Windows 2003 Rebooting: Event ID 1003 Category 102

[systemsadmin3000]

My Windows 2003 RS Server (DELL PE 2850) is rebooting automatically at irregular intervals:

Event ID 1003
Category 102

Error code 000000d1, parameter1 00000003, parameter2 00000002, parameter3 00000000, parameter4 f76a9917

I ran a DELL 32Bit diagnostics and all hardware is functional.

Anyone ever encounted this?

 

[captaincrunch00]

This would be my first step:

http://eventid.net/display.asp?eventid=1003&eventno=1274&source=System&phase=1

 

[systemsadmin3000]

I did a bugcheck analysis and came up with the following. Can anyone tell me what it means?

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 00000003, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: f75d9917, address which referenced memory



Debugging Details:

------------------





READ_ADDRESS: 00000003



CURRENT_IRQL: 2



FAULTING_IP:

mvstdi5x+2917

f75d9917 8a16 mov dl,byte ptr [esi]



DEFAULT_BUCKET_ID: DRIVER_FAULT



BUGCHECK_STR: 0xD1



PROCESS_NAME: Idle



TRAP_FRAME: 80899f28 -- (.trap ffffffff80899f28)

ErrCode = 00000000

eax=00000062 ebx=87d116f0 ecx=00000020 edx=00000085 esi=00000003 edi=00000000

eip=f75d9917 esp=80899f9c ebp=80899fa8 iopl=0 nv up ei pl nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206

mvstdi5x+0x2917:

f75d9917 8a16 mov dl,byte ptr [esi] ds:0023:00000003=??

Resetting default scope



LAST_CONTROL_TRANSFER: from f75d9917 to 8088bdd3



STACK_TEXT:

80899f28 f75d9917 badb0d00 00000085 00000002 nt!KiTrap0E+0x2a7

WARNING: Stack unwind information not available. Following frames may be wrong.

80899fa8 f75d916e 00000062 87c76da4 8089a004 mvstdi5x+0x2917

80899fd4 f75d95a6 87d11728 8089a004 8089a008 mvstdi5x+0x216e

80899ff8 f75e0eed 00000085 87c76da4 00000054 mvstdi5x+0x25a6

8089a01c f75dc65b 89b74460 88a422f0 00000a20 mvstdi5x+0x9eed

8089a050 ba956fd2 89b74460 88a422f0 00000a20 mvstdi5x+0x565b

8089a0b4 ba9567ba 88a422f0 00001050 87c76d60 tcpip!IPRcvComplete+0x236e

8089a174 ba954f8f 8a38e8f8 f5f0000a 1df2000a tcpip!IPRcvComplete+0x1b56

8089a1d4 ba96eb49 00000020 8a38e8f8 ba95653d tcpip!IPRcvComplete+0x32b

8089a258 ba96eea6 8a38e8f8 8a38e8f8 87c76d60 tcpip!IPInjectPkt+0x105d

8089a294 ba96f195 8a38e8f8 8a38e8f8 89fef018 tcpip!IPInjectPkt+0x13ba

8089a350 ba954c56 8a38e8f8 89fef02c 0000002c tcpip!IPInjectPkt+0x16a9

8089a390 ba954d58 00000000 8a017120 89fef00a tcpip!IPRcvPacket+0x4e0

8089a3cc baf5d1d9 89d1ae70 00000000 8a0a5008 tcpip!IPRcvComplete+0xf4

8089a420 bae5559e 8a1693f0 8089a460 00000004 NDIS!ethFilterDprIndicateReceivePacket+0x318

8089a570 bae56471 000a5008 8089a59f 8a1693f0 e1000325+0x59e

8089a594 baf5212f 000a5008 ffdffa40 8a0a5460 e1000325+0x1471

8089a5a8 80831cb2 8a0a5460 8a0a544c 00000000 NDIS!ndisMDpcX+0x1f

8089a600 8088d28f 00000000 0000000e 00000000 nt!KiRetireDpcList+0xca

8089a604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37





STACK_COMMAND: kb



FOLLOWUP_IP:

mvstdi5x+2917

f75d9917 8a16 mov dl,byte ptr [esi]



SYMBOL_STACK_INDEX: 1



SYMBOL_NAME: mvstdi5x+2917



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: mvstdi5x



IMAGE_NAME: mvstdi5x.sys



DEBUG_FLR_IMAGE_TIMESTAMP: 41657065



FAILURE_BUCKET_ID: 0xD1_mvstdi5x+2917



BUCKET_ID: 0xD1_mvstdi5x+2917



Followup: MachineOwner

 

[MiniOrganMorgan]

Would appear the device driver mvstdi5x.sys is at fault - a 5 sec Google search would suggest that this is related to a McAfee Anti-Virus firewall driver. Either look for a patch from them or uninstall/disable that funcationality.

 

[systemsadmin3000]

Thanks I found that as well. But we are on the lastest pacth version of McAfee (13). And we do not have McAfee firewall enabled. I'm still researching.

 

[MiniOrganMorgan]

Have you tried removing McAfee? It might not be enabled, but it could still have the device driver being loaded.

 

[systemsadmin3000]

I'll try that. Thanks