Windows Xp Reboot alone

G

Guest

Guest
Hi,



One of our computer restart alone .



This computer is part of a windows 2003 domain .



This is the result of the minidump :



EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

referenced memory at "0x%08lx". The memory could not be "%s".



FAULTING_IP:

mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]



EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)

ExceptionAddress: a8cf58b7

(mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000038

Attempt to read from address 00000038



CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)

eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008

edi=000000b4

eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng nz ac pe

nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000

efl=00010296

mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:

a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

ds:0023:00000038=????????

Resetting default scope



CUSTOMER_CRASH_COUNT: 1



PROCESS_NAME: System



ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced

memory at "0x%08lx". The memory could not be "%s".



EXCEPTION_PARAMETER1: 00000000



EXCEPTION_PARAMETER2: 00000038



READ_ADDRESS: 00000038



FOLLOWUP_IP:

mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]



BUGCHECK_STR: 0x7E



DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE



LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7



STACK_TEXT:

a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34

mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16

a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c

mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9

a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40

a7f7bd6c a8d624b1 00000000 00000000 8905d020

mrxsmb!SmbCeDiscardTransactExchange+0x15a

a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc

rdbss!RxpWorkerThreadDispatcher+0x93

a7f7bdac 805cff64 a8d6bfc0 00000000 00000000

rdbss!RxWorkerThreadDispatcher+0x1a

a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16





SYMBOL_STACK_INDEX: 0



SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: mrxsmb



IMAGE_NAME: mrxsmb.sys



DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a



STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb



FAILURE_BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16



BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16



Followup: MachineOwner







Could You help me.



Best Regards



M Gerard
 
altheys@noemail.noemail wrote:



> One of our computer restart alone .

>

> This computer is part of a windows 2003 domain .

>

> This is the result of the minidump :

>

> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

> referenced memory at "0x%08lx". The memory could not be "%s".

>

> FAULTING_IP:

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

>

> EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)

> ExceptionAddress: a8cf58b7

> (mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)

> ExceptionCode: c0000005 (Access violation)

> ExceptionFlags: 00000000

> NumberParameters: 2

> Parameter[0]: 00000000

> Parameter[1]: 00000038

> Attempt to read from address 00000038

>

> CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)

> eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008

> edi=000000b4

> eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng

> nz ac pe nc

> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000

> efl=00010296

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

> ds:0023:00000038=????????

> Resetting default scope

>

> CUSTOMER_CRASH_COUNT: 1

>

> PROCESS_NAME: System

>

> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

> referenced memory at "0x%08lx". The memory could not be "%s".

>

> EXCEPTION_PARAMETER1: 00000000

>

> EXCEPTION_PARAMETER2: 00000038

>

> READ_ADDRESS: 00000038

>

> FOLLOWUP_IP:

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

>

> BUGCHECK_STR: 0x7E

>

> DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

>

> LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7

>

> STACK_TEXT:

> a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16

> a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c

> mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9

> a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40

> a7f7bd6c a8d624b1 00000000 00000000 8905d020

> mrxsmb!SmbCeDiscardTransactExchange+0x15a

> a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc

> rdbss!RxpWorkerThreadDispatcher+0x93

> a7f7bdac 805cff64 a8d6bfc0 00000000 00000000

> rdbss!RxWorkerThreadDispatcher+0x1a

> a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000

> nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000

> 00000000 nt!KiThreadStartup+0x16

>

> SYMBOL_STACK_INDEX: 0

>

> SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

>

> FOLLOWUP_NAME: MachineOwner

>

> MODULE_NAME: mrxsmb

>

> IMAGE_NAME: mrxsmb.sys

>

> DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a

>

> STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb

>

> FAILURE_BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

> BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

>

> Followup: MachineOwner

>

>

>

> Could You help me.



Tested the memory?

Tested the hard disk drive (and everything between it and the controller (in

fact - include the controller?)



Update the hardware drivers from the hardware manufacturer's support web

page(s).

Checked for spyware/adware?

Checked for viruses/trojans/worms?

Checked for rootkits?



Changed what programs run all the time?



Machine up to date?



What exact OS is the machine? Service Pack level? Antivirus application in

use? Antimalware application(s) used? How often do you defragment? How

often do you use CHKDSK? What are your backups like?



--

Shenan Stanley

MS-MVP

--

How To Ask Questions The Smart Way

http://www.catb.org/~esr/faqs/smart-questions.html
 
Bug Check 0x5: INVALID_PROCESS_ATTACH_ATTEMPT:

http://msdn.microsoft.com/en-us/library/ff559087(VS.85).aspx



altheys@noemail.noemail wrote:

> Hi,

>

> One of our computer restart alone .

>

> This computer is part of a windows 2003 domain .

>

> This is the result of the minidump :

>

> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

> referenced memory at "0x%08lx". The memory could not be "%s".

>

> FAULTING_IP:

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

>

> EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)

> ExceptionAddress: a8cf58b7

> (mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)

> ExceptionCode: c0000005 (Access violation)

> ExceptionFlags: 00000000

> NumberParameters: 2

> Parameter[0]: 00000000

> Parameter[1]: 00000038

> Attempt to read from address 00000038

>

> CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)

> eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008

> edi=000000b4

> eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng nz ac pe

> nc

> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000

> efl=00010296

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

> ds:0023:00000038=????????

> Resetting default scope

>

> CUSTOMER_CRASH_COUNT: 1

>

> PROCESS_NAME: System

>

> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

> referenced

> memory at "0x%08lx". The memory could not be "%s".

>

> EXCEPTION_PARAMETER1: 00000000

>

> EXCEPTION_PARAMETER2: 00000038

>

> READ_ADDRESS: 00000038

>

> FOLLOWUP_IP:

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

>

> BUGCHECK_STR: 0x7E

>

> DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

>

> LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7

>

> STACK_TEXT:

> a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34

> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16

> a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c

> mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9

> a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40

> a7f7bd6c a8d624b1 00000000 00000000 8905d020

> mrxsmb!SmbCeDiscardTransactExchange+0x15a

> a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc

> rdbss!RxpWorkerThreadDispatcher+0x93

> a7f7bdac 805cff64 a8d6bfc0 00000000 00000000

> rdbss!RxWorkerThreadDispatcher+0x1a

> a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000

> nt!PspSystemThreadStartup+0x34

> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

>

>

> SYMBOL_STACK_INDEX: 0

>

> SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

>

> FOLLOWUP_NAME: MachineOwner

>

> MODULE_NAME: mrxsmb

>

> IMAGE_NAME: mrxsmb.sys

>

> DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a

>

> STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb

>

> FAILURE_BUCKET_ID:

> 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

>

> BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

>

> Followup: MachineOwner

>

>

>

> Could You help me.

>

> Best Regards

>

> M Gerard
 
Back
Top