Hello Everyone,
I have recently had a crash dump file appear in C:\windows\minidump. I have output the results from one of the online debugging site and results are pasted here, for anyone if you wish to review it. I have had 10 servers crashed and the results i have pasted belongs to 2 of the server's mini dump.
This free analysis is provided by OSR Open Systems Resources, Inc.Server1:
Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com) Online Crash Dump Analysis Service See http://www.osronline.com for more information Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 6002.18005.amd64fre.lh_sp2rtm.090410-1830 Machine Name: Kernel base = 0xfffff800`0161e000 PsLoadedModuleList = 0xfffff800`017e2dd0 Debug session time: Thu Apr 11 22:32:27.364 2013 (UTC - 4:00) System Uptime: 0 days 6:27:36.834 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, The subtype of the bugcheck. Arg2: fffffa80005f9640 Arg3: 000000000000ffff Arg4: 0000000000000000 Debugging Details: ------------------ TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2 BUGCHECK_STR: 0x1a_41790 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT_SERVER PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff8000162dbd8 to fffff80001678450 STACK_TEXT: fffffa60`05307868 fffff800`0162dbd8 : 00000000`0000001a 00000000`00041790 fffffa80`005f9640 00000000`0000ffff : nt!KeBugCheckEx fffffa60`05307870 fffff800`016a1e72 : 00000000`00000011 000007fe`f2b3ffff fffffa80`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x1c42e fffffa60`05307a00 fffff800`018eb17e : 000007fe`f2990000 0007ffff`00000000 00000000`00000000 fffffa80`1aac7a30 : nt!MiRemoveMappedView+0xd2 fffffa60`05307b20 fffff800`018f0f13 : 00000000`00000000 000007fe`f2990000 fffffa80`00000001 fffffa80`1a416910 : nt!MiUnmapViewOfSection+0x18e fffffa60`05307be0 fffff800`01677ef3 : ffffffff`ffffffff fffffa80`1a87abb0 fffffa80`1aac7a30 00000000`00008000 : nt!NtUnmapViewOfSection+0x57 fffffa60`05307c20 00000000`77736fba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0247e888 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77736fba STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+1c42e fffff800`0162dbd8 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+1c42e FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 49e0237f FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+1c42e BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+1c42e Followup: MachineOwner ---------
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
![Hide Div]()
Crash Code Links
Crash Code Links![Hide Div]()
Loaded Module List
start end module name fffff800`0161e000 fffff800`01b36000 nt ntkrnlmp.exe fffff800`01b36000 fffff800`01b7c000 hal hal.dll fffff960`000a0000 fffff960`00351000 win32k win32k.sys fffff960`004b0000 fffff960`004ce000 dxg dxg.sys fffff960`00600000 fffff960`0060a000 TSDDD TSDDD.dll fffff960`008f0000 fffff960`008f9000 framebuf framebuf.dll fffffa60`00603000 fffffa60`0060d000 kdcom kdcom.dll fffffa60`0060d000 fffffa60`00648000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll fffffa60`00648000 fffffa60`0065c000 PSHED PSHED.dll fffffa60`0065c000 fffffa60`006b9000 CLFS CLFS.SYS fffffa60`006b9000 fffffa60`0076b000 CI CI.dll fffffa60`0076b000 fffffa60`00787000 sacdrv sacdrv.sys fffffa60`00787000 fffffa60`007d7000 msrpc msrpc.sys fffffa60`007d7000 fffffa60`007e8000 Npfs Npfs.SYS fffffa60`007f3000 fffffa60`007fe000 Msfs Msfs.SYS fffffa60`00801000 fffffa60`009c4000 NDIS NDIS.SYS fffffa60`009c4000 fffffa60`009d8000 volmgr volmgr.sys fffffa60`009d8000 fffffa60`009fb000 rasl2tp rasl2tp.sys fffffa60`00a08000 fffffa60`00a61000 NETIO NETIO.SYS fffffa60`00a61000 fffffa60`00b3b000 Wdf01000 Wdf01000.sys fffffa60`00b3b000 fffffa60`00b49000 WDFLDR WDFLDR.SYS fffffa60`00b49000 fffffa60`00b9f000 acpi acpi.sys fffffa60`00b9f000 fffffa60`00ba8000 WMILIB WMILIB.SYS fffffa60`00ba8000 fffffa60`00bb2000 msisadrv msisadrv.sys fffffa60`00bb2000 fffffa60`00be2000 pci pci.sys fffffa60`00be2000 fffffa60`00bf7000 partmgr partmgr.sys fffffa60`00bf7000 fffffa60`00c00000 rasacd rasacd.sys fffffa60`00c06000 fffffa60`00c6c000 volmgrx volmgrx.sys fffffa60`00c6c000 fffffa60`00c73000 pciide pciide.sys fffffa60`00c73000 fffffa60`00c83000 PCIIDEX PCIIDEX.SYS fffffa60`00c83000 fffffa60`00c96000 mountmgr mountmgr.sys fffffa60`00c96000 fffffa60`00c9e000 atapi atapi.sys fffffa60`00c9e000 fffffa60`00cc2000 ataport ataport.SYS fffffa60`00cc2000 fffffa60`00ccc000 msahci msahci.sys fffffa60`00ccc000 fffffa60`00ce5000 arcsas arcsas.sys fffffa60`00ce5000 fffffa60`00d42000 storport storport.sys fffffa60`00d42000 fffffa60`00d89000 fltmgr fltmgr.sys fffffa60`00d89000 fffffa60`00d97000 vga vga.sys fffffa60`00d97000 fffffa60`00da0000 RDPCDD RDPCDD.sys fffffa60`00da1000 fffffa60`00dda000 msiscsi msiscsi.sys fffffa60`00dda000 fffffa60`00de7000 TDI TDI.SYS fffffa60`00de7000 fffffa60`00df3000 ndistapi ndistapi.sys fffffa60`00df3000 fffffa60`00dfc000 rdpencdd rdpencdd.sys fffffa60`00e08000 fffffa60`00e8e000 ksecdd ksecdd.sys fffffa60`00e8e000 fffffa60`00ea7000 dump_arcsas dump_arcsas.sys fffffa60`00ea7000 fffffa60`00eb3000 tunnel tunnel.sys fffffa60`00eb3000 fffffa60`00ec6000 intelppm intelppm.sys fffffa60`00ec6000 fffffa60`00f19000 e1e6032e e1e6032e.sys fffffa60`00f19000 fffffa60`00f25000 usbuhci usbuhci.sys fffffa60`00f25000 fffffa60`00f6b000 USBPORT USBPORT.SYS fffffa60`00f6b000 fffffa60`00f7c000 usbehci usbehci.sys fffffa60`00f7c000 fffffa60`00f8a000 vgapnp vgapnp.sys fffffa60`00f8a000 fffffa60`00faf000 VIDEOPRT VIDEOPRT.SYS fffffa60`00faf000 fffffa60`00fbf000 watchdog watchdog.sys fffffa60`00fbf000 fffffa60`00fdc000 serial serial.sys fffffa60`00fdc000 fffffa60`00fe8000 serenum serenum.sys fffffa60`00fe8000 fffffa60`00ff8000 tpm tpm.sys fffffa60`0100c000 fffffa60`01181000 tcpip tcpip.sys fffffa60`01181000 fffffa60`011ad000 fwpkclnt fwpkclnt.sys fffffa60`011ad000 fffffa60`011ba000 storflt storflt.sys fffffa60`011ba000 fffffa60`011e6000 CLASSPNP CLASSPNP.SYS fffffa60`011e6000 fffffa60`011f0000 crcdisk crcdisk.sys fffffa60`01200000 fffffa60`01207b80 HIDPARSE HIDPARSE.SYS fffffa60`01208000 fffffa60`01388000 Ntfs Ntfs.sys fffffa60`01388000 fffffa60`013cc000 volsnap volsnap.sys fffffa60`013cc000 fffffa60`013d4000 spldr spldr.sys fffffa60`013d4000 fffffa60`013e6000 mup mup.sys fffffa60`013e6000 fffffa60`013fa000 disk disk.sys fffffa60`02c00000 fffffa60`02c09000 Null Null.SYS fffffa60`02c09000 fffffa60`02c3a000 ndiswan ndiswan.sys fffffa60`02c3a000 fffffa60`02c4a000 raspppoe raspppoe.sys fffffa60`02c4a000 fffffa60`02c68000 raspptp raspptp.sys fffffa60`02c68000 fffffa60`02c80000 rassstp rassstp.sys fffffa60`02c80000 fffffa60`02d1a000 rdpdr rdpdr.sys fffffa60`02d1a000 fffffa60`02d2d000 termdd termdd.sys fffffa60`02d2d000 fffffa60`02d3b000 kbdclass kbdclass.sys fffffa60`02d3b000 fffffa60`02d47000 mouclass mouclass.sys fffffa60`02d47000 fffffa60`02d48480 swenum swenum.sys fffffa60`02d49000 fffffa60`02d7d000 ks ks.sys fffffa60`02d7d000 fffffa60`02d88000 mssmbios mssmbios.sys fffffa60`02d88000 fffffa60`02d98000 umbus umbus.sys fffffa60`02d98000 fffffa60`02de0000 usbhub usbhub.sys fffffa60`02de0000 fffffa60`02df4000 NDProxy NDProxy.SYS fffffa60`02df4000 fffffa60`02dfe000 Fs_Rec Fs_Rec.SYS fffffa60`03400000 fffffa60`03409000 hidusb hidusb.sys fffffa60`03409000 fffffa60`03426000 tdx tdx.sys fffffa60`03426000 fffffa60`03441000 smb smb.sys fffffa60`03441000 fffffa60`034ac000 afd afd.sys fffffa60`034ac000 fffffa60`034f0000 netbt netbt.sys fffffa60`034f0000 fffffa60`0350e000 pacer pacer.sys fffffa60`0350e000 fffffa60`0351d000 netbios netbios.sys fffffa60`0351d000 fffffa60`03538000 wanarp wanarp.sys fffffa60`03538000 fffffa60`03585000 rdbss rdbss.sys fffffa60`03585000 fffffa60`03591000 nsiproxy nsiproxy.sys fffffa60`03591000 fffffa60`035ae000 dfsc dfsc.sys fffffa60`035ae000 fffffa60`035c6000 USBSTOR USBSTOR.SYS fffffa60`035c6000 fffffa60`035c7e00 USBD USBD.SYS fffffa60`035c8000 fffffa60`035e4000 cdrom cdrom.sys fffffa60`035e4000 fffffa60`035f2000 crashdmp crashdmp.sys fffffa60`035f2000 fffffa60`035fc000 dump_diskdump dump_diskdump.sys fffffa60`03800000 fffffa60`03812000 HIDCLASS HIDCLASS.SYS fffffa60`03812000 fffffa60`0382e000 usbccgp usbccgp.sys fffffa60`0382e000 fffffa60`03839000 kbdhid kbdhid.sys fffffa60`03839000 fffffa60`03844000 mouhid mouhid.sys fffffa60`03844000 fffffa60`03850000 Dxapi Dxapi.sys fffffa60`03850000 fffffa60`03863000 monitor monitor.sys fffffa60`03863000 fffffa60`03885000 luafv luafv.sys fffffa60`03885000 fffffa60`03899000 lltdio lltdio.sys fffffa60`03899000 fffffa60`038b1000 rspndr rspndr.sys fffffa60`038b1000 fffffa60`038cf000 bowser bowser.sys fffffa60`038cf000 fffffa60`038e9000 mpsdrv mpsdrv.sys fffffa60`038e9000 fffffa60`03912000 mrxsmb mrxsmb.sys fffffa60`03912000 fffffa60`0395b000 mrxsmb10 mrxsmb10.sys fffffa60`0395b000 fffffa60`0397a000 mrxsmb20 mrxsmb20.sys fffffa60`0397a000 fffffa60`039a3000 srvnet srvnet.sys fffffa60`039a3000 fffffa60`039b3000 tcpipreg tcpipreg.sys fffffa60`039b3000 fffffa60`039e5000 srv2 srv2.sys fffffa60`04400000 fffffa60`0440b000 secdrv secdrv.SYS fffffa60`0440e000 fffffa60`044a8000 spsys spsys.sys fffffa60`044a8000 fffffa60`04547000 HTTP HTTP.sys fffffa60`04547000 fffffa60`045fd000 peauth peauth.sys fffffa60`04803000 fffffa60`04894000 srv srv.sys fffffa60`04894000 fffffa60`048b0000 cdfs cdfs.sys Unloaded modules: fffffa60`011f0000 fffffa60`011fe000 crashdmp.sys fffffa60`01000000 fffffa60`0100a000 dump_storpor fffffa60`00e8e000 fffffa60`00ea7000 dump_arcsas. fffffa60`00df3000 fffffa60`00dfe000 kbdhid.sys fffffa60`007d7000 fffffa60`007f3000 cdrom.sys fffffa60`00d89000 fffffa60`00da1000 IPMIDrv.sys
![Show Div]()
Raw Stack Contents
Raw Stack Contents![Show Div]()
Dump Header Information
![Show Div]()
Strings
Server 2:
![Show Div]()
Primary Analysis
Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com) Online Crash Dump Analysis Service See http://www.osronline.com for more information Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 6002.18881.amd64fre.vistasp2_gdr.130707-1535 Machine Name: Kernel base = 0xfffff800`01817000 PsLoadedModuleList = 0xfffff800`019dbe30 Debug session time: Sat May 24 23:07:22.700 2014 (UTC - 4:00) System Uptime: 29 days 14:05:21.534 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffffa6004f56188, The address that the exception occurred at Arg3: fffffa6004c7f9e8, Exception Record Address Arg4: fffffa6004c7f3c0, Context Record Address Debugging Details: ------------------ TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: dserverdriver+1188 fffffa60`04f56188 48894808 mov qword ptr [rax+8],rcx EXCEPTION_RECORD: fffffa6004c7f9e8 -- (.exr 0xfffffa6004c7f9e8) ExceptionAddress: fffffa6004f56188 (dserverdriver+0x0000000000001188) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffffa6004c7f3c0 -- (.cxr 0xfffffa6004c7f3c0) rax=0061006600720065 rbx=fffffa80057b2690 rcx=fffffa80057e0460 rdx=00000000000003a1 rsi=fffffa80057dca58 rdi=fffffa6004c7fd30 rip=fffffa6004f56188 rsp=fffffa6004c7fc20 rbp=0000000000000080 r8=000000000d7d0e05 r9=0000000000013393 r10=0000000000000000 r11=0000000000000000 r12=fffffa6004f780a0 r13=0000000000000000 r14=fffffa800368a690 r15=fffffa60019d5cc0 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 dserverdriver+0x1188: fffffa60`04f56188 48894808 mov qword ptr [rax+8],rcx ds:002b:00610066`0072006d=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT_SERVER PROCESS_NAME: System CURRENT_IRQL: 2 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a3e080 GetUlongFromAddress: unable to read from fffff80001a3e160 ffffffffffffffff FOLLOWUP_IP: dserverdriver+1188 fffffa60`04f56188 48894808 mov qword ptr [rax+8],rcx BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffffa8038376868 to fffffa6004f56188 STACK_TEXT: fffffa60`04c7fc20 fffffa80`38376868 : 00610066`00720065 fffffa80`057b2690 fffffa60`04f77e6b fffffa80`057e0460 : dserverdriver+0x1188 fffffa60`04c7fc28 00610066`00720065 : fffffa80`057b2690 fffffa60`04f77e6b fffffa80`057e0460 fffffa80`057dca58 : 0xfffffa80`38376868 fffffa60`04c7fc30 fffffa80`057b2690 : fffffa60`04f77e6b fffffa80`057e0460 fffffa80`057dca58 0000173f`e65eb47c : 0x610066`00720065 fffffa60`04c7fc38 fffffa60`04f77e6b : fffffa80`057e0460 fffffa80`057dca58 0000173f`e65eb47c fffff800`0186505b : 0xfffffa80`057b2690 fffffa60`04c7fc40 fffffa80`057e0460 : fffffa80`057dca58 0000173f`e65eb47c fffff800`0186505b 0000173f`00000003 : dserverdriver+0x22e6b fffffa60`04c7fc48 fffffa80`057dca58 : 0000173f`e65eb47c fffff800`0186505b 0000173f`00000003 fffffa80`057b2690 : 0xfffffa80`057e0460 fffffa60`04c7fc50 0000173f`e65eb47c : fffff800`0186505b 0000173f`00000003 fffffa80`057b2690 fffffa80`00000000 : 0xfffffa80`057dca58 fffffa60`04c7fc58 fffff800`0186505b : 0000173f`00000003 fffffa80`057b2690 fffffa80`00000000 fffffa80`057dca58 : 0x173f`e65eb47c fffffa60`04c7fc60 fffffa60`04f78111 : fffffa80`057dca58 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeWaitForSingleObject+0x2cb fffffa60`04c7fcf0 fffffa80`057dca58 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa60`04c7fd28 : dserverdriver+0x23111 fffffa60`04c7fcf8 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa60`04c7fd28 00000000`00000000 : 0xfffffa80`057dca58 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: dserverdriver+1188 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dserverdriver IMAGE_NAME: dserverdriver.sys DEBUG_FLR_IMAGE_TIMESTAMP: 51b03210 STACK_COMMAND: .cxr 0xfffffa6004c7f3c0 ; kb FAILURE_BUCKET_ID: X64_0x7E_dserverdriver+1188 BUCKET_ID: X64_0x7E_dserverdriver+1188 Followup: MachineOwner ---------
Thanks in Advance!!!
Uttam