Windows 7: BSOD on bootup on vmware 5.0 guest SBS Server 2011

saintsgf2013 · 12 Dec 2012

Hi guys

Can you please have a look into the attachments and see if you can see any issues to resolve this major problem

If I log into DRSM I don't get the issue so you think there is a problem with AD however, I have checked the integrity and all looks ok
I have also moved the logs and the database

I disable all services other then M$ and it will boot again, restart the machine several times and still can't get it BSOD

Any help would be much appreciated

bagavan · 12 Dec 2012

Code:

USTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR:  0x1E

PROCESS_NAME:  SavService.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff8800c29d648 -- (.exr 0xfffff8800c29d648)
ExceptionAddress: fffff88004d6403a (mrxsmb10!MRxSmbDeferredCreate+0x000000000000018a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000058
Attempt to read from address 0000000000000058

TRAP_FRAME:  fffff8800c29d6f0 -- (.trap 0xfffff8800c29d6f0)
Unable to read trap frame at fffff880`0c29d6f0

LAST_CONTROL_TRANSFER:  from fffff80002a94bbe to fffff80002a9d190

STACK_TEXT:  
fffff880`0c29c728 fffff800`02a94bbe : 00000000`00000000 fffff880`04d48e50 00000000`00000000 fffff800`02af36cb : nt!KeBugCheck
fffff880`0c29c730 fffff800`02ac7e2d : fffff800`02ca18ec fffff800`02be3f88 fffff800`02a1e000 fffff880`0c29d648 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`0c29c760 fffff800`02ac6c05 : fffff800`02be3f80 fffff880`0c29c7d8 fffff880`0c29d648 fffff800`02a1e000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0c29c790 fffff800`02ad7b81 : fffff880`0c29d648 fffff880`0c29cea0 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
fffff880`0c29ce70 fffff800`02a9c842 : fffff880`0c29d648 fffff8a0`030447a0 fffff880`0c29d6f0 fffff8a0`168a12d0 : nt!KiDispatchException+0x135
fffff880`0c29d510 fffff800`02a9b3ba : 00000000`00000000 00000000`00000058 fffff781`c0000000 fffff8a0`030447a0 : nt!KiExceptionDispatch+0xc2
fffff880`0c29d6f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02a94bbe 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4fa390f3

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------

Uninstall Sophos Anti-Virus

saintsgf2013 · 12 Dec 2012

Hi there

what do you mean uninstall Sophos is the issue savservice.exe I can see that but why
maybe there is an update or something?

so how can I get it to BSOD then

bagavan · 12 Dec 2012

Quote: Originally Posted by saintsgf2013

Hi there

what do you mean uninstall Sophos is the issue savservice.exe I can see that but why
maybe there is an update or something?

so how can I get it to BSOD then

If you can update to the latest version then update it and see if the BSOD persists.

In the BSOD dump report you can see that SavService.exe caused BSOD.

If updating to the latest version does not work then I suggest you to try MSE

saintsgf2013 · 12 Dec 2012

ok thanks
if this is the case why does it not BSOD all the time do you know when and why it's happening??
also is the cause for all the other mini-dumps sent through?

bagavan · 12 Dec 2012

Few of your previous dumps also blame the antivirus.

For example, during disinfection, suppose the antivirus uses memory illegally then it will cause BSOD.

saintsgf2013 · 12 Dec 2012

ok this would be when the server reboots right?
if you notice the dates this is when the server has been rebooting
so are we saying that each time there has been an infection?

bagavan · 12 Dec 2012

I just gave an example when these types of crashes due to antivirus.

No there has been no infection.

Just to be on the safer side perform a full system scan.

saintsgf2013 · 12 Dec 2012

I have done this and there is no sign of infection
just wondering why has it just started happening though seems strange?

bagavan · 12 Dec 2012

Good.

Yes sometimes antivirus can cause BSOD after a couple of weeks after installation.

Windows 7: BSOD on bootup on vmware 5.0 guest SBS Server 2011

BSOD on bootup on vmware 5.0 guest SBS Server 2011 problems?