Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD help!!


  • Please log in to reply
6 replies to this topic

#1 sshedlock

sshedlock

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:39 PM

Posted 08 August 2010 - 10:19 PM

Hi Everyone! My name is Steve from Columbus, Ohio. I am in need of some crash dump analysis. I can't find a forum for Win2K3 so will try here. I am having multiple BSODs daily and nightly on a server running Windows 2003 server R2 SP2. This machine runs my SQL database. here are the dumps. Thanks in advance!


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini080810-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_rtm.070216-1710
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sun Aug 8 10:58:13.484 2010 (UTC - 4:00)
System Uptime: 0 days 1:37:04.125
Loading Kernel Symbols
...............................................................
...................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, f773ffe0, 0, 0}

Unable to load image dcsnap.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dcsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for dcsnap.sys
Unable to load image VVBackd5.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VVBackd5.sys
*** ERROR: Module load completed but symbols could not be loaded for VVBackd5.sys
Probably caused by : CLASSPNP.SYS ( CLASSPNP!SubmitTransferPacket+bb )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f773ffe0
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: Idle

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 80a5a56d to 80a5c401

STACK_TEXT:
f78c0004 80a5a56d 808934f8 8b31caf8 8b31cc48 hal!KfLowerIrql+0xd
f78c0008 808934f8 8b31caf8 8b31cc48 000000f4 hal!KeReleaseQueuedSpinLock+0x2d
f78c004c f7252fc0 00000000 0041003f 44506353 nt!ExAllocatePoolWithTag+0x980
f78c0064 f7253a72 00000000 000001e0 44506353 SCSIPORT!SpAllocatePoolEx+0x1f
f78c0090 f7253acf 00000000 000001e0 00000000 SCSIPORT!SpAllocateSrbDataBackend+0x67
f78c00a8 f7252cb2 8b31ce40 884803bc 8b3310e8 SCSIPORT!ExAllocateFromNPagedLookasideList+0x27
f78c00c4 f7252da8 8b3310e8 88448e20 88398838 SCSIPORT!SpAllocateSrbData+0x19
f78c00dc f7252299 8b331030 88398838 8b277f38 SCSIPORT!ScsiPortPdoScsi+0xb0
f78c00f0 8081df65 8b331030 88398838 88480310 SCSIPORT!ScsiPortGlobalDispatch+0x1d
f78c0104 f723f607 88480310 52072000 f78c0148 nt!IofCallDriver+0x45
f78c0114 f723f2b2 88480310 8b38eb70 88448f20 CLASSPNP!SubmitTransferPacket+0xbb
f78c0148 f723f533 00000000 00002000 00000010 CLASSPNP!ServiceTransferRequest+0x1e4
f78c016c 8081df65 8b38eab8 00000000 8b32f258 CLASSPNP!ClassReadWrite+0x159
f78c0180 f74c80cf 00000000 88448f44 f78c01a4 nt!IofCallDriver+0x45
f78c0190 8081df65 8b38e880 88448e20 8b278bd0 PartMgr!PmReadWrite+0x95
f78c01a4 bafcfb77 bafcefa8 8b278b18 88448e20 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
f78c01e8 8081df65 8b278b18 88448e20 00102b84 dcsnap+0x1b77
f78c01fc f79662be f79602f0 8b3e7b88 88448e20 nt!IofCallDriver+0x45
f78c022c f795f23d 000093d7 8ac68000 00102b68 VVBackd5+0xb2be
f78c0230 00000000 8ac68000 00102b68 f78c0270 VVBackd5+0x423d


STACK_COMMAND: kb

FOLLOWUP_IP:
CLASSPNP!SubmitTransferPacket+bb
f723f607 5e pop esi

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: CLASSPNP!SubmitTransferPacket+bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME: CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 45d6a080

FAILURE_BUCKET_ID: 0x7f_8_CLASSPNP!SubmitTransferPacket+bb

BUCKET_ID: 0x7f_8_CLASSPNP!SubmitTransferPacket+bb

Followup: MachineOwner
---------

3: kd> lmvm CLASSPNP
start end module name
f723e000 f7251000 CLASSPNP (pdb symbols) c:\symbols\classpnp.pdb\7A500B223916422893BA4BE476B22FE82\classpnp.pdb
Loaded symbol image file: CLASSPNP.SYS
Mapped memory image file: c:\symbols\CLASSPNP.SYS\45D6A08013000\CLASSPNP.SYS
Image path: CLASSPNP.SYS
Image name: CLASSPNP.SYS
Timestamp: Sat Feb 17 01:28:16 2007 (45D6A080)
CheckSum: 0000EFB8
ImageSize: 00013000
File version: 5.2.3790.3959
Product version: 5.2.3790.3959
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: Classpnp.sys
OriginalFilename: Classpnp.sys
ProductVersion: 5.2.3790.3959
FileVersion: 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
FileDescription: SCSI Class System Dll
LegalCopyright: © Microsoft Corporation. All rights reserved.


and another


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini080810-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_rtm.070216-1710
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sun Aug 8 02:21:07.298 2010 (UTC - 4:00)
System Uptime: 2 days 12:11:38.343
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, f772ffe0, 0, 0}

Unable to load image dcsnap.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dcsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for dcsnap.sys
Unable to load image VVBackd5.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VVBackd5.sys
*** ERROR: Module load completed but symbols could not be loaded for VVBackd5.sys
Probably caused by : CLASSPNP.SYS ( CLASSPNP!SubmitTransferPacket+bb )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f772ffe0
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: Idle

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 80a5a56d to 80a5c401

STACK_TEXT:
f78b0004 80a5a56d 808934f8 8b2e9af8 8b2e9c48 hal!KfLowerIrql+0xd
f78b0008 808934f8 8b2e9af8 8b2e9c48 000000dc hal!KeReleaseQueuedSpinLock+0x2d
f78b004c f7252fc0 00000000 004d0033 44506353 nt!ExAllocatePoolWithTag+0x980
f78b0064 f7253a72 00000000 000001e0 44506353 SCSIPORT!SpAllocatePoolEx+0x1f
f78b0090 f7253acf 00000000 000001e0 00000000 SCSIPORT!SpAllocateSrbDataBackend+0x67
f78b00a8 f7252cb2 8b2e9e40 8991b3cc 8b2d80e8 SCSIPORT!ExAllocateFromNPagedLookasideList+0x27
f78b00c4 f7252da8 8b2d80e8 8825fd10 882491e0 SCSIPORT!SpAllocateSrbData+0x19
f78b00dc f7252299 8b2d8030 882491e0 8b388f38 SCSIPORT!ScsiPortPdoScsi+0xb0
f78b00f0 8081df65 8b2d8030 882491e0 8991b320 SCSIPORT!ScsiPortGlobalDispatch+0x1d
f78b0104 f723f607 8991b320 1c6f0000 f78b0148 nt!IofCallDriver+0x45
f78b0114 f723f2b2 8991b320 8b2d0b70 8825fe10 CLASSPNP!SubmitTransferPacket+0xbb
f78b0148 f723f533 00000000 00002000 00000010 CLASSPNP!ServiceTransferRequest+0x1e4
f78b016c 8081df65 8b2d0ab8 00000000 8b3363e8 CLASSPNP!ClassReadWrite+0x159
f78b0180 f74c80cf 00000000 8825fe34 f78b01a4 nt!IofCallDriver+0x45
f78b0190 8081df65 8b2d0880 8825fd10 8b38abd0 PartMgr!PmReadWrite+0x95
f78b01a4 bafcfb77 bafcefa8 8b38ab18 8825fd10 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
f78b01e8 8081df65 8b38ab18 8825fd10 00007d90 dcsnap+0x1b77
f78b01fc f79662be f79602f0 8b2cdb88 8825fd10 nt!IofCallDriver+0x45
f78b022c f795f23d 0000047c 8ac97000 00007d74 VVBackd5+0xb2be
f78b0230 00000000 8ac97000 00007d74 f78b0270 VVBackd5+0x423d


STACK_COMMAND: kb

FOLLOWUP_IP:
CLASSPNP!SubmitTransferPacket+bb
f723f607 5e pop esi

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: CLASSPNP!SubmitTransferPacket+bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME: CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 45d6a080

FAILURE_BUCKET_ID: 0x7f_8_CLASSPNP!SubmitTransferPacket+bb

BUCKET_ID: 0x7f_8_CLASSPNP!SubmitTransferPacket+bb

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 computerxpds

computerxpds

    Bleepin' Comp


  • Moderator
  • 4,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:39 PM

Posted 08 August 2010 - 10:22 PM

I will have this moved to the appropriate forum but until then do this:

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply. :thumbsup:

Edited by Budapest, 08 August 2010 - 10:30 PM.
Moved from XP ~BP

sigcomp.png 
If I have replied to a topic and you reply and I haven't gotten back to you within 48 hours (2 days) then send me a P.M.
Some important links: BC Forum Rules | Misplaced Malware Logs | BC Tutorials | BC Downloads |
Follow BleepingComputer on: Facebook! | Twitter! | Google+| Come join us on the BleepingComputer Live Chat on Discord too! |

#3 sshedlock

sshedlock
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:39 PM

Posted 08 August 2010 - 10:46 PM

I will have this moved to the appropriate forum but until then do this:

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply. :thumbsup:


here you go. Thanks again

==================================================
Dump File : Mini080810-03.dmp
Crash Time : 8/8/2010 11:00:23 AM
Bug Check String : UNEXPECTED_KERNEL_MODE_TRAP
Bug Check Code : 0x1000007f
Parameter 1 : 0x00000008
Parameter 2 : 0xf773ffe0
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : hal.dll
Caused By Address : hal.dll+456d
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini080810-03.dmp
Processors Count : 4
Major Version : 15
Minor Version : 3790
==================================================

==================================================
Dump File : Mini080810-02.dmp
Crash Time : 8/8/2010 9:21:54 AM
Bug Check String : UNEXPECTED_KERNEL_MODE_TRAP
Bug Check Code : 0x1000007f
Parameter 1 : 0x00000008
Parameter 2 : 0xf7737fe0
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+90014
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini080810-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 3790
==================================================

Dump File : Mini080810-01.dmp
Crash Time : 8/8/2010 2:23:15 AM
Bug Check String : UNEXPECTED_KERNEL_MODE_TRAP
Bug Check Code : 0x1000007f
Parameter 1 : 0x00000008
Parameter 2 : 0xf772ffe0
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : hal.dll
Caused By Address : hal.dll+456d
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini080810-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 3790
==================================================

Edited by sshedlock, 08 August 2010 - 10:49 PM.


#4 MrBruce1959

MrBruce1959

    My cat Oreo


  • BC Advisor
  • 6,377 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Norwich, Connecticut. in the USA
  • Local time:09:39 PM

Posted 18 August 2010 - 09:50 PM

I am just curious.

Has this topic ever been solved?

It has been dormant for quite some time now.

Bruce.
Welcome to Bleeping Computer! :welcome:
New Members: Please click here for the Bleeping Computer Forum Board Rules
 
My Career Involves 37 Years as an Electronics Repair Technician, to Which I am Currently Retired From.

I Am Currently Using Windows 10 Home Edition.

As a Volunteer Staff Member of Bleeping Computer, the Help That I Proudly Provide Here To Our BC Forum Board Membership is Free of Charge. :wink:

#5 computerxpds

computerxpds

    Bleepin' Comp


  • Moderator
  • 4,486 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:39 PM

Posted 19 August 2010 - 02:57 PM

Hey Bruce (I know I know Im on vacation :thumbsup: )

But this topic hasnt been solved yet so feel free... :huh: (I must have accidentally forgotten about it)
sigcomp.png 
If I have replied to a topic and you reply and I haven't gotten back to you within 48 hours (2 days) then send me a P.M.
Some important links: BC Forum Rules | Misplaced Malware Logs | BC Tutorials | BC Downloads |
Follow BleepingComputer on: Facebook! | Twitter! | Google+| Come join us on the BleepingComputer Live Chat on Discord too! |

#6 killerx525

killerx525

    Bleepin' Aussie


  • Members
  • 7,220 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Melbourne, Australia
  • Local time:12:39 PM

Posted 08 October 2010 - 08:58 AM

Maybe try sfc /scannow

>Michael 
System1: CPU- Intel Core i7-5820K @ 4.4GHz, CPU Cooler- Noctua NH-D14, RAM- G.Skill Ripjaws 16GB Kit(4Gx4) DDR3 2133MHz, SSD/HDD- Samsung 850 EVO 250GB/Western Digital Caviar Black 1TB/Seagate Barracuada 3TB, GPU- 2x EVGA GTX980 Superclocked @1360/MHz1900MHz, Motherboard- Asus X99 Deluxe, Case- Custom Mac G5, PSU- EVGA P2-1000W, Soundcard- Realtek High Definition Audio, OS- Windows 10 Pro 64-Bit
Games: APB: Reloaded, Hours played: 3100+  System2: Late 2011 Macbook Pro 15inch   OFw63FY.png


#7 Baltboy

Baltboy

    Bleepin' Flame Head


  • Members
  • 1,430 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pennsylvania
  • Local time:08:39 PM

Posted 09 October 2010 - 10:06 AM

Given that the errors all related to the hal or kernel I have to ask was any of the hardware replaced, upgraded, or repaired in recent history?
Get your facts first, then you can distort them as you please.
Mark Twain




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users