Windows 2003 Server Bugcheck Debug

OK I have no idea what all this information the server has given me means, hopefully some genius could tell me what caused this server to crash.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 MP (2 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer
Built by: 3790.srv03_rtm.030324-2048
Kernel base = 0xe0b4a000 PsLoadedModuleList = 0xe0be76a8
Debug session time: Tue Feb 15 08:22:11.828 2005 (GMT+0)
System Uptime: 0 days 17:24:06.593
Loading Kernel Symbols
...........................................................................................................
Loading unloaded module list
......
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {c0000005, e0b5cb6a, f3bdd788, f3bdd3d8}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for TmPreFlt.sys -
Probably caused by : TmXPFlt.sys ( TmXPFlt+dfbf )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: e0b5cb6a, The address that the exception occurred at
Arg3: f3bdd788, Exception Record Address
Arg4: f3bdd3d8, Context Record Address

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ObfDereferenceObject+1d
e0b5cb6a f00fc13e lock xadd [esi],edi

EXCEPTION_PARAMETER1: f3bdd788

CONTEXT: f3bdd3d8 -- (.cxr fffffffff3bdd3d8)
eax=f92c7f7c ebx=00000000 ecx=000003c1 edx=f3caf7b0 esi=000003a9 edi=ffffffff
eip=e0b5cb6a esp=f3bdd850 ebp=000003c1 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!ObfDereferenceObject+0x1d:
e0b5cb6a f00fc13e lock xadd [esi],edi ds:0023:000003a9=????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x7E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from f3c8bfbf to e0b5cb6a

STACK_TEXT:
f3bdd85c f3c8bfbf 00000000 f92c7df8 f3bdd878 nt!ObfDereferenceObject+0x1d
WARNING: Stack unwind information not available. Following frames may be wrong.
f3bdd86c f3c8140c f92c7f7c f3bdd8e0 f6c29c35 TmXPFlt+0xdfbf
f3bdd878 f6c29c35 00000108 f3bdd8dc f9185028 TmXPFlt+0x340c
f3bdd8e0 e0b5c4f3 fa17b7a0 00000108 f92c7df8 TmPreFlt!TmpAddRdr+0x1f63
f3bdd8f0 e0bfb338 f9898590 f99a81a8 f3bddadc nt!IofCallDriver+0x3f
f3bdd9e8 e0c0ab34 fa17b6e8 00000000 f9778170 nt!IopParseDevice+0xab5
f3bdda20 e0bf96c8 f9898590 00000000 f9778170 nt!IopParseFile+0x44
f3bdda9c e0bf99a9 000009e8 f3bddadc 00000040 nt!ObpLookupObjectName+0x117
f3bddaf0 e0bfb549 00000000 00000000 dd0c0800 nt!ObOpenObjectByName+0xe8
f3bddb6c e0bfb61d f3bddccc 0002019f f3bddc94 nt!IopCreateFile+0x413
f3bddbb8 f59fe4ee f3bddccc 0002019f f3bddc94 nt!IoCreateFile+0x3d
f3bddc28 f59fa6c9 fa45b9d0 f3bddccc 0002019f srv!SrvIoCreateFile+0x35e
f3bddcf4 f59fa293 f9309128 e3fa3728 0002019f srv!SrvNtCreateFile+0x562
f3bddd78 f59e6854 fa45b9d8 fa823520 f59fac47 srv!SrvSmbNtCreateAndX+0xf8
f3bddd84 f59fac47 00000000 f92da020 00000000 srv!SrvProcessSmb+0xb5
f3bdddac e0c0735e 00823520 00000000 00000000 srv!WorkerThread+0x136
f3bddddc e0b6c8e6 f59fab80 fa823520 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
TmXPFlt+dfbf
f3c8bfbf 83662800 and dword ptr [esi+0x28],0x0

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TmXPFlt+dfbf

MODULE_NAME: TmXPFlt

IMAGE_NAME: TmXPFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41e77b20

STACK_COMMAND: .cxr fffffffff3bdd3d8 ; kb

FAILURE_BUCKET_ID: 0x7E_TmXPFlt+dfbf

BUCKET_ID: 0x7E_TmXPFlt+dfbf

Followup: MachineOwner
---------

Kind Regards

Jon

 

This looks like a malfunction in TmXPFlt.Sys. This file is dated jan 15. Perhaps there is a problem with this latest revision. Can you back-rev it?

 

Its the latest download from the Microsoft site, and set to automatically download symbols, what exactly do you want me to do?

 

Thats a trend micro file. you either need to find a newer (not likely) or older version of the file and install it. Or contact the vendor for further support.

 

Is it the trend micro file that caused the server to crash then?