Guest Jamie Posted January 21, 2008 Posted January 21, 2008 I made a post already about this problem but it will not allow me to post replies on the updated situation so I will start again: I have a windows small business sever 2003 service pack 2 that is rebooting almost daily. It reboots around 5-6am almost every morning. There is no backups or scheduled tasks running at this time or user activity. The server would be at its least active time. The UPS logs show nothing strange but the problem has only been occuring the last month or so. All that is recorded in the event viewer is: Event ID: 1076 The reason supplied by user DOMAIN\Administrator for the last unexpected shutdown of this computer is: System Failure: Stop error Reason Code: 0x805000f Bug ID: Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000) Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000) and Event ID 1003 Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3 00000000, parameter4 00000000. and Event ID 1001 The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. How can I find the cause of the reboots and stop them?
Guest Jamie Posted January 21, 2008 Posted January 21, 2008 RE: Server failing and rebooting I now have the bug check analysis if anyone can help me, thanks to Robert L. (MS-MVP) : Opened log file 'c:\debuglog.txt' Microsoft ® Windows Debugger Version 6.8.0004.0 X86 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\MEMORY.DMP] Kernel Summary Dump File: Only kernel address space is available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp2_gdr.070304-2240 Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time: Sat Jan 19 05:33:05.198 2008 (GMT+9) System Uptime: 0 days 12:41:43.132 WARNING: Process directory table base 7F795320 doesn't match CR3 005BB000 WARNING: Process directory table base 7F795320 doesn't match CR3 005BB000 Loading Kernel Symbols .......................................................................................................... Loading User Symbols PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7F, {8, 80042000, 0, 0} *** ERROR: Module load completed but symbols could not be loaded for MegaIDE.sys *** ERROR: Symbol file could not be found. Defaulted to export symbols for TmPreFlt.sys - *** ERROR: Symbol file could not be found. Defaulted to export symbols for VSApiNt.sys - *** ERROR: Module load completed but symbols could not be loaded for TmXPFlt.sys PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details Probably caused by : MegaIDE.sys ( MegaIDE+730b ) Followup: MachineOwner --------- 0: kd> !analyze -v;r;kv;lmtn;.logclose;q ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000008, EXCEPTION_DOUBLE_FAULT Arg2: 80042000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details BUGCHECK_STR: 0x7f_8 TSS: 00000028 -- (.tss 0x28) ..tss 0x28 eax=00001000 ebx=8a34a0e8 ecx=8978162c edx=8a336004 esi=8978162c edi=8a34baf8 eip=f727d30b esp=b7a1afd8 ebp=b7a1b008 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 MegaIDE+0x730b: f727d30b 8945e4 mov dword ptr [ebp-1Ch],eax ss:0010:b7a1afec=???????? ..trap Resetting default scope DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: NTRtScan.exe CURRENT_IRQL: 7 TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68) ..trap 0xffffffffb7a1bd68 ErrCode = 00000000 eax=cab77c00 ebx=0000000e ecx=0000000f edx=00000000 esi=88596020 edi=00000000 eip=808b64a6 esp=b7a1bddc ebp=b7a1be18 iopl=0 nv up ei ng nz ac po cy cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293 nt!CcMapData+0x8c: 808b64a6 8a10 mov dl,byte ptr [eax] ds:0023:cab77c00=3f ..trap Resetting default scope LAST_CONTROL_TRANSFER: from f727d05f to f727d30b STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b7a1b008 f727d05f 8a336004 8978162c ba40e000 MegaIDE+0x730b b7a1b068 f727a42f 8a336004 00000000 8a336000 MegaIDE+0x705f b7a1b0b4 f727a264 8a336004 8a336000 00000000 MegaIDE+0x442f b7a1b32c f7277ae6 8a336004 00000028 006e74b4 MegaIDE+0x4264 b7a1b35c f7277508 8a336004 8978162c 8978162c MegaIDE+0x1ae6 b7a1b37c f72590be 8a336004 8978162c 8a34baf8 MegaIDE+0x1508 b7a1b3a0 8088d631 8a34ba40 00000002 89781602 SCSIPORT!SpStartIoSynchronized+0x14f b7a1b3d8 80a5b147 8a34ba40 896d2e70 88522528 nt!KeSynchronizeExecution+0x21 b7a1b404 f72593a6 88522528 8a34ba40 89efe810 hal!HalBuildScatterGatherList+0x1c7 b7a1b450 8081cf82 8a34ba40 88522528 8a34baf8 SCSIPORT!ScsiPortStartIo+0x36a b7a1b474 f725962f 8a34ba40 896d2e70 00000000 nt!IoStartPacket+0x82 b7a1b4a8 f7259146 8a34ba40 016d2f04 8978162c SCSIPORT!ScsiPortFdoDispatch+0x270 b7a1b4c4 f7258dc3 8a34a0e8 896d2e70 8a199e70 SCSIPORT!SpDispatchRequest+0x68 b7a1b4e0 f7258299 8a34a030 896d2e70 8a33e438 SCSIPORT!ScsiPortPdoScsi+0x129 b7a1b4f4 8081df65 8a34a030 896d2e70 89781580 SCSIPORT!ScsiPortGlobalDispatch+0x1d b7a1b508 f7245607 89781580 fee37000 b7a1b54c nt!IofCallDriver+0x45 b7a1b518 f72452b2 89781580 8a33ab70 8a199f94 CLASSPNP!SubmitTransferPacket+0xbb b7a1b54c f7245533 00000000 00001000 8a199f94 CLASSPNP!ServiceTransferRequest+0x1e4 b7a1b570 8081df65 8a33aab8 00000000 8a33ef38 CLASSPNP!ClassReadWrite+0x159 b7a1b584 f74c803f 8979ef58 8a349020 b7a1b5a8 nt!IofCallDriver+0x45 b7a1b594 8081df65 8a349020 8a199e70 8a199e70 PartMgr!PmReadWrite+0x9a b7a1b5a8 f72eb802 8a3487c0 8979ef58 8a347418 nt!IofCallDriver+0x45 b7a1b5f0 f7305153 8979ef58 013487c0 03000000 dmio!voldiskiostart+0x482 b7a1b640 f72f6a8c 8979ef58 b7a1b698 b7a1b68c dmio!vol_subdisksio_start+0x107 b7a1b6b0 f72ece9a 89528740 00000001 00000001 dmio!volkiostart+0x32c b7a1b6dc f72ef64c 8a2e04b8 8a199e70 8a31c3c8 dmio!volrdwr+0xa0 b7a1b6f0 8081df65 8a2e04b8 8a199e70 8a199fdc dmio!volread+0x58 b7a1b704 f72c08bc 8a350248 8a1a21c8 8a23bb88 nt!IofCallDriver+0x45 b7a1b71c 8081df65 8a23bb88 8a199e70 8a199e70 volsnap!VolSnapRead+0x52 b7a1b730 baf71a62 b7a1ba14 b7a1b914 baf718d9 nt!IofCallDriver+0x45 b7a1b73c baf718d9 b7a1ba14 8a23bb88 c1037000 Ntfs!NtfsSingleAsync+0x91 b7a1b914 baf72156 b7a1ba14 8a199e70 8a1a21c8 Ntfs!NtfsNonCachedIo+0x2db b7a1ba00 baf72079 b7a1ba14 8a199e70 00000001 Ntfs!NtfsCommonRead+0xaf5 b7a1bbac 8081df65 8a0a2718 8a199e70 8a2e0f38 Ntfs!NtfsFsdRead+0x113 b7a1bbc0 f7223c45 8a2e0f38 00000000 808b4901 nt!IofCallDriver+0x45 b7a1bbe8 8081df65 89fa4828 8a199e70 89ea3858 fltmgr!FltpDispatch+0x6f b7a1bbfc ba01cbfe b7a1bc18 8081df65 8a0d6e08 nt!IofCallDriver+0x45 b7a1bc04 8081df65 8a0d6e08 8a199e70 8a199e70 TmPreFlt!TmpAddRdr+0x7ea b7a1bc18 8081e4ed 88596020 89efe7d8 c0655bb8 nt!IofCallDriver+0x45 b7a1bc30 8085114a 8a3e6b08 89efe810 89efe7f0 nt!IoPageRead+0x109 b7a1bccc 8085ea66 00000001 cab77c00 89efe7d8 nt!MiDispatchFault+0xece b7a1bd50 8088c798 00000000 cab77c00 00000000 nt!MmAccessFault+0x89e b7a1bd50 808b64a6 00000000 cab77c00 00000000 nt!KiTrap0E+0xdc b7a1be18 bafb1f2d 8a3e6ba0 b7a1be48 00000400 nt!CcMapData+0x8c b7a1be38 bafaf494 88358ef8 8a1a21c8 01037c00 Ntfs!NtfsMapStream+0x4b b7a1beac bafb1df0 88358ef8 8a0a27f8 ecc28010 Ntfs!NtfsReadMftRecord+0x86 b7a1bee4 bafb1fac 88358ef8 8a0a27f8 ecc28010 Ntfs!NtfsReadFileRecord+0x7a b7a1bf1c bafa388d 88358ef8 ecc28008 ecc28010 Ntfs!NtfsLookupInFileRecord+0x37 b7a1bfcc bafa57be 88358ef8 00000001 ecc28008 Ntfs!NtfsUpdateFcbInfoFromDisk+0x3e b7a1c098 bafa30b9 88358ef8 88409cd8 88409e44 Ntfs!NtfsOpenFile+0x330 b7a1c2bc bafb2ef8 88358ef8 88409cd8 b7a1c2fc Ntfs!NtfsCommonCreate+0x127e b7a1c3c0 8081df65 8a0a2718 88409cd8 8a2e0f38 Ntfs!NtfsFsdCreate+0x17d b7a1c3d4 f7231458 88409cd8 8a2e0f38 8a0a0008 nt!IofCallDriver+0x45 b7a1c400 8081df65 89fa4828 88409cd8 88409e44 fltmgr!FltpCreate+0xe4 b7a1c414 ba0229ba 8a0fddd8 89ea3858 88742328 nt!IofCallDriver+0x45 b7a1c47c 8081df65 8a0d6e08 88409cd8 88409cd8 TmPreFlt!TmpQueryFullName+0x5d42 b7a1c490 808f8f71 b7a1c638 8a2e04a0 00000000 nt!IofCallDriver+0x45 b7a1c578 80937942 8a2e04b8 00000000 883eede8 nt!IopParseDevice+0xa35 b7a1c5f8 80933a76 00000000 b7a1c638 00000040 nt!ObpLookupObjectName+0x5b0 b7a1c64c 808eae25 00000000 00000000 00000000 nt!ObOpenObjectByName+0xea b7a1c6c8 808ec0bf e25bf800 80100000 b7a1c890 nt!IopCreateFile+0x447 b7a1c724 808eeb4e e25bf800 80100000 b7a1c890 nt!IoCreateFile+0xa3 b7a1c764 8088978c e25bf800 80100000 b7a1c890 nt!NtCreateFile+0x30 b7a1c764 8082e901 e25bf800 80100000 b7a1c890 nt!KiFastCallEntry+0xfc b7a1c808 b9149e38 e25bf800 80100000 b7a1c890 nt!ZwCreateFile+0x11 b7a1c848 b91637db e25bf800 80100000 b7a1c890 VSApiNt!VSSwapShortTable+0xa7c b7a1c8ec b91644bc b7a1cc24 00000000 b7a1c920 VSApiNt!VSOpenFileW+0x12c b7a1c8fc b9159859 b7a1cc24 00000000 00000002 VSApiNt!VSAccessW+0xaa b7a1c920 b91597ab b7a1cc24 00000002 00000000 VSApiNt!VSOpenResource+0x15e b7a1c94c b90ce8b0 b7a1cc24 00000002 00000000 VSApiNt!VSOpenResource+0xb0 b7a1c97c b90cdbb0 b7a1cc24 b7a1d0f0 b7a1d0ee VSApiNt!VSCheckPatternFileW+0x908 b7a1d108 b90cdcb0 e25c6656 b7a1d124 00002e3a VSApiNt!QuerySystemRoot+0x41fa b7a1d37c b90cdde7 e25bc01c e25c6656 b9072c30 VSApiNt!VSKDReadNewestPatternW+0x95 b7a1d604 b90f6399 e25bc01c e4e19c1c 00000001 VSApiNt!VSKDReadNewestPatternW+0x1cc b7a1d61c b903ed7c e25bc01c b7a1d690 00000000 VSApiNt!VSReadPatternInFileW+0x47 STACK_COMMAND: .tss 0x28 ; kb FOLLOWUP_IP: MegaIDE+730b f727d30b 8945e4 mov dword ptr [ebp-1Ch],eax SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: MegaIDE+730b FOLLOWUP_NAME: MachineOwner MODULE_NAME: MegaIDE IMAGE_NAME: MegaIDE.sys DEBUG_FLR_IMAGE_TIMESTAMP: 44a53372 FAILURE_BUCKET_ID: 0x7f_8_MegaIDE+730b BUCKET_ID: 0x7f_8_MegaIDE+730b Followup: MachineOwner --------- eax=ffdff13c ebx=80042000 ecx=00000000 edx=00000000 esi=ffdff120 edi=8a0d06b8 eip=8088b777 esp=80897894 ebp=00000000 iopl=0 nv up di ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086 nt!KiTrap08+0x75: 8088b777 ebee jmp nt!KiTrap08+0x65 (8088b767) ChildEBP RetAddr Args to Child 00000000 f727d30b 00000000 00000000 00000000 nt!KiTrap08+0x75 (FPO: TSS 28:0) WARNING: Stack unwind information not available. Following frames may be wrong. b7a1b008 f727d05f 8a336004 8978162c ba40e000 MegaIDE+0x730b b7a1b068 f727a42f 8a336004 00000000 8a336000 MegaIDE+0x705f b7a1b0b4 f727a264 8a336004 8a336000 00000000 MegaIDE+0x442f b7a1b32c f7277ae6 8a336004 00000028 006e74b4 MegaIDE+0x4264 b7a1b35c f7277508 8a336004 8978162c 8978162c MegaIDE+0x1ae6 b7a1b37c f72590be 8a336004 8978162c 8a34baf8 MegaIDE+0x1508 b7a1b3a0 8088d631 8a34ba40 00000002 89781602 SCSIPORT!SpStartIoSynchronized+0x14f (FPO: [Non-Fpo]) b7a1b3d8 80a5b147 8a34ba40 896d2e70 88522528 nt!KeSynchronizeExecution+0x21 b7a1b404 f72593a6 88522528 8a34ba40 89efe810 hal!HalBuildScatterGatherList+0x1c7 (FPO: [Non-Fpo]) b7a1b450 8081cf82 8a34ba40 88522528 8a34baf8 SCSIPORT!ScsiPortStartIo+0x36a (FPO: [Non-Fpo]) b7a1b474 f725962f 8a34ba40 896d2e70 00000000 nt!IoStartPacket+0x82 (FPO: [Non-Fpo]) b7a1b4a8 f7259146 8a34ba40 016d2f04 8978162c SCSIPORT!ScsiPortFdoDispatch+0x270 (FPO: [Non-Fpo]) b7a1b4c4 f7258dc3 8a34a0e8 896d2e70 8a199e70 SCSIPORT!SpDispatchRequest+0x68 (FPO: [Non-Fpo]) b7a1b4e0 f7258299 8a34a030 896d2e70 8a33e438 SCSIPORT!ScsiPortPdoScsi+0x129 (FPO: [Non-Fpo]) b7a1b4f4 8081df65 8a34a030 896d2e70 89781580 SCSIPORT!ScsiPortGlobalDispatch+0x1d (FPO: [Non-Fpo]) b7a1b508 f7245607 89781580 fee37000 b7a1b54c nt!IofCallDriver+0x45 (FPO: [Non-Fpo]) b7a1b518 f72452b2 89781580 8a33ab70 8a199f94 CLASSPNP!SubmitTransferPacket+0xbb (FPO: [Non-Fpo]) b7a1b54c f7245533 00000000 00001000 8a199f94 CLASSPNP!ServiceTransferRequest+0x1e4 (FPO: [Non-Fpo]) b7a1b570 8081df65 8a33aab8 00000000 8a33ef38 CLASSPNP!ClassReadWrite+0x159 (FPO: [Non-Fpo]) start end module name 80800000 80a56000 nt ntkrpamp.exe Mon Mar 05 21:16:25 2007 (45EC0A19) 80a56000 80a82000 hal halmacpi.dll Sat Feb 17 14:48:26 2007 (45D6972A) b7537000 b7562000 RDPWD RDPWD.SYS Sat Feb 17 14:44:38 2007 (45D69646) b855b000 b8585000 Fastfat Fastfat.SYS Sat Feb 17 15:27:55 2007 (45D6A06B) b873d000 b88fc180 tm_cfw tm_cfw.sys Wed Feb 28 18:07:39 2007 (45E5465B) b89c5000 b89dcc00 tmcomm tmcomm.sys Wed Aug 01 16:46:56 2007 (46B04880) b8cfd000 b8d4d000 HTTP HTTP.sys Sat Feb 17 15:28:12 2007 (45D6A07C) b8e65000 b8ec2000 srv srv.sys Sat Feb 17 15:27:20 2007 (45D6A048) b8ec2000 b8ef5000 mrxdav mrxdav.sys Sat Feb 17 14:50:49 2007 (45D697B9) b8ff7000 b9026e60 exifs exifs.sys Fri Aug 26 08:29:05 2005 (430E6251) b9027000 b9069000 TmXPFlt TmXPFlt.sys Mon Sep 17 14:40:39 2007 (46EE2167) b9069000 b917a460 VSApiNt VSApiNt.sys Mon Sep 17 14:30:42 2007 (46EE1F12) b917b000 b91a6580 dump_MegaIDE dump_MegaIDE.sys Fri Jun 30 22:21:38 2006 (44A53372) b91a7000 b91bc000 Cdfs Cdfs.SYS Sat Feb 17 15:27:08 2007 (45D6A03C) b9246000 b9250000 Dxapi Dxapi.sys Tue Mar 25 16:06:01 2003 (3E7FFFD9) b9b40000 b9b4b000 TDTCP TDTCP.SYS Sat Feb 17 14:44:32 2007 (45D69640) b9bd0000 b9be1000 Fips Fips.SYS Sat Feb 17 15:26:33 2007 (45D6A019) b9be1000 b9c57000 mrxsmb mrxsmb.sys Sat Feb 17 15:28:15 2007 (45D6A07F) b9c57000 b9c87000 rdbss rdbss.sys Sat Feb 17 15:27:37 2007 (45D6A059) b9c87000 b9cb1000 afd afd.sys Sat Feb 17 15:28:16 2007 (45D6A080) b9d51000 b9d82000 netbt netbt.sys Sat Feb 17 15:28:57 2007 (45D6A0A9) b9d82000 b9e12000 tcpip tcpip.sys Wed Oct 31 02:34:10 2007 (47276B12) b9e12000 b9e2b000 ipsec ipsec.sys Sat Feb 17 15:29:28 2007 (45D6A0C8) b9f0b000 b9f15000 flpydisk flpydisk.sys Tue Mar 25 16:04:32 2003 (3E7FFF80) b9f2b000 b9f37000 vga vga.sys Sat Feb 17 15:10:30 2007 (45D69C56) b9f5b000 b9f68000 wanarp wanarp.sys Sat Feb 17 14:59:17 2007 (45D699B5) b9f8b000 b9f95000 dump_diskdump dump_diskdump.sys Sat Feb 17 15:07:44 2007 (45D69BB0) b9fe6000 b9ffb000 usbhub usbhub.sys Sat Feb 17 15:13:05 2007 (45D69CF1) ba01b000 ba028000 TmPreFlt TmPreFlt.sys Mon Sep 17 14:40:39 2007 (46EE2167) ba0bb000 ba11a000 update update.sys Mon May 28 20:15:16 2007 (465AC7D4) ba11a000 ba151000 rdpdr rdpdr.sys Sat Feb 17 14:51:00 2007 (45D697C4) ba151000 ba163000 raspptp raspptp.sys Sat Feb 17 15:29:20 2007 (45D6A0C0) ba163000 ba17c000 ndiswan ndiswan.sys Sat Feb 17 15:29:22 2007 (45D6A0C2) ba17c000 ba190000 rasl2tp rasl2tp.sys Sat Feb 17 15:29:02 2007 (45D6A0AE) ba190000 ba1b7000 ks ks.sys Sat Feb 17 15:30:40 2007 (45D6A110) ba1b7000 ba1cb000 redbook redbook.sys Sat Feb 17 15:07:26 2007 (45D69B9E) ba1cb000 ba1e0000 cdrom cdrom.sys Sat Feb 17 15:07:48 2007 (45D69BB4) ba1e0000 ba1fc000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 15:10:30 2007 (45D69C56) ba1fc000 ba364000 ati2mtag ati2mtag.sys Thu Apr 06 11:03:52 2006 (44348518) ba364000 ba38e000 USBPORT USBPORT.SYS Sat Feb 17 15:12:59 2007 (45D69CEB) ba38e000 ba3a3000 serial serial.sys Sat Feb 17 15:06:46 2007 (45D69B76) ba3a3000 ba3e3000 e1e5132 e1e5132.sys Thu Nov 02 03:23:48 2006 (4548E634) baa7c000 baa85000 watchdog watchdog.sys Sat Feb 17 15:11:45 2007 (45D69CA1) baa8c000 baa9b000 raspppoe raspppoe.sys Sat Feb 17 14:59:23 2007 (45D699BB) baadc000 baae7000 Msfs Msfs.SYS Sat Feb 17 14:50:33 2007 (45D697A9) baafc000 bab0b000 intelppm intelppm.sys Sat Feb 17 14:48:30 2007 (45D6972E) baf0d000 baf2c000 Mup Mup.sys Sat Feb 17 15:27:41 2007 (45D6A05D) baf2c000 baf6b000 NDIS NDIS.sys Sat Feb 17 15:28:49 2007 (45D6A0A1) baf6b000 bb000000 Ntfs Ntfs.sys Sat Feb 17 15:27:23 2007 (45D6A04B) bf800000 bf9cf000 win32k win32k.sys Thu Mar 01 23:59:28 2007 (45E6EA50) bf9cf000 bf9e6000 dxg dxg.sys Sat Feb 17 15:14:39 2007 (45D69D4F) bf9e6000 bfa29000 ati2dvag ati2dvag.dll Thu Apr 06 11:04:15 2006 (4434852F) bfa29000 bfa68000 ati2cqag ati2cqag.dll Thu Apr 06 09:57:18 2006 (4434757E) bfa68000 bfa9e000 atikvmag atikvmag.dll Thu Apr 06 10:25:29 2006 (44347C19) bff60000 bff7e000 RDPDD RDPDD.dll Sat Feb 17 23:01:19 2007 (45D70AAF) f721f000 f7244000 fltmgr fltmgr.sys Sat Feb 17 14:51:08 2007 (45D697CC) f7244000 f7257000 CLASSPNP CLASSPNP.SYS Sat Feb 17 15:28:16 2007 (45D6A080) f7257000 f7276000 SCSIPORT SCSIPORT.SYS Sat Feb 17 15:28:41 2007 (45D6A099) f7276000 f72a1580 MegaIDE MegaIDE.sys Fri Jun 30 22:21:38 2006 (44A53372) f72a2000 f72bf000 atapi atapi.sys Sat Feb 17 15:07:34 2007 (45D69BA6) f72bf000 f72e9000 volsnap volsnap.sys Sat Feb 17 15:08:23 2007 (45D69BD7) f72e9000 f7315000 dmio dmio.sys Sat Feb 17 15:10:44 2007 (45D69C64) f7315000 f733c000 ftdisk ftdisk.sys Sat Feb 17 15:08:05 2007 (45D69BC5) f733c000 f7352000 pci pci.sys Sat Feb 17 14:59:03 2007 (45D699A7) f7352000 f7386000 ACPI ACPI.sys Sat Feb 17 14:58:47 2007 (45D69997) f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 16:13:00 2003 (3E80017C) f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 14:58:57 2007 (45D699A1) f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 15:07:32 2007 (45D69BA4) f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 15:05:35 2007 (45D69B2F) f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 15:29:25 2007 (45D6A0C5) f74d7000 f74e7000 disk disk.sys Sat Feb 17 15:07:51 2007 (45D69BB7) f74e7000 f74f3000 Dfs Dfs.sys Sat Feb 17 14:51:17 2007 (45D697D5) f74f7000 f7501000 crcdisk crcdisk.sys Sat Feb 17 15:09:50 2007 (45D69C2E) f7557000 f7562000 ptilink ptilink.sys Sat Feb 17 15:06:38 2007 (45D69B6E) f7567000 f7575000 msgpc msgpc.sys Sat Feb 17 14:58:37 2007 (45D6998D) f7577000 f7581000 mouclass mouclass.sys Tue Mar 25 16:03:09 2003 (3E7FFF2D) f7587000 f7595000 NDProxy NDProxy.SYS Sat Feb 17 14:59:21 2007 (45D699B9) f7597000 f75a0000 raspti raspti.sys Sat Feb 17 14:59:23 2007 (45D699BB) f75b7000 f75c1000 serenum serenum.sys Sat Feb 17 15:06:44 2007 (45D69B74) f75f7000 f7602000 TDI TDI.SYS Sat Feb 17 15:01:19 2007 (45D69A2F) f7607000 f7610000 ndistapi ndistapi.sys Sat Feb 17 14:59:19 2007 (45D699B7) f7617000 f7624000 Npfs Npfs.SYS Sat Feb 17 14:50:36 2007 (45D697AC) f7627000 f7634000 netbios netbios.sys Sat Feb 17 14:58:29 2007 (45D69985) f7667000 f7672000 fdc fdc.sys Sat Feb 17 15:07:16 2007 (45D69B94) f7677000 f7686000 termdd termdd.sys Sat Feb 17 14:44:32 2007 (45D69640) f7687000 f7692000 kbdclass kbdclass.sys Sat Feb 17 15:05:39 2007 (45D69B33) f7697000 f76a0000 mssmbios mssmbios.sys Sat Feb 17 14:59:12 2007 (45D699B0) f76b7000 f76c5000 IAMT03 IAMT03.sys Thu Oct 19 15:12:14 2006 (4537254E) f76e1000 f7707000 KSecDD KSecDD.sys Sat Feb 17 14:46:32 2007 (45D696B8) f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 16:08:00 2003 (3E800050) f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 16:07:58 2003 (3E80004E) f7717000 f771e000 pciide pciide.sys Tue Mar 25 16:04:46 2003 (3E7FFF8E) f771f000 f7726000 dmload dmload.sys Tue Mar 25 16:08:08 2003 (3E800058) f772f000 f7736000 dxgthk dxgthk.sys Tue Mar 25 16:05:52 2003 (3E7FFFD0) f775f000 f7764180 usbuhci usbuhci.sys Sat Feb 17 15:13:02 2007 (45D69CEE) f777f000 f7785b80 usbehci usbehci.sys Sat Feb 17 15:12:56 2007 (45D69CE8) f7787000 f778f000 audstub audstub.sys Tue Mar 25 16:09:12 2003 (3E800098) f77a7000 f77af000 Fs_Rec Fs_Rec.SYS Tue Mar 25 16:08:36 2003 (3E800074) f77bf000 f77c6000 Null Null.SYS Tue Mar 25 16:03:05 2003 (3E7FFF29) f77c7000 f77ce000 Beep Beep.SYS Tue Mar 25 16:03:04 2003 (3E7FFF28) f77d7000 f77df000 rasacd rasacd.sys Tue Mar 25 16:11:50 2003 (3E800136) f780f000 f7817000 mnmdd mnmdd.SYS Tue Mar 25 16:07:53 2003 (3E800049) f7817000 f781f000 RDPCDD RDPCDD.sys Tue Mar 25 16:03:05 2003 (3E7FFF29) f79ab000 f79ac280 swenum swenum.sys Sat Feb 17 15:05:56 2007 (45D69B44) f79b5000 f79b6580 USBD USBD.SYS Tue Mar 25 16:10:39 2003 (3E8000EF) f7b19000 f7bdf000 dmboot dmboot.sys Sat Feb 17 15:10:48 2007 (45D69C68) Unloaded modules: bade9000 badf7000 imapi.sys Timestamp: unavailable (00000000) Checksum: 00000000 b9e38000 b9e4b000 i8042prt.sys Timestamp: unavailable (00000000) Checksum: 00000000 f7797000 f779f000 Sfloppy.SYS Timestamp: unavailable (00000000) Checksum: 00000000 Closing open log file c:\debuglog.txt "Jamie" wrote: > I made a post already about this problem but it will not allow me to post > replies on the updated situation so I will start again: > > I have a windows small business sever 2003 service pack 2 that is rebooting > almost daily. > > It reboots around 5-6am almost every morning. There is no backups or > scheduled tasks running at this time or user activity. The server would be at > its least active time. The UPS logs show nothing strange but the problem has > only been occuring the last month or so. > > All that is recorded in the event viewer is: > > Event ID: 1076 > > The reason supplied by user DOMAIN\Administrator for the last unexpected > shutdown of this computer is: System Failure: Stop error > Reason Code: 0x805000f > Bug ID: > Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000) > Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000) > > and > > Event ID 1003 > > Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3 > 00000000, parameter4 00000000. > > and > > Event ID 1001 > > The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f > (0x00000008, 0x80042000, 0x00000000, 0x00000000). A dump was saved in: > C:\WINDOWS\MEMORY.DMP. > > > > How can I find the cause of the reboots and stop them? > > >
Guest Steven Andrews Posted January 21, 2008 Posted January 21, 2008 Re: Server failing and rebooting Jamie NTRTScan.exe is related to trend micro? Is this the AV on the server? Check AV - exclusions, etc. Check for updates not only definition but AV driver / Engine updates. Is the AV doing a scan at the time of reboot? Disable incoming mail overnight and disable RT scanning on the server - including exchange scanning (overnight). See if the server still reboots. If it doesn't then at least we know what is causing the failure. If it does reboot after this - please repost the new event log error. Steve > > DEFAULT_BUCKET_ID: DRIVER_FAULT > > PROCESS_NAME: NTRtScan.exe > > CURRENT_IRQL: 7 > > TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68)
Guest Steve Posted March 13, 2008 Posted March 13, 2008 Re: Server failing and rebooting I have been having the same issue for the past 3 days, except the first 2 crashes are at 12:03am, the 3rd at 1:03am. SBS Backup process is doing its thing. Debug Results: Microsoft ® Windows Debugger Version 6.8.0004.0 X86 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\MiniDumps\Mini031308-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS Built by: 3790.srv03_sp2_gdr.070304-2240 Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time: Thu Mar 13 01:04:57.958 2008 (GMT-4) System Uptime: 0 days 16:12:32.796 Loading Kernel Symbols .................................................................................................................. Loading User Symbols Loading unloaded module list ........ *** WARNING: Unable to verify timestamp for MegaIDE.sys *** ERROR: Module load completed but symbols could not be loaded for MegaIDE.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007F, {8, 80042000, 0, 0} Probably caused by : MegaIDE.sys ( MegaIDE+4429 ) Followup: MachineOwner --------- "Steven Andrews" wrote: > Jamie > > NTRTScan.exe is related to trend micro? Is this the AV on the server? > > Check AV - exclusions, etc. Check for updates not only definition but > AV driver / Engine updates. Is the AV doing a scan at the time of reboot? > > Disable incoming mail overnight and disable RT scanning on the server - > including exchange scanning (overnight). See if the server still > reboots. If it doesn't then at least we know what is causing the > failure. If it does reboot after this - please repost the new event log > error. > > Steve > > > > > > DEFAULT_BUCKET_ID: DRIVER_FAULT > > > > PROCESS_NAME: NTRtScan.exe > > > > CURRENT_IRQL: 7 > > > > TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68) >
Recommended Posts