Event ID 1076

[bryanvine]

Hello everyone, I'm seeing the same issue as another user reported here: www . techspot . com/vb/topic37299.html

The SBS 2003 server is a VM which is bluescreening on a regular basis. It's hosted on a HyperV box which is backed up by DPM. I'm pretty sure DPM is the culprit since the timing of the BSODs are right as express full backups run. I've attached a mini-dump, please if you have any insights, I'd appreciate it:

Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 10/12/2009
Time: 8:24:47 AM
User: ***********
Computer: ***********
Description:
The reason supplied by user ******* for the last unexpected shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x0000000a (0xb07efefc, 0xd0000002, 0x00000000, 0x8086bce6)
Comment: 0x0000000a (0xb07efefc, 0xd0000002, 0x00000000, 0x8086bce6)

Data:
0000: 0f 00 05 08 ....

 

[bryanvine]

BTW, because I'm a new member, I can't post links, so you'll have to remove the spaces in the link above to the closed forum post.

 

[bryanvine]

I'm trying to up my postcount++

 

[bryanvine]

two more posts until I can post links....

 

[bryanvine]

Last one.... then I can finally post links.....

 

[bryanvine]

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
Probably caused by : ntkrpamp.exe ( nt!KiSystemFatalException+f )

Followup: MachineOwner
---------

 

[bryanvine]

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL: 1b

LAST_CONTROL_TRANSFER: from 8088dd11 to 8088d0f7

STACK_TEXT:
8089a588 8088dd11 badb0d00 80010031 00000016 nt!KiSystemFatalException+0xf
8089a600 8088debb 00000000 0000000e 00000000 nt!SwapContext+0x111
8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xa3


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiSystemFatalException+f
8088d0f7 c3 ret

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiSystemFatalException+f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49c21e56

FAILURE_BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+f

BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+f

Followup: MachineOwner
---------

 

[Route44]

Your error is 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
One of three types of problems occurred in kernel-mode: (1) Hardware failures. (2) Software problems. (3) A bound trap (i.e., a condition that the kernel is not allowed to have or intercept). Hardware failures are the most common cause and, of these, memory hardware failures are the most common.

As you can tell the cause can be quite broad.


The core Windows driver ntkrpamp.exe is the cause by blocking another Windows driver mssmbios.sys which is the process System Management BIOS Driver belonging to the software Microsoft System Management BIOS Driver.

1. You may need to do a Windows repair.

2. Before a repair try running Memtest on your RAM for a minimum of 7 Passes.

 

[bryanvine]

Thanks Route44!

The SBS 2003 is actually a VM on a HyperV 2008 server which has been running fine and doesn't crash when this VM does. A ram test has already been ran and the installation of the OS is rather recent.

I'll take a snapshot of the VM and run a windows repair tonight outside of business hours.