Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Westi on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Server is BSODing everyday, read my minidump?

Status
Not open for further replies.

jcrapps

Programmer
Oct 26, 2001
94
US
I have started to experience about one BSOD a day for the last week or so. AFAIK, we didn't change any hardware of update any drivers. I have no idea how to read these dumps, so any help would be appreciated.

...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7267421, The address that the exception occurred at
Arg3: b7e67798, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

Unable to load image \??\C:\Program Files\Symantec\SYMEVENT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS



EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
Ntfs!NtfsAcquireResourceExclusive+8
f7267421 6681380207 cmp word ptr [eax],702h

TRAP_FRAME: b7e67798 -- (.trap 0xffffffffb7e67798)
.trap 0xffffffffb7e67798
ErrCode = 00000000
eax=00000000 ebx=893004c0 ecx=00002ca9 edx=8a62b020 esi=8930062c edi=00000000
eip=f7267421 esp=b7e6780c ebp=b7e6780c iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x8:
f7267421 6681380207 cmp word ptr [eax],702h ds:0023:00000000=0000
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from f72acf85 to f7267421

STACK_TEXT:
b7e6780c f72acf85 8a56da88 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x8
b7e67910 8083f9d0 8a62b020 893004c0 893004c0 Ntfs!NtfsFsdCreate+0x362
b7e67924 f732d51e 8a74d008 00000000 8a719788 nt!IofCallDriver+0x45
b7e67954 8083f9d0 8a71a830 893004c0 b7e679b8 fltmgr!FltpCreate+0x1aa
b7e67968 b8dff163 b7e679b8 b7047900 00000000 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b7e679e8 f731fb43 00000000 893004c0 89300674 SYMEVENT+0xb163
b7e67a0c f732d5af b7e67a2c 8a32d0a8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b7e67a48 8083f9d0 8a32d0a8 893004c0 893004c0 fltmgr!FltpCreate+0x23b
b7e67a5c 8092e269 b7e67c04 8a64f018 00000000 nt!IofCallDriver+0x45
b7e67b44 80936caa 8a64f030 00000000 86642f28 nt!IopParseDevice+0xa35
b7e67bc4 80936aa5 00000000 b7e67c04 00000040 nt!ObpLookupObjectName+0x5a9
b7e67c18 80936f27 00000000 00000000 642f2801 nt!ObOpenObjectByName+0xea
b7e67c94 80936ff8 00a2d6d4 02100080 00a2d670 nt!IopCreateFile+0x447
b7e67cf0 8092ed98 00a2d6d4 02100080 00a2d670 nt!IoCreateFile+0xa3
b7e67d30 80834d3f 00a2d6d4 02100080 00a2d670 nt!NtCreateFile+0x30
b7e67d30 7c82ed54 00a2d6d4 02100080 00a2d670 nt!KiFastCallEntry+0xfc
00a2d6cc 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND: kb

FOLLOWUP_IP:
SYMEVENT+b163
b8dff163 ?? ???

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: SYMEVENT+b163

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 423f8ec8

FAILURE_BUCKET_ID: 0x8E_SYMEVENT+b163

BUCKET_ID: 0x8E_SYMEVENT+b163

Followup: MachineOwner
---------

eax=00000000 ebx=893004c0 ecx=00002ca9 edx=8a62b020 esi=8930062c edi=00000000
eip=f7267421 esp=b7e6780c ebp=b7e6780c iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x8:
f7267421 6681380207 cmp word ptr [eax],702h ds:0023:00000000=0000
ChildEBP RetAddr Args to Child
b7e6780c f72acf85 8a56da88 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x8 (FPO: [Non-Fpo])
b7e67910 8083f9d0 8a62b020 893004c0 893004c0 Ntfs!NtfsFsdCreate+0x362 (FPO: [Non-Fpo])
b7e67924 f732d51e 8a74d008 00000000 8a719788 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
b7e67954 8083f9d0 8a71a830 893004c0 b7e679b8 fltmgr!FltpCreate+0x1aa (FPO: [Non-Fpo])
b7e67968 b8dff163 b7e679b8 b7047900 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
b7e679e8 f731fb43 00000000 893004c0 89300674 SYMEVENT+0xb163
b7e67a0c f732d5af b7e67a2c 8a32d0a8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b (FPO: [Non-Fpo])
b7e67a48 8083f9d0 8a32d0a8 893004c0 893004c0 fltmgr!FltpCreate+0x23b (FPO: [Non-Fpo])
b7e67a5c 8092e269 b7e67c04 8a64f018 00000000 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
b7e67b44 80936caa 8a64f030 00000000 86642f28 nt!IopParseDevice+0xa35 (FPO: [Non-Fpo])
b7e67bc4 80936aa5 00000000 b7e67c04 00000040 nt!ObpLookupObjectName+0x5a9 (FPO: [Non-Fpo])
b7e67c18 80936f27 00000000 00000000 642f2801 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
b7e67c94 80936ff8 00a2d6d4 02100080 00a2d670 nt!IopCreateFile+0x447 (FPO: [Non-Fpo])
b7e67cf0 8092ed98 00a2d6d4 02100080 00a2d670 nt!IoCreateFile+0xa3 (FPO: [Non-Fpo])
b7e67d30 80834d3f 00a2d6d4 02100080 00a2d670 nt!NtCreateFile+0x30 (FPO: [Non-Fpo])
b7e67d30 7c82ed54 00a2d6d4 02100080 00a2d670 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b7e67d64)
00a2d6cc 00000000 00000000 00000000 00000000 0x7c82ed54
start end module name
80800000 80a75000 nt ntkrnlmp.exe Thu Mar 24 17:42:08 2005 (42435E60)
80a75000 80aa1000 hal halaacpi.dll Thu Mar 24 17:28:37 2005 (42435B35)
b6e31000 b6e43720 naveng naveng.sys Thu Feb 28 17:21:51 2008 (47C75E2F)
b6e44000 b6f1cf80 navex15 navex15.sys Thu Feb 28 17:20:50 2008 (47C75DF2)
b6f1d000 b6f3b000 EraserUtilDrv10741 EraserUtilDrv10741.sys Thu Jan 17 18:44:27 2008 (4790128B)
b7b77000 b7ba4000 RDPWD RDPWD.SYS Wed Jun 15 08:33:14 2005 (42B04A3A)
b80f4000 b80ff000 TDTCP TDTCP.SYS Thu Mar 24 17:27:15 2005 (42435AE3)
b839c000 b83ec000 HTTP HTTP.sys Thu Mar 24 17:40:36 2005 (42435E04)
b8554000 b85c0000 srv srv.sys Fri Sep 01 07:32:26 2006 (44F8447A)
b8ac0000 b8ad5000 Cdfs Cdfs.SYS Thu Mar 24 17:40:55 2005 (42435E17)
b8ad5000 b8b35000 eeCtrl eeCtrl.sys Thu Jan 17 18:44:27 2008 (4790128B)
b8b35000 b8b46000 Fips Fips.SYS Thu Mar 24 17:40:33 2005 (42435E01)
b8b46000 b8bc6000 mrxsmb mrxsmb.sys Mon May 08 10:18:45 2006 (445F7D75)
b8bc6000 b8bff000 rdbss rdbss.sys Mon May 08 10:18:53 2006 (445F7D7D)
b8bff000 b8c29000 afd afd.sys Thu Mar 24 17:40:43 2005 (42435E0B)
b8c29000 b8c5a000 netbt netbt.sys Thu Mar 24 17:40:31 2005 (42435DFF)
b8c5a000 b8cbb000 tcpip tcpip.sys Tue May 23 18:02:22 2006 (4473B09E)
b8cbb000 b8cd4000 ipsec ipsec.sys Thu Mar 24 17:40:49 2005 (42435E11)
b8de0000 b8df4000 Savrtpel Savrtpel.sys Fri Feb 04 20:03:26 2005 (4204458E)
b8df4000 b8e10ac0 SYMEVENT SYMEVENT.SYS Mon Mar 21 20:19:36 2005 (423F8EC8)
b8e11000 b8e66000 savrt savrt.sys Fri Feb 04 20:03:24 2005 (4204458C)
b8f00000 b8f0b000 Msfs Msfs.SYS Thu Mar 24 17:30:04 2005 (42435B8C)
b8f20000 b8f2a000 dump_diskdump dump_diskdump.sys Thu Mar 24 17:28:56 2005 (42435B48)
b9030000 b903d000 wanarp wanarp.sys Thu Mar 24 17:34:07 2005 (42435C7F)
b9070000 b9084000 usbhub usbhub.sys Thu Mar 24 17:30:46 2005 (42435BB6)
b90b4000 b90c1000 Npfs Npfs.SYS Thu Mar 24 17:30:04 2005 (42435B8C)
b944c000 b9459000 netbios netbios.sys Thu Mar 24 17:33:21 2005 (42435C51)
b989c000 b98a4000 mnmdd mnmdd.SYS Tue Mar 25 00:07:53 2003 (3E800049)
b9b08000 b9b10000 RDPCDD RDPCDD.sys Tue Mar 25 00:03:05 2003 (3E7FFF29)
b9b10000 b9b17000 Beep Beep.SYS Tue Mar 25 00:03:04 2003 (3E7FFF28)
b9c00000 b9cc6000 dmboot dmboot.sys Thu Mar 24 17:30:03 2005 (42435B8B)
b9d06000 b9d0e000 Fs_Rec Fs_Rec.SYS Tue Mar 25 00:08:36 2003 (3E800074)
b9d1e000 b9d26000 rasacd rasacd.sys Tue Mar 25 00:11:50 2003 (3E800136)
b9d66000 b9da6000 update update.sys Thu Mar 24 17:40:27 2005 (42435DFB)
b9da6000 b9ddd000 rdpdr rdpdr.sys Thu Mar 24 17:30:20 2005 (42435B9C)
b9e2d000 b9e38000 dump_mraid35x dump_mraid35x.sys Tue Sep 07 14:26:51 2004 (413E279B)
b9e7d000 b9e90000 raspptp raspptp.sys Thu Mar 24 17:40:43 2005 (42435E0B)
b9e90000 b9eaa000 ndiswan ndiswan.sys Thu Mar 24 17:40:46 2005 (42435E0E)
b9eaa000 b9ebf000 rasl2tp rasl2tp.sys Thu Mar 24 17:40:29 2005 (42435DFD)
b9ebf000 b9ee7000 ks ks.sys Thu Mar 24 17:41:03 2005 (42435E1F)
b9ee7000 b9efb000 redbook redbook.sys Thu Mar 24 17:28:46 2005 (42435B3E)
b9efb000 b9f10000 cdrom cdrom.sys Thu Mar 24 17:28:57 2005 (42435B49)
b9f40000 b9f4f000 termdd termdd.sys Thu Mar 24 17:27:15 2005 (42435AE3)
b9f60000 b9f69000 raspti raspti.sys Thu Mar 24 17:34:16 2005 (42435C88)
b9f70000 b9f7b000 ptilink ptilink.sys Thu Mar 24 17:28:25 2005 (42435B29)
b9fc0000 b9fcb000 TDI TDI.SYS Thu Mar 24 17:35:34 2005 (42435CD6)
b9fe0000 b9fef000 raspppoe raspppoe.sys Thu Mar 24 17:34:16 2005 (42435C88)
ba070000 ba079000 ndistapi ndistapi.sys Thu Mar 24 17:34:11 2005 (42435C83)
ba080000 ba08eee0 Cdr4_xp Cdr4_xp.SYS Tue Dec 17 12:32:57 2002 (3DFF89F9)
ba090000 ba09e000 imapi imapi.sys Thu Mar 24 17:29:10 2005 (42435B56)
ba0f0000 ba108000 parport parport.sys Thu Mar 24 17:28:25 2005 (42435B29)
ba128000 ba134000 vga vga.sys Thu Mar 24 17:29:54 2005 (42435B82)
ba178000 ba186000 NDProxy NDProxy.SYS Thu Mar 24 17:34:13 2005 (42435C85)
ba1e8000 ba1f2000 flpydisk flpydisk.sys Tue Mar 25 00:04:32 2003 (3E7FFF80)
ba1f8000 ba202000 Dxapi Dxapi.sys Tue Mar 25 00:06:01 2003 (3E7FFFD9)
ba218000 ba226000 msgpc msgpc.sys Thu Mar 24 17:33:31 2005 (42435C5B)
ba388000 ba39d000 serial serial.sys Thu Mar 24 17:28:29 2005 (42435B2D)
ba39d000 ba3b0000 i8042prt i8042prt.sys Thu Mar 24 17:41:05 2005 (42435E21)
ba3b0000 ba3cb000 VIDEOPRT VIDEOPRT.SYS Thu Mar 24 17:29:53 2005 (42435B81)
ba3cb000 ba4a9000 ati2mtag ati2mtag.sys Thu Nov 11 19:02:01 2004 (419427A9)
ba4a9000 ba4d3000 USBPORT USBPORT.SYS Thu Mar 24 17:30:43 2005 (42435BB3)
ba4d3000 ba4fae00 e1000325 e1000325.sys Tue Oct 24 11:15:26 2006 (453E583E)
ba5e7000 ba5ef000 audstub audstub.sys Tue Mar 25 00:09:12 2003 (3E800098)
ba5ef000 ba5f7000 fsvga fsvga.sys Tue Mar 25 00:07:51 2003 (3E800047)
ba5f7000 ba5fc560 Cdralw2k Cdralw2k.SYS Tue Dec 17 12:32:44 2002 (3DFF89EC)
ba761000 ba76b000 mouclass mouclass.sys Tue Mar 25 00:03:09 2003 (3E7FFF2D)
ba7c1000 ba7ca000 mssmbios mssmbios.sys Thu Mar 24 17:34:14 2005 (42435C86)
ba811000 ba816180 usbuhci usbuhci.sys Thu Mar 24 17:30:45 2005 (42435BB5)
bae0d000 bae16000 watchdog watchdog.sys Thu Mar 24 17:30:19 2005 (42435B9B)
bae3d000 bae4c000 intelppm intelppm.sys Thu Mar 24 17:28:40 2005 (42435B38)
bf800000 bf9d0000 win32k win32k.sys Wed Oct 05 17:37:08 2005 (434471B4)
bf9d0000 bf9e6000 dxg dxg.sys Thu Mar 24 17:27:25 2005 (42435AED)
bf9e6000 bfa20000 ati2dvag ati2dvag.dll Thu Nov 11 19:02:23 2004 (419427BF)
bfa20000 bfa5d000 ati2cqag ati2cqag.dll Thu Nov 11 18:22:24 2004 (41941E60)
bfa5d000 bfc90320 ati3duag ati3duag.dll Thu Nov 11 18:43:23 2004 (4194234B)
bfc91000 bfcfb000 ativvaxx ativvaxx.dll Thu Nov 11 18:38:17 2004 (41942219)
bff60000 bff7e000 RDPDD RDPDD.dll Thu Mar 24 19:30:48 2005 (424377D8)
f7062000 f706c000 kbdclass kbdclass.sys Tue Mar 25 00:03:10 2003 (3E7FFF2E)
f70e2000 f70ed000 fdc fdc.sys Thu Mar 24 17:28:43 2005 (42435B3B)
f7162000 f716b000 ndisuio ndisuio.sys Thu Mar 24 17:33:16 2005 (42435C4C)
f720a000 f7229000 Mup Mup.sys Thu Mar 24 17:40:49 2005 (42435E11)
f7229000 f725f000 NDIS NDIS.sys Thu Mar 24 17:40:26 2005 (42435DFA)
f725f000 f72f4000 Ntfs Ntfs.sys Thu Mar 24 17:40:29 2005 (42435DFD)
f72f4000 f731b000 KSecDD KSecDD.sys Thu Mar 24 17:28:53 2005 (42435B45)
f731b000 f7340000 fltmgr fltmgr.sys Mon Aug 21 02:59:45 2006 (44E98411)
f7340000 f7353000 CLASSPNP CLASSPNP.SYS Thu Mar 24 17:40:23 2005 (42435DF7)
f7353000 f7364000 symmpi symmpi.sys Mon Dec 13 13:03:14 2004 (41BE0392)
f7364000 f7383000 SCSIPORT SCSIPORT.SYS Thu Mar 24 17:40:26 2005 (42435DFA)
f7383000 f739f000 atapi atapi.sys Thu Mar 24 17:28:49 2005 (42435B41)
f739f000 f73c9000 volsnap volsnap.sys Thu Mar 24 17:29:10 2005 (42435B56)
f73c9000 f73f5000 dmio dmio.sys Thu Mar 24 17:30:02 2005 (42435B8A)
f73f5000 f741c000 ftdisk ftdisk.sys Thu Mar 24 17:29:00 2005 (42435B4C)
f741c000 f7432000 pci pci.sys Thu Mar 24 17:34:14 2005 (42435C86)
f7432000 f7466000 ACPI ACPI.sys Thu Mar 24 17:34:09 2005 (42435C81)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 00:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 00:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Thu Mar 24 17:28:48 2005 (42435B40)
f74b7000 f74c7000 MountMgr MountMgr.sys Thu Mar 24 17:27:23 2005 (42435AEB)
f74c7000 f74d2000 PartMgr PartMgr.sys Thu Mar 24 17:40:34 2005 (42435E02)
f74d7000 f74e2000 mraid35x mraid35x.sys Tue Sep 07 14:26:51 2004 (413E279B)
f74e7000 f74f7000 disk disk.sys Thu Mar 24 17:28:58 2005 (42435B4A)
f74f7000 f7503000 Dfs Dfs.sys Thu Mar 24 17:30:28 2005 (42435BA4)
f7507000 f7511000 crcdisk crcdisk.sys Thu Mar 24 17:29:40 2005 (42435B74)
f75a7000 f75b1000 serenum serenum.sys Thu Mar 24 17:28:27 2005 (42435B2B)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 00:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 00:07:58 2003 (3E80004E)
f7717000 f771e000 PCIIde PCIIde.sys Tue Mar 25 00:04:46 2003 (3E7FFF8E)
f771f000 f7726000 intelide intelide.sys Thu Mar 24 17:28:48 2005 (42435B40)
f7727000 f772e000 dmload dmload.sys Tue Mar 25 00:08:08 2003 (3E800058)
f7747000 f774e000 dxgthk dxgthk.sys Tue Mar 25 00:05:52 2003 (3E7FFFD0)
f7797000 f779e000 parvdm parvdm.sys Tue Mar 25 00:03:49 2003 (3E7FFF55)
f77bf000 f77c6000 Null Null.SYS Tue Mar 25 00:03:05 2003 (3E7FFF29)
f77f7000 f77fda00 usbehci usbehci.sys Thu Mar 24 17:30:43 2005 (42435BB3)
f7993000 f7994280 swenum swenum.sys Thu Mar 24 17:27:42 2005 (42435AFE)
f79e7000 f79e8580 USBD USBD.SYS Tue Mar 25 00:10:39 2003 (3E8000EF)

Unloaded modules:
b6f3b000 b6f4e000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b6f4e000 b7027000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7027000 b7045000 EraserUtilDr
Timestamp: unavailable (00000000)
Checksum: 00000000
b7711000 b7724000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7724000 b77fd000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b77fd000 b781b000 EraserUtilDr
Timestamp: unavailable (00000000)
Checksum: 00000000
b7711000 b7724000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7724000 b77fd000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b8cf4000 b8d07000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b8d07000 b8de0000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77ef000 f77f7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt
 
Hi, did you add this address " as the symbols path in the debugger?

as you have a bit that says symbols could not be loaded for SYMEVENT.SYS ?

This could be a symantec issue . . .

but the solution page has been remove from the symantec website!!!!

Are you using an older version of Norton AV?

Definatley worth running a memory check . . .


Adrian Paris

Paris Engineering Ltd

Google search of just tech forums & articles
(very useful, honest!)
 
I haven't done a memory check yet. I'm running SAV 10.1.6. I did load the symbols from the MS website so I don't think that's the problem. I will look into your links to see if I can see what's going on. Thanks much!
 
Just to give an update, I have reinstalled Symantec Antivirus from 10.0 (i thought i had 10.1.6) to 10.1.6 and also Symantec System Security Console from 10.0 to 10.1.6. It hasn't restarted in 2.5 days so far. I'll let you guys know if I keep getting the problem. Thanks so much for your help guys!!
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top