none
window2003 server ,installed SEP software,AUTO restart,DUMP file display:Probably caused by : ntkrpamp.exe ,what can I resloved it? RRS feed

  • 问题

  • window2003 server ,installed SEP software,AUTO shutdown and restart,DUMP file display:Probably caused by : ntkrpamp.exe ,what can I resloved it?DUMP DETAILS refer below:

    Many Thanks . 

    Microsoft (R) Windows Debugger  Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\DUMP FILE\H3NGDCSHP02\Minidump\Mini090112-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (12 procs) Free x86 compatible
    Product: Server, suite: TerminalServer SingleUserTS
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Sat Sep  1 04:04:10.290 2012 (GMT+8)
    System Uptime: 74 days 3:50:15.004
    Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    Loading Kernel Symbols
    ............................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {2, a1ce, 182b58, 8}

    *** WARNING: Unable to verify timestamp for Ntfs.sys
    *** WARNING: Unable to verify timestamp for mssmbios.sys
    Probably caused by : ntkrnlpa.exe ( nt!KeDelayExecutionThread+b9 )

    Followup: MachineOwner
    ---------

    11: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc).  If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000002, A list entry was corrupt
    Arg2: 0000a1ce, entry in list being removed
    Arg3: 00182b58, highest physical page number
    Arg4: 00000008, reference count of entry being removed

    Debugging Details:
    ------------------


    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x4E

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from 80865f91 to 80827c83

    STACK_TEXT: 
    f790a510 80865f91 0000004e 00000002 0000a1ce nt!KeDelayExecutionThread+0xb9
    f790a55c 8081194d de6d4000 00000001 e13841a0 nt!MiWaitForForkToComplete+0x1bd
    f790a560 de6d4000 00000001 e13841a0 f790a5e8 nt!CcPrepareMdlWrite+0x297
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f790a5a4 808b6557 89cca500 e13841a0 00001000 0xde6d4000
    f790a608 f7b1e7e0 89cca500 e13841a0 00001000 nt!HvRefreshHive+0x2d3
    f790a680 f7b1e933 e1384160 e1460000 00003b60 Ntfs!LfsGetLbcb+0x3f
    f790a694 f7b1dce4 e1384160 000022e8 e1460000 Ntfs!LfsPrepareLfcbForLogRecord+0x4a
    f790a6e4 f7b1e6f7 e1384160 e146b1d8 00000002 Ntfs!LfsWriteLogRecordIntoLogPage+0x5c
    f790a7c0 f7b1e1ba e146b1d8 00000002 f790a890 Ntfs!LfsWrite+0x305
    f790a950 f7b156db f790ac28 89ccccf0 00000000 Ntfs!NtfsWriteLog+0x75e
    f790abf4 f7b14b2d f790ac28 89ccc100 00000000 Ntfs!NtfsCheckpointVolume+0xff5
    f790ad80 80880499 00000000 00000000 8bd73020 Ntfs!NtfsCheckpointAllVolumes+0xd2
    f790adac 80949c88 00000000 00000000 00000000 nt!RaiseException+0x4b
    f790addc 8088e0e2 808803ae 00000000 00000000 nt!NtSetInformationJobObject+0x698
    00000000 00000000 00000000 00000000 00000000 nt!HalPrivateDispatchTable+0x12


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KeDelayExecutionThread+b9
    80827c83 5d              pop     ebp

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!KeDelayExecutionThread+b9

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4cbda48f

    FAILURE_BUCKET_ID:  0x4E_nt!KeDelayExecutionThread+b9

    BUCKET_ID:  0x4E_nt!KeDelayExecutionThread+b9

    Followup: MachineOwner
    ---------

    11: kd> lmvm nt
    start    end        module name
    80800000 80a5a000   nt       M (pdb symbols)          C:\WINDOWS\Symbols\exe\ntkrnlpa.pdb
        Loaded symbol image file: ntkrnlpa.exe
        Image path: \WINDOWS\system32\ntkrnlpa.exe
        Image name: ntkrnlpa.exe
        Timestamp:        Tue Oct 19 22:00:47 2010 (4CBDA48F)
        CheckSum:         0023FE46
        ImageSize:        0025A000
        Translations:     0000.04b0 0000.04e0 0409.04b0 0409.04e0

     

    2012年9月3日 8:43

答案

  • Dear Customer,

    Thank you for your post.

    Per my experience, this issue can be due to many causes, virus/Trojan infection, third-party application or system related issue. Please perform the steps below to check the status:

    Step 1:

    =========

    1. Right-click My Computer and select properties.

    2. In the Advanced tab, click Start & Recovery.

    3. Uncheck the Automatically reboot box.

    4. In the Write Debugging Information box, select Complete Memory Dump.

    5. Click OK to save the settings, then restart the computer to make it effect.

    If you encounter blue screen after that, you need to contact Microsoft phone support engineer to debug the dump file, which is a quick and efficient way to resolve blue screen issue.

    Step 2:

    ==========

    If possible, please refer to the following article to perform a clean boot, run the server for a period of time to see if you reencounter the issue. Let us check to see if the issue occurs in a clean environment.

    Q310353 How to Perform a Clean Boot in Windows XP, it is the same steps in win2k3 server

    http://support.microsoft.com/support/kb/articles/q310/3/53.asp

    Step 3:

    ==========

    It is possible that the server is infected by virus or a backdoor Trojan and causes the server reboots or shutdown.

    Keep the anti-virus up to date and perform a full virus scan. You may also go to the following websites to perform a free online virus scan:

    Trend

    http://www.housecall.antivirus.com

    MacAfee:

    www.mcafee.com

    Panda's Active Scan

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    This response contains a reference to a third party World Wide Web site. Microsoft can make no representation concerning the content of these sites. Microsoft is providing this information only as a convenience to you: this is to inform you that Microsoft has not tested any software or information found on these sites and therefore cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software on the Internet.

    Let me know how this works out and the results of the suggested tasks listed above.

    I look forward to your reply.


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    • 已标记为答案 泡泡熊 2012年9月11日 6:06
    2012年9月4日 9:03
    版主

全部回复

  • Dear Customer,

    Thank you for your post.

    Per my experience, this issue can be due to many causes, virus/Trojan infection, third-party application or system related issue. Please perform the steps below to check the status:

    Step 1:

    =========

    1. Right-click My Computer and select properties.

    2. In the Advanced tab, click Start & Recovery.

    3. Uncheck the Automatically reboot box.

    4. In the Write Debugging Information box, select Complete Memory Dump.

    5. Click OK to save the settings, then restart the computer to make it effect.

    If you encounter blue screen after that, you need to contact Microsoft phone support engineer to debug the dump file, which is a quick and efficient way to resolve blue screen issue.

    Step 2:

    ==========

    If possible, please refer to the following article to perform a clean boot, run the server for a period of time to see if you reencounter the issue. Let us check to see if the issue occurs in a clean environment.

    Q310353 How to Perform a Clean Boot in Windows XP, it is the same steps in win2k3 server

    http://support.microsoft.com/support/kb/articles/q310/3/53.asp

    Step 3:

    ==========

    It is possible that the server is infected by virus or a backdoor Trojan and causes the server reboots or shutdown.

    Keep the anti-virus up to date and perform a full virus scan. You may also go to the following websites to perform a free online virus scan:

    Trend

    http://www.housecall.antivirus.com

    MacAfee:

    www.mcafee.com

    Panda's Active Scan

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    This response contains a reference to a third party World Wide Web site. Microsoft can make no representation concerning the content of these sites. Microsoft is providing this information only as a convenience to you: this is to inform you that Microsoft has not tested any software or information found on these sites and therefore cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software on the Internet.

    Let me know how this works out and the results of the suggested tasks listed above.

    I look forward to your reply.


    如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
    Description: Description: TechNet 论坛好帮手立刻免费下载  TechNet 论坛好帮手

    • 已标记为答案 泡泡熊 2012年9月11日 6:06
    2012年9月4日 9:03
    版主
  • HI Tom,

    Thanks for you suggestion , I have cancel the Automatically reboot box ,let me test it for moment .

    2012年9月11日 6:08