BSOD 0xA NetBT

-

since few weeks i've been getting bsod's on production server randomly every couple of days.  memory.dmp contains following :

*******************************************************************************
*                                                                             *
*                        bugcheck analysis                                    *
*                                                                             *
*******************************************************************************

irql_not_less_or_equal (a)
attempt made access pageable (or invalid) address @ an
interrupt request level (irql) high.  usually
caused drivers using improper addresses.
if kernel debugger available stack backtrace.
arguments:
arg1: 5adc860c, memory referenced
arg2: 00000002, irql
arg3: 00000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not execute operation, 1 = execute operation (only on chips support level of status)
arg4: 804395b4, address referenced memory

debugging details:
------------------

the call loadlibrary(kdextx86) failed, win32 error 0n2
    "the system cannot find file specified."
please check debugger configuration and/or network access.
call loadlibrary(kdextx86) failed, win32 error 0n2
    "the system cannot find file specified."
please check debugger configuration and/or network access.
call loadlibrary(kdextx86) failed, win32 error 0n2
    "the system cannot find file specified."
please check debugger configuration and/or network access.

write_address: call loadlibrary(kdextx86) failed, win32 error 0n2
    "the system cannot find file specified."
please check debugger configuration and/or network access.
 5adc860c

current_irql:  2

faulting_ip:
nt!mmunlockpages+ce
804395b4 834f0c01        or      dword ptr [edi+0ch],1

default_bucket_id:  intel_cpu_microcode_zero

bugcheck_str:  0xa

process_name:  system

trap_frame:  b877a80c -- (.trap 0xffffffffb877a80c)
.trap 0xffffffffb877a80c
errcode = 00000002
eax=9a3a6cc0 ebx=00000fff ecx=89092000 edx=00000000 esi=8792d228 edi=5adc8600
eip=804395b4 esp=b877a880 ebp=8792d248 iopl=0         nv ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!mmunlockpages+0xce:
804395b4 834f0c01        or      dword ptr [edi+0ch],1 ds:0023:5adc860c=????????
.trap
resetting default scope

last_control_transfer:  804395b4 8046b1ac

stack_text: 
b877a80c 804395b4 fc6c7900 ffffffff bb6c8672 nt!kitrap0e+0x210
b877a890 8041f1c6 8792d200 00000000 8879bf68 nt!mmunlockpages+0xce
b877a8b4 bfa44234 00000000 87bcd0b7 00000000 nt!iopfcompleterequest+0x1f4
b877a8c8 bfa4c357 8879bfa0 00000000 00000000 netbt!ntiocomplete+0x8c
b877a8f0 bfa4c19c 888b3608 0000000f 88675008 netbt!nbtprocesslmhsvcrequest+0x22b
b877a95c bfa49b9e b877a900 c0000001 87be2978 netbt!nbtconnectcommon+0x9be
b877a988 bfa49253 b877a9f4 bfa22978 87be2978 netbt!nbtconnect+0xf6
b877aa34 bfa44843 88d5d770 88675008 88d5d770 netbt!ntconnect+0x194
b877aa50 8041eecb 88d5d7e0 8867509c 00000000 netbt!nbtdispatchinternalctrl+0xab
b877aa64 bfa6230a 88d5d770 87be2968 00000000 nt!iopfcalldriver+0x35
b877aacc bfa4920f 00000000 87be2978 00000000 netbt!delayednbtprocessconnect+0x2b5
b877ab74 bfa44843 88d5d770 87bc43c8 88d5d770 netbt!ntconnect+0x225
b877ab90 8041eecb 88d5d7e0 87bc445c 88c4f814 netbt!nbtdispatchinternalctrl+0xab
b877aba4 bfa204f3 882c611c 882c6108 00000001 nt!iopfcalldriver+0x35
b877abf4 bfa1c68c 87e761e8 00000003 882c6108 rdbss!rxtdiinitiateasynchronousconnect+0x1aa
b877ac0c bfa32eb3 87e761e8 879dd7b0 87df1968 rdbss!rxceinitiateconnectrequest+0x32
b877acb4 bf9dbcc8 88d5e990 00000000 00000002 rdbss!rxcebuildconnectionovermultipletransports+0x255
b877ad1c bf9b0974 875a9fc8 875a9fec 88d5aea8 mrxsmb!vctinstantiateservertransport+0x23f
b877ad38 bfa1e4c4 875a9fc8 00000000 00000000 mrxsmb!smbceconstructservertransport+0x181
b877ad9c bfa38726 88d5aea8 bfa22e20 804578c2 rdbss!rxpworkerthreaddispatcher+0xb8
b877ada8 804578c2 88d5aea8 00000000 00000000 rdbss!rxworkerthreaddispatcher+0x16
b877addc 8046c966 bfa38710 88d5aea8 00000000 nt!pspsystemthreadstartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!kithreadstartup+0x16


stack_command:  kb

followup_ip:
netbt!ntiocomplete+8c
bfa44234 5f              pop     edi

symbol_stack_index:  3

symbol_name:  netbt!ntiocomplete+8c

followup_name:  machineowner

module_name: netbt

image_name:  netbt.sys

debug_flr_image_timestamp:  424df40c

failure_bucket_id:  0xa_netbt!ntiocomplete+8c

bucket_id:  0xa_netbt!ntiocomplete+8c

followup: machineowner
---------

eax=8905f13c ebx=0000000a ecx=00000001 edx=40000000 esi=804395b4 edi=5adc860c
eip=8046b1ac esp=b877a7f8 ebp=b877a80c iopl=0         nv ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!kitrap0e+0x210:
8046b1ac f7457000000200  test    dword ptr [ebp+70h],20000h ss:0010:b877a87c=82020100
childebp retaddr  args child             
b877a80c 804395b4 fc6c7900 ffffffff bb6c8672 nt!kitrap0e+0x210 (fpo: [0,0] trapframe @ b877a80c)
b877a890 8041f1c6 8792d200 00000000 8879bf68 nt!mmunlockpages+0xce (fpo: [uses ebp] [1,1,4])
b877a8b4 bfa44234 00000000 87bcd0b7 00000000 nt!iopfcompleterequest+0x1f4 (fpo: [uses ebp] [0,3,4])
b877a8c8 bfa4c357 8879bfa0 00000000 00000000 netbt!ntiocomplete+0x8c (fpo: [non-fpo])
b877a8f0 bfa4c19c 888b3608 0000000f 88675008 netbt!nbtprocesslmhsvcrequest+0x22b (fpo: [non-fpo])
b877a95c bfa49b9e b877a900 c0000001 87be2978 netbt!nbtconnectcommon+0x9be (fpo: [non-fpo])
b877a988 bfa49253 b877a9f4 bfa22978 87be2978 netbt!nbtconnect+0xf6 (fpo: [non-fpo])
b877aa34 bfa44843 88d5d770 88675008 88d5d770 netbt!ntconnect+0x194 (fpo: [non-fpo])
b877aa50 8041eecb 88d5d7e0 8867509c 00000000 netbt!nbtdispatchinternalctrl+0xab (fpo: [non-fpo])
b877aa64 bfa6230a 88d5d770 87be2968 00000000 nt!iopfcalldriver+0x35 (fpo: [0,0,2])
b877aacc bfa4920f 00000000 87be2978 00000000 netbt!delayednbtprocessconnect+0x2b5 (fpo: [non-fpo])
b877ab74 bfa44843 88d5d770 87bc43c8 88d5d770 netbt!ntconnect+0x225 (fpo: [non-fpo])
b877ab90 8041eecb 88d5d7e0 87bc445c 88c4f814 netbt!nbtdispatchinternalctrl+0xab (fpo: [non-fpo])
b877aba4 bfa204f3 882c611c 882c6108 00000001 nt!iopfcalldriver+0x35 (fpo: [0,0,2])
b877abf4 bfa1c68c 87e761e8 00000003 882c6108 rdbss!rxtdiinitiateasynchronousconnect+0x1aa (fpo: [non-fpo])
b877ac0c bfa32eb3 87e761e8 879dd7b0 87df1968 rdbss!rxceinitiateconnectrequest+0x32 (fpo: [uses ebp] [1,0,4])
b877acb4 bf9dbcc8 88d5e990 00000000 00000002 rdbss!rxcebuildconnectionovermultipletransports+0x255 (fpo: [non-fpo])
b877ad1c bf9b0974 875a9fc8 875a9fec 88d5aea8 mrxsmb!vctinstantiateservertransport+0x23f (fpo: [non-fpo])
b877ad38 bfa1e4c4 875a9fc8 00000000 00000000 mrxsmb!smbceconstructservertransport+0x181 (fpo: [uses ebp] [1,1,4])
b877ad9c bfa38726 88d5aea8 bfa22e20 804578c2 rdbss!rxpworkerthreaddispatcher+0xb8 (fpo: [non-fpo])
b877ada8 804578c2 88d5aea8 00000000 00000000 rdbss!rxworkerthreaddispatcher+0x16 (fpo: [1,0,0])
b877addc 8046c966 bfa38710 88d5aea8 00000000 nt!pspsystemthreadstartup+0x54 (fpo: [non-fpo])
00000000 00000000 00000000 00000000 00000000 nt!kithreadstartup+0x16

i'm not experienced dump file reader understand netbt seems cause of unexpected crashes.  how should fix problem :

* remove , reinstall netbt ?

* update network card drivers ?

or have other suggestions ?

regards,

joeri michiels

van dijk information consultants

jm

can please let us know the operating system , service pack installed ? problem netbt.sys mentioned above , can solved upgrading network card drivers.

http://www.arabitpro.com



Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

Error: 0x80073701 when trying to add Print Services Role in Windows 2012 Standard

-
hello, i'm getting error when trying add print services role in windows 2012 standard. i'm getting same error whether use gui or powershell. this new server install. the powershell error follows: add-windowsfeature : request add or remove features on specified server failed. installation of 1 or more roles, role services, or features failed. the referenced assembly not found. error: 0x80073701 at line:1 char:1 + add-windowsfeature print-services + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     + categoryinfo          : invalidoperation: (@{vhd=; credent...name=localhost}:psobject) [install-windowsfeature],     exception     + fullyqualifiederrorid : dismapi_error__failed_to_enable_updates,microsoft.windows.servermanager.commands.addwind    owsfeaturecommand success restart needed exit code      feature result ------- ------...
Read more

Windows 2016 RDS event 1306 Connection Broker Client failed to redirect the user... Error: NULL

-
Image
i'm attempting setup windows 2016 rds standard deployment session hosting.  layout follows: rds01 - rds connection broker , web access ts02 - rds session host ts03 - rds session host domain these servers part of has (1) windows 2008 server , (2) windows 2016 servers acting dcs.  domain running @ windows 2003 functional level. servers on single routed network no firewall between them.  dns , ptr records servers exist , resolve on hosts.  servers can pinged each other. in other words, there no network connectivity issues. i've setup rds deployment several times w/ same results. the issue can login via rdweb interface on rds01 win10 desktop , connect published rdp desktop without issue (i.e. no error messages user) , no errors in logs.  when try directly rdp rds01, authenticate user (per event log) error stating user doesn't have access system.  in event log event id 1306 message of "remote desktop connection broker client faile...
Read more

Como saber quien entro a mi PC por la Red

-
quisiera saber si es posible, o existe forma de auditar quien accedió a mi pc vía red, es decir se que hay software que perminten auditar el file server para saber quien entro y modifico y/o borro un archivo... pero si alguien entro mi pc \\pcname\c$ hay forma de determinar que usuario entro al disco c de una pc en especifica y copio, modifico o borro un archivo...   y la otra pregunta cuales son las mejores herramientas para auditar la red y el file server   gracias una forma de detectar quien esta conectado tu pc es través del comando net user entra en cmd y escribes net user eso muestra los usuarios que están conectados en tu equipo en un momento determinado, se que no es lo que pides pero puede servir para descubir alguien en determinado momento. para que no este compartido le dan clic derecho sobre mi pc>propiedades>remoto y le desmarcan donde dice ''permitir que este equipo envíe invitaciones ...
Read more