none
I am having BSOD with Server 2008 Enterprise

    Question

  • I am posting the crash dump for any one that can point me in the right direction on the problem. Thanks in advance.

    Kernel Summary Dump File: Only kernel address space is available


    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (16 procs) Free x86 compatible
    Product: LanManNt, suite: Enterprise TerminalServer SingleUserTS
    Built by: 6002.18881.x86fre.vistasp2_gdr.130707-1535
    Machine Name:
    Kernel base = 0x81c18000 PsLoadedModuleList = 0x81d2fc70
    Debug session time: Fri Jan 10 01:16:51.109 2014 (UTC - 6:00)
    System Uptime: 1 days 12:16:39.251
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ......................
    Loading User Symbols

    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {954e90d8, 0, 81d942bf, 0}

    Page 2005 not present in the dump file. Type ".hh dbgerr004" for details
    Probably caused by : ntkrpamp.exe ( nt!CmpCheckKey+61b )

    Followup: MachineOwner
    ---------

    10: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: 954e90d8, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 81d942bf, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------

    Page 2005 not present in the dump file. Type ".hh dbgerr004" for details

    READ_ADDRESS:  954e90d8

    FAULTING_IP:
    nt!CmpCheckKey+61b
    81d942bf 394724          cmp     dword ptr [edi+24h],eax

    MM_INTERNAL_CODE:  0

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

    TRAP_FRAME:  936279ec -- (.trap 0xffffffff936279ec)
    ErrCode = 00000000
    eax=00000000 ebx=93c4b1e4 ecx=bd757dcb edx=00000036 esi=eb369008 edi=954e90b4
    eip=81d942bf esp=93627a60 ebp=93627a8c iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!CmpCheckKey+0x61b:
    81d942bf 394724          cmp     dword ptr [edi+24h],eax ds:0023:954e90d8=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 81c65de4 to 81cb0292

    STACK_TEXT: 
    936279d4 81c65de4 00000000 954e90d8 00000000 nt!MmAccessFault+0x10b
    936279d4 81d942bf 00000000 954e90d8 00000000 nt!KiTrap0E+0xdc
    93627a8c 81d9a81a 01000001 00ae80b0 009c3f70 nt!CmpCheckKey+0x61b
    93627abc 81d9ae48 eb369008 01000001 00000006 nt!CmpCheckRegistry2+0x8c
    93627b04 81d9586e 01000001 93627c60 8000cb08 nt!CmCheckRegistry+0xf5
    93627b60 81d97fdd 93627bb4 00000005 00000000 nt!CmpInitializeHive+0x4c1
    93627bd8 81d9a27d 93627c60 00000000 93627c4c nt!CmpInitHiveFromFile+0x19e
    93627c18 81d904c5 93627c60 00000000 93627c7b nt!CmpCmdHiveOpen+0x36
    93627d14 81d906fa 00000002 81d105a0 00000002 nt!CmpFlushBackupHive+0x2fd
    93627d38 81e6fcbd 81d1a13c 8a450580 81cbdd4a nt!CmpSyncBackupHives+0x90
    93627d44 81cbdd4a 00000000 00000000 8a450580 nt!CmpPeriodicBackupFlushWorker+0x32
    93627d7c 81dee01c 00000000 2e17000b 00000000 nt!ExpWorkerThread+0xfd
    93627dc0 81c56eee 81cbdc4d 00000001 00000000 nt!PspSystemThreadStartup+0x9d
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!CmpCheckKey+61b
    81d942bf 394724          cmp     dword ptr [edi+24h],eax

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!CmpCheckKey+61b

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  51da1840

    IMAGE_VERSION:  6.0.6002.18881

    FAILURE_BUCKET_ID:  0x50_nt!CmpCheckKey+61b

    BUCKET_ID:  0x50_nt!CmpCheckKey+61b

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:0x50_nt!cmpcheckkey+61b

    FAILURE_ID_HASH:  {b0c48432-dfba-c9e0-33fc-874f17d1f0e6}

    Followup: MachineOwner
    ---------

    10: kd> .trap 0xffffffff936279ec
    ErrCode = 00000000
    eax=00000000 ebx=93c4b1e4 ecx=bd757dcb edx=00000036 esi=eb369008 edi=954e90b4
    eip=81d942bf esp=93627a60 ebp=93627a8c iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!CmpCheckKey+0x61b:
    81d942bf 394724          cmp     dword ptr [edi+24h],eax ds:0023:954e90d8=????????
    10: kd> lmvm nt
    start    end        module name
    81c18000 81fd2000   nt         (pdb symbols)          c:\symbols\ntkrpamp.pdb\EAADD48E06944F81B2B51568531AA0E12\ntkrpamp.pdb
        Loaded symbol image file: ntkrpamp.exe
        Image path: ntkrpamp.exe
        Image name: ntkrpamp.exe
        Timestamp:        Sun Jul 07 20:39:12 2013 (51DA1840)
        CheckSum:         0037C9BA
        ImageSize:        003BA000
        File version:     6.0.6002.18881
        Product version:  6.0.6002.18881
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        1.0 App
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntkrpamp.exe
        OriginalFilename: ntkrpamp.exe
        ProductVersion:   6.0.6002.18881
        FileVersion:      6.0.6002.18881 (vistasp2_gdr.130707-1535)
        FileDescription:  NT Kernel & System
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    Friday, January 10, 2014 10:15 PM

Answers

All replies