Windows 2003 R2 Server crash - Error code 1000008e

Hello.

I would greatly appreciate someone's help on this.

Following the intructions on your forum I have extracted the data from a Memory.dmp file on our server to a Debuglog.txt file. Here is what the log contains:

Opened log file 'c:debuglog.txt'

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.100216-1301
Machine Name:
Kernel base = 0xe0800000 PsLoadedModuleList = 0xe08a6ea8
Debug session time: Wed Dec 15 09:47:40.213 2010 (UTC + 0:00)
System Uptime: 17 days 23:25:25.077
Loading Kernel Symbols
...............................................................
................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffff00c). Type ".hh dbgerr001" for details
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, de603819, f18527c8, 0}

Page 13c350 not present in the dump file. Type ".hh dbgerr004" for details
*** ERROR: Module load completed but symbols could not be loaded for vmx_fb.dll
Probably caused by : vmx_fb.dll ( vmx_fb+1b819 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: de603819, The address that the exception occurred at
Arg3: f18527c8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
vmx_fb+1b819
de603819 8b83a4092000 mov eax,dword ptr [ebx+2009A4h]

TRAP_FRAME: f18527c8 -- (.trap 0xfffffffff18527c8)
.trap 0xfffffffff18527c8
ErrCode = 00000000
eax=f1852864 ebx=00000000 ecx=f0200000 edx=00000300 esi=e143e010 edi=f1852884
eip=de603819 esp=f185283c ebp=f1852840 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
vmx_fb+0x1b819:
de603819 8b83a4092000 mov eax,dword ptr [ebx+2009A4h] ds:0023:002009a4=????????
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from e082d820 to e0827c83

STACK_TEXT:
f1852394 e082d820 0000008e c0000005 de603819 nt!KeBugCheckEx+0x1b
f1852758 e088a2aa f1852774 00000000 f18527c8 nt!KiDispatchException+0x3a2
f18527c0 e088a25e f1852840 de603819 badb0d00 nt!CommonDispatchException+0x4a
f18527dc de42831a 00000001 e143e010 00000000 nt!Kei386EoiHelper+0x186
f1852840 de5e98cb 00000000 f1852864 00000000 win32k!GreDeviceIoControl+0x93
WARNING: Stack unwind information not available. Following frames may be wrong.
f1852884 de5edd92 e143e010 00000001 e143e010 vmx_fb+0x18cb
f18528a8 de5ed456 00000004 00000001 e7d677f8 vmx_fb+0x5d92
f18528c0 de40c6d4 e143e010 e7d677f8 f1852958 vmx_fb+0x5456
f18528f8 de40ae22 e143e010 e7d677f8 00000000 win32k!WatchdogDrvEnableSurface+0x36
f1852914 de40497a f1852aec e1d418f0 00000000 win32k!PDEVOBJ::bMakeSurface+0x43
f1852974 de40471c e1d418f0 e2ada3c0 e3ab4458 win32k!hCreateHDEV+0x398
f1852af0 de4068db 00000000 00000000 00000001 win32k!DrvCreateMDEV+0x4f0
f1852be4 de40675b 00000000 00000000 00000000 win32k!DrvChangeDisplaySettings+0x2eb
f1852c20 de422b1e 00000000 f1852d20 00000009 win32k!InitVideo+0x28
f1852c40 de4228a2 f1852c64 00000012 fe794cb8 win32k!RemoteConnect+0x23d
f1852d50 e08897cc 0047fdcc 0000000a 0047fe88 win32k!NtUserRemoteConnect+0xb4
f1852d50 7c82860c 0047fdcc 0000000a 0047fe88 nt!KiFastCallEntry+0xfc
0047fea0 00000000 00000000 00000000 00000000 0x7c82860c


STACK_COMMAND: kb

FOLLOWUP_IP:
vmx_fb+1b819
de603819 8b83a4092000 mov eax,dword ptr [ebx+2009A4h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: vmx_fb+1b819

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: vmx_fb

IMAGE_NAME: vmx_fb.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4ab9d0bf

FAILURE_BUCKET_ID: 0x8E_vmx_fb+1b819

BUCKET_ID: 0x8E_vmx_fb+1b819

Followup: MachineOwner
---------

eax=f534713c ebx=de603819 ecx=00000000 edx=e088edc2 esi=f5347120 edi=00000000
eip=e0827c83 esp=f185237c ebp=f1852394 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
e0827c83 5d pop ebp
ChildEBP RetAddr Args to Child
f1852394 e082d820 0000008e c0000005 de603819 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f1852758 e088a2aa f1852774 00000000 f18527c8 nt!KiDispatchException+0x3a2 (FPO: [Non-Fpo])
f18527c0 e088a25e f1852840 de603819 badb0d00 nt!CommonDispatchException+0x4a (FPO: [0,20,0])
f18527dc de42831a 00000001 e143e010 00000000 nt!Kei386EoiHelper+0x186
f1852840 de5e98cb 00000000 f1852864 00000000 win32k!GreDeviceIoControl+0x93 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f1852884 de5edd92 e143e010 00000001 e143e010 vmx_fb+0x18cb
f18528a8 de5ed456 00000004 00000001 e7d677f8 vmx_fb+0x5d92
f18528c0 de40c6d4 e143e010 e7d677f8 f1852958 vmx_fb+0x5456
f18528f8 de40ae22 e143e010 e7d677f8 00000000 win32k!WatchdogDrvEnableSurface+0x36 (FPO: [Non-Fpo])
f1852914 de40497a f1852aec e1d418f0 00000000 win32k!PDEVOBJ::bMakeSurface+0x43 (FPO: [Non-Fpo])
f1852974 de40471c e1d418f0 e2ada3c0 e3ab4458 win32k!hCreateHDEV+0x398 (FPO: [Non-Fpo])
f1852af0 de4068db 00000000 00000000 00000001 win32k!DrvCreateMDEV+0x4f0 (FPO: [Non-Fpo])
f1852be4 de40675b 00000000 00000000 00000000 win32k!DrvChangeDisplaySettings+0x2eb (FPO: [Non-Fpo])
f1852c20 de422b1e 00000000 f1852d20 00000009 win32k!InitVideo+0x28 (FPO: [Non-Fpo])
f1852c40 de4228a2 f1852c64 00000012 fe794cb8 win32k!RemoteConnect+0x23d (FPO: [Non-Fpo])
f1852d50 e08897cc 0047fdcc 0000000a 0047fe88 win32k!NtUserRemoteConnect+0xb4 (FPO: [Non-Fpo])
f1852d50 7c82860c 0047fdcc 0000000a 0047fe88 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f1852d64)
0047fea0 00000000 00000000 00000000 00000000 0x7c82860c
start end module name
de400000 de5d1000 win32k win32k.sys Tue Aug 31 15:33:35 2010 (4C7D12BF)
de5d1000 de5e8000 dxg dxg.sys Sat Feb 17 06:14:39 2007 (45D69D4F)
de5e8000 de61b880 vmx_fb vmx_fb.dll Wed Sep 23 08:39:43 2009 (4AB9D0BF)
de61c000 de666000 ATMFD ATMFD.DLL Sat Aug 28 17:40:11 2010 (4C793BEB)
de666000 de684000 RDPDD RDPDD.dll Sat Feb 17 14:01:19 2007 (45D70AAF)
e0800000 e0a5a000 nt ntkrpamp.exe Tue Feb 16 12:33:49 2010 (4B7A90AD)
e0a5a000 e0a86000 hal halmacpi.dll Sat Feb 17 05:48:26 2007 (45D6972A)
f2b62000 f2b8c000 Fastfat Fastfat.SYS Sat Feb 17 06:27:55 2007 (45D6A06B)
f304d000 f3078000 RDPWD RDPWD.SYS Sat Feb 17 05:44:38 2007 (45D69646)
f334c000 f334f600 KAPFA KAPFA.SYS Thu Mar 26 23:05:46 2009 (49CC0A4A)
f3c30000 f3c3b000 TDTCP TDTCP.SYS Sat Feb 17 05:44:32 2007 (45D69640)
f3e60000 f3ec4000 srv srv.sys Mon Aug 16 18:08:17 2010 (4C697081)
f3fdc000 f402d000 HTTP HTTP.sys Fri Nov 06 12:51:22 2009 (4AF41BCA)
f430f000 f433ee60 exifs exifs.sys Fri Aug 26 01:29:05 2005 (430E6251)
f44af000 f44b9000 ndisuio ndisuio.sys Sat Feb 17 05:58:25 2007 (45D69981)
f4547000 f4558000 dump_symmpi dump_symmpi.sys Mon Dec 13 21:03:14 2004 (41BE0392)
f4558000 f456d000 Cdfs Cdfs.SYS Sat Feb 17 06:27:08 2007 (45D6A03C)
f456d000 f457e000 Fips Fips.SYS Sat Feb 17 06:26:33 2007 (45D6A019)
f457e000 f45f4000 mrxsmb mrxsmb.sys Wed Feb 24 15:54:48 2010 (4B854BC8)
f461c000 f464c000 rdbss rdbss.sys Wed Feb 24 15:54:03 2010 (4B854B9B)
f464c000 f4676000 afd afd.sys Thu Aug 14 11:46:56 2008 (48A40D20)
f4676000 f46a7000 netbt netbt.sys Sat Feb 17 06:28:57 2007 (45D6A0A9)
f46a7000 f46d1000 ipnat ipnat.sys Sat Feb 17 05:59:08 2007 (45D699AC)
f46d1000 f4765000 tcpip tcpip.sys Sat Aug 15 10:53:38 2009 (4A8685A2)
f4765000 f477e000 ipsec ipsec.sys Sat Feb 17 06:29:28 2007 (45D6A0C8)
f4965000 f496f000 Dxapi Dxapi.sys Tue Mar 25 07:06:01 2003 (3E7FFFD9)
f49ec000 f4a4b000 update update.sys Mon May 28 13:15:16 2007 (465AC7D4)
f4a73000 f4aaa000 rdpdr rdpdr.sys Sat Feb 17 05:51:00 2007 (45D697C4)
f4aaa000 f4abc000 raspptp raspptp.sys Sat Feb 17 06:29:20 2007 (45D6A0C0)
f4aec000 f4af6000 dump_diskdump dump_diskdump.sys Sat Feb 17 06:07:44 2007 (45D69BB0)
f4b5c000 f4b75000 ndiswan ndiswan.sys Sat Feb 17 06:29:22 2007 (45D6A0C2)
f4b75000 f4b89000 rasl2tp rasl2tp.sys Sat Feb 17 06:29:02 2007 (45D6A0AE)
f4b89000 f4ba1c00 e1000325 e1000325.sys Mon Jan 13 19:12:12 2003 (3E230F8C)
f4ba2000 f4bbe000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 06:10:30 2007 (45D69C56)
f4bbe000 f4be5000 ks ks.sys Sat Feb 17 06:30:40 2007 (45D6A110)
f4be5000 f4bf9000 redbook redbook.sys Sat Feb 17 06:07:26 2007 (45D69B9E)
f4bf9000 f4c0e000 cdrom cdrom.sys Sat Feb 17 06:07:48 2007 (45D69BB4)
f4c0e000 f4c23000 serial serial.sys Sat Feb 17 06:06:46 2007 (45D69B76)
f4c23000 f4c3b000 parport parport.sys Sat Feb 17 06:06:42 2007 (45D69B72)
f4c3b000 f4c4e000 i8042prt i8042prt.sys Sat Feb 17 06:30:40 2007 (45D6A110)
f4d0e000 f4d2d000 Mup Mup.sys Sat Feb 17 06:27:41 2007 (45D6A05D)
f4d2d000 f4d6c000 NDIS NDIS.sys Sat Feb 17 06:28:49 2007 (45D6A0A1)
f4d6c000 f4e01000 Ntfs Ntfs.sys Sat Feb 17 06:27:23 2007 (45D6A04B)
f4e01000 f4e27000 KSecDD KSecDD.sys Mon Jun 15 18:45:11 2009 (4A3688A7)
f4e27000 f4e3b000 RepKap RepKap.sys Tue Jun 08 12:08:42 2010 (4C0E24BA)
f4e3b000 f4e5a000 RepDrv RepDrv.sys Tue Jun 08 12:08:52 2010 (4C0E24C4)
f4e5a000 f4e7f000 fltMgr fltMgr.sys Sat Feb 17 05:51:08 2007 (45D697CC)
f4e7f000 f4e92000 CLASSPNP CLASSPNP.SYS Sat Feb 17 06:28:16 2007 (45D6A080)
f4e92000 f4eb1000 SCSIPORT SCSIPORT.SYS Sat Feb 17 06:28:41 2007 (45D6A099)
f4eb1000 f4ec2000 symmpi symmpi.sys Mon Dec 13 21:03:14 2004 (41BE0392)
f4ec2000 f4edf000 atapi atapi.sys Sat Feb 17 06:07:34 2007 (45D69BA6)
f4edf000 f4f09000 volsnap volsnap.sys Sat Feb 17 06:08:23 2007 (45D69BD7)
f4f09000 f4f35000 dmio dmio.sys Sat Feb 17 06:10:44 2007 (45D69C64)
f4f35000 f4f5c000 ftdisk ftdisk.sys Sat Feb 17 06:08:05 2007 (45D69BC5)
f4f5c000 f4f72000 pci pci.sys Sat Feb 17 05:59:03 2007 (45D699A7)
f4f72000 f4fa6000 ACPI ACPI.sys Sat Feb 17 05:58:47 2007 (45D69997)
f50a7000 f50b0000 WMILIB WMILIB.SYS Tue Mar 25 07:13:00 2003 (3E80017C)
f50b7000 f50c6000 isapnp isapnp.sys Sat Feb 17 05:58:57 2007 (45D699A1)
f50c7000 f50d4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 06:07:32 2007 (45D69BA4)
f50d7000 f50e7000 MountMgr MountMgr.sys Sat Feb 17 06:05:35 2007 (45D69B2F)
f50e7000 f50f2000 PartMgr PartMgr.sys Sat Feb 17 06:29:25 2007 (45D6A0C5)
f50f7000 f5107000 disk disk.sys Sat Feb 17 06:07:51 2007 (45D69BB7)
f5107000 f5110000 RepDac RepDac.sys Tue Jun 08 12:08:34 2010 (4C0E24B2)
f5117000 f5123000 Dfs Dfs.sys Sat Feb 17 05:51:17 2007 (45D697D5)
f5127000 f5137000 agp440 agp440.sys Sat Feb 17 05:58:53 2007 (45D6999D)
f5137000 f5141000 crcdisk crcdisk.sys Sat Feb 17 06:09:50 2007 (45D69C2E)
f5157000 f5166000 termdd termdd.sys Sat Feb 17 05:44:32 2007 (45D69640)
f5167000 f5172000 TDI TDI.SYS Sat Feb 17 06:01:19 2007 (45D69A2F)
f5177000 f5182000 fdc fdc.sys Sat Feb 17 06:07:16 2007 (45D69B94)
f5187000 f5191000 serenum serenum.sys Sat Feb 17 06:06:44 2007 (45D69B74)
f5197000 f51a0000 mssmbios mssmbios.sys Sat Feb 17 05:59:12 2007 (45D699B0)
f51b7000 f51c4000 RepHsm RepHsm.sys Tue Jun 08 12:08:46 2010 (4C0E24BE)
f51c7000 f51d0000 ndistapi ndistapi.sys Sat Feb 17 05:59:19 2007 (45D699B7)
f51d7000 f51e0000 ws2ifsl ws2ifsl.sys Sat Feb 17 05:59:56 2007 (45D699DC)
f51e7000 f51f5000 msgpc msgpc.sys Sat Feb 17 05:58:37 2007 (45D6998D)
f51f7000 f5200000 raspti raspti.sys Sat Feb 17 05:59:23 2007 (45D699BB)
f5207000 f5216000 raspppoe raspppoe.sys Sat Feb 17 05:59:23 2007 (45D699BB)
f5217000 f5223000 vga vga.sys Sat Feb 17 06:10:30 2007 (45D69C56)
f5227000 f5231000 mouclass mouclass.sys Tue Mar 25 07:03:09 2003 (3E7FFF2D)
f5237000 f5242000 Msfs Msfs.SYS Sat Feb 17 05:50:33 2007 (45D697A9)
f5247000 f5254000 wanarp wanarp.sys Sat Feb 17 05:59:17 2007 (45D699B5)
f5257000 f5264000 netbios netbios.sys Sat Feb 17 05:58:29 2007 (45D69985)
f5267000 f5276000 intelppm intelppm.sys Sat Feb 17 05:48:30 2007 (45D6972E)
f5297000 f52a2000 ptilink ptilink.sys Sat Feb 17 06:06:38 2007 (45D69B6E)
f52a7000 f52b1000 flpydisk flpydisk.sys Tue Mar 25 07:04:32 2003 (3E7FFF80)
f52b7000 f52c2c80 vmci vmci.sys Tue Jan 20 07:51:18 2009 (49758276)
f52c7000 f52d0000 watchdog watchdog.sys Sat Feb 17 06:11:45 2007 (45D69CA1)
f52d7000 f52e4000 Npfs Npfs.SYS Sat Feb 17 05:50:36 2007 (45D697AC)
f52f7000 f5305000 NDProxy NDProxy.SYS Sat Feb 17 05:59:21 2007 (45D699B9)
f5307000 f5312000 kbdclass kbdclass.sys Sat Feb 17 06:05:39 2007 (45D69B33)
f5327000 f532f000 kdcom kdcom.dll Tue Mar 25 07:08:00 2003 (3E800050)
f532f000 f5337000 BOOTVID BOOTVID.dll Tue Mar 25 07:07:58 2003 (3E80004E)
f5337000 f533e000 intelide intelide.sys Sat Feb 17 06:07:32 2007 (45D69BA4)
f533f000 f5346000 dmload dmload.sys Tue Mar 25 07:08:08 2003 (3E800058)
f53b7000 f53bc380 vmx_svga vmx_svga.sys Wed Sep 23 08:37:28 2009 (4AB9D038)
f53bf000 f53c6000 vncmirror vncmirror.sys Fri Mar 14 17:42:46 2008 (47DAB916)
f53c7000 f53cf000 audstub audstub.sys Tue Mar 25 07:09:12 2003 (3E800098)
f53df000 f53e7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 07:08:36 2003 (3E800074)
f53e7000 f53ee000 Null Null.SYS Tue Mar 25 07:03:05 2003 (3E7FFF29)
f53ef000 f53f6000 Beep Beep.SYS Tue Mar 25 07:03:04 2003 (3E7FFF28)
f53f7000 f53ff000 mnmdd mnmdd.SYS Tue Mar 25 07:07:53 2003 (3E800049)
f53ff000 f5407000 RDPCDD RDPCDD.sys Tue Mar 25 07:03:05 2003 (3E7FFF29)
f5407000 f540f000 rasacd rasacd.sys Tue Mar 25 07:11:50 2003 (3E800136)
f541f000 f5426000 dxgthk dxgthk.sys Tue Mar 25 07:05:52 2003 (3E7FFFD0)
f5487000 f548e400 lgtosync lgtosync.sys Fri Mar 10 01:47:08 2006 (4410DA9C)
f548f000 f5496000 parvdm parvdm.sys Tue Mar 25 07:03:49 2003 (3E7FFF55)
f54b7000 f54b9980 compbatt compbatt.sys Sat Feb 17 05:58:51 2007 (45D6999B)
f54bb000 f54be900 BATTC BATTC.SYS Sat Feb 17 05:58:46 2007 (45D69996)
f55a3000 f55a6700 CmBatt CmBatt.sys Sat Feb 17 05:58:51 2007 (45D6999B)
f55b9000 f55ba280 vmmouse vmmouse.sys Mon Sep 29 07:49:38 2008 (48E07A82)
f55bb000 f55bc280 swenum swenum.sys Sat Feb 17 06:05:56 2007 (45D69B44)
f5643000 f5644e00 vmmemctl vmmemctl.sys Tue Dec 22 23:58:35 2009 (4B315D2B)

Unloaded modules:
f5317000 f5320000 vmdebug.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
f4b4c000 f4b5a000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
f53d7000 f53df000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00008000
Closing open log file c:debuglog.txt