We have a Windows 2003 server that is spontaneously rebooting on occasion and claims to be running out of system resources every week.

Attached is a minidump file.

Would someone please take a look and let me know what the problem is? Also, I would appreciate it if you could send me the dump in a txt file. Furthermore, if you would explain to me how I could save a .dmp file to a .txt that would be great.

Attached Files

Mini052306-01.zip (11.3 KB, 6 views)

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Downloads\Mini052306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue May 23 00:10:36.310 2006 (GMT-7)
System Uptime: 9 days 0:35:15.844
Loading Kernel Symbols
........................................................................... ..................................
Loading User Symbols
Loading unloaded module list
...
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck C5, {6b0065, 2, 1, 808933b7}

Unable to load image UdDrv.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for UdDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for UdDrv.sys
*** WARNING: Unable to verify timestamp for tmpreflt.sys
*** ERROR: Module load completed but symbols could not be loaded for tmpreflt.sys
Probably caused by : UdDrv.sys ( UdDrv+11f7 )

Followup: MachineOwner
---------

3: kd> !analyze-v
No export analyze-v found
3: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 006b0065, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 808933b7, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExAllocatePoolWithTag+83f
808933b7 897004 mov [eax+0x4],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

LAST_CONTROL_TRANSFER: from 808933b7 to 8088bdd3

STACK_TEXT:
b73ae5c4 808933b7 badb0d00 00000027 00010000 nt!KiTrap0E+0x2a7
b73ae674 80810919 00000000 00000000 63536343 nt!ExAllocatePoolWithTag+0x83f
b73ae6c0 f7b7d9e3 87dd4ad0 b73ae6e8 e16c9001 nt!CcInitializeCacheMap+0xb3
b73ae72c f7b83831 b73aeb20 ece4cd28 00000001 Ntfs!NtfsCreateInternalStreamCommon+0x1e5
b73ae754 f7b87304 b73aeb20 ece4cd28 00000000 Ntfs!ReadIndexBuffer+0x26
b73ae784 f7b824dc b73aeb20 e6201aa8 ed69b5b8 Ntfs!FindFirstIndexEntry+0x196
b73ae8ac f7b80b06 b73aeb20 ece4ceb8 ece4cd28 Ntfs!NtfsRestartIndexEnumeration+0x6c
b73aead0 f7b82180 b73aeb20 872925d8 8a366428 Ntfs!NtfsQueryDirectory+0x54c
b73aeb04 f7b82452 b73aeb20 ece4cd28 896cace0 Ntfs!NtfsCommonDirectoryControl+0xbc
b73aec74 8081dce5 8a366348 872925d8 8a2b5498 Ntfs!NtfsFsdDirectoryControl+0xad
b73aec88 f7250c53 8a2b5498 872925d8 ffffffff nt!IofCallDriver+0x45
b73aecb0 8081dce5 896cace0 872925d8 89c5c168 fltmgr!FltpDispatch+0x6f
b73aecc4 f75181f7 8081dce5 896c8b18 872925d8 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
b73aecdc b8397d10 b73aecf8 8081dce5 89a963f8 UdDrv+0x11f7
b73aece4 8081dce5 89a963f8 872925d8 014de504 tmpreflt+0x1d10
b73aecf8 808f4797 b73aed64 014de504 808eecdc nt!IofCallDriver+0x45
b73aed0c 808eed39 89a963f8 872925d8 89e8c260 nt!IopSynchronousServiceTail+0x10b
b73aed30 80888c6c 000002a4 00000000 00000000 nt!NtQueryDirectoryFile+0x5d
b73aed30 7c82ed54 000002a4 00000000 00000000 nt!KiFastCallEntry+0xfc
014de7d8 00000000 00000000 00000000 00000000 0x7c82ed54


STACK_COMMAND: kb

FOLLOWUP_IP:
UdDrv+11f7
f75181f7 ?? ???

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: d

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: UdDrv+11f7

MODULE_NAME: UdDrv

IMAGE_NAME: UdDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42c2dc72

FAILURE_BUCKET_ID: 0xC5_2_UdDrv+11f7

BUCKET_ID: 0xC5_2_UdDrv+11f7

Followup: MachineOwner
---------

Go to this website for help on your minidump problem.

www.ureader.com/message/1338320.aspx

Thank you!

This is known software problem at undelete. De-install de-install will resolve the problem.