Server failing and rebooting

[Jamie]

I made a post already about this problem but it will not allow me to post
replies on the updated situation so I will start again:

I have a windows small business sever 2003 service pack 2 that is rebooting
almost daily.

It reboots around 5-6am almost every morning. There is no backups or
scheduled tasks running at this time or user activity. The server would be at
its least active time. The UPS logs show nothing strange but the problem has
only been occuring the last month or so.

All that is recorded in the event viewer is:

Event ID: 1076

The reason supplied by user DOMAIN\Administrator for the last unexpected
shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)

and

Event ID 1003

Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3
00000000, parameter4 00000000.

and

Event ID 1001

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f
(0x00000008, 0x80042000, 0x00000000, 0x00000000). A dump was saved in:
C:\WINDOWS\MEMORY.DMP.



How can I find the cause of the reboots and stop them?

 

[Jamie]

I now have the bug check analysis if anyone can help me, thanks to Robert L.
(MS-MVP) :

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
C:\WINDOWSC:\WINDOWS\system32C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free
x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer
SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sat Jan 19 05:33:05.198 2008 (GMT+9)
System Uptime: 0 days 12:41:43.132
WARNING: Process directory table base 7F795320 doesn't match CR3 005BB000
WARNING: Process directory table base 7F795320 doesn't match CR3 005BB000
Loading Kernel Symbols
..........................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80042000, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for
MegaIDE.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
TmPreFlt.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
VSApiNt.sys -
*** ERROR: Module load completed but symbols could not be loaded for
TmXPFlt.sys

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Probably caused by : MegaIDE.sys ( MegaIDE+730b )

Followup: MachineOwner
---------

0: kd> !analyze -vrkvlmtn.logcloseq
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 0x28)
..tss 0x28
eax=00001000 ebx=8a34a0e8 ecx=8978162c edx=8a336004 esi=8978162c edi=8a34baf8
eip=f727d30b esp=b7a1afd8 ebp=b7a1b008 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
MegaIDE+0x730b:
f727d30b 8945e4 mov dword ptr [ebp-1Ch],eax
ss:0010:b7a1afec=????????
..trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: NTRtScan.exe

CURRENT_IRQL: 7

TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68)
..trap 0xffffffffb7a1bd68
ErrCode = 00000000
eax=cab77c00 ebx=0000000e ecx=0000000f edx=00000000 esi=88596020 edi=00000000
eip=808b64a6 esp=b7a1bddc ebp=b7a1be18 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!CcMapData+0x8c:
808b64a6 8a10 mov dl,byte ptr [eax]
ds:0023:cab77c00=3f
..trap
Resetting default scope

LAST_CONTROL_TRANSFER: from f727d05f to f727d30b

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
b7a1b008 f727d05f 8a336004 8978162c ba40e000 MegaIDE+0x730b
b7a1b068 f727a42f 8a336004 00000000 8a336000 MegaIDE+0x705f
b7a1b0b4 f727a264 8a336004 8a336000 00000000 MegaIDE+0x442f
b7a1b32c f7277ae6 8a336004 00000028 006e74b4 MegaIDE+0x4264
b7a1b35c f7277508 8a336004 8978162c 8978162c MegaIDE+0x1ae6
b7a1b37c f72590be 8a336004 8978162c 8a34baf8 MegaIDE+0x1508
b7a1b3a0 8088d631 8a34ba40 00000002 89781602
SCSIPORT!SpStartIoSynchronized+0x14f
b7a1b3d8 80a5b147 8a34ba40 896d2e70 88522528 nt!KeSynchronizeExecution+0x21
b7a1b404 f72593a6 88522528 8a34ba40 89efe810
hal!HalBuildScatterGatherList+0x1c7
b7a1b450 8081cf82 8a34ba40 88522528 8a34baf8 SCSIPORT!ScsiPortStartIo+0x36a
b7a1b474 f725962f 8a34ba40 896d2e70 00000000 nt!IoStartPacket+0x82
b7a1b4a8 f7259146 8a34ba40 016d2f04 8978162c
SCSIPORT!ScsiPortFdoDispatch+0x270
b7a1b4c4 f7258dc3 8a34a0e8 896d2e70 8a199e70 SCSIPORT!SpDispatchRequest+0x68
b7a1b4e0 f7258299 8a34a030 896d2e70 8a33e438 SCSIPORT!ScsiPortPdoScsi+0x129
b7a1b4f4 8081df65 8a34a030 896d2e70 89781580
SCSIPORT!ScsiPortGlobalDispatch+0x1d
b7a1b508 f7245607 89781580 fee37000 b7a1b54c nt!IofCallDriver+0x45
b7a1b518 f72452b2 89781580 8a33ab70 8a199f94
CLASSPNP!SubmitTransferPacket+0xbb
b7a1b54c f7245533 00000000 00001000 8a199f94
CLASSPNP!ServiceTransferRequest+0x1e4
b7a1b570 8081df65 8a33aab8 00000000 8a33ef38 CLASSPNP!ClassReadWrite+0x159
b7a1b584 f74c803f 8979ef58 8a349020 b7a1b5a8 nt!IofCallDriver+0x45
b7a1b594 8081df65 8a349020 8a199e70 8a199e70 PartMgr!PmReadWrite+0x9a
b7a1b5a8 f72eb802 8a3487c0 8979ef58 8a347418 nt!IofCallDriver+0x45
b7a1b5f0 f7305153 8979ef58 013487c0 03000000 dmio!voldiskiostart+0x482
b7a1b640 f72f6a8c 8979ef58 b7a1b698 b7a1b68c dmio!vol_subdisksio_start+0x107
b7a1b6b0 f72ece9a 89528740 00000001 00000001 dmio!volkiostart+0x32c
b7a1b6dc f72ef64c 8a2e04b8 8a199e70 8a31c3c8 dmio!volrdwr+0xa0
b7a1b6f0 8081df65 8a2e04b8 8a199e70 8a199fdc dmio!volread+0x58
b7a1b704 f72c08bc 8a350248 8a1a21c8 8a23bb88 nt!IofCallDriver+0x45
b7a1b71c 8081df65 8a23bb88 8a199e70 8a199e70 volsnap!VolSnapRead+0x52
b7a1b730 baf71a62 b7a1ba14 b7a1b914 baf718d9 nt!IofCallDriver+0x45
b7a1b73c baf718d9 b7a1ba14 8a23bb88 c1037000 Ntfs!NtfsSingleAsync+0x91
b7a1b914 baf72156 b7a1ba14 8a199e70 8a1a21c8 Ntfs!NtfsNonCachedIo+0x2db
b7a1ba00 baf72079 b7a1ba14 8a199e70 00000001 Ntfs!NtfsCommonRead+0xaf5
b7a1bbac 8081df65 8a0a2718 8a199e70 8a2e0f38 Ntfs!NtfsFsdRead+0x113
b7a1bbc0 f7223c45 8a2e0f38 00000000 808b4901 nt!IofCallDriver+0x45
b7a1bbe8 8081df65 89fa4828 8a199e70 89ea3858 fltmgr!FltpDispatch+0x6f
b7a1bbfc ba01cbfe b7a1bc18 8081df65 8a0d6e08 nt!IofCallDriver+0x45
b7a1bc04 8081df65 8a0d6e08 8a199e70 8a199e70 TmPreFlt!TmpAddRdr+0x7ea
b7a1bc18 8081e4ed 88596020 89efe7d8 c0655bb8 nt!IofCallDriver+0x45
b7a1bc30 8085114a 8a3e6b08 89efe810 89efe7f0 nt!IoPageRead+0x109
b7a1bccc 8085ea66 00000001 cab77c00 89efe7d8 nt!MiDispatchFault+0xece
b7a1bd50 8088c798 00000000 cab77c00 00000000 nt!MmAccessFault+0x89e
b7a1bd50 808b64a6 00000000 cab77c00 00000000 nt!KiTrap0E+0xdc
b7a1be18 bafb1f2d 8a3e6ba0 b7a1be48 00000400 nt!CcMapData+0x8c
b7a1be38 bafaf494 88358ef8 8a1a21c8 01037c00 Ntfs!NtfsMapStream+0x4b
b7a1beac bafb1df0 88358ef8 8a0a27f8 ecc28010 Ntfs!NtfsReadMftRecord+0x86
b7a1bee4 bafb1fac 88358ef8 8a0a27f8 ecc28010 Ntfs!NtfsReadFileRecord+0x7a
b7a1bf1c bafa388d 88358ef8 ecc28008 ecc28010 Ntfs!NtfsLookupInFileRecord+0x37
b7a1bfcc bafa57be 88358ef8 00000001 ecc28008
Ntfs!NtfsUpdateFcbInfoFromDisk+0x3e
b7a1c098 bafa30b9 88358ef8 88409cd8 88409e44 Ntfs!NtfsOpenFile+0x330
b7a1c2bc bafb2ef8 88358ef8 88409cd8 b7a1c2fc Ntfs!NtfsCommonCreate+0x127e
b7a1c3c0 8081df65 8a0a2718 88409cd8 8a2e0f38 Ntfs!NtfsFsdCreate+0x17d
b7a1c3d4 f7231458 88409cd8 8a2e0f38 8a0a0008 nt!IofCallDriver+0x45
b7a1c400 8081df65 89fa4828 88409cd8 88409e44 fltmgr!FltpCreate+0xe4
b7a1c414 ba0229ba 8a0fddd8 89ea3858 88742328 nt!IofCallDriver+0x45
b7a1c47c 8081df65 8a0d6e08 88409cd8 88409cd8 TmPreFlt!TmpQueryFullName+0x5d42
b7a1c490 808f8f71 b7a1c638 8a2e04a0 00000000 nt!IofCallDriver+0x45
b7a1c578 80937942 8a2e04b8 00000000 883eede8 nt!IopParseDevice+0xa35
b7a1c5f8 80933a76 00000000 b7a1c638 00000040 nt!ObpLookupObjectName+0x5b0
b7a1c64c 808eae25 00000000 00000000 00000000 nt!ObOpenObjectByName+0xea
b7a1c6c8 808ec0bf e25bf800 80100000 b7a1c890 nt!IopCreateFile+0x447
b7a1c724 808eeb4e e25bf800 80100000 b7a1c890 nt!IoCreateFile+0xa3
b7a1c764 8088978c e25bf800 80100000 b7a1c890 nt!NtCreateFile+0x30
b7a1c764 8082e901 e25bf800 80100000 b7a1c890 nt!KiFastCallEntry+0xfc
b7a1c808 b9149e38 e25bf800 80100000 b7a1c890 nt!ZwCreateFile+0x11
b7a1c848 b91637db e25bf800 80100000 b7a1c890 VSApiNt!VSSwapShortTable+0xa7c
b7a1c8ec b91644bc b7a1cc24 00000000 b7a1c920 VSApiNt!VSOpenFileW+0x12c
b7a1c8fc b9159859 b7a1cc24 00000000 00000002 VSApiNt!VSAccessW+0xaa
b7a1c920 b91597ab b7a1cc24 00000002 00000000 VSApiNt!VSOpenResource+0x15e
b7a1c94c b90ce8b0 b7a1cc24 00000002 00000000 VSApiNt!VSOpenResource+0xb0
b7a1c97c b90cdbb0 b7a1cc24 b7a1d0f0 b7a1d0ee
VSApiNt!VSCheckPatternFileW+0x908
b7a1d108 b90cdcb0 e25c6656 b7a1d124 00002e3a VSApiNt!QuerySystemRoot+0x41fa
b7a1d37c b90cdde7 e25bc01c e25c6656 b9072c30
VSApiNt!VSKDReadNewestPatternW+0x95
b7a1d604 b90f6399 e25bc01c e4e19c1c 00000001
VSApiNt!VSKDReadNewestPatternW+0x1cc
b7a1d61c b903ed7c e25bc01c b7a1d690 00000000
VSApiNt!VSReadPatternInFileW+0x47


STACK_COMMAND: .tss 0x28 kb

FOLLOWUP_IP:
MegaIDE+730b
f727d30b 8945e4 mov dword ptr [ebp-1Ch],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: MegaIDE+730b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MegaIDE

IMAGE_NAME: MegaIDE.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 44a53372

FAILURE_BUCKET_ID: 0x7f_8_MegaIDE+730b

BUCKET_ID: 0x7f_8_MegaIDE+730b

Followup: MachineOwner
---------

eax=ffdff13c ebx=80042000 ecx=00000000 edx=00000000 esi=ffdff120 edi=8a0d06b8
eip=8088b777 esp=80897894 ebp=00000000 iopl=0 nv up di ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x75:
8088b777 ebee jmp nt!KiTrap08+0x65 (8088b767)
ChildEBP RetAddr Args to Child
00000000 f727d30b 00000000 00000000 00000000 nt!KiTrap08+0x75 (FPO: TSS 28:0)
WARNING: Stack unwind information not available. Following frames may be
wrong.
b7a1b008 f727d05f 8a336004 8978162c ba40e000 MegaIDE+0x730b
b7a1b068 f727a42f 8a336004 00000000 8a336000 MegaIDE+0x705f
b7a1b0b4 f727a264 8a336004 8a336000 00000000 MegaIDE+0x442f
b7a1b32c f7277ae6 8a336004 00000028 006e74b4 MegaIDE+0x4264
b7a1b35c f7277508 8a336004 8978162c 8978162c MegaIDE+0x1ae6
b7a1b37c f72590be 8a336004 8978162c 8a34baf8 MegaIDE+0x1508
b7a1b3a0 8088d631 8a34ba40 00000002 89781602
SCSIPORT!SpStartIoSynchronized+0x14f (FPO: [Non-Fpo])
b7a1b3d8 80a5b147 8a34ba40 896d2e70 88522528 nt!KeSynchronizeExecution+0x21
b7a1b404 f72593a6 88522528 8a34ba40 89efe810
hal!HalBuildScatterGatherList+0x1c7 (FPO: [Non-Fpo])
b7a1b450 8081cf82 8a34ba40 88522528 8a34baf8 SCSIPORT!ScsiPortStartIo+0x36a
(FPO: [Non-Fpo])
b7a1b474 f725962f 8a34ba40 896d2e70 00000000 nt!IoStartPacket+0x82 (FPO:
[Non-Fpo])
b7a1b4a8 f7259146 8a34ba40 016d2f04 8978162c
SCSIPORT!ScsiPortFdoDispatch+0x270 (FPO: [Non-Fpo])
b7a1b4c4 f7258dc3 8a34a0e8 896d2e70 8a199e70 SCSIPORT!SpDispatchRequest+0x68
(FPO: [Non-Fpo])
b7a1b4e0 f7258299 8a34a030 896d2e70 8a33e438 SCSIPORT!ScsiPortPdoScsi+0x129
(FPO: [Non-Fpo])
b7a1b4f4 8081df65 8a34a030 896d2e70 89781580
SCSIPORT!ScsiPortGlobalDispatch+0x1d (FPO: [Non-Fpo])
b7a1b508 f7245607 89781580 fee37000 b7a1b54c nt!IofCallDriver+0x45 (FPO:
[Non-Fpo])
b7a1b518 f72452b2 89781580 8a33ab70 8a199f94
CLASSPNP!SubmitTransferPacket+0xbb (FPO: [Non-Fpo])
b7a1b54c f7245533 00000000 00001000 8a199f94
CLASSPNP!ServiceTransferRequest+0x1e4 (FPO: [Non-Fpo])
b7a1b570 8081df65 8a33aab8 00000000 8a33ef38 CLASSPNP!ClassReadWrite+0x159
(FPO: [Non-Fpo])
start end module name
80800000 80a56000 nt ntkrpamp.exe Mon Mar 05 21:16:25 2007 (45EC0A19)
80a56000 80a82000 hal halmacpi.dll Sat Feb 17 14:48:26 2007 (45D6972A)
b7537000 b7562000 RDPWD RDPWD.SYS Sat Feb 17 14:44:38 2007 (45D69646)
b855b000 b8585000 Fastfat Fastfat.SYS Sat Feb 17 15:27:55 2007 (45D6A06B)
b873d000 b88fc180 tm_cfw tm_cfw.sys Wed Feb 28 18:07:39 2007 (45E5465B)
b89c5000 b89dcc00 tmcomm tmcomm.sys Wed Aug 01 16:46:56 2007 (46B04880)
b8cfd000 b8d4d000 HTTP HTTP.sys Sat Feb 17 15:28:12 2007 (45D6A07C)
b8e65000 b8ec2000 srv srv.sys Sat Feb 17 15:27:20 2007 (45D6A048)
b8ec2000 b8ef5000 mrxdav mrxdav.sys Sat Feb 17 14:50:49 2007 (45D697B9)
b8ff7000 b9026e60 exifs exifs.sys Fri Aug 26 08:29:05 2005 (430E6251)
b9027000 b9069000 TmXPFlt TmXPFlt.sys Mon Sep 17 14:40:39 2007 (46EE2167)
b9069000 b917a460 VSApiNt VSApiNt.sys Mon Sep 17 14:30:42 2007 (46EE1F12)
b917b000 b91a6580 dump_MegaIDE dump_MegaIDE.sys Fri Jun 30 22:21:38 2006
(44A53372)
b91a7000 b91bc000 Cdfs Cdfs.SYS Sat Feb 17 15:27:08 2007 (45D6A03C)
b9246000 b9250000 Dxapi Dxapi.sys Tue Mar 25 16:06:01 2003 (3E7FFFD9)
b9b40000 b9b4b000 TDTCP TDTCP.SYS Sat Feb 17 14:44:32 2007 (45D69640)
b9bd0000 b9be1000 Fips Fips.SYS Sat Feb 17 15:26:33 2007 (45D6A019)
b9be1000 b9c57000 mrxsmb mrxsmb.sys Sat Feb 17 15:28:15 2007 (45D6A07F)
b9c57000 b9c87000 rdbss rdbss.sys Sat Feb 17 15:27:37 2007 (45D6A059)
b9c87000 b9cb1000 afd afd.sys Sat Feb 17 15:28:16 2007 (45D6A080)
b9d51000 b9d82000 netbt netbt.sys Sat Feb 17 15:28:57 2007 (45D6A0A9)
b9d82000 b9e12000 tcpip tcpip.sys Wed Oct 31 02:34:10 2007 (47276B12)
b9e12000 b9e2b000 ipsec ipsec.sys Sat Feb 17 15:29:28 2007 (45D6A0C8)
b9f0b000 b9f15000 flpydisk flpydisk.sys Tue Mar 25 16:04:32 2003 (3E7FFF80)
b9f2b000 b9f37000 vga vga.sys Sat Feb 17 15:10:30 2007 (45D69C56)
b9f5b000 b9f68000 wanarp wanarp.sys Sat Feb 17 14:59:17 2007 (45D699B5)
b9f8b000 b9f95000 dump_diskdump dump_diskdump.sys Sat Feb 17 15:07:44 2007
(45D69BB0)
b9fe6000 b9ffb000 usbhub usbhub.sys Sat Feb 17 15:13:05 2007 (45D69CF1)
ba01b000 ba028000 TmPreFlt TmPreFlt.sys Mon Sep 17 14:40:39 2007 (46EE2167)
ba0bb000 ba11a000 update update.sys Mon May 28 20:15:16 2007 (465AC7D4)
ba11a000 ba151000 rdpdr rdpdr.sys Sat Feb 17 14:51:00 2007 (45D697C4)
ba151000 ba163000 raspptp raspptp.sys Sat Feb 17 15:29:20 2007 (45D6A0C0)
ba163000 ba17c000 ndiswan ndiswan.sys Sat Feb 17 15:29:22 2007 (45D6A0C2)
ba17c000 ba190000 rasl2tp rasl2tp.sys Sat Feb 17 15:29:02 2007 (45D6A0AE)
ba190000 ba1b7000 ks ks.sys Sat Feb 17 15:30:40 2007 (45D6A110)
ba1b7000 ba1cb000 redbook redbook.sys Sat Feb 17 15:07:26 2007 (45D69B9E)
ba1cb000 ba1e0000 cdrom cdrom.sys Sat Feb 17 15:07:48 2007 (45D69BB4)
ba1e0000 ba1fc000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 15:10:30 2007 (45D69C56)
ba1fc000 ba364000 ati2mtag ati2mtag.sys Thu Apr 06 11:03:52 2006 (44348518)
ba364000 ba38e000 USBPORT USBPORT.SYS Sat Feb 17 15:12:59 2007 (45D69CEB)
ba38e000 ba3a3000 serial serial.sys Sat Feb 17 15:06:46 2007 (45D69B76)
ba3a3000 ba3e3000 e1e5132 e1e5132.sys Thu Nov 02 03:23:48 2006 (4548E634)
baa7c000 baa85000 watchdog watchdog.sys Sat Feb 17 15:11:45 2007 (45D69CA1)
baa8c000 baa9b000 raspppoe raspppoe.sys Sat Feb 17 14:59:23 2007 (45D699BB)
baadc000 baae7000 Msfs Msfs.SYS Sat Feb 17 14:50:33 2007 (45D697A9)
baafc000 bab0b000 intelppm intelppm.sys Sat Feb 17 14:48:30 2007 (45D6972E)
baf0d000 baf2c000 Mup Mup.sys Sat Feb 17 15:27:41 2007 (45D6A05D)
baf2c000 baf6b000 NDIS NDIS.sys Sat Feb 17 15:28:49 2007 (45D6A0A1)
baf6b000 bb000000 Ntfs Ntfs.sys Sat Feb 17 15:27:23 2007 (45D6A04B)
bf800000 bf9cf000 win32k win32k.sys Thu Mar 01 23:59:28 2007 (45E6EA50)
bf9cf000 bf9e6000 dxg dxg.sys Sat Feb 17 15:14:39 2007 (45D69D4F)
bf9e6000 bfa29000 ati2dvag ati2dvag.dll Thu Apr 06 11:04:15 2006 (4434852F)
bfa29000 bfa68000 ati2cqag ati2cqag.dll Thu Apr 06 09:57:18 2006 (4434757E)
bfa68000 bfa9e000 atikvmag atikvmag.dll Thu Apr 06 10:25:29 2006 (44347C19)
bff60000 bff7e000 RDPDD RDPDD.dll Sat Feb 17 23:01:19 2007 (45D70AAF)
f721f000 f7244000 fltmgr fltmgr.sys Sat Feb 17 14:51:08 2007 (45D697CC)
f7244000 f7257000 CLASSPNP CLASSPNP.SYS Sat Feb 17 15:28:16 2007 (45D6A080)
f7257000 f7276000 SCSIPORT SCSIPORT.SYS Sat Feb 17 15:28:41 2007 (45D6A099)
f7276000 f72a1580 MegaIDE MegaIDE.sys Fri Jun 30 22:21:38 2006 (44A53372)
f72a2000 f72bf000 atapi atapi.sys Sat Feb 17 15:07:34 2007 (45D69BA6)
f72bf000 f72e9000 volsnap volsnap.sys Sat Feb 17 15:08:23 2007 (45D69BD7)
f72e9000 f7315000 dmio dmio.sys Sat Feb 17 15:10:44 2007 (45D69C64)
f7315000 f733c000 ftdisk ftdisk.sys Sat Feb 17 15:08:05 2007 (45D69BC5)
f733c000 f7352000 pci pci.sys Sat Feb 17 14:59:03 2007 (45D699A7)
f7352000 f7386000 ACPI ACPI.sys Sat Feb 17 14:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 16:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 14:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 15:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 15:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 15:29:25 2007 (45D6A0C5)
f74d7000 f74e7000 disk disk.sys Sat Feb 17 15:07:51 2007 (45D69BB7)
f74e7000 f74f3000 Dfs Dfs.sys Sat Feb 17 14:51:17 2007 (45D697D5)
f74f7000 f7501000 crcdisk crcdisk.sys Sat Feb 17 15:09:50 2007 (45D69C2E)
f7557000 f7562000 ptilink ptilink.sys Sat Feb 17 15:06:38 2007 (45D69B6E)
f7567000 f7575000 msgpc msgpc.sys Sat Feb 17 14:58:37 2007 (45D6998D)
f7577000 f7581000 mouclass mouclass.sys Tue Mar 25 16:03:09 2003 (3E7FFF2D)
f7587000 f7595000 NDProxy NDProxy.SYS Sat Feb 17 14:59:21 2007 (45D699B9)
f7597000 f75a0000 raspti raspti.sys Sat Feb 17 14:59:23 2007 (45D699BB)
f75b7000 f75c1000 serenum serenum.sys Sat Feb 17 15:06:44 2007 (45D69B74)
f75f7000 f7602000 TDI TDI.SYS Sat Feb 17 15:01:19 2007 (45D69A2F)
f7607000 f7610000 ndistapi ndistapi.sys Sat Feb 17 14:59:19 2007 (45D699B7)
f7617000 f7624000 Npfs Npfs.SYS Sat Feb 17 14:50:36 2007 (45D697AC)
f7627000 f7634000 netbios netbios.sys Sat Feb 17 14:58:29 2007 (45D69985)
f7667000 f7672000 fdc fdc.sys Sat Feb 17 15:07:16 2007 (45D69B94)
f7677000 f7686000 termdd termdd.sys Sat Feb 17 14:44:32 2007 (45D69640)
f7687000 f7692000 kbdclass kbdclass.sys Sat Feb 17 15:05:39 2007 (45D69B33)
f7697000 f76a0000 mssmbios mssmbios.sys Sat Feb 17 14:59:12 2007 (45D699B0)
f76b7000 f76c5000 IAMT03 IAMT03.sys Thu Oct 19 15:12:14 2006 (4537254E)
f76e1000 f7707000 KSecDD KSecDD.sys Sat Feb 17 14:46:32 2007 (45D696B8)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 16:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 16:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 16:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 16:08:08 2003 (3E800058)
f772f000 f7736000 dxgthk dxgthk.sys Tue Mar 25 16:05:52 2003 (3E7FFFD0)
f775f000 f7764180 usbuhci usbuhci.sys Sat Feb 17 15:13:02 2007 (45D69CEE)
f777f000 f7785b80 usbehci usbehci.sys Sat Feb 17 15:12:56 2007 (45D69CE8)
f7787000 f778f000 audstub audstub.sys Tue Mar 25 16:09:12 2003 (3E800098)
f77a7000 f77af000 Fs_Rec Fs_Rec.SYS Tue Mar 25 16:08:36 2003 (3E800074)
f77bf000 f77c6000 Null Null.SYS Tue Mar 25 16:03:05 2003 (3E7FFF29)
f77c7000 f77ce000 Beep Beep.SYS Tue Mar 25 16:03:04 2003 (3E7FFF28)
f77d7000 f77df000 rasacd rasacd.sys Tue Mar 25 16:11:50 2003 (3E800136)
f780f000 f7817000 mnmdd mnmdd.SYS Tue Mar 25 16:07:53 2003 (3E800049)
f7817000 f781f000 RDPCDD RDPCDD.sys Tue Mar 25 16:03:05 2003 (3E7FFF29)
f79ab000 f79ac280 swenum swenum.sys Sat Feb 17 15:05:56 2007 (45D69B44)
f79b5000 f79b6580 USBD USBD.SYS Tue Mar 25 16:10:39 2003 (3E8000EF)
f7b19000 f7bdf000 dmboot dmboot.sys Sat Feb 17 15:10:48 2007 (45D69C68)

Unloaded modules:
bade9000 badf7000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9e38000 b9e4b000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7797000 f779f000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt


"Jamie" wrote:

> I made a post already about this problem but it will not allow me to post
> replies on the updated situation so I will start again:
>
> I have a windows small business sever 2003 service pack 2 that is rebooting
> almost daily.
>
> It reboots around 5-6am almost every morning. There is no backups or
> scheduled tasks running at this time or user activity. The server would be at
> its least active time. The UPS logs show nothing strange but the problem has
> only been occuring the last month or so.
>
> All that is recorded in the event viewer is:
>
> Event ID: 1076
>
> The reason supplied by user DOMAIN\Administrator for the last unexpected
> shutdown of this computer is: System Failure: Stop error
> Reason Code: 0x805000f
> Bug ID:
> Bugcheck String: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
> Comment: 0x0000007f (0x00000008, 0x80042000, 0x00000000, 0x00000000)
>
> and
>
> Event ID 1003
>
> Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3
> 00000000, parameter4 00000000.
>
> and
>
> Event ID 1001
>
> The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f
> (0x00000008, 0x80042000, 0x00000000, 0x00000000). A dump was saved in:
> C:\WINDOWS\MEMORY.DMP.
>
>
>
> How can I find the cause of the reboots and stop them?
>
>
>

 

[Steven Andrews]

Jamie

NTRTScan.exe is related to trend micro? Is this the AV on the server?

Check AV - exclusions, etc. Check for updates not only definition but
AV driver / Engine updates. Is the AV doing a scan at the time of reboot?

Disable incoming mail overnight and disable RT scanning on the server -
including exchange scanning (overnight). See if the server still
reboots. If it doesn't then at least we know what is causing the
failure. If it does reboot after this - please repost the new event log
error.

Steve


>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> PROCESS_NAME: NTRtScan.exe
>
> CURRENT_IRQL: 7
>
> TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68)

 

[Steve]

I have been having the same issue for the past 3 days, except the first 2
crashes are at 12:03am, the 3rd at 1:03am. SBS Backup process is doing its
thing.

Debug Results:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\MiniDumps\Mini031308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free
x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer
SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Thu Mar 13 01:04:57.958 2008 (GMT-4)
System Uptime: 0 days 16:12:32.796
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*** WARNING: Unable to verify timestamp for MegaIDE.sys
*** ERROR: Module load completed but symbols could not be loaded for
MegaIDE.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 80042000, 0, 0}



Probably caused by : MegaIDE.sys ( MegaIDE+4429 )

Followup: MachineOwner
---------







"Steven Andrews" wrote:

> Jamie
>
> NTRTScan.exe is related to trend micro? Is this the AV on the server?
>
> Check AV - exclusions, etc. Check for updates not only definition but
> AV driver / Engine updates. Is the AV doing a scan at the time of reboot?
>
> Disable incoming mail overnight and disable RT scanning on the server -
> including exchange scanning (overnight). See if the server still
> reboots. If it doesn't then at least we know what is causing the
> failure. If it does reboot after this - please repost the new event log
> error.
>
> Steve
>
>
> >
> > DEFAULT_BUCKET_ID: DRIVER_FAULT
> >
> > PROCESS_NAME: NTRtScan.exe
> >
> > CURRENT_IRQL: 7
> >
> > TRAP_FRAME: b7a1bd68 -- (.trap 0xffffffffb7a1bd68)
>