Started Getting Lots of 1003 Events with Stop Errors - What is Cau

Discussion in 'Windows Server' started by Travis, Oct 11, 2007.

  1. Travis

    Travis Guest

    Error code 0000000a, parameter1 cc2c2b1c, parameter2 d0000002, parameter3
    00000000, parameter4 8080f5b6.

    Error code 0000000a, parameter1 00000005, parameter2 d0000002, parameter3
    00000000, parameter4 8080f5db.

    Error code 1000007e, parameter1 c0000005, parameter2 f7b9b93c, parameter3
    b63b8c30, parameter4 b63b892c.

    When these occur the server just reboots. I have looked at the minidumps
    and those aren't telling me much. Please Help.

    Travis
     
    Travis, Oct 11, 2007
    #1
    1. Advertisements

  2. Travis

    Travis Guest

    Anyone? Please Help!
     
    Travis, Oct 11, 2007
    #2
    1. Advertisements

  3. Travis

    Travis Guest

    Pretty Please!!! I need some help.
     
    Travis, Oct 11, 2007
    #3
  4. Travis

    John John Guest

    My guess is that the 0x0a and 0x7e errors are caused by bad driver(s) or
    bad RAM. If you enable and run Driver Verifier you may find more
    information. Disable the Automatically Reboot on failure option and
    after you enable Verifier reboot the machine and see if it gives you a
    BSOD and a driver file name. As for the Event ID 1003, what is the
    source of the error?

    John
     
    John John, Oct 11, 2007
    #4
  5. Travis

    Travis Guest

    Here is a redout of one of the minidump files - different everytime though.
    Iw ill psot the others too.

    1: kd> !analyze -v
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 808f8157, The address that the exception occurred at
    Arg3: b4668bc0, Exception Record Address
    Arg4: b46688bc, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
    referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!RtlUpcaseUnicodeToOemN+709
    808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

    EXCEPTION_RECORD: b4668bc0 -- (.exr 0xffffffffb4668bc0)
    ExceptionAddress: 808f8157 (nt!RtlUpcaseUnicodeToOemN+0x00000709)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 0000002c
    Attempt to read from address 0000002c

    CONTEXT: b46688bc -- (.cxr 0xffffffffb46688bc)
    eax=00000000 ebx=e51606a8 ecx=00004b36 edx=000001c8 esi=000000c8 edi=86d90798
    eip=808f8157 esp=b4668c88 ebp=b4668cd0 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!RtlUpcaseUnicodeToOemN+0x709:
    808f8157 83782c14 cmp dword ptr [eax+2Ch],14h
    ds:0023:0000002c=00000000
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
    memory at "0x%08lx". The memory could not be "%s".

    READ_ADDRESS: 0000002c

    BUGCHECK_STR: 0x7E

    EXCEPTION_STR: 0x0

    LAST_CONTROL_TRANSFER: from 808ea1b0 to 808f8157

    STACK_TEXT:
    b4668cd0 808ea1b0 86d90798 00000001 00000001 nt!RtlUpcaseUnicodeToOemN+0x709
    b4668d04 8080fca9 86d90798 b4668d3c 808a3ff0 nt!PspQueryQuotaLimits+0x5c
    b4668d40 808127a2 86cc7b98 808ae5c0 8a393298 nt!CcExtendVacbArray+0x9
    b4668d80 8088043d 8a393298 00000000 86cc7b98 nt!FsRtlFastCheckLockForRead+0x3a
    b4668dac 80949b7c 8a393298 00000000 00000000 nt!VerifierIrqlData+0x3d
    b4668ddc 8088e062 80880352 80000000 00000000 nt!CmpPrefetchHiveFile+0x4e
    b4668e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


    FOLLOWUP_IP:
    nt!RtlUpcaseUnicodeToOemN+709
    808f8157 83782c14 cmp dword ptr [eax+2Ch],14h

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!RtlUpcaseUnicodeToOemN+709

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

    STACK_COMMAND: .cxr 0xffffffffb46688bc ; kb

    FAILURE_BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

    BUCKET_ID: 0x7E_nt!RtlUpcaseUnicodeToOemN+709

    Followup: MachineOwner
    ---------
     
    Travis, Oct 11, 2007
    #5
  6. Mathieu CHATEAU, Oct 11, 2007
    #6
  7. Travis

    Travis Guest

    Here's another:
    0: kd> !analyze -v
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: cc2c2b1c, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
    chips which support this level of status)
    Arg4: 8080f5b6, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: cc2c2b1c

    CURRENT_IRQL: d0000002

    FAULTING_IP:
    nt!CcGetBcbListHeadLargeOffset+13c
    8080f5b6 ?? ???

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 8080f5b6 to 8088c963

    STACK_TEXT:
    f78dac1c 8080f5b6 badb0d00 00000000 87b58bf8 nt!FsRtlNotifyCleanup+0x47
    f78dacfc 8080fc56 8864a224 00000000 00000001
    nt!CcGetBcbListHeadLargeOffset+0x13c
    f78dad40 808127a2 8a394660 808ae5c0 8a3880b0 nt!CcReferenceFileOffset+0x5c
    f78dad80 8088043d 8a3880b0 00000000 8a394660 nt!FsRtlFastCheckLockForRead+0x3a
    f78dadac 80949b7c 8a3880b0 00000000 00000000 nt!VerifierIrqlData+0x3d
    f78daddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e
    f78dae84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!CcGetBcbListHeadLargeOffset+13c
    8080f5b6 ?? ???

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

    SYMBOL_NAME: nt!CcGetBcbListHeadLargeOffset+13c

    FAILURE_BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

    BUCKET_ID: 0xA_nt!CcGetBcbListHeadLargeOffset+13c

    Followup: MachineOwner
    ---------
     
    Travis, Oct 11, 2007
    #7
  8. Travis

    Travis Guest

    And another - all of these are within yesterday and today:
    0: kd> !analyze -v
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000005, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
    chips which support this level of status)
    Arg4: 8080f5db, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 00000005

    CURRENT_IRQL: d0000002

    FAULTING_IP:
    nt!CcGetVacbLargeOffset+1d
    8080f5db ?? ???

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 8080f5db to 8088c963

    STACK_TEXT:
    f78d2c1c 8080f5db badb0d00 00000000 8a1bb7a0 nt!FsRtlNotifyCleanup+0x47
    f78d2cfc 8080fc56 899cee2c 00000000 00000001 nt!CcGetVacbLargeOffset+0x1d
    f78d2d40 808127a2 8a394b40 808ae5c0 8a3911e0 nt!CcReferenceFileOffset+0x5c
    f78d2d80 8088043d 8a3911e0 00000000 8a394b40 nt!FsRtlFastCheckLockForRead+0x3a
    f78d2dac 80949b7c 8a3911e0 00000000 00000000 nt!VerifierIrqlData+0x3d
    f78d2ddc 8088e062 80880352 00000000 00000000 nt!CmpPrefetchHiveFile+0x4e
    f78d2e84 00000000 00000000 00000000 00000000 nt!IoReadPartitionTable+0x1f2


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!CcGetVacbLargeOffset+1d
    8080f5db ?? ???

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

    SYMBOL_NAME: nt!CcGetVacbLargeOffset+1d

    FAILURE_BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

    BUCKET_ID: 0xA_nt!CcGetVacbLargeOffset+1d

    Followup: MachineOwner
    ---------
     
    Travis, Oct 11, 2007
    #8
  9. Travis

    Travis Guest

    Excellent - I will give this a go when I take the machein down later today.
     
    Travis, Oct 11, 2007
    #9
  10. Travis

    Travis Guest

    Alos, I too thought of remving the checkmark so it doesn't auto-reboot.
    Hopefully that will make it so I see the BSOD nest time it happens.
     
    Travis, Oct 11, 2007
    #10
  11. Travis

    John John Guest

    John John, Oct 11, 2007
    #11
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.