We got blue screen of one of Windows 2003 SP2. It shows the problem caused by ntkrnlmp.exe, but we cannot find the root cause. Anyone could help? Thx ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 8E, {c0000005, 8092b7e0, abc24c84, 0} *** WARNING: Unable to verify timestamp for mssmbios.sys *** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 1 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 2 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 3 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 1 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 2 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 3 PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+16 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 8092b7e0, The address that the exception occurred at Arg3: abc24c84, Trap Frame Arg4: 00000000 Debugging Details: ------------------ GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 1 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 2 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 3 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 1 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 2 GetContextState failed, 0x80070026 Unable to read selector for PCR for processor 3 PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: nt!ObpCloseHandleTableEntry+16 8092b7e0 8b80a8000000 mov eax,dword ptr [eax+0A8h] TRAP_FRAME: abc24c84 -- (.trap 0xffffffffabc24c84) ErrCode = 00000000 eax=00000000 ebx=e3fe3410 ecx=00000000 edx=86000169 esi=86000168 edi=e1d9d090 eip=8092b7e0 esp=abc24cf8 ebp=abc24d04 iopl=0 nv up ei ng nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282 nt!ObpCloseHandleTableEntry+0x16: 8092b7e0 8b80a8000000 mov eax,dword ptr [eax+0A8h] ds:0023:000000a8=???????? Resetting default scope DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: w3wp.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 8085bba7 to 8087c480 STACK_TEXT: abc24850 8085bba7 0000008e c0000005 8092b7e0 nt!KeBugCheckEx+0x1b abc24c14 808346b4 abc24c30 00000000 abc24c84 nt!KiDispatchException+0x3a2 abc24c7c 80834668 abc24d04 8092b7e0 badb0d00 nt!CommonDispatchException+0x4a abc24c98 8092991a 85d2b2e8 e16d6553 89b95900 nt!Kei386EoiHelper+0x186 abc24d04 8092b776 e3fe3410 e1d9d090 00002848 nt!ObpFreeObject+0x192 abc24d48 8092b7c1 00002848 00000001 abc24d64 nt!ObpCloseHandle+0x82 abc24d58 80833bdf 00002848 0006fd04 7c8285ec nt!NtClose+0x1b abc24d58 7c8285ec 00002848 0006fd04 7c8285ec nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 0006fcf4 7c826d2b 77e63eb3 00002848 0006fd3c 0x7c8285ec 0006fd04 72e82199 00002848 0e1088e8 72eb5af9 0x7c826d2b 0006fd3c 72e9d2e2 0006fd5c 0006fd68 7c81a352 0x72e82199 0006fd48 7c81a352 72e50000 00000000 00000001 0x72e9d2e2 0006fd68 7c830e70 72e6946e 72e50000 00000000 0x7c81a352 0006fe20 77e668a3 00000000 00000001 7ffd4000 0x7c830e70 0006ff0c 77e66905 fffffffe 77e8f3b0 ffffffff 0x77e668a3 0006ff20 77bcade4 fffffffe 0006ff5c 77bcaefc 0x77e66905 0006ff2c 77bcaefc fffffffe 00000000 fffffffe 0x77bcade4 0006ff5c 77bcaf52 fffffffe 00000000 00000000 0x77bcaefc 0006ff70 01001a3c fffffffe 00000000 00000000 0x77bcaf52 0006ffc0 77e6f23b 00000000 00000000 7ffd4000 0x1001a3c 0006fff0 00000000 010018f8 00000000 78746341 0x77e6f23b STACK_COMMAND: kb FOLLOWUP_IP: nt!ObpCloseHandleTableEntry+16 8092b7e0 8b80a8000000 mov eax,dword ptr [eax+0A8h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!ObpCloseHandleTableEntry+16 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45ec14ca FAILURE_BUCKET_ID: 0x8E_nt!ObpCloseHandleTableEntry+16 BUCKET_ID: 0x8E_nt!ObpCloseHandleTableEntry+16 Followup: MachineOwner ---------

It looks to be related to IIS (w3wp.exe). It looks like it had a problem closing a file, I'd start by verifying the BIOS, storage drivers, network drivers, and firmware are up to date.http://www.virmansec.com/blogs/skhairuddin

Hi, Please understand that to troubleshoot the blue screen issues, we usually need to perform debugging. However, in this forum, we do not provide debugging support. If you would like to perform debugging, please contact Microsoft Customer Support Service (CSS). To obtain the phone numbers for specific technology request, please refer to the website listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS If you are outside the US, please refer to http://support.microsoft.com for regional support phone numbers. Tim Quan