Windows Forum

Ask something
Question Locked

SBS 2003 Server reboots by Itself

0 helpful
6 replies

by cabmickey

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,
I have a 2003 server that reboots by itself and there is really nothing in the Event log that helps at all. Today it did it twice in one hour. I would appreciate any help you can give me in solving this. Here is the memory.dmp:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: F:\symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sun Oct 28 10:03:38.375 2007 (GMT-4)
System Uptime: 0 days 2:12:59.166
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 27, {baad0080, b865b940, b865b63c, 80959d33}

Page 79b0b not present in the dump file. Type ".hh dbgerr004" for details
Page 79b7c not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details
Probably caused by : mrxdav.sys ( mrxdav!MRxDAVOuterStop+92 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0080
Arg2: b865b940
Arg3: b865b63c
Arg4: 80959d33

Debugging Details:
------------------

Page 79b0b not present in the dump file. Type ".hh dbgerr004" for details
Page 79b7c not present in the dump file. Type ".hh dbgerr004" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffde00c). Type ".hh dbgerr001" for details

EXCEPTION_RECORD: b865b940 -- (.exr 0xffffffffb865b940)
ExceptionAddress: 80959d33 (nt!RtlDestroyHeap+0x00000037)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT: b865b63c -- (.cxr 0xffffffffb865b63c)
eax=b865ba20 ebx=00ea0050 ecx=b9fc3f00 edx=00000000 esi=00000000 edi=00ea0000
eip=80959d33 esp=b865ba08 ebp=b865ba24 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!RtlDestroyHeap+0x37:
80959d33 8b36 mov esi,dword ptr [esi] ds:0023:00000000=????????
Resetting default scope

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

BUGCHECK_STR: 0x27

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

LAST_CONTROL_TRANSFER: from b9fc53dc to 80959d33

STACK_TEXT:
b865ba24 b9fc53dc 00ea0000 00000000 88e08b50 nt!RtlDestroyHeap+0x37
b865ba5c b9fc566c 88e08b50 00000000 88e08b50 mrxdav!MRxDAVOuterStop+0x92
b865ba9c b9fcfb91 01e08b50 b9fceb9a 88d68008 mrxdav!MRxDAVDevFcbXXXControlFile+0x204
b865bab4 b9fcff3d 88e08b50 88d68008 88d6809c mrxdav!RxXXXControlFileCallthru+0x67
b865bad8 b9fbbf72 88e08b50 00000000 88e35888 mrxdav!RxCommonDevFCBFsCtl+0x8d
b865bb68 b9fcf80c b9fc30f0 88d68008 88e35888 mrxdav!RxFsdCommonDispatch+0x320
b865bb88 b9fc8fc4 89b18030 88d68008 89b21020 mrxdav!RxFsdDispatch+0xd4
b865bbfc 8081df65 89b18030 88d68008 88d68008 mrxdav!MRxDAVFsdDispatch+0x1f0
b865bc10 f727c6c1 88d68008 88d68008 8a1a6868 nt!IofCallDriver+0x45
b865bc3c 8081df65 89b21020 88d68008 88e35888 fltmgr!FltpFsControl+0xd7
b865bc50 808f5437 88d6809c 88e35888 88d68008 nt!IofCallDriver+0x45
b865bc64 808f61bf 89b21020 88d68008 88e35888 nt!IopSynchronousServiceTail+0x10b
b865bd00 808eed3c 000002b0 00000000 00000000 nt!IopXxxControlFile+0x5e5
b865bd34 8088978c 000002b0 00000000 00000000 nt!NtFsControlFile+0x2a
b865bd34 7c8285ec 000002b0 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00feff20 00000000 00000000 00000000 00000000 0x7c8285ec

FOLLOWUP_IP:
mrxdav!MRxDAVOuterStop+92
b9fc53dc 6800800000 push 8000h

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: mrxdav!MRxDAVOuterStop+92

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mrxdav

IMAGE_NAME: mrxdav.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45d697b9

STACK_COMMAND: .cxr 0xffffffffb865b63c ; kb

FAILURE_BUCKET_ID: 0x27_mrxdav!MRxDAVOuterStop+92

BUCKET_ID: 0x27_mrxdav!MRxDAVOuterStop+92

Followup: MachineOwner
---------

6 replies

by bart777

Ok,
Has anything been updated recently on the server?

First I would try disabling the virus scanner. I've seen bad updates to DAT files cause the virus scanner to blue screen a box.

Failing that, I would start updating drivers for the hardware.

If that STILL doesn't fix the problem it will be time to look at a possible hardware problem. Could be RAM.

Best of luck.

by cabmickey

Not that I can think of other than maybe a Windows update.

Ok, I will try those things. Thanks for your reply!

by rob miners

really 100% certain on this but there is a problem with mrxdav. This is all that I have been able to find.

There is a batch file here to disable WebDav

http://www.derkeiler.com/Mailing-Lists/securityfocus/focus-ms/2003-03/0062.html

This link seems to be only for XP.
A Stop error in Mrxdav.sys occurs, or your computer restarts, when you try to open a file on a network share on a Microsoft Windows XP Professional-based computer

http://support.microsoft.com/kb/832143

How to check the Version Number

http://www.greenbytes.de/tech/webdav/webdav-redirector-list.html

by nikhilpb

Hi,
I hv windows server 2003 SBS installed on IBM machine.It restarts giving no message,i checked the event view logger but nothing found.Also asked to IBM,they suggested to check with Microsoft.If you have any solutions or can help then please reply me..Thank you in Adv.

by cg it

There was a problem with small business server using gigabit NICs a while back. I believe that updating drivers fixed the problem but the reboots were due to how SBS dealt with jumbo frames.

If you have a gigabit NIC, and a 100 NIC, try using the 100BaseT NIC and see if the problem goes away. If so, then it's the gigabit NIC.

This discussion is closed to new replies.