Folks,
We are having an issue that started about a week ago. Our File Server is crashing with a Bug Check 0x00000050. All indications seem to point to the LyncFile.sys driver. I believe this is a component of Lync Software, which I believe is used by Layton Audit Wizard. Basically this software lets you monitor what is happening with the USB ports on Various Clients. It appears it got loaded onto this server and we theorize that a recent Windows Patch may have impacted it. Is anyone else having issues with this?
Here’s the Bug Check Report(MEMORY.DMP):
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: b834c000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b8256ad8, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
——————
*** ERROR: Module load completed but symbols could not be loaded for LyncFile.sys
READ_ADDRESS: b834c000
FAULTING_IP:
LyncFile+8ad8
b8256ad8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 0
IMAGE_NAME: LyncFile.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4885d730
MODULE_NAME: LyncFile
FAULTING_MODULE: b824e000 LyncFile
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 1
TRAP_FRAME: b8db8c0c — (.trap 0xffffffffb8db8c0c)
ErrCode = 00000000
eax=0000f000 ebx=88fc7368 ecx=00002c00 edx=000006bd esi=b834c000 edi=88a9e000
eip=b8256ad8 esp=b8db8c80 ebp=b8db8ca4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
LyncFile+0x8ad8:
b8256ad8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
LAST_CONTROL_TRANSFER: from 808692a4 to 8087c480
STACK_TEXT:
b8db8ba4 808692a4 00000050 b834c000 00000000 nt!KeBugCheckEx+0x1b
b8db8bf4 80836c1a 00000000 b834c000 00000000 nt!MmAccessFault+0x813
b8db8bf4 b8256ad8 00000000 b834c000 00000000 nt!KiTrap0E+0xdc
WARNING: Stack unwind information not available. Following frames may be wrong.
b8db8ca4 b829ef6d 01fc7148 b8348000 0003c000 LyncFile+0x8ad8
b8db8cf8 80840153 89070d58 00fc7148 88fc7148 LyncFile+0x50f6d
b8db8d0c b8c5531a 89541db0 89541d10 895426b0 nt!IofCallDriver+0x45
b8db8d38 b8c9b237 89541d10 89070d58 89c10500 srv!SrvIssueMdlCompleteRequest+0xd0
b8db8d84 b8c5e6c7 00000000 895d3db0 00000000 srv!SrvFsdRestartWriteAndX+0x5ab
b8db8dac 80920833 0079a680 00000000 00000000 srv!WorkerThread+0x138
b8db8ddc 8083fe9f b8c5e602 8979a680 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
LyncFile+8ad8
b8256ad8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: LyncFile+8ad8
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x50_LyncFile+8ad8
BUCKET_ID: 0x50_LyncFile+8ad8
Followup: MachineOwner
———
