Hi,
One of windows 2000 Terminal server has crashed with BSOD,
with Bug Check 0x0000001e (0xc0000047, 0x8042f18a, 0x80452b79, 0x00000004)
After analyzing the full memory dump i found that IMAGE_NAME: savrt.sys is causing problem.
savrt.sys is from C:\Program Files\Symantec AntiVirus\
I have attached the debug anaysis below please help me to find a fix for the same.
Thanks
Vatsa
ugCheck 1E, {c0000047, 8042f18a, 80452b79, 4}
*** ERROR: Module load completed but symbols could not be loaded for savrt.sys
Probably caused by : savrt.sys ( savrt+156b7 )
Followup: MachineOwner
———
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000047, The exception code that was not handled
Arg2: 8042f18a, The address that the exception occurred at
Arg3: 80452b79, Parameter 0 of the exception
Arg4: 00000004, Parameter 1 of the exception
Debugging Details:
——————
EXCEPTION_CODE: (NTSTATUS) 0xc0000047 – An attempt was made to release a semaphore such that its maximum count would have been exceeded.
FAULTING_IP:
nt!KeReleaseSemaphore+38
8042f18a 85db test ebx,ebx
EXCEPTION_PARAMETER1: 80452b79
EXCEPTION_PARAMETER2: 00000004
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
EXCEPTION_RECORD: f68632d8 — (.exr 0xfffffffff68632d8)
ExceptionAddress: 8042f18a (nt!KeReleaseSemaphore+0x00000038)
ExceptionCode: c0000047
ExceptionFlags: 00000001
NumberParameters: 0
TRAP_FRAME: f6863254 — (.trap 0xfffffffff6863254)
ESP EDITED! New esp=f6863604
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=00000000 edx=00000000 esi=877dedc8 edi=00000002
eip=8042f18a esp=f68632c8 ebp=f6863618 iopl=0 nv up ei pl zr na pe nc
cs=0000 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeReleaseSemaphore+0x38:
8042f18a 85db test ebx,ebx
Resetting default scope
LAST_CONTROL_TRANSFER: from 804341ee to 804308ea
STACK_TEXT:
f6862eb0 804341ee f68632d8 00000000 f6863254 nt!KiDispatchException+0x30e
f6863224 8046b93f f68632d8 f6863328 00000000 nt!KiRaiseException+0x16c
f6863240 80468389 f68632d8 f6863328 00000001 nt!NtRaiseException+0x33
f6863240 8042f18a f68632d8 f6863328 00000001 nt!KiSystemService+0xc9
f6863618 bf7976b7 877dedc8 00000000 00000001 nt!KeReleaseSemaphore+0x38
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 savrt+0x156b7
STACK_COMMAND: kb
FOLLOWUP_IP:
savrt+156b7
bf7976b7 85ed test ebp,ebp
SYMBOL_STACK_INDEX: 5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: savrt
IMAGE_NAME: savrt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 422cda85
SYMBOL_NAME: savrt+156b7
FAILURE_BUCKET_ID: 0x1E_savrt+156b7
BUCKET_ID: 0x1E_savrt+156b7
Followup: MachineOwner
———