server reboots periodically - BugCheck 50

  • Thread starter Thread starter mspublikforum
  • Start date Start date
M

mspublikforum

The server reboots periodically with the blue screen.
The hardware tests using the tools provided by the manufacturer have not
reviled any problematic component.

The minidump analyze gives the following:




Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Aug 5 14:28:02.173 2009 (GMT+1)
System Uptime: not available
Loading Kernel Symbol
....................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fe7ba000, 0, 80464569, 0}

*** ERROR: Module load completed but symbols could not be loaded for FAL.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for
SPBBCDrv.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for
win32k.sys
Probably caused by : FAL.sys ( FAL+f52 )

Followup: MachineOwner
---------

2: kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: fe7ba000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80464569, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: unable to read from 80485bd8
unable to read from 80485868
unable to read from 80485748
unable to read from 80477478
unable to read from 80485760
unable to read from 80485864
unable to read from 8047747c
unable to read from 80485924
unable to read from 80485b78
fe7ba000

FAULTING_IP:
nt!wcslen+d
80464569 668b10 mov dx,word ptr [eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

TRAP_FRAME: be552260 -- (.trap 0xffffffffbe552260)
ErrCode = 00000000
eax=fe7ba000 ebx=fe7b9008 ecx=fe7b9008 edx=e96b5926 esi=be552418 edi=00000042
eip=80464569 esp=be5522d4 ebp=be5522f4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!wcslen+0xd:
80464569 668b10 mov dx,word ptr [eax]
ds:0023:fe7ba000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8046b063 to 8044c796

STACK_TEXT:
be552248 8046b063 00000000 fe7ba000 00000000 nt!MmAccessFault+0x7dc
be552248 80464569 00000000 fe7ba000 00000000 nt!KiTrap0E+0xc7
be5522d0 f66a0f52 fe7b9008 fe7b9008 e96bc00c nt!wcslen+0xd
WARNING: Stack unwind information not available. Following frames may be
wrong.
be5522f4 f66a146b be552418 fe7b9008 fe7ea488 FAL+0xf52
be55235c 80468389 be552438 00100080 be552418 FAL+0x146b
be55235c 80431acb be552438 00100080 be552418 nt!KiSystemService+0xc9
be5523ec bf2262ca be552438 00100080 be552418 nt!ZwOpenFile+0xb
be55243c bf226963 be552460 be552468 be552474 SPBBCDrv+0x32ca
be55247c bf23553a e9690de8 e2ed8268 00000002 SPBBCDrv+0x3963
be5524b8 bf23f645 be552590 00000005 00000006 SPBBCDrv+0x1253a
be5524e8 bf23f376 be5525e0 e97792a8 00000000 SPBBCDrv+0x1c645
be552520 bf230e5d 00000000 be5525e0 e2bcc008 SPBBCDrv+0x1c376
be552588 80415801 bf272db0 be552654 e2ed8268 SPBBCDrv+0xde5d
be552627 eeb82088 236b6de2 552654bf 6b9b68be nt!ExReleaseResourceLite+0xbb
be55262b 236b6de2 552654bf 6b9b68be 41df48e9 0xeeb82088
be55262f 552654bf 6b9b68be 41df48e9 55268488 0x236b6de2
be552633 6b9b68be 41df48e9 55268488 000001be 0x552654bf
be552637 41df48e9 55268488 000001be 2360d700 0x6b9b68be
be55263b 55268488 000001be 2360d700 552654bf 0x41df48e9
be55263f 00000000 2360d700 552654bf 497fe8be 0x55268488


STACK_COMMAND: kb

FOLLOWUP_IP:
FAL+f52
f66a0f52 d1e0 shl eax,1

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: FAL+f52

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: FAL

IMAGE_NAME: FAL.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e483350

FAILURE_BUCKET_ID: 0x50_FAL+f52

BUCKET_ID: 0x50_FAL+f52

Followup: MachineOwner

Thanks in advance.
 
The message says that it's probably caused by FAL.sys, a search on the
net returns little information or nothing useful about the file or
driver. Can you find this file on your server and is there any relevant
information about the file in its properties?

John
The server reboots periodically with the blue screen.
The hardware tests using the tools provided by the manufacturer have not
reviled any problematic component.

The minidump analyze gives the following:




Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Aug 5 14:28:02.173 2009 (GMT+1)
System Uptime: not available
Loading Kernel Symbols
...................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fe7ba000, 0, 80464569, 0}

*** ERROR: Module load completed but symbols could not be loaded for FAL.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for
SPBBCDrv.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for
win32k.sys
Probably caused by : FAL.sys ( FAL+f52 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: fe7ba000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80464569, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: unable to read from 80485bd8
unable to read from 80485868
unable to read from 80485748
unable to read from 80477478
unable to read from 80485760
unable to read from 80485864
unable to read from 8047747c
unable to read from 80485924
unable to read from 80485b78
fe7ba000

FAULTING_IP:
nt!wcslen+d
80464569 668b10 mov dx,word ptr [eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

TRAP_FRAME: be552260 -- (.trap 0xffffffffbe552260)
ErrCode = 00000000
eax=fe7ba000 ebx=fe7b9008 ecx=fe7b9008 edx=e96b5926 esi=be552418 edi=00000042
eip=80464569 esp=be5522d4 ebp=be5522f4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!wcslen+0xd:
80464569 668b10 mov dx,word ptr [eax]
ds:0023:fe7ba000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8046b063 to 8044c796

STACK_TEXT:
be552248 8046b063 00000000 fe7ba000 00000000 nt!MmAccessFault+0x7dc
be552248 80464569 00000000 fe7ba000 00000000 nt!KiTrap0E+0xc7
be5522d0 f66a0f52 fe7b9008 fe7b9008 e96bc00c nt!wcslen+0xd
WARNING: Stack unwind information not available. Following frames may be
wrong.
be5522f4 f66a146b be552418 fe7b9008 fe7ea488 FAL+0xf52
be55235c 80468389 be552438 00100080 be552418 FAL+0x146b
be55235c 80431acb be552438 00100080 be552418 nt!KiSystemService+0xc9
be5523ec bf2262ca be552438 00100080 be552418 nt!ZwOpenFile+0xb
be55243c bf226963 be552460 be552468 be552474 SPBBCDrv+0x32ca
be55247c bf23553a e9690de8 e2ed8268 00000002 SPBBCDrv+0x3963
be5524b8 bf23f645 be552590 00000005 00000006 SPBBCDrv+0x1253a
be5524e8 bf23f376 be5525e0 e97792a8 00000000 SPBBCDrv+0x1c645
be552520 bf230e5d 00000000 be5525e0 e2bcc008 SPBBCDrv+0x1c376
be552588 80415801 bf272db0 be552654 e2ed8268 SPBBCDrv+0xde5d
be552627 eeb82088 236b6de2 552654bf 6b9b68be nt!ExReleaseResourceLite+0xbb
be55262b 236b6de2 552654bf 6b9b68be 41df48e9 0xeeb82088
be55262f 552654bf 6b9b68be 41df48e9 55268488 0x236b6de2
be552633 6b9b68be 41df48e9 55268488 000001be 0x552654bf
be552637 41df48e9 55268488 000001be 2360d700 0x6b9b68be
be55263b 55268488 000001be 2360d700 552654bf 0x41df48e9
be55263f 00000000 2360d700 552654bf 497fe8be 0x55268488


STACK_COMMAND: kb

FOLLOWUP_IP:
FAL+f52
f66a0f52 d1e0 shl eax,1

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: FAL+f52

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: FAL

IMAGE_NAME: FAL.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e483350

FAILURE_BUCKET_ID: 0x50_FAL+f52

BUCKET_ID: 0x50_FAL+f52

Followup: MachineOwner

Thanks in advance.
Click to expand...
 
Hi John,

Thanks for the reply.
I was suspecting the same driver.

It belongs to an old Legato Networker Disaster Recovery module.
The module was never really used except some testing, but was not properly
uninstalled. There is no uninstaller left, so the only way is to remove the
file physically/ delete it.


Let see if this works.

John John - MVP said:
The message says that it's probably caused by FAL.sys, a search on the
net returns little information or nothing useful about the file or
driver. Can you find this file on your server and is there any relevant
information about the file in its properties?

John
The server reboots periodically with the blue screen.
The hardware tests using the tools provided by the manufacturer have not
reviled any problematic component.

The minidump analyze gives the following:




Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Aug 5 14:28:02.173 2009 (GMT+1)
System Uptime: not available
Loading Kernel Symbols
...................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fe7ba000, 0, 80464569, 0}

*** ERROR: Module load completed but symbols could not be loaded for FAL.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for
SPBBCDrv.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for
win32k.sys
Probably caused by : FAL.sys ( FAL+f52 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: fe7ba000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80464569, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: unable to read from 80485bd8
unable to read from 80485868
unable to read from 80485748
unable to read from 80477478
unable to read from 80485760
unable to read from 80485864
unable to read from 8047747c
unable to read from 80485924
unable to read from 80485b78
fe7ba000

FAULTING_IP:
nt!wcslen+d
80464569 668b10 mov dx,word ptr [eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

TRAP_FRAME: be552260 -- (.trap 0xffffffffbe552260)
ErrCode = 00000000
eax=fe7ba000 ebx=fe7b9008 ecx=fe7b9008 edx=e96b5926 esi=be552418 edi=00000042
eip=80464569 esp=be5522d4 ebp=be5522f4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!wcslen+0xd:
80464569 668b10 mov dx,word ptr [eax]
ds:0023:fe7ba000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8046b063 to 8044c796

STACK_TEXT:
be552248 8046b063 00000000 fe7ba000 00000000 nt!MmAccessFault+0x7dc
be552248 80464569 00000000 fe7ba000 00000000 nt!KiTrap0E+0xc7
be5522d0 f66a0f52 fe7b9008 fe7b9008 e96bc00c nt!wcslen+0xd
WARNING: Stack unwind information not available. Following frames may be
wrong.
be5522f4 f66a146b be552418 fe7b9008 fe7ea488 FAL+0xf52
be55235c 80468389 be552438 00100080 be552418 FAL+0x146b
be55235c 80431acb be552438 00100080 be552418 nt!KiSystemService+0xc9
be5523ec bf2262ca be552438 00100080 be552418 nt!ZwOpenFile+0xb
be55243c bf226963 be552460 be552468 be552474 SPBBCDrv+0x32ca
be55247c bf23553a e9690de8 e2ed8268 00000002 SPBBCDrv+0x3963
be5524b8 bf23f645 be552590 00000005 00000006 SPBBCDrv+0x1253a
be5524e8 bf23f376 be5525e0 e97792a8 00000000 SPBBCDrv+0x1c645
be552520 bf230e5d 00000000 be5525e0 e2bcc008 SPBBCDrv+0x1c376
be552588 80415801 bf272db0 be552654 e2ed8268 SPBBCDrv+0xde5d
be552627 eeb82088 236b6de2 552654bf 6b9b68be nt!ExReleaseResourceLite+0xbb
be55262b 236b6de2 552654bf 6b9b68be 41df48e9 0xeeb82088
be55262f 552654bf 6b9b68be 41df48e9 55268488 0x236b6de2
be552633 6b9b68be 41df48e9 55268488 000001be 0x552654bf
be552637 41df48e9 55268488 000001be 2360d700 0x6b9b68be
be55263b 55268488 000001be 2360d700 552654bf 0x41df48e9
be55263f 00000000 2360d700 552654bf 497fe8be 0x55268488


STACK_COMMAND: kb

FOLLOWUP_IP:
FAL+f52
f66a0f52 d1e0 shl eax,1

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: FAL+f52

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: FAL

IMAGE_NAME: FAL.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e483350

FAILURE_BUCKET_ID: 0x50_FAL+f52

BUCKET_ID: 0x50_FAL+f52

Followup: MachineOwner

Thanks in advance.
Click to expand...
Click to expand...
 
You should see if you can disable it via the Services management console
or with the SC Config tool, or remove it from its location in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key. You should
also check to make sure that it isn't a phantom device, if you see it as
a phantom remove it:

http://support.microsoft.com/kb/241257/EN-US/
Device Manager Does Not Display Devices Not Currently Present in Windows
2000

John
Hi John,

Thanks for the reply.
I was suspecting the same driver.

It belongs to an old Legato Networker Disaster Recovery module.
The module was never really used except some testing, but was not properly
uninstalled. There is no uninstaller left, so the only way is to remove the
file physically/ delete it.


Let see if this works.

John John - MVP said:
The message says that it's probably caused by FAL.sys, a search on the
net returns little information or nothing useful about the file or
driver. Can you find this file on your server and is there any relevant
information about the file in its properties?

John
The server reboots periodically with the blue screen.
The hardware tests using the tools provided by the manufacturer have not
reviled any problematic component.

The minidump analyze gives the following:




Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Aug 5 14:28:02.173 2009 (GMT+1)
System Uptime: not available
Loading Kernel Symbols
...................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fe7ba000, 0, 80464569, 0}

*** ERROR: Module load completed but symbols could not be loaded for FAL.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for SPBBCDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for
SPBBCDrv.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for
win32k.sys
Probably caused by : FAL.sys ( FAL+f52 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: fe7ba000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80464569, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: unable to read from 80485bd8
unable to read from 80485868
unable to read from 80485748
unable to read from 80477478
unable to read from 80485760
unable to read from 80485864
unable to read from 8047747c
unable to read from 80485924
unable to read from 80485b78
fe7ba000

FAULTING_IP:
nt!wcslen+d
80464569 668b10 mov dx,word ptr [eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

TRAP_FRAME: be552260 -- (.trap 0xffffffffbe552260)
ErrCode = 00000000
eax=fe7ba000 ebx=fe7b9008 ecx=fe7b9008 edx=e96b5926 esi=be552418 edi=00000042
eip=80464569 esp=be5522d4 ebp=be5522f4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!wcslen+0xd:
80464569 668b10 mov dx,word ptr [eax]
ds:0023:fe7ba000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8046b063 to 8044c796

STACK_TEXT:
be552248 8046b063 00000000 fe7ba000 00000000 nt!MmAccessFault+0x7dc
be552248 80464569 00000000 fe7ba000 00000000 nt!KiTrap0E+0xc7
be5522d0 f66a0f52 fe7b9008 fe7b9008 e96bc00c nt!wcslen+0xd
WARNING: Stack unwind information not available. Following frames may be
wrong.
be5522f4 f66a146b be552418 fe7b9008 fe7ea488 FAL+0xf52
be55235c 80468389 be552438 00100080 be552418 FAL+0x146b
be55235c 80431acb be552438 00100080 be552418 nt!KiSystemService+0xc9
be5523ec bf2262ca be552438 00100080 be552418 nt!ZwOpenFile+0xb
be55243c bf226963 be552460 be552468 be552474 SPBBCDrv+0x32ca
be55247c bf23553a e9690de8 e2ed8268 00000002 SPBBCDrv+0x3963
be5524b8 bf23f645 be552590 00000005 00000006 SPBBCDrv+0x1253a
be5524e8 bf23f376 be5525e0 e97792a8 00000000 SPBBCDrv+0x1c645
be552520 bf230e5d 00000000 be5525e0 e2bcc008 SPBBCDrv+0x1c376
be552588 80415801 bf272db0 be552654 e2ed8268 SPBBCDrv+0xde5d
be552627 eeb82088 236b6de2 552654bf 6b9b68be nt!ExReleaseResourceLite+0xbb
be55262b 236b6de2 552654bf 6b9b68be 41df48e9 0xeeb82088
be55262f 552654bf 6b9b68be 41df48e9 55268488 0x236b6de2
be552633 6b9b68be 41df48e9 55268488 000001be 0x552654bf
be552637 41df48e9 55268488 000001be 2360d700 0x6b9b68be
be55263b 55268488 000001be 2360d700 552654bf 0x41df48e9
be55263f 00000000 2360d700 552654bf 497fe8be 0x55268488


STACK_COMMAND: kb

FOLLOWUP_IP:
FAL+f52
f66a0f52 d1e0 shl eax,1

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: FAL+f52

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: FAL

IMAGE_NAME: FAL.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e483350

FAILURE_BUCKET_ID: 0x50_FAL+f52

BUCKET_ID: 0x50_FAL+f52

Followup: MachineOwner

Thanks in advance.
Click to expand...
Click to expand...
Click to expand...
 
Back
Top