TechSpot

Event ID 1076

By bryanvine
Oct 12, 2009
  1. Hello everyone, I'm seeing the same issue as another user reported here: www . techspot . com/vb/topic37299.html

    The SBS 2003 server is a VM which is bluescreening on a regular basis. It's hosted on a HyperV box which is backed up by DPM. I'm pretty sure DPM is the culprit since the timing of the BSODs are right as express full backups run. I've attached a mini-dump, please if you have any insights, I'd appreciate it:

    Event Type: Warning
    Event Source: USER32
    Event Category: None
    Event ID: 1076
    Date: 10/12/2009
    Time: 8:24:47 AM
    User: ***********
    Computer: ***********
    Description:
    The reason supplied by user ******* for the last unexpected shutdown of this computer is: System Failure: Stop error
    Reason Code: 0x805000f
    Bug ID:
    Bugcheck String: 0x0000000a (0xb07efefc, 0xd0000002, 0x00000000, 0x8086bce6)
    Comment: 0x0000000a (0xb07efefc, 0xd0000002, 0x00000000, 0x8086bce6)

    Data:
    0000: 0f 00 05 08 ....
     
  2. bryanvine

    bryanvine TS Rookie Topic Starter

    BTW, because I'm a new member, I can't post links, so you'll have to remove the spaces in the link above to the closed forum post.
     
  3. bryanvine

    bryanvine TS Rookie Topic Starter

    I'm trying to up my postcount++
     
  4. bryanvine

    bryanvine TS Rookie Topic Starter

    two more posts until I can post links....
     
  5. bryanvine

    bryanvine TS Rookie Topic Starter

    Last one.... then I can finally post links.....
     
  6. bryanvine

    bryanvine TS Rookie Topic Starter

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7F, {d, 0, 0, 0}

    *** WARNING: Unable to verify timestamp for mssmbios.sys
    *** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
    Probably caused by : ntkrpamp.exe ( nt!KiSystemFatalException+f )

    Followup: MachineOwner
    ---------
     
  7. bryanvine

    bryanvine TS Rookie Topic Starter

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    UNEXPECTED_KERNEL_MODE_TRAP (7f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault). The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
    use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
    use .trap on that value
    Else
    .trap on the appropriate frame will show where the trap was taken
    (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 0000000d, EXCEPTION_GP_FAULT
    Arg2: 00000000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x7f_d

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

    CURRENT_IRQL: 1b

    LAST_CONTROL_TRANSFER: from 8088dd11 to 8088d0f7

    STACK_TEXT:
    8089a588 8088dd11 badb0d00 80010031 00000016 nt!KiSystemFatalException+0xf
    8089a600 8088debb 00000000 0000000e 00000000 nt!SwapContext+0x111
    8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xa3


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiSystemFatalException+f
    8088d0f7 c3 ret

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!KiSystemFatalException+f

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 49c21e56

    FAILURE_BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+f

    BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+f

    Followup: MachineOwner
    ---------
     
  8. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Your error is 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
    One of three types of problems occurred in kernel-mode: (1) Hardware failures. (2) Software problems. (3) A bound trap (i.e., a condition that the kernel is not allowed to have or intercept). Hardware failures are the most common cause and, of these, memory hardware failures are the most common.

    As you can tell the cause can be quite broad.


    The core Windows driver ntkrpamp.exe is the cause by blocking another Windows driver mssmbios.sys which is the process System Management BIOS Driver belonging to the software Microsoft System Management BIOS Driver.

    1. You may need to do a Windows repair.

    2. Before a repair try running Memtest on your RAM for a minimum of 7 Passes.
     
  9. bryanvine

    bryanvine TS Rookie Topic Starter

    Thanks Route44!

    The SBS 2003 is actually a VM on a HyperV 2008 server which has been running fine and doesn't crash when this VM does. A ram test has already been ran and the installation of the OS is rather recent.

    I'll take a snapshot of the VM and run a windows repair tonight outside of business hours.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...