积极答复者
window2003 server ,installed SEP software,AUTO restart,DUMP file display:Probably caused by : ntkrpamp.exe ,what can I resloved it?

问题
-
window2003 server ,installed SEP software,AUTO shutdown and restart,DUMP file display:Probably caused by : ntkrpamp.exe ,what can I resloved it?DUMP DETAILS refer below:
Many Thanks .
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\DUMP FILE\H3NGDCSHP02\Minidump\Mini090112-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (12 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sat Sep 1 04:04:10.290 2012 (GMT+8)
System Uptime: 74 days 3:50:15.004
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************Use !analyze -v to get detailed debugging information.
BugCheck 4E, {2, a1ce, 182b58, 8}
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** WARNING: Unable to verify timestamp for mssmbios.sys
Probably caused by : ntkrnlpa.exe ( nt!KeDelayExecutionThread+b9 )Followup: MachineOwner
---------11: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0000a1ce, entry in list being removed
Arg3: 00182b58, highest physical page number
Arg4: 00000008, reference count of entry being removedDebugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x4E
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 80865f91 to 80827c83
STACK_TEXT:
f790a510 80865f91 0000004e 00000002 0000a1ce nt!KeDelayExecutionThread+0xb9
f790a55c 8081194d de6d4000 00000001 e13841a0 nt!MiWaitForForkToComplete+0x1bd
f790a560 de6d4000 00000001 e13841a0 f790a5e8 nt!CcPrepareMdlWrite+0x297
WARNING: Frame IP not in any known module. Following frames may be wrong.
f790a5a4 808b6557 89cca500 e13841a0 00001000 0xde6d4000
f790a608 f7b1e7e0 89cca500 e13841a0 00001000 nt!HvRefreshHive+0x2d3
f790a680 f7b1e933 e1384160 e1460000 00003b60 Ntfs!LfsGetLbcb+0x3f
f790a694 f7b1dce4 e1384160 000022e8 e1460000 Ntfs!LfsPrepareLfcbForLogRecord+0x4a
f790a6e4 f7b1e6f7 e1384160 e146b1d8 00000002 Ntfs!LfsWriteLogRecordIntoLogPage+0x5c
f790a7c0 f7b1e1ba e146b1d8 00000002 f790a890 Ntfs!LfsWrite+0x305
f790a950 f7b156db f790ac28 89ccccf0 00000000 Ntfs!NtfsWriteLog+0x75e
f790abf4 f7b14b2d f790ac28 89ccc100 00000000 Ntfs!NtfsCheckpointVolume+0xff5
f790ad80 80880499 00000000 00000000 8bd73020 Ntfs!NtfsCheckpointAllVolumes+0xd2
f790adac 80949c88 00000000 00000000 00000000 nt!RaiseException+0x4b
f790addc 8088e0e2 808803ae 00000000 00000000 nt!NtSetInformationJobObject+0x698
00000000 00000000 00000000 00000000 00000000 nt!HalPrivateDispatchTable+0x12
STACK_COMMAND: kbFOLLOWUP_IP:
nt!KeDelayExecutionThread+b9
80827c83 5d pop ebpSYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeDelayExecutionThread+b9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlpa.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cbda48f
FAILURE_BUCKET_ID: 0x4E_nt!KeDelayExecutionThread+b9
BUCKET_ID: 0x4E_nt!KeDelayExecutionThread+b9
Followup: MachineOwner
---------11: kd> lmvm nt
start end module name
80800000 80a5a000 nt M (pdb symbols) C:\WINDOWS\Symbols\exe\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Image path: \WINDOWS\system32\ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Tue Oct 19 22:00:47 2010 (4CBDA48F)
CheckSum: 0023FE46
ImageSize: 0025A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
答案
-
Dear Customer,
Thank you for your post.
Per my experience, this issue can be due to many causes, virus/Trojan infection, third-party application or system related issue. Please perform the steps below to check the status:
Step 1:
=========
1. Right-click My Computer and select properties.
2. In the Advanced tab, click Start & Recovery.
3. Uncheck the Automatically reboot box.
4. In the Write Debugging Information box, select Complete Memory Dump.
5. Click OK to save the settings, then restart the computer to make it effect.
If you encounter blue screen after that, you need to contact Microsoft phone support engineer to debug the dump file, which is a quick and efficient way to resolve blue screen issue.
Step 2:
==========
If possible, please refer to the following article to perform a clean boot, run the server for a period of time to see if you reencounter the issue. Let us check to see if the issue occurs in a clean environment.
Q310353 How to Perform a Clean Boot in Windows XP, it is the same steps in win2k3 server
http://support.microsoft.com/support/kb/articles/q310/3/53.asp
Step 3:
==========
It is possible that the server is infected by virus or a backdoor Trojan and causes the server reboots or shutdown.
Keep the anti-virus up to date and perform a full virus scan. You may also go to the following websites to perform a free online virus scan:
Trend
http://www.housecall.antivirus.com
MacAfee:
Panda's Active Scan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
This response contains a reference to a third party World Wide Web site. Microsoft can make no representation concerning the content of these sites. Microsoft is providing this information only as a convenience to you: this is to inform you that Microsoft has not tested any software or information found on these sites and therefore cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software on the Internet.
Let me know how this works out and the results of the suggested tasks listed above.
I look forward to your reply.
如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
立刻免费下载 TechNet 论坛好帮手
- 已标记为答案 泡泡熊 2012年9月11日 6:06
全部回复
-
Dear Customer,
Thank you for your post.
Per my experience, this issue can be due to many causes, virus/Trojan infection, third-party application or system related issue. Please perform the steps below to check the status:
Step 1:
=========
1. Right-click My Computer and select properties.
2. In the Advanced tab, click Start & Recovery.
3. Uncheck the Automatically reboot box.
4. In the Write Debugging Information box, select Complete Memory Dump.
5. Click OK to save the settings, then restart the computer to make it effect.
If you encounter blue screen after that, you need to contact Microsoft phone support engineer to debug the dump file, which is a quick and efficient way to resolve blue screen issue.
Step 2:
==========
If possible, please refer to the following article to perform a clean boot, run the server for a period of time to see if you reencounter the issue. Let us check to see if the issue occurs in a clean environment.
Q310353 How to Perform a Clean Boot in Windows XP, it is the same steps in win2k3 server
http://support.microsoft.com/support/kb/articles/q310/3/53.asp
Step 3:
==========
It is possible that the server is infected by virus or a backdoor Trojan and causes the server reboots or shutdown.
Keep the anti-virus up to date and perform a full virus scan. You may also go to the following websites to perform a free online virus scan:
Trend
http://www.housecall.antivirus.com
MacAfee:
Panda's Active Scan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
This response contains a reference to a third party World Wide Web site. Microsoft can make no representation concerning the content of these sites. Microsoft is providing this information only as a convenience to you: this is to inform you that Microsoft has not tested any software or information found on these sites and therefore cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software on the Internet.
Let me know how this works out and the results of the suggested tasks listed above.
I look forward to your reply.
如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
立刻免费下载 TechNet 论坛好帮手
- 已标记为答案 泡泡熊 2012年9月11日 6:06