none
DUMP Analysis RRS feed

  • Question

  • Hi All,

             Am facing a repeated unexpected shutdown of one server 2003 R2 Sp1 , I have configured Minidump on the server and analysed the minidumb. The Last cause i could find is

    "BSOD - NDIS.sys is probable cause"


    Loading Dump File [C:\Documents and Settings\Administrator\Desktop\Toolket\Minidump\Mini052009-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Built by: 3790.srv03_sp1_rtm.050324-1447
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Wed May 20 15:44:13.508 2009 (GMT+10)
    System Uptime: 9 days 5:09:51.171
    Loading Kernel Symbols
    ...............................................................
    ........................................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 100000C5, {a4, 2, 1, 808933b7}

    Probably caused by : NDIS.sys ( NDIS!ndisWorkerThread+4a )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 000000a4, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 808933b7, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0xC5_2

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!ExAllocatePoolWithTag+83f
    808933b7 897004          mov     dword ptr [eax+4],esi

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 80938559 to 808933b7

    STACK_TEXT: 
    bae8db8c 80938559 00000000 00000000 e5726854 nt!ExAllocatePoolWithTag+0x83f
    bae8dbb0 80938c79 858acfa0 8cfe1c00 00000000 nt!ObpAllocateObject+0xc9
    bae8dbe4 80948dd3 8cfe1c00 8d1616f8 00000000 nt!ObCreateObject+0x129
    bae8dd4c 80949ea9 bae8ddb4 001f03ff 00000000 nt!PspCreateThread+0xb9
    bae8dd80 baf3e058 bae8ddb4 001f03ff 00000000 nt!PsCreateSystemThread+0x33
    bae8ddac 80948bb2 00003690 00000000 00000000 NDIS!ndisWorkerThread+0x4a
    bae8dddc 8088d4d2 baf3e005 00000000 00000000 nt!PspSystemThreadStartup+0x2e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    NDIS!ndisWorkerThread+4a
    baf3e058 85c0            test    eax,eax

    SYMBOL_STACK_INDEX:  5

    SYMBOL_NAME:  NDIS!ndisWorkerThread+4a

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: NDIS

    IMAGE_NAME:  NDIS.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  42435dfa

    FAILURE_BUCKET_ID:  0xC5_2_NDIS!ndisWorkerThread+4a

    BUCKET_ID:  0xC5_2_NDIS!ndisWorkerThread+4a

    Followup: MachineOwner
    Thursday, May 21, 2009 1:50 AM

Answers

All replies