SBS 2003 BSOD Error

[Rowse]

I'm getting a BSOD on my SBS 2003 machine, the dump from the memory.dmp file is below. Can anyone tell me what this means:

----- 32 bit Kernel Summary Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000ece
DirectoryTableBase 3db36940
PfnDataBase 81600000
PsLoadedModuleList 808a6ea8
PsActiveProcessHead 808ad0c8
MachineImageType 0000014c
NumberProcessors 00000002
BugCheckCode 00000027
BugCheckParameter1 baad0080
BugCheckParameter2 f3299994
BugCheckParameter3 f3299690
BugCheckParameter4 f6544f8a
PaeEnabled 00000001
KdDebuggerDataBlock 808943e0

SUMMARY_DUMP32:
DumpOptions 504d4453
HeaderSize 00009000
BitmapSize 0003df30
Pages 00007308
Bitmap.SizeOfBitMap 0003df30

KiProcessorBlock at 808a6220
2 KiProcessorBlock entries:
ffdff120 f7727120


Windows XP Kernel Version 3790 (Service Pack 1) MP (2 procs) Free x86 compatible
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Nov 18 13:06:43 2005
System Uptime: 0 days 0:39:05
start end module name
80800000 80a53000 nt Checksum: FFFFFFFF Timestamp: unavailable (FFFFFFFE)

Unloaded modules:
f7887000 f788f000 drmkaud.sys Timestamp: Fri Nov 18 12:31:21 2005 (437DC999)
f4398000 f43c8000 kmixer.sys Timestamp: Fri Nov 18 12:31:21 2005 (437DC999)
f43c8000 f43da000 DMusic.sys Timestamp: Fri Nov 18 12:31:21 2005 (437DC999)
f43da000 f43ee000 swmidi.sys Timestamp: Fri Nov 18 12:31:19 2005 (437DC997)
f443e000 f4466000 aec.sys Timestamp: Fri Nov 18 12:31:17 2005 (437DC995)
f5985000 f5987000 splitter.sys Timestamp: Fri Nov 18 12:31:17 2005 (437DC995)
f68d2000 f68e0000 imapi.sys Timestamp: Fri Nov 18 12:27:48 2005 (437DC8C4)
f75f7000 f7603000 vga.sys Timestamp: Fri Nov 18 12:27:48 2005 (437DC8C4)
f77f7000 f77ff000 Sfloppy.SYS Timestamp: Fri Nov 18 12:27:48 2005 (437DC8C4)

Finished dump check

 

[Rowse]

here's the full memory dump:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b85372c0, The address that the exception occurred at
Arg3: b81c4b4c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for avgcll.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for avgcll.dll -

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
afd!AfdExceptionFilter+11
b85372c0 8b00 mov eax,[eax]

TRAP_FRAME: b81c4b4c -- (.trap ffffffffb81c4b4c)
ErrCode = 00000000
eax=0002afd4 ebx=88c231b8 ecx=b81c4c08 edx=9e610003 esi=889e2628 edi=88a34b20
eip=b85372c0 esp=b81c4bc0 ebp=b81c4bc0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
afd!AfdExceptionFilter+0x11:
b85372c0 8b00 mov eax,[eax] ds:0023:0002afd4=????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from b8547f9d to b85372c0

STACK_TEXT:
b81c4bc0 b8547f9d 89f12820 b81c4c08 b853c679 afd!AfdExceptionFilter+0x11
b81c4bcc b853c679 889e2638 b854152f 889e2628 afd!AfdAddressListChange+0x123
b81c4c28 b853c04c 88a34b20 8992ae00 b81c4c4c afd!AfdPoll+0x49e
b81c4c38 8081dce5 89927468 88a34b20 89b8dc38 afd!AfdDispatchDeviceControl+0x53
b81c4c4c 808f4797 88a34bfc 89e6b550 88a34b20 nt!IofCallDriver+0x45
b81c4c60 808f5515 89927468 88a34b20 89e6b550 nt!IopSynchronousServiceTail+0x10b
b81c4d00 808ee0e4 000001ac 0000022c 00000000 nt!IopXxxControlFile+0x5db
b81c4d34 80888c6c 000001ac 0000022c 00000000 nt!NtDeviceIoControlFile+0x2a
b81c4d34 7c82ed54 000001ac 0000022c 00000000 nt!KiFastCallEntry+0xfc
0133fbcc 7c8213e4 71b236e4 000001ac 0000022c ntdll!KiFastSystemCallRet
0133fbd0 71b236e4 000001ac 0000022c 00000000 ntdll!NtDeviceIoControlFile+0xc
0133fcd8 71c0470c 00000040 0133fd50 00000000 mswsock!WSPSelect+0x358
0133fd28 6143180b 00000040 0133fd50 00000000 WS2_32!select+0xb9
WARNING: Stack unwind information not available. Following frames may be wrong.
0133ff84 77bcb530 00e4ced0 00000000 00000000 avgcll!DllUnregisterServer+0x237b6
0133ffb8 77e66063 00c5c018 00000000 00000000 msvcrt!_endthreadex+0xa3
0133ffec 00000000 77bcb4bc 00c5c018 00000000 kernel32!BaseThreadStart+0x34


FOLLOWUP_IP:
afd!AfdExceptionFilter+11
b85372c0 8b00 mov eax,[eax]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: afd!AfdExceptionFilter+11

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435e0b

STACK_COMMAND: .trap ffffffffb81c4b4c ; kb

FAILURE_BUCKET_ID: 0x8E_afd!AfdExceptionFilter+11

BUCKET_ID: 0x8E_afd!AfdExceptionFilter+11

Followup: MachineOwner
---------

 

[SgtBeavis]

I'm afraid you don't understand.

I would actually need the dump itself so I could go deeper that a !analzye.

Also, you might note that once again, you have a different stop code and the stack calls are completely different.

You should seriously consider cutting your losses. Backup and do a bear metal restore. Also, if we are looking at hardware (and I think we are) memory dumps will not always give you root cause but will give you hints. In this case we have seen multiple calls that involve the file system and some calls to the scsi minidriver. IMO, that is where your focus should be.

Good luck

Microsoft Certified Nut.

 

[xmsre]

Above the disk class driver sits either ftdisk or dmio depending on whether it is a basic or dynamic disk. Below that you'll find a monolithic prot driver or a prot/miniport comination. In one of the later dumps I see scsiport.

In the last dump, it's our old friend afd.sys. This is a helper for IP. In the dump I see some device IO file control calls. What devices are connted via IP? I'd look at both the storage and any network printers.

 

[Rowse]

i've replaced the hard disk and it still errored, and nothing was attached to the network.

Any suggestions what to try next?

 

[Jeremy23]

I am experiencing the same problem only it all started with a bad RAID Driver, we took it back to the company that made it and that is what they came back with. It became corrupt.

Since then we haven't used the server, until this past weekend. It's running SBS 2003 Standard Edition. It has an AMD Opteron 1.8G 1Gb DDR 400 RAM on a TYAN Tiger S2875 motherboard.

I did a repair reinstall of the OS, along with some drivers for devices that weren't recognized, such as the Audio driver, the integrated network adapter, and PCI card drivers.

I'm not sure why this server is having so much difficulty because we got another one just like it, same everything, only we were using that one for everything until we got Server 2003 standard edition for our company software. Now, some users can't logon to the software, others the network drives can't be connected. I don't know why.