Here is the last minidump Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini081610-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible Product: Server, suite: TerminalServer Built by: 3790.srv03_sp2_gdr.100216-1301 Machine Name: Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 Debug session time: Mon Aug 16 17:30:12.354 2010 (GMT-4) System Uptime: 1 days 1:53:47.348 Loading Kernel Symbols ............................................................... ................................................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck CB, {f5f1a2f2, f5f1b933, 888a0b00, 6} Probably caused by : afd.sys ( afd!AfdAllocateMdlChain+bf ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb) Caused by a driver not cleaning up completely after an I/O. When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. Arguments: Arg1: f5f1a2f2, The calling address in the driver that locked the pages or if the IO manager locked the pages this points to the dispatch routine of the top driver on the stack to which the IRP was sent. Arg2: f5f1b933, The caller of the calling address in the driver that locked the pages. If the IO manager locked the pages this points to the device object of the top driver on the stack to which the IRP was sent. Arg3: 888a0b00, A pointer to the MDL containing the locked pages. Arg4: 00000006, The number of locked pages. Debugging Details: ------------------ FAULTING_IP: afd!AfdAllocateMdlChain+bf f5f1a2f2 8b45dc mov eax,dword ptr [ebp-24h] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP BUGCHECK_STR: 0xCB PROCESS_NAME: java.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 8084cc87 to 80827c83 STACK_TEXT: aed9ec54 8084cc87 000000cb f5f1a2f2 f5f1b933 nt!KeBugCheckEx+0x1b aed9ec84 8094c5c9 ffffff04 88371810 88371a50 nt!MmCleanProcessAddressSpace+0x551 aed9ed0c 8094c71d 00000000 00000000 8831dd88 nt!PspExitThread+0x5f1 aed9ed24 8094c917 88371810 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b aed9ed54 808897cc 00000000 00000000 02fefbf8 nt!NtTerminateProcess+0x125 aed9ed54 7c82860c 00000000 00000000 02fefbf8 nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 02fefbf8 00000000 00000000 00000000 00000000 0x7c82860c STACK_COMMAND: .bugcheck ; kb FOLLOWUP_IP: afd!AfdAllocateMdlChain+bf f5f1a2f2 8b45dc mov eax,dword ptr [ebp-24h] SYMBOL_NAME: afd!AfdAllocateMdlChain+bf FOLLOWUP_NAME: MachineOwner MODULE_NAME: afd IMAGE_NAME: afd.sys DEBUG_FLR_IMAGE_TIMESTAMP: 48a40d20 FAILURE_BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf Followup: MachineOwner --------- 0: kd> lmvm afd start end module name f5f0b000 f5f35000 afd (pdb symbols) c:\websymbols\afd.pdb\58290F5DE8594177A0C88B7AD053A8C32\afd.pdb Loaded symbol image file: afd.sys Mapped memory image file: c:\websymbols\afd.sys\48A40D202a000\afd.sys Image path: \SystemRoot\System32\drivers\afd.sys Image name: afd.sys Timestamp: Thu Aug 14 06:46:56 2008 (48A40D20) CheckSum: 00029DE7 ImageSize: 0002A000 File version: 5.2.3790.4355 Product version: 5.2.3790.4355 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: afd.sys OriginalFilename: afd.sys ProductVersion: 5.2.3790.4355 FileVersion: 5.2.3790.4355 (srv03_sp2_gdr.080814-1204) FileDescription: Ancillary Function Driver for WinSock LegalCopyright: © Microsoft Corporation. All rights reserved.

These ones may help. Bug Check 0xCB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS http://msdn.microsoft.com/en-us/library/ff560212(VS.85).aspx The version of AFD.SYS that is released together with security update 953230 (MS08-037) and security update 956803 (MS08-066) has an application compatibility issue http://support.microsoft.com/kb/958752 Regards, Dave Patrick .... Microsoft Certified Professional -Microsoft MVP [Windows]

Hi, Please understand that to troubleshoot the blue screen issues, we usually need to perform debugging. However, in this forum, we do not provide debugging support. If you would like to perform debugging, please contact Microsoft Customer Support Service (CSS). To obtain the phone numbers for specific technology request, please refer to the website listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US, please refer to http://support.microsoft.com for regional support phone numbers. Tim Quan