Hi, I'm facing this problem, it's been a few weekes and just can't fix. Have this VM, running Win 2k8, with IIS 7, It's an app/web server. Every morning when I log on to the server I got the message: Problem signature: Problem Event Name: BlueScreen OS Version: 6.0.6002.2.2.0.272.7 Locale ID: 1046 Additional information about the problem: BCCode: 27 BCP1: 00000000BAAD0075 BCP2: FFFFFA60052DA838 BCP3: FFFFFA60052DA210 BCP4: FFFFF80001CC3940 OS Version: 6_0_6002 Service Pack: 2_0 Product: 272_3 Files that help describe the problem: C:\Windows\Minidump\Mini061511-02.dmp C:\Users\AppData\Local\Temp\WER-1422718-0.sysdata.xml C:\Users\AppData\Local\Temp\WER42B.tmp.version.txt I tried to analyse the minidump, but impossible for me to understand, really appreciate any help! Thanks in advance!Thanks, Cesar Hara

Bug Check Code 0x27: http://msdn.microsoft.com/en-us/library/ff557446(VS.85).aspx Please use Microsoft Skydrive to upload C:\Windows\Minidump\Mini061511-02.dmp dump file. Once done, post a link here. It is possible that you have to add an additional RAM. You can also contact Microsoft CSS. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator

Hi MR X thanks for helping me out, here is the address to download de dump file: http://download.fde.sp.gov.br/Mini061511-01.zip I uploaded it on my company's web server. Appreciate! Thanks, Cesar Hara

******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: 00000000baad0075 Arg2: fffffa6005698838 Arg3: fffffa6005698210 Arg4: fffff80001884940 Debugging Details: ------------------ EXCEPTION_RECORD: fffffa6005698838 -- (.exr 0xfffffa6005698838) ExceptionAddress: fffff80001884940 (nt!MmMapLockedPagesSpecifyCache+0x0000000000000350) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffffa6005698210 -- (.cxr 0xfffffa6005698210) rax=0000000000000963 rbx=0000000000000963 rcx=fffffa800630ca78 rdx=0000000000000001 rsi=fffffa60069d0090 rdi=fffffa800630ca40 rip=fffff80001884940 rsp=fffffa6005698a70 rbp=fffff6fd30034e80 r8=fffffa8003b9f370 r9=00000000ffe0ff11 r10=0000fffffffff000 r11=0000058000000000 r12=fffef280b2dda500 r13=000000000000096b r14=fffffa800630ca70 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!MmMapLockedPagesSpecifyCache+0x350: fffff800`01884940 410fb64c241a movzx ecx,byte ptr [r12+1Ah] ds:002b:fffef280`b2dda51a=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a41080 ffffffffffffffff FOLLOWUP_IP: mrxsmb20!MRxSmb2BuildSmb2Header+46 fffffa60`042a3e02 488bf0 mov rsi,rax FAULTING_IP: nt!MmMapLockedPagesSpecifyCache+350 fffff800`01884940 410fb64c241a movzx ecx,byte ptr [r12+1Ah] BUGCHECK_STR: 0x27 LAST_CONTROL_TRANSFER: from fffffa60042a3e02 to fffff80001884940 STACK_TEXT: fffffa60`05698a70 fffffa60`042a3e02 : fffffa80`0630ca40 01cc2b54`000069d0 00000000`00000000 00000000`0000001f : nt!MmMapLockedPagesSpecifyCache+0x350 fffffa60`05698b30 fffffa60`042a673e : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0503a040 : mrxsmb20!MRxSmb2BuildSmb2Header+0x46 fffffa60`05698b70 fffffa60`042290c6 : fffffa80`05fac7f0 fffffa80`063274e0 fffffa80`06693401 fffff880`06ab0012 : mrxsmb20!Smb2Write_Restart+0xd2 fffffa60`05698be0 fffffa60`0423748e : fffffa80`05ec9010 fffffa80`063274e0 fffffa80`05fac7f0 fffffa80`05fac7f0 : mrxsmb!SmbCeInitiateExchange+0x4ce fffffa60`05698c50 fffffa60`03d3a2c9 : fffffa60`03d58968 00000000`00000080 fffffa60`03d57110 fffffa80`05ec90c0 : mrxsmb!SmbCepResumeCompoundedExchangesWorker+0xa2 fffffa60`05698ca0 fffff800`01a7ef77 : fffffa60`03d58968 fffffa60`03d58d98 fffffa80`06d66900 00000000`00000000 : rdbss!RxpWorkerThreadDispatcher+0x199 fffffa60`05698d50 fffff800`018b1636 : fffff800`0198d680 fffffa80`057bc4f0 fffff800`01992b80 fffffa80`05f59ca8 : nt!PspSystemThreadStartup+0x57 fffffa60`05698d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: mrxsmb20!MRxSmb2BuildSmb2Header+46 FOLLOWUP_NAME: MachineOwner MODULE_NAME: mrxsmb20 IMAGE_NAME: mrxsmb20.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d5e7f3a STACK_COMMAND: .cxr 0xfffffa6005698210 ; kb FAILURE_BUCKET_ID: X64_0x27_mrxsmb20!MRxSmb2BuildSmb2Header+46 BUCKET_ID: X64_0x27_mrxsmb20!MRxSmb2BuildSmb2Header+46 ------------------------------------------------------ Not big thing to extract. Try adding an additional RAM to the server on which your experienced the problem and check again, This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator

Ok Mr X I'll do that, monitor a couple days and let you know! Thanks again!Thanks, Cesar Hara

Hi, You may try to refer to the following link to download and install the security bulletin MS11-043 to update the version of mrxsmb20.sys file. MS11-043: Vulnerability in SMB Client could allow remote code execution: June 14, 2011 http://support.microsoft.com/kb/2536276 If the issue persists, you may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Arthur tks for the answer, yesterday thi kb was applied and the machine didn't present the issue, I will monitor to see if that resolves, or have to upgrade the ram memory! Thanks!Thanks, Cesar Hara