Windows 2003 keeps crashing [DUMP LOG]

Let me start off by saying that I am not even the primary tech on this issue but nobody seems to be able to fix the issue so I would like to ask for help.

OS - Windows 2003 Enterprise SP 1
This issue surfaced after the latest DAT was downloaded from ePO for the Feb-03 virus. The scan has been run but the server sporadically reboots. Also, this server runs MS SQL Server 2000 and the performance degrades for client access over time as well. The client is MS Access 97 using ADO to access SQL Server data.

I looked around on the web and saw that most people post the actual dump file for the experts to look at. I read some posts and figured it out and here is the dump file. Also, the error is consistently the same on the server so I assuming the previous dump files would be same as well.

Thanks for any help in advance :

Opened log file 'c:\debuglog.txt'
2: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
2: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
..............................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 0219000e, Memory contents of the pool block
Arg4: 896a9868, Address of the block of pool being deallocated

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\drivers\mvstdi5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for mvstdi5x.sys
*** ERROR: Module load completed but symbols could not be loaded for mvstdi5x.sys

POOL_ADDRESS: 896a9868

FREED_POOL_TAG: McFo

BUGCHECK_STR: 0xc2_7_McFo

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8089c8f4 to 8087b6be

STACK_TEXT:
f78e2ac0 8089c8f4 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78e2b28 8089c622 896a9868 00000000 f78e2b48 nt!ExFreePoolWithTag+0x477
f78e2b38 ba2412dc 896a9868 896e8e20 f78e2b54 nt!ExFreePool+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
f78e2b48 ba24131b 896a9868 f78e2b68 ba23c90f mvstdi5x+0x62dc
f78e2b54 ba23c90f 896a9868 00000000 896a9868 mvstdi5x+0x631b
f78e2b68 ba23c9a8 896e8e20 f78e2b8c ba2441a5 mvstdi5x+0x190f
f78e2b74 ba2441a5 896e8e20 89619e00 00000002 mvstdi5x+0x19a8
f78e2b8c ba240a5d 89f23020 89eff030 89619e00 mvstdi5x+0x91a5
f78e2ba4 ba240ac2 89f23020 89619e00 00000002 mvstdi5x+0x5a5d
f78e2bb8 8083f9d0 89f23020 89619e00 89619e10 mvstdi5x+0x5ac2
f78e2bcc 80937b66 80a78be4 00000000 89f44580 nt!IofCallDriver+0x45
f78e2c04 8092ac38 00f44598 89f44580 00000000 nt!IopDeleteFile+0x13a
f78e2c1c 80840172 89f44598 00000000 00001330 nt!ObpRemoveObjectRoutine+0xde
f78e2c3c 8092af82 e1000e58 8a39a648 8a396020 nt!ObfDereferenceObject+0x67
f78e2c54 8092ae9e e1000e58 89f44598 00001330 nt!ObpCloseHandleTableEntry+0x139
f78e2c98 8092aee9 00001330 00000000 f78e2cb4 nt!ObpCloseHandle+0x82
f78e2ca8 80834d3f 00001330 f78e2d3c 8083c0fc nt!NtClose+0x1b
f78e2ca8 8083c0fc 00001330 f78e2d3c 8083c0fc nt!KiFastCallEntry+0xfc
f78e2d24 b85163fa 00001330 8083fb69 895e6dd8 nt!ZwClose+0x11
f78e2d3c b84f7fcc 895e6dd8 b85156a8 895e6e4c netbt!NbtTdiCloseConnection+0x38
f78e2d50 b84f7a5e 00000000 895e6dd8 00000000 netbt!DelayedWipeOutLowerconn+0x1b
f78e2d80 8083f72e b85156bc 00000000 8a396020 netbt!NTExecuteWorker+0x6a
f78e2dac 8092ccff b85156bc 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a96 8083f671 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
mvstdi5x+62dc
ba2412dc ?? ???

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: mvstdi5x+62dc

MODULE_NAME: mvstdi5x

IMAGE_NAME: mvstdi5x.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41657065

FAILURE_BUCKET_ID: 0xc2_7_McFo_mvstdi5x+62dc

BUCKET_ID: 0xc2_7_McFo_mvstdi5x+62dc

Followup: MachineOwner
---------

eax=f772f13c ebx=0000121a ecx=00000001 edx=896a9868 esi=f772f120 edi=000001ff
eip=8087b6be esp=f78e2aa8 ebp=f78e2ac0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8087b6be 5d pop ebp
ChildEBP RetAddr Args to Child
f78e2ac0 8089c8f4 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f78e2b28 8089c622 896a9868 00000000 f78e2b48 nt!ExFreePoolWithTag+0x477 (FPO: [Non-Fpo])
f78e2b38 ba2412dc 896a9868 896e8e20 f78e2b54 nt!ExFreePool+0xf (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f78e2b48 ba24131b 896a9868 f78e2b68 ba23c90f mvstdi5x+0x62dc
f78e2b54 ba23c90f 896a9868 00000000 896a9868 mvstdi5x+0x631b
f78e2b68 ba23c9a8 896e8e20 f78e2b8c ba2441a5 mvstdi5x+0x190f
f78e2b74 ba2441a5 896e8e20 89619e00 00000002 mvstdi5x+0x19a8
f78e2b8c ba240a5d 89f23020 89eff030 89619e00 mvstdi5x+0x91a5
f78e2ba4 ba240ac2 89f23020 89619e00 00000002 mvstdi5x+0x5a5d
f78e2bb8 8083f9d0 89f23020 89619e00 89619e10 mvstdi5x+0x5ac2
f78e2bcc 80937b66 80a78be4 00000000 89f44580 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f78e2c04 8092ac38 00f44598 89f44580 00000000 nt!IopDeleteFile+0x13a (FPO: [Non-Fpo])
f78e2c1c 80840172 89f44598 00000000 00001330 nt!ObpRemoveObjectRoutine+0xde (FPO: [Non-Fpo])
f78e2c3c 8092af82 e1000e58 8a39a648 8a396020 nt!ObfDereferenceObject+0x67 (FPO: [Non-Fpo])
f78e2c54 8092ae9e e1000e58 89f44598 00001330 nt!ObpCloseHandleTableEntry+0x139 (FPO: [Non-Fpo])
f78e2c98 8092aee9 00001330 00000000 f78e2cb4 nt!ObpCloseHandle+0x82 (FPO: [Non-Fpo])
f78e2ca8 80834d3f 00001330 f78e2d3c 8083c0fc nt!NtClose+0x1b (FPO: [Non-Fpo])
f78e2ca8 8083c0fc 00001330 f78e2d3c 8083c0fc nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f78e2cb4)
f78e2d24 b85163fa 00001330 8083fb69 895e6dd8 nt!ZwClose+0x11 (FPO: [1,0,0])
f78e2d3c b84f7fcc 895e6dd8 b85156a8 895e6e4c netbt!NbtTdiCloseConnection+0x38 (FPO: [Non-Fpo])
start end module name
80800000 80a75000 nt ntkrnlmp.exe Thu Mar 24 19:42:08 2005 (42435E60)
80a75000 80aa1000 hal halaacpi.dll Thu Mar 24 19:28:37 2005 (42435B35)
aaf24000 aaf4e000 Fastfat Fastfat.SYS Thu Mar 24 19:40:20 2005 (42435DF4)
af7e6000 af8007c0 naiavf5x naiavf5x.sys Tue Nov 02 12:32:39 2004 (4187C4B7)
b6fa9000 b7007000 srv srv.sys Tue May 03 22:44:01 2005 (427836F1)
b7267000 b7270000 ndisuio ndisuio.sys Thu Mar 24 19:33:16 2005 (42435C4C)
b7407000 b7411000 Dxapi Dxapi.sys Tue Mar 25 02:06:01 2003 (3E7FFFD9)
b7517000 b752c000 Cdfs Cdfs.SYS Thu Mar 24 19:40:55 2005 (42435E17)
b752c000 b753d000 Fips Fips.SYS Thu Mar 24 19:40:33 2005 (42435E01)
b753d000 b75b3000 mrxsmb mrxsmb.sys Thu Mar 24 19:41:13 2005 (42435E29)
b77f6000 b77f9e40 ASPI32 ASPI32.SYS Fri Sep 10 19:46:10 1999 (37D99842)
b7a06000 b7a12000 dump_mraid35x dump_mraid35x.sys Fri Dec 12 01:13:16 2003 (3FD95C7C)
b83dd000 b840d000 rdbss rdbss.sys Thu Mar 24 19:40:49 2005 (42435E11)
b845d000 b8487000 afd afd.sys unavailable (00000000)
b84f5000 b8526000 netbt netbt.sys Thu Mar 24 19:40:31 2005 (42435DFF)
b93ec000 b944d000 tcpip tcpip.sys Thu Mar 24 19:40:31 2005 (42435DFF)
b944d000 b9466000 ipsec ipsec.sys Thu Mar 24 19:40:49 2005 (42435E11)
b9486000 b949a000 usbhub usbhub.sys Thu Mar 24 19:30:46 2005 (42435BB6)
b953a000 b9546000 vga vga.sys Thu Mar 24 19:29:54 2005 (42435B82)
b967a000 b9687000 netbios netbios.sys Thu Mar 24 19:33:21 2005 (42435C51)
b979a000 b97a5000 Msfs Msfs.SYS unavailable (00000000)
b986e000 b9878000 flpydisk flpydisk.sys Tue Mar 25 02:04:32 2003 (3E7FFF80)
b9a0e000 b9a1b000 Npfs Npfs.SYS Thu Mar 24 19:30:04 2005 (42435B8C)
b9a80000 b9a88000 RDPCDD RDPCDD.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)
b9a88000 b9a90000 mnmdd mnmdd.SYS Tue Mar 25 02:07:53 2003 (3E800049)
b9b88000 b9b95000 wanarp wanarp.sys Thu Mar 24 19:34:07 2005 (42435C7F)
b9bee000 b9bf0740 awlegacy awlegacy.sys Mon Sep 11 18:19:37 2000 (39BD5A79)
b9c12000 b9cd8000 dmboot dmboot.sys unavailable (00000000)
b9dd8000 b9e18000 update update.sys Thu Mar 24 19:40:27 2005 (42435DFB)
b9e40000 b9e77000 rdpdr rdpdr.sys Thu Mar 24 19:30:20 2005 (42435B9C)
b9e77000 b9e8a000 raspptp raspptp.sys Thu Mar 24 19:40:43 2005 (42435E0B)
b9e8a000 b9ea4000 ndiswan ndiswan.sys Thu Mar 24 19:40:46 2005 (42435E0E)
b9ea4000 b9eb9000 rasl2tp rasl2tp.sys Thu Mar 24 19:40:29 2005 (42435DFD)
b9eb9000 b9edea00 e100b325 e100b325.sys Thu Aug 19 16:25:22 2004 (41250CB2)
b9edf000 b9f09000 USBPORT USBPORT.SYS Thu Mar 24 19:30:43 2005 (42435BB3)
b9f09000 b9f31000 ks ks.sys Thu Mar 24 19:41:03 2005 (42435E1F)
b9f31000 b9f45000 redbook redbook.sys Thu Mar 24 19:28:46 2005 (42435B3E)
b9f45000 b9f5a000 cdrom cdrom.sys Thu Mar 24 19:28:57 2005 (42435B49)
b9f82000 b9f83580 USBD USBD.SYS Tue Mar 25 02:10:39 2003 (3E8000EF)
b9f96000 b9fae000 parport parport.sys Thu Mar 24 19:28:25 2005 (42435B29)
b9fd7000 b9fe0000 mssmbios mssmbios.sys Thu Mar 24 19:34:14 2005 (42435C86)
ba047000 ba052000 ptilink ptilink.sys Thu Mar 24 19:28:25 2005 (42435B29)
ba057000 ba060000 ndistapi ndistapi.sys Thu Mar 24 19:34:11 2005 (42435C83)
ba0d7000 ba0e5000 msgpc msgpc.sys Thu Mar 24 19:33:31 2005 (42435C5B)
ba107000 ba11c000 serial serial.sys Thu Mar 24 19:28:29 2005 (42435B2D)
ba11c000 ba12f000 i8042prt i8042prt.sys Thu Mar 24 19:41:05 2005 (42435E21)
ba12f000 ba140400 atiragem atiragem.sys Thu Oct 03 21:22:15 2002 (3D9CED47)
ba141000 ba15c000 VIDEOPRT VIDEOPRT.SYS Thu Mar 24 19:29:53 2005 (42435B81)
ba1e0000 ba1e0840 idisw2km idisw2km.sys Mon Jun 28 00:58:38 2004 (40DFA57E)
ba22b000 ba236000 TDI TDI.SYS Thu Mar 24 19:35:34 2005 (42435CD6)
ba23b000 ba249460 mvstdi5x mvstdi5x.sys Thu Oct 07 12:35:49 2004 (41657065)
ba2cb000 ba2d5000 serenum serenum.sys Thu Mar 24 19:28:27 2005 (42435B2B)
ba2db000 ba2e6000 fdc fdc.sys Thu Mar 24 19:28:43 2005 (42435B3B)
ba2eb000 ba2f9000 processr processr.sys Thu Mar 24 19:28:39 2005 (42435B37)
ba2fb000 ba305000 mouclass mouclass.sys Tue Mar 25 02:03:09 2003 (3E7FFF2D)
ba30b000 ba315000 kbdclass kbdclass.sys Tue Mar 25 02:03:10 2003 (3E7FFF2E)
ba31b000 ba324000 watchdog watchdog.sys Thu Mar 24 19:30:19 2005 (42435B9B)
ba32b000 ba33a000 termdd termdd.sys Thu Mar 24 19:27:15 2005 (42435AE3)
ba37b000 ba383000 rasacd rasacd.sys Tue Mar 25 02:11:50 2003 (3E800136)
ba383000 ba38a000 Beep Beep.SYS Tue Mar 25 02:03:04 2003 (3E7FFF28)
ba39b000 ba3a3000 EntDrv52 EntDrv52.sys Tue Oct 05 19:23:57 2004 (41632D0D)
ba3cb000 ba3d1000 PGPmemlock PGPmemlock.sys Fri May 14 15:20:09 1999 (373C7769)
ba3db000 ba3e2000 dxgthk dxgthk.sys Tue Mar 25 02:05:52 2003 (3E7FFFD0)
ba473000 ba47a000 Null Null.SYS unavailable (00000000)
ba48b000 ba48f820 0dlttape 0dlttape.sys Wed Mar 05 10:26:33 2003 (3E661729)
ba49b000 ba4a3000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
ba4cb000 ba4d2b60 aw_host5 aw_host5.sys Mon Feb 11 14:06:39 2002 (3C68163F)
ba4d3000 ba4db000 audstub audstub.sys Tue Mar 25 02:09:12 2003 (3E800098)
ba4db000 ba4df400 usbohci usbohci.sys Thu Mar 24 19:30:45 2005 (42435BB5)
bae25000 bae33000 NDProxy NDProxy.SYS Thu Mar 24 19:34:13 2005 (42435C85)
bf800000 bf9cf000 win32k win32k.sys Thu Mar 24 19:40:09 2005 (42435DE9)
bf9cf000 bf9e5000 dxg dxg.sys Thu Mar 24 19:27:25 2005 (42435AED)
bf9e5000 bf9e7b40 awvid5 awvid5.dll Thu Feb 07 15:41:40 2002 (3C62E684)
bf9e8000 bf9e8940 AWDDI5 AWDDI5.DLL Fri Feb 15 15:08:50 2002 (3C6D6AD2)
bff30000 bff49c00 atiraged atiraged.DLL Tue Mar 25 04:46:28 2003 (3E802574)
f71f0000 f720f000 Mup Mup.sys Thu Mar 24 19:40:49 2005 (42435E11)
f720f000 f7245000 NDIS NDIS.sys Thu Mar 24 19:40:26 2005 (42435DFA)
f7245000 f72da000 Ntfs Ntfs.sys Thu Mar 24 19:40:29 2005 (42435DFD)
f72da000 f7301000 KSecDD KSecDD.sys Thu Mar 24 19:28:53 2005 (42435B45)
f7301000 f7326000 fltmgr fltmgr.sys Thu Mar 24 19:30:25 2005 (42435BA1)
f7326000 f7339000 CLASSPNP CLASSPNP.SYS Thu Mar 24 19:40:23 2005 (42435DF7)
f7339000 f734a7c0 afamgt afamgt.sys Mon Nov 24 18:39:49 2003 (3FC296C5)
f734b000 f7363e80 adpu160m adpu160m.sys Mon Sep 17 16:55:53 2001 (3BA66359)
f7364000 f7383000 SCSIPORT SCSIPORT.SYS Thu Mar 24 19:40:26 2005 (42435DFA)
f7383000 f739f000 atapi atapi.sys Thu Mar 24 19:28:49 2005 (42435B41)
f739f000 f73c9000 volsnap volsnap.sys Thu Mar 24 19:29:10 2005 (42435B56)
f73c9000 f73f5000 dmio dmio.sys Thu Mar 24 19:30:02 2005 (42435B8A)
f73f5000 f741c000 ftdisk ftdisk.sys Thu Mar 24 19:29:00 2005 (42435B4C)
f741c000 f7432000 pci pci.sys Thu Mar 24 19:34:14 2005 (42435C86)
f7432000 f7466000 ACPI ACPI.sys Thu Mar 24 19:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 02:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 02:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Thu Mar 24 19:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Thu Mar 24 19:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Thu Mar 24 19:40:34 2005 (42435E02)
f74d7000 f74e3000 mraid35x mraid35x.sys Fri Dec 12 01:13:16 2003 (3FD95C7C)
f74e7000 f74f7000 disk disk.sys Thu Mar 24 19:28:58 2005 (42435B4A)
f74f7000 f75020e0 vsp vsp.sys Thu Apr 03 14:16:05 2003 (3E8C8875)
f7507000 f7513000 Dfs Dfs.sys Thu Mar 24 19:30:28 2005 (42435BA4)
f7517000 f7521000 crcdisk crcdisk.sys Thu Mar 24 19:29:40 2005 (42435B74)
f7587000 f7590000 raspti raspti.sys Thu Mar 24 19:34:16 2005 (42435C88)
f7607000 f7616000 raspppoe raspppoe.sys Thu Mar 24 19:34:16 2005 (42435C88)
f7627000 f7631000 dump_diskdump dump_diskdump.sys Thu Mar 24 19:28:56 2005 (42435B48)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 02:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 02:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 02:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys unavailable (00000000)
f77bf000 f77c6000 parvdm parvdm.sys Tue Mar 25 02:03:49 2003 (3E7FFF55)
f7897000 f789a780 Gernuwa Gernuwa.sys Tue Oct 09 16:14:34 2001 (3BC35AAA)
f79a1000 f79a2280 swenum swenum.sys Thu Mar 24 19:27:42 2005 (42435AFE)
f79dd000 f79de300 kbstuff5 kbstuff5.sys Mon Jun 28 00:57:56 2004 (40DFA554)

Unloaded modules:
b7119000 b716f000 wlbs.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b962a000 b9638000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9bda000 b9bdd000 scsichng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7797000 f779f000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Hi,

I believe that it is the software error of Anti-Virus Mini-Firewall Driver (McAfee). If you searh google using the time stamp of the failing module 41657065, you will find a lot of hits relating to system crash at this module. Upgrade McAfee Anti-Virus Mini-Firewall Driver.