最佳解答者
Windows Server 2003 Unexpected Shutdown

問題
-
My windows 2003 server unexpected shutdown last week. I check the memory dump file, found below information:
BugCheck 7E, {c0000005, 80819fe8, f7912ac8, f79127c4}
Probably caused by : ntkrpamp.exe
I search from Microsoft but only found some related to windows XP. Grateful if anyone could help on this issue. It occurs 2 times within a month.
Below is the memory dump file:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\cicadmin\桌面\新資料夾\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
WARNING: Whitespace at end of path element
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.090805-1438
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Apr 15 16:49:04.386 2011 (UTC + 8:00)
System Uptime: 34 days 19:07:48.765
Loading Kernel Symbols
...............................................................
...........................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {c0000005, 80819fe8, f7912ac8, f79127c4}
Probably caused by : ntkrpamp.exe ( nt!FsRtlLookupPerStreamContextInternal+4a )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80819fe8, The address that the exception occurred at
Arg3: f7912ac8, Exception Record Address
Arg4: f79127c4, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
FAULTING_IP:
nt!FsRtlLookupPerStreamContextInternal+4a
80819fe8 395008 cmp dword ptr [eax+8],edx
EXCEPTION_RECORD: f7912ac8 -- (.exr 0xfffffffff7912ac8)
ExceptionAddress: 80819fe8 (nt!FsRtlLookupPerStreamContextInternal+0x0000004a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008
CONTEXT: f79127c4 -- (.cxr 0xfffffffff79127c4)
eax=00000000 ebx=85ea71b0 ecx=e9f99bd4 edx=8a871828 esi=e9f99ba8 edi=00000000
eip=80819fe8 esp=f7912b90 ebp=f7912b9c iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
nt!FsRtlLookupPerStreamContextInternal+0x4a:
80819fe8 395008 cmp dword ptr [eax+8],edx ds:0023:00000008=????????
Resetting default scope
PROCESS_NAME: System
CURRENT_IRQL: 1
ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000008
READ_ADDRESS: 00000008
FOLLOWUP_IP:
nt!FsRtlLookupPerStreamContextInternal+4a
80819fe8 395008 cmp dword ptr [eax+8],edx
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from f7866884 to 80819fe8
STACK_TEXT:
f7912b9c f7866884 e9f99ba8 8a871828 00000000 nt!FsRtlLookupPerStreamContextInternal+0x4a
f7912c00 f7878f43 8a871828 874a9a70 00000000 fltMgr!FltpGetStreamListCtrl+0x5a
f7912c1c f7861337 8a871828 874a9a70 f7912cc0 fltMgr!FltpCleanupStreamListCtrlForFileObjectClose+0x17
f7912c78 f7862f2a 00912cc0 870c8d08 f7912cc0 fltMgr!FltpPerformPreCallbacks+0x141
f7912c8c f78638d2 f7912cc0 00000000 8a75f150 fltMgr!FltpPassThroughInternal+0x32
f7912ca8 f7863ce3 f7912cc0 874a9a70 8aa9ae88 fltMgr!FltpPassThrough+0x1c2
f7912cd8 8081df85 8a75f150 870c8b78 870c8b88 fltMgr!FltpDispatch+0x10d
f7912cec 808f98e0 00000000 00000000 00000000 nt!IofCallDriver+0x45
f7912d24 80933918 004a9a70 80a5ff00 874a9a58 nt!IopDeleteFile+0x13a
f7912d40 8086c981 874a9a70 00000000 87de62f8 nt!ObpRemoveObjectRoutine+0xdc
f7912d60 80841ded 80a5e540 87de62f8 808ab4d4 nt!ObfDereferenceObject+0x67
f7912d8c 80843ab4 e888a0d0 00000000 8b37b2d0 nt!MiSegmentDelete+0xd3
f7912dac 80949b80 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0xa6
f7912ddc 8088e092 80843a0e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!FsRtlLookupPerStreamContextInternal+4a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a799091
STACK_COMMAND: .cxr 0xfffffffff79127c4 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!FsRtlLookupPerStreamContextInternal+4a
BUCKET_ID: 0x7E_nt!FsRtlLookupPerStreamContextInternal+4a
Followup: MachineOwner2011年4月21日 上午 03:40
解答
-
Dear Customer,
Thank you for your post.
Based on the current information, I cannot determine the cause of the issue. I'd like to provide the following info for your reference:
Info 1.
Since this issue always caused by third party application, please perform a Clean Boot to see whether the problem persists.
1. Click Start->Run...->type msconfig and press Enter
2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services.
3. Click Startup tab and Disable All startup items
4. Click OK and choose Restart
5. After reboot, check whether the problem still occurs
6. If there are no more problems, please use the above steps to enable services and startup items one by one in order to figure out the root cause of this issue.
Info 2.
Please send the application and system event log directly to the forum.
Info 3.
Please make sure that you've installed all security updates from Microsoft Update, and then check whether this issue persists.
Thanks for your cooperation and understanding.
如果您对我们的论坛在线支持服务有任何的意见或建议,请通过邮件告诉我们。
Tom Zhang – MSFT
立刻免费下载 TechNet 论坛好帮手
- 已標示為解答 Tom Zhang – MSFTModerator 2011年5月6日 上午 08:29
2011年4月27日 上午 09:31版主