TechSpot

windows bluescreen with KMODE_EXCEPTION_NOT_HANDLED

By Kelvin Tan
May 2, 2006
  1. hi there,

    1 fine day i my Win2k server SP4 rebooted without apparent reason. it hasn't done so the 2nd time so far but i'm very eager to find out wht's wrong cos i know it will come again.

    Following are error messages captured from few sources (screen, eventlog, dumpchk, memory dump).

    Anyone know's wht went wrong? I saw few similar postings and seems there are ppl who are able to decode the error msg and pinpoint exactly wht went wrong. how's that done?

    any help is appreciated.

    cheers,
    kelvin

    ***bluescreen error msg***

    *** STOP: 0x0000001E (0xC0000044,0x804A1F6E,0x00000000,0x00000000)
    KMODE_EXCEPTION_NOT_HANDLED

    *** Address 804A1F6E base at 80400000, DateStamp 3ee650b3 - ntoskrnl.exe



    ***In eventlog***

    Event ID 6088 Source Eventlog The previous system shutdown at 14:53:16 on 17-Apr-06 was unexpected
    Event ID 2019 Source Srv The server was unable to allocate from the system nonpaged pool because the pool was empty.
    Event ID 5719 Source NETLOGON No Windows NT or Windows 2000 Domain Controller is available for domain SHWAS. The following error occurred:
    Not enough storage is available to process this command.
    Event ID 2019 Source Srv The server was unable to allocate from the system nonpaged pool because the pool was empty.



    ** Windows 2000 Crash Dump Analysis
    **
    ****************************************************************
    *
    Filename . . . . . . .c:\winnt\memory.dmp
    Signature. . . . . . .PAGE
    ValidDump. . . . . . .DUMP
    MajorVersion . . . . .free system
    MinorVersion . . . . .2195
    DirectoryTableBase . .0xc42d6000
    PfnDataBase. . . . . .0x890c3000
    PsLoadedModuleList . .0x80484520
    PsActiveProcessHead. .0x80485c68
    MachineImageType . . .i386
    NumberProcessors . . .4
    BugCheckCode . . . . .0x0000001e
    BugCheckParameter1 . .0xc0000044
    BugCheckParameter2 . .0x804a1f6e
    BugCheckParameter3 . .0x00000000
    BugCheckParameter4 . .0x00000000

    ExceptionCode. . . . .0x80000003
    ExceptionFlags . . . .0x00000001
    ExceptionAddress . . .0x8042f2fc



    ***Debugger Tools for Windows***

    Microsoft (R) Windows Debugger Version 6.6.0003.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINNT\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    ************************************************************************
    WARNING: Dump file has inconsistent set-bit count. Data may be missing.
    ************************************************************************
    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
    Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
    Product: Server, suite: TerminalServer
    Kernel base = 0x80400000 PsLoadedModuleList = 0x80484520
    Debug session time: Sun Apr 30 03:02:05.406 2006 (GMT+8)
    System Uptime: 9 days 13:15:27.156
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
    Loading Kernel Symbols
    .........................................................................................................
    Loading User Symbols
    ..............
    Loading unloaded module list
    ...........*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

    The call to LoadLibrary(ext) failed, Win32 error 127
    "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.
    The call to LoadLibrary(ext) failed, Win32 error 127
    "The specified procedure could not be found."
    Please check your debugger configuration and/or network access.
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Bugcheck code 0000001E
    Arguments c0000044 804a1f6e 00000000 00000000

    ChildEBP RetAddr Args to Child
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
    bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
    bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for Ntfs.sys -
    bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
    bcd28460 804a1f6e 00000000 00000286 8046b656 Ntfs!NtfsCommitCurrentTransaction+0x184c
    00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde
     
  2. Samstoned

    Samstoned TechSpot Paladin Posts: 1,018

    go to MS and download the symbls
    and or follow ther instructions for terminal load from website
    not much from this
    except maybe
    your out of page file memory
    our it failed to write to page file
    you may need to allocate more cache memory somewhere's
    I ran W2k advanced it was a litle better and handling off load memory
    don't get me wrong windows is great for back end server management
    but the front end is hard to config
    for me anyway
     
  3. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    ?? Fauty CPU

    It is no need to fix the symbol as your dump is full memory dump. From the stack trace, I believe that it is faulty CPU.

    WARNING: Stack unwind information not available. Following frames may be wrong.
    bcd28058 80432934 bcd28480 00000000 bcd283fc nt!KeTerminateThread+0xd0e
    bcd283cc 8046a033 bcd28480 bcd284d0 00000000 nt!ZwYieldExecution+0x1c60
    bcd283e8 80466389 bcd28480 bcd284d0 00000001 nt!KiCoprocessorError+0x15f <--- Co-Processor error ??
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for Ntfs.sys -
    bcd28410 bfee4d72 88fea800 fe3d4568 00000000 nt!KiReleaseSpinLock+0xba9
    bcd28460 804a1f6e 00000000 00000286 8046b656 Ntfs!NtfsCommitCurrentTransaction+0x184c
    00000000 00000000 00000000 00000000 00000000 nt!IoCreateStreamFileObject+0xde

    Your windows is crashed with NT status code c0000044. Refer the following problem
    Norton AV software problem
    http://www.experts-exchange.com/Operating_Systems/Win2000/Q_21711756.html
    Memory Leak
    http://support.microsoft.com/kb/264223/
     
  4. Kelvin Tan

    Kelvin Tan TS Rookie Topic Starter

    Hi there,

    thanks a lot for your inputs.

    I have run poolmon.exe and collected the following (sorted with higher bytes on top):

    Memory: 3669496K Avail: 2391756K PageFlts: 87149 InRam Krnl: 2312K P:34492K
    Commit:1394324K Limit:6649500K Peak:1394380K Pool N:42204K P:34692K
    Tag Type Allocs Frees Diff Bytes Per Alloc

    SavE Nonp 656839 ( 0) 656377 ( 0) 462 15103008 ( 0) 32690
    WD Nonp 386 ( 0) 225 ( 0) 161 3392576 ( 0) 21071
    NDpp Nonp 8 ( 0) 0 ( 0) 8 2544864 ( 0) 318108
    LSwi Nonp 1 ( 0) 0 ( 0) 1 2293760 ( 0) 2293760
    tdLL Nonp 4644 ( 0) 736 ( 7) 3908 2234880 ( -896) 571
    MmCm Nonp 45 ( 0) 11 ( 0) 34 1892928 ( 0) 55674
    NtFC Nonp 93778 ( 0) 77012 ( 0) 16766 1876320 ( 0) 111
    PTrk Nonp 9642 ( 0) 4996 ( 0) 4646 1504000 ( 0) 323

    Anyone knows what is SavE?? Is it Symantec anti-virus??? How do you define the Tag value? Appreciate your help. Thanks!!
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...