb6d80 ati2mpad ati2mpad.sys Thu Jul 18 20:13:20 2002 (3D3767B0)
bac56000 bac5e000 rasacd rasacd.sys Tue Mar 25 01:11:50 2003 (3E800136)
bac5e000 bac66000 RDPCDD RDPCDD.sys Tue Mar 25 01:03:05 2003 (3E7FFF29)
bac66000 bac6e000 mnmdd mnmdd.SYS Tue Mar 25 01:07:53 2003 (3E800049)
bac6e000 bac75000 Beep Beep.SYS Tue Mar 25 01:03:04 2003 (3E7FFF28)
bac76000 bac7d000 Null Null.SYS Tue Mar 25 01:03:05 2003 (3E7FFF29)
bac7e000 bac86000 Fs_Rec Fs_Rec.SYS Tue Mar 25 01:08:36 2003 (3E800074)
bae09000 bae12000 raspti raspti.sys Thu Mar 24 18:34:16 2005 (42435C88)
bae19000 bae24000 ptilink ptilink.sys Thu Mar 24 18:28:25 2005 (42435B29)
bae29000 bae34000 TDI TDI.SYS Thu Mar 24 18:35:34 2005 (42435CD6)
bae39000 bae48000 raspppoe raspppoe.sys Thu Mar 24 18:34:16 2005 (42435C88)
bae49000 bae52000 ndistapi ndistapi.sys Thu Mar 24 18:34:11 2005 (42435C83)
bae59000 bae64000 fdc fdc.sys Thu Mar 24 18:28:43 2005 (42435B3B)
bae69000 bae73000 serenum serenum.sys Thu Mar 24 18:28:27 2005 (42435B2B)
bf800000 bf9d0000 win32k win32k.sys Wed Oct 05 19:37:08 2005 (434471B4)
bf9d0000 bf9e6000 dxg dxg.sys Thu Mar 24 18:27:25 2005 (42435AED)
bf9e6000 bfa3c680 ati2drad ati2drad.dll Thu Mar 24 20:30:34 2005 (424377CA)
bff60000 bff7e000 RDPDD RDPDD.dll Thu Mar 24 20:30:48 2005 (424377D8)
f7201000 f7220000 Mup Mup.sys Thu Mar 24 18:40:49 2005 (42435E11)
f7220000 f7245000 fltmgr fltmgr.sys Thu Mar 24 18:30:25 2005 (42435BA1)
f7245000 f7258000 CLASSPNP CLASSPNP.SYS Thu Mar 24 18:40:23 2005 (42435DF7)
f7258000 f7269b60 AACMgt AACMgt.sys Wed Mar 22 21:24:14 2006 (442214DE)
f726a000 f7284000 storport storport.sys Thu Mar 24 18:28:57 2005 (42435B49)
f7284000 f72a3000 SCSIPORT SCSIPORT.SYS Thu Mar 24 18:40:26 2005 (42435DFA)
f72a3000 f72bf000 atapi atapi.sys Thu Mar 24 18:28:49 2005 (42435B41)
f72bf000 f72e9000 volsnap volsnap.sys Thu Mar 24 18:29:10 2005 (42435B56)
f72e9000 f7315000 dmio dmio.sys Thu Mar 24 18:30:02 2005 (42435B8A)
f7315000 f733c000 ftdisk ftdisk.sys Thu Mar 24 18:29:00 2005 (42435B4C)
f733c000 f7352000 pci pci.sys Thu Mar 24 18:34:14 2005 (42435C86)
f7352000 f7386000 ACPI ACPI.sys Thu Mar 24 18:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 01:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 01:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Thu Mar 24 18:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Thu Mar 24 18:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Thu Mar 24 18:40:34 2005 (42435E02)
f74d7000 f74e3e80 si3114 si3114.sys Wed Sep 03 14:05:30 2003 (3F563B7A)
f74e7000 f74f6000 arc arc.sys Sun Mar 26 20:45:27 2006 (442751C7)
f74f7000 f7507000 disk disk.sys Thu Mar 24 18:28:58 2005 (42435B4A)
f7507000 f7513000 Dfs Dfs.sys Thu Mar 24 18:30:28 2005 (42435BA4)
f7517000 f7521000 crcdisk crcdisk.sys Thu Mar 24 18:29:40 2005 (42435B74)
f7567000 f7575000 NDProxy NDProxy.SYS Thu Mar 24 18:34:13 2005 (42435C85)
f7587000 f7590000 watchdog watchdog.sys Thu Mar 24 18:30:19 2005 (42435B9B)
f7597000 f75a0000 mssmbios mssmbios.sys Thu Mar 24 18:34:14 2005 (42435C86)
f75e7000 f75f1000 kbdclass kbdclass.sys Tue Mar 25 01:03:10 2003 (3E7FFF2E)
f75f7000 f7606000 termdd termdd.sys Thu Mar 24 18:27:15 2005 (42435AE3)
f7617000 f7626000 amdk8 amdk8.sys Thu Mar 24 18:28:41 2005 (42435B39)
f7647000 f7653000 vga vga.sys Thu Mar 24 18:29:54 2005 (42435B82)
f7657000 f7663e80 dump_si3114 dump_si3114.sys Wed Sep 03 14:05:30 2003 (3F563B7A)
f76a7000 f76b2000 Msfs Msfs.SYS Thu Mar 24 18:30:04 2005 (42435B8C)
f76b7000 f76c1000 mouclass mouclass.sys Tue Mar 25 01:03:09 2003 (3E7FFF2D)
f76e0000 f7707000 KSecDD KSecDD.sys Thu Mar 24 18:28:53 2005 (42435B45)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 01:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 01:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 01:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 01:08:08 2003 (3E800058)
f7817000 f781f000 audstub audstub.sys Tue Mar 25 01:09:12 2003 (3E800098)
f7861000 f7897000 NDIS NDIS.sys Thu Mar 24 18:40:26 2005 (42435DFA)
f7897000 f7899780 SiWinAcc SiWinAcc.sys Mon Jun 09 17:29:18 2003 (3EE50A3E)
f79e1000 f79e2280 swenum swenum.sys Thu Mar 24 18:27:42 2005 (42435AFE)
f7b4a000 f7bdf000 Ntfs Ntfs.sys Thu Mar 24 18:40:29 2005 (42435DFD)

Unloaded modules:
ba749000 ba757000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba3c6000 ba3da000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba591000 ba5a4000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba58f000 ba5a4000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bac86000 bac8e000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

hmm just looked up SiWinAcc

I think that's for the Seagate harddrive, or Silicon Image SATA Onboard Driver? Which is what the OS drive is on.

Their is also a 8 port Adaptec SATA II Raid card as well in the server.
It's a Dual Opteron Server.

also supposedly can be some adware that uses that filename.

Thanks for any help!

 

bump..

Please somone check out my dump. It's crashing 8times a day and I have no idea what's going on

 

I thought someone here can read it?

I've never opened a ticket with MS before, but I will try that as well.

Does anyone have any ideas what it might be tho?

Thanks,

 

Have you eliminated things like memory by running something like MEMTEST86 from a bootable CD. I have found that sometimes we start running down a rabbit trail chasing something from the dump log when really, it was something completely different. Has there been any hardware change recently? Did you download any new drivers? If so, can you roll them back and see if things smooth out? If the Adaptec card you installed had mfg drivers and not MS drivers, were they replaced by "updated" drivers recently? Most of the time, we can step back and look at what was going on a day or two before the problem and figure it out! Just my $.02!

 

The system also has a PCI-X Adaptec SATA 12 port Raid5 Controller with 5 disks+ hotspare raid-5 going.

That has not given us any issues, and from the logs all i see is the silicon one. The odd thing is the silicon image driver is from 2003, certified by windows, and been around forever. Stable and comes with every tyan dual processor board that has onboard sata. I did see their might be some firmware on the motherboard I can try updating. I'll try that next after we finishing backing things up.

 

Hi.

I upgraded to the latest bios and drivers for everything on board and I don't seem to be getting the sata error and copying GB of data doesn't have any crashes so far.

However now I am getting a completely different error.

From what I can tell, I read it might be because I do not have /PAE in my boot.ini since I am using 4GB of ram in windows 2003 Enterprise server.

I have since put in /PAE and am waiting to see what happens. Can someone tell me what's the issue in this memory dump please.


Thanks!


Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini060306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sat Jun 3 16:34:56.375 2006 (GMT-5)
System Uptime: 0 days 3:01:15.241
Loading Kernel Symbols
..............................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 1b, 0, 8082796e}

Probably caused by : ntkrpamp.exe ( nt!KeSetEvent+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8082796e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000016

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KeSetEvent+4c
8082796e 385816 cmp [eax+0x16],bl

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8082796e to 8088bdd3

IRP_ADDRESS: 87f1b790

STACK_TEXT:
b51d7b18 8082796e badb0d00 00000000 000087b8 nt!KiTrap0E+0x2a7
b51d7b9c 80821552 0190d92c 00000000 00000000 nt!KeSetEvent+0x4c
b51d7bf4 8082d7c5 87f1b7d0 b51d7c40 b51d7c34 nt!IopCompleteRequest+0x268
b51d7c44 80832f95 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
b51d7c7c 8082ae27 b51d7d64 00000000 808ec924 nt!KiSwapThread+0x29f
b51d7cc4 808eca00 8a066d10 00000001 b51d7ce4 nt!KeRemoveQueue+0x417
b51d7d48 80888c6c 000001ac 00feff4c 00feff10 nt!NtRemoveIoCompletion+0xdc
b51d7d48 7c82ed54 000001ac 00feff4c 00feff10 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fefef8 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!KeSetEvent+4c
8082796e 385816 cmp [eax+0x16],bl

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KeSetEvent+4c

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

FAILURE_BUCKET_ID: 0xA_nt!KeSetEvent+4c

BUCKET_ID: 0xA_nt!KeSetEvent+4c

Followup: MachineOwner
---------

eax=f772713c ebx=0000001b ecx=00000001 edx=00000000 esi=f7727120 edi=00000016
eip=8088bdd3 esp=b51d7b00 ebp=b51d7b18 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x2a7:
8088bdd3 833da0628a8000 cmp dword ptr [nt!KiFreezeFlag (808a62a0)],0x0 ds:0023:808a62a0=????????
ChildEBP RetAddr Args to Child
b51d7b18 8082796e badb0d00 00000000 000087b8 nt!KiTrap0E+0x2a7 (FPO: [0,0] TrapFrame @ b51d7b18)
b51d7b9c 80821552 0190d92c 00000000 00000000 nt!KeSetEvent+0x4c (FPO: [Non-Fpo])
b51d7bf4 8082d7c5 87f1b7d0 b51d7c40 b51d7c34 nt!IopCompleteRequest+0x268 (FPO: [Non-Fpo])
b51d7c44 80832f95 00000000 00000000 00000000 nt!KiDeliverApc+0xbb (FPO: [Non-Fpo])
b51d7c7c 8082ae27 b51d7d64 00000000 808ec924 nt!KiSwapThread+0x29f (FPO: [Non-Fpo])
b51d7cc4 808eca00 8a066d10 00000001 b51d7ce4 nt!KeRemoveQueue+0x417 (FPO: [Non-Fpo])
b51d7d48 80888c6c 000001ac 00feff4c 00feff10 nt!NtRemoveIoCompletion+0xdc (FPO: [Non-Fpo])
b51d7d48 7c82ed54 000001ac 00feff4c 00feff10 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b51d7d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fefef8 00000000 00000000 00000000 00000000 0x7c82ed54
start end module name
80800000 80a53000 nt ntkrpamp.exe Thu Mar 24 18:28:04 2005 (42435B14)
80a53000 80a7f000 hal halmacpi.dll Thu Mar 24 18:28:37 2005 (42435B35)
b4ffb000 b5028000 RDPWD RDPWD.SYS Wed Jun 15 10:33:14 2005 (42B04A3A)
b51e0000 b523e000 srv srv.sys Tue May 03 21:44:01 2005 (427836F1)
b5502000 b5509000 dxgthk dxgthk.sys Tue Mar 25 01:05:52 2003 (3E7FFFD0)
b7e96000 b7ea1000 TDTCP TDTCP.SYS Thu Mar 24 18:27:15 2005 (42435AE3)
b8e7c000 b8e86000 Dxapi Dxapi.sys Tue Mar 25 01:06:01 2003 (3E7FFFD9)
b95f1000 b9602000 Fips Fips.SYS Thu Mar 24 18:40:33 2005 (42435E01)
b9602000 b9678000 mrxsmb mrxsmb.sys Thu Mar 24 18:41:13 2005 (42435E29)
b9678000 b96a8000 rdbss rdbss.sys Thu Mar 24 18:40:49 2005 (42435E11)
b96a8000 b96b7100 dump_si3114 dump_si3114.sys Tue Nov 29 15:24:54 2005 (438CC726)
b9708000 b9711000 ndisuio ndisuio.sys Thu Mar 24 18:33:16 2005 (42435C4C)
b9748000 b9772000 afd afd.sys Thu Mar 24 18:40:43 2005 (42435E0B)
b979a000 b97cb000 netbt netbt.sys Thu Mar 24 18:40:31 2005 (42435DFF)
b97cb000 b982c000 tcpip tcpip.sys Thu Jan 12 20:12:43 2006 (43C70C9B)
b982c000 b9845000 ipsec ipsec.sys Thu Mar 24 18:40:49 2005 (42435E11)
b9967000 b9a2d000 dmboot dmboot.sys Thu Mar 24 18:30:03 2005 (42435B8B)
b9a55000 b9a69000 usbhub usbhub.sys Thu Mar 24 18:30:46 2005 (42435BB6)
b9a69000 b9aa9000 update update.sys Thu Mar 24 18:40:27 2005 (42435DFB)
b9aa9000 b9ad1000 ks ks.sys Thu Mar 24 18:41:03 2005 (42435E1F)
b9af0000 b9afa000 dump_diskdump dump_diskdump.sys Thu Mar 24 18:28:56 2005 (42435B48)
b9b10000 b9b1b000 Msfs Msfs.SYS Thu Mar 24 18:30:04 2005 (42435B8C)
b9b20000 b9b2c000 vga vga.sys Thu Mar 24 18:29:54 2005 (42435B82)
b9b60000 b9b6a000 flpydisk flpydisk.sys Tue Mar 25 01:04:32 2003 (3E7FFF80)
ba53b000 ba545000 mouclass mouclass.sys Tue Mar 25 01:03:09 2003 (3E7FFF2D)
ba54b000 ba555000 kbdclass kbdclass.sys Tue Mar 25 01:03:10 2003 (3E7FFF2E)
ba55b000 ba56a000 termdd termdd.sys Thu Mar 24 18:27:15 2005 (42435AE3)
ba5bb000 ba5c8000 netbios netbios.sys Thu Mar 24 18:33:21 2005 (42435C51)
ba5cb000 ba5d8000 wanarp wanarp.sys Thu Mar 24 18:34:07 2005 (42435C7F)
ba630000 ba667000 rdpdr rdpdr.sys Thu Mar 24 18:30:20 2005 (42435B9C)
ba667000 ba67a000 raspptp raspptp.sys Thu Mar 24 18:40:43 2005 (42435E0B)
ba67a000 ba694000 ndiswan ndiswan.sys Thu Mar 24 18:40:46 2005 (42435E0E)
ba694000 ba6a9000 rasl2tp rasl2tp.sys Thu Mar 24 18:40:29 2005 (42435DFD)
ba6a9000 ba6c9c80 b57xp32 b57xp32.sys Thu Jul 21 19:12:32 2005 (42E039F0)
ba6ca000 ba6df000 serial serial.sys Thu Mar 24 18:28:29 2005 (42435B2D)
ba6df000 ba6fa000 VIDEOPRT VIDEOPRT.SYS Thu Mar 24 18:29:53 2005 (42435B81)
ba6fa000 ba74dd80 ati2mpad ati2mpad.sys Thu Jul 18 20:13:20 2002 (3D3767B0)
ba74e000 ba778000 USBPORT USBPORT.SYS Thu Mar 24 18:30:43 2005 (42435BB3)
ba78c000 ba794000 mnmdd mnmdd.SYS Tue Mar 25 01:07:53 2003 (3E800049)
ba794000 ba79b000 Beep Beep.SYS Tue Mar 25 01:03:04 2003 (3E7FFF28)
ba79c000 ba7a3000 Null Null.SYS Tue Mar 25 01:03:05 2003 (3E7FFF29)
ba7a4000 ba7ac000 Fs_Rec Fs_Rec.SYS Tue Mar 25 01:08:36 2003 (3E800074)
bab60000 bab69000 raspti raspti.sys Thu Mar 24 18:34:16 2005 (42435C88)
bab70000 bab7b000 ptilink ptilink.sys Thu Mar 24 18:28:25 2005 (42435B29)
bab80000 bab8b000 TDI TDI.SYS Thu Mar 24 18:35:34 2005 (42435CD6)
bab90000 bab9f000 raspppoe raspppoe.sys Thu Mar 24 18:34:16 2005 (42435C88)
baba0000 baba9000 ndistapi ndistapi.sys Thu Mar 24 18:34:11 2005 (42435C83)
babb0000 babbf000 amdk8 amdk8.sys Thu Mar 24 18:28:41 2005 (42435B39)
babc0000 babcb000 fdc fdc.sys Thu Mar 24 18:28:43 2005 (42435B3B)
babd0000 babda000 serenum serenum.sys Thu Mar 24 18:28:27 2005 (42435B2B)
bf800000 bf9d0000 win32k win32k.sys Wed Oct 05 19:37:08 2005 (434471B4)
bf9d0000 bf9e6000 dxg dxg.sys Thu Mar 24 18:27:25 2005 (42435AED)
bf9e6000 bfa3c680 ati2drad ati2drad.dll Thu Mar 24 20:30:34 2005 (424377CA)
bff60000 bff7e000 RDPDD RDPDD.dll Thu Mar 24 20:30:48 2005 (424377D8)
f7201000 f7220000 Mup Mup.sys Thu Mar 24 18:40:49 2005 (42435E11)
f7220000 f7245000 fltmgr fltmgr.sys Thu Mar 24 18:30:25 2005 (42435BA1)
f7245000 f7258000 CLASSPNP CLASSPNP.SYS Thu Mar 24 18:40:23 2005 (42435DF7)
f7258000 f7269b60 AACMgt AACMgt.sys Wed Mar 22 21:24:14 2006 (442214DE)
f726a000 f7284000 storport storport.sys Thu Mar 24 18:28:57 2005 (42435B49)
f7284000 f72a3000 SCSIPORT SCSIPORT.SYS Thu Mar 24 18:40:26 2005 (42435DFA)
f72a3000 f72bf000 atapi atapi.sys Thu Mar 24 18:28:49 2005 (42435B41)
f72bf000 f72e9000 volsnap volsnap.sys Thu Mar 24 18:29:10 2005 (42435B56)
f72e9000 f7315000 dmio dmio.sys Thu Mar 24 18:30:02 2005 (42435B8A)
f7315000 f733c000 ftdisk ftdisk.sys Thu Mar 24 18:29:00 2005 (42435B4C)
f733c000 f7352000 pci pci.sys Thu Mar 24 18:34:14 2005 (42435C86)
f7352000 f7386000 ACPI ACPI.sys Thu Mar 24 18:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 01:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 01:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Thu Mar 24 18:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Thu Mar 24 18:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Thu Mar 24 18:40:34 2005 (42435E02)
f74d7000 f74e6100 si3114 si3114.sys Tue Nov 29 15:24:54 2005 (438CC726)
f74e7000 f74f6000 arc arc.sys Sun Mar 26 20:45:27 2006 (442751C7)
f74f7000 f7507000 disk disk.sys Thu Mar 24 18:28:58 2005 (42435B4A)
f7507000 f7513000 Dfs Dfs.sys Thu Mar 24 18:30:28 2005 (42435BA4)
f7517000 f7521000 crcdisk crcdisk.sys Thu Mar 24 18:29:40 2005 (42435B74)
f7567000 f7574000 Npfs Npfs.SYS Thu Mar 24 18:30:04 2005 (42435B8C)
f7587000 f7595000 NDProxy NDProxy.SYS Thu Mar 24 18:34:13 2005 (42435C85)
f7627000 f7630000 mssmbios mssmbios.sys Thu Mar 24 18:34:14 2005 (42435C86)
f7667000 f7670000 watchdog watchdog.sys Thu Mar 24 18:30:19 2005 (42435B9B)
f7697000 f76a5000 msgpc msgpc.sys Thu Mar 24 18:33:31 2005 (42435C5B)
f76e0000 f7707000 KSecDD KSecDD.sys Thu Mar 24 18:28:53 2005 (42435B45)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 01:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 01:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 01:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 01:08:08 2003 (3E800058)
f778f000 f7797000 RDPCDD RDPCDD.sys Tue Mar 25 01:03:05 2003 (3E7FFF29)
f7797000 f779f000 rasacd rasacd.sys Tue Mar 25 01:11:50 2003 (3E800136)
f77e7000 f77eb400 usbohci usbohci.sys Thu Mar 24 18:30:45 2005 (42435BB5)
f77ef000 f77f7000 audstub audstub.sys Tue Mar 25 01:09:12 2003 (3E800098)
f7861000 f7897000 NDIS NDIS.sys Thu Mar 24 18:40:26 2005 (42435DFA)
f7897000 f7899880 SiWinAcc SiWinAcc.sys Mon Nov 01 13:21:31 2004 (41868CBB)
f7993000 f7994280 swenum swenum.sys Thu Mar 24 18:27:42 2005 (42435AFE)
f7995000 f7996580 USBD USBD.SYS Tue Mar 25 01:10:39 2003 (3E8000EF)
f7b4a000 f7bdf000 Ntfs Ntfs.sys Thu Mar 24 18:40:29 2005 (42435DFD)

Unloaded modules:
b52c6000 b52de000 parport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f76a7000 f76b5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9694000 b96a8000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b98a2000 b98b5000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b98ff000 b9914000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba7ac000 ba7b4000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Hi,

The first dump is crashed at IRQL 2 and the second dump is crashed at IRQL x'1b' (ie performance monitoring). As the dump occurs randomly, I believe the culprit is faulty ram. Especially crash at IRQL x'1b' is rare and usually it is caused by faulty ram. Run memtest to stress test the ram.