Please Help: STOP: 0X0000001E

[netactor]

I got the following BSOD error from a Windows Server 2003 R2 64-bit box:

STOP: 0X0000001E (0XFFFFFFFFC0000005, 0XFFFFF80001293CE1,
0X0000000000000000, 0X0000000000001808)

This happens whenever I try to logon to the system (as soon as I entered the correct password). I tried to logon by using both the Administrator and my own login account, both crashed the server with same STOP code. I also tried to logon to both local computer and domain, same thing. I tried to use remote desktop, it crashed the same way. However, I could logon when I enter Safe Mode or Safe Mode with Networking with no problem. I checked Event Viewer (in Safe Mode), nothing useful except it says "The previous system shutdown at xxx on xxx was unexpected".

Is there any ways to either fix this error or even just bypass the error? I really need to logon to the system.

Attached is the result from windbg when I loaded up Memory.dmp.

Please help....

 

[Route44]

Your error is 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
The Windows kernel detected an illegal or unknown processor instruction. A Stop 0x1E condition can be caused by invalid memory and access violations similar to those that generate Stop 0xA errors.

0xA errors are either caused by hardware or drivers attempting to address a higher IRQ LEVEL they have no right doing.

Since you can boot into Safe Mode it is a good chance we are looking at a driver issue but memory may be the culprit as well.

While in Safe Mode do a full sytem scan for infections. Have you ever run memtest on your memory before?

 

[netactor]

Memtest had no problem and there was no infections. By the way, the server is running Excahnge 2007. When first boot up, it used around 1GB of memory and now it is up to 3.8GB, the mail server is still working fine. This server has a total of 4GB memory.

Any other suggestions?

Thanks for your help.

 

[Route44]

Was this memory usage a gradual thing or has this suddenly jumped to 3.8 GB? How is your BIOS reading both memory installed and memory voltage?

 

[netactor]

By the way, I saw the following in the debugging details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+b8
fffff800`01293ce1 498b4608 mov rax,qword ptr [r14+8]

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000001808

READ_ADDRESS: 0000000000001808

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x1E

PROCESS_NAME: services.exe

CURRENT_IRQL: 0

Since it said "DEFAULT_BUCKET_ID: DRIVER_FAULT", could I be certain that this was caused by a corrupted driver file (or is this just a standard error message)? How could I check/verify this?

Thanks again.

 

[netactor]

Was this memory usage a gradual thing or has this suddenly jumped to 3.8 GB? How is your BIOS reading both memory installed and memory voltage?

This seems to be ok because we have something like this from day 1. It is kind of a gradual thing. Exchange 2007 has a process call store.exe which will pre-allocate memory (tried to grab maximum memory that it could use) for its own operations.

 

[netactor]

Was this memory usage a gradual thing or has this suddenly jumped to 3.8 GB? How is your BIOS reading both memory installed and memory voltage?

Not sure about the voltage, but when I check the system performance, here's what I got:

Physical Memory(Kb)
Total 4193368
Available 145192
System Cache 197584
System Cache Peak 1326992

Kernal Memory (Kb)
Total 90036
Paged 56580
Nonopaged 33472

Unfortunately I can't reboot at the moment because users are using the mail server now...

 

[Route44]

The usage of 3.8 gb of RAM is extreme so I searched "services.exe memory" and I think you'll find this link helpful. I am not recommending you do this but services.exe was in your dump and you are also using way too much memory.

Link: http://www.dexternights.com/2008/03...l-your-memory-and-windows-hangs-after-launch/