SBS 2003 Keeps rebooting on it's own

[cabmickey]

Hello,
I have a 2003 server that reboots by itself and there is really nothing in the Event log that helps at all. Today it did it twice in one hour. I would appreciate any help you can give me in solving this. Here is the memory.dmp:


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: F:\symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sun Oct 28 10:03:38.375 2007 (GMT-4)
System Uptime: 0 days 2:12:59.166
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 27, {baad0080, b865b940, b865b63c, 80959d33}

Page 79b0b not present in the dump file. Type ".hh dbgerr004" for details
Page 79b7c not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Probably caused by : mrxdav.sys ( mrxdav!MRxDAVOuterStop+92 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0080
Arg2: b865b940
Arg3: b865b63c
Arg4: 80959d33

Debugging Details:
------------------

Page 79b0b not present in the dump file. Type ".hh dbgerr004" for details
Page 79b7c not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

EXCEPTION_RECORD: b865b940 -- (.exr 0xffffffffb865b940)
ExceptionAddress: 80959d33 (nt!RtlDestroyHeap+0x00000037)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT: b865b63c -- (.cxr 0xffffffffb865b63c)
eax=b865ba20 ebx=00ea0050 ecx=b9fc3f00 edx=00000000 esi=00000000 edi=00ea0000
eip=80959d33 esp=b865ba08 ebp=b865ba24 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!RtlDestroyHeap+0x37:
80959d33 8b36 mov esi,dword ptr [esi] ds:0023:00000000=????????
Resetting default scope

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

BUGCHECK_STR: 0x27

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

LAST_CONTROL_TRANSFER: from b9fc53dc to 80959d33

STACK_TEXT:
b865ba24 b9fc53dc 00ea0000 00000000 88e08b50 nt!RtlDestroyHeap+0x37
b865ba5c b9fc566c 88e08b50 00000000 88e08b50 mrxdav!MRxDAVOuterStop+0x92
b865ba9c b9fcfb91 01e08b50 b9fceb9a 88d68008 mrxdav!MRxDAVDevFcbXXXControlFile+0x204
b865bab4 b9fcff3d 88e08b50 88d68008 88d6809c mrxdav!RxXXXControlFileCallthru+0x67
b865bad8 b9fbbf72 88e08b50 00000000 88e35888 mrxdav!RxCommonDevFCBFsCtl+0x8d
b865bb68 b9fcf80c b9fc30f0 88d68008 88e35888 mrxdav!RxFsdCommonDispatch+0x320
b865bb88 b9fc8fc4 89b18030 88d68008 89b21020 mrxdav!RxFsdDispatch+0xd4
b865bbfc 8081df65 89b18030 88d68008 88d68008 mrxdav!MRxDAVFsdDispatch+0x1f0
b865bc10 f727c6c1 88d68008 88d68008 8a1a6868 nt!IofCallDriver+0x45
b865bc3c 8081df65 89b21020 88d68008 88e35888 fltmgr!FltpFsControl+0xd7
b865bc50 808f5437 88d6809c 88e35888 88d68008 nt!IofCallDriver+0x45
b865bc64 808f61bf 89b21020 88d68008 88e35888 nt!IopSynchronousServiceTail+0x10b
b865bd00 808eed3c 000002b0 00000000 00000000 nt!IopXxxControlFile+0x5e5
b865bd34 8088978c 000002b0 00000000 00000000 nt!NtFsControlFile+0x2a
b865bd34 7c8285ec 000002b0 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00feff20 00000000 00000000 00000000 00000000 0x7c8285ec


FOLLOWUP_IP:
mrxdav!MRxDAVOuterStop+92
b9fc53dc 6800800000 push 8000h

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: mrxdav!MRxDAVOuterStop+92

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mrxdav

IMAGE_NAME: mrxdav.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45d697b9

STACK_COMMAND: .cxr 0xffffffffb865b63c ; kb

FAILURE_BUCKET_ID: 0x27_mrxdav!MRxDAVOuterStop+92

BUCKET_ID: 0x27_mrxdav!MRxDAVOuterStop+92

Followup: MachineOwner
---------

 

[itsp1965]

Two possibilities; software or hardware (that's a loaded statement)

On the software side
--------------------
Do you have the server autoreboot on stop error? Try disabling that first to see if the server is bluescreening. Also have u checked the system event log for any similar events that occur prior to each reboot?

As for hardware
---------------
Check for issues related to power/overheating of CPU (check your BIOS logs)

 

[cabmickey]

I don't have it set to not automatically reboot because I don't actually work there so I wouldn't be able to restart. Most of the time it was doing it at night and people access the server from outside to do work. This way if it reboots its self it will come back up and they will able to access it. I've looked in the event log and the only thing refering to this is after it comes back up it has an entry that says the previous system shutdown was unexpected.

I will check the bios logs latter. Thanks for your reply!

 

[itsp1965]

Check the event log for events prior to the "previous system shutdown was unexpected." event in both the system and application logs
Also another possibility I did not mention in my last post.. viruses/malware can cause this behaviour also.

 

[cabmickey]

The only thing I can see is in the app log there is a ParseInt32 Error. Value was either too large or too small for an Int32. That that happened at 9:17 and the shutdown happened at 9:48.

I will run Ad-Aware on it and see if it finds anything.

 

[cabmickey]

I ran both Ad-Aware and Spybot and neither found anything out of the ordinary just tracking cookies.

 

[itsp1965]

Well that app error refers to MOM

http://support.microsoft.com/kb/913278

Doubt that it's the cause

If you have found nothing else in the system/event logs, time to check hardware (power, CPU, memory)

 

[cabmickey]

Ok thanks, except I don't have MOM.
I will look into the hardware issues.

 

[itsp1965]

Re-read your page dump and the mrxdav.sys caught my eye. I googled Reboot and mrxdav.sys and got a few good hits one in particular to SBS2003

 

[cabmickey]

I saw something about the webclient and it allowing people from outside to take control of the PC. If I stop this service will we still be able to access the server from outside to do work?

 

[cabmickey]

Ok, I set the server to automatically restart if it reboots. It restarted yesterday at around 4:00 but I don't believe that there was a blue screen that came up because I did not receive a call from the office, which I'm sure would have happened because they would have had no idea what it was and what to do. I was also noticing that the last time the Memory.dmp file was modifoed was 10/2007. So that file I posted may not have anything to do with the reboots that are currently happening.

 

[cabmickey]

Does anyone have any other ideas of what my problem could be with this? Thanks!

 

[technome]

http://support.microsoft.com/kb/832143

........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[cabmickey]

I saw this article, but it is only for XP. Thanks.