Hi Everyone, I have run into a problem with new HP desktop that runs Windows 7 Pro 32 bit. Since Jan 2012 we had 5 BSOD. The computer is part of Windows 2011 SBS domain as well. We were able to pin point when the BSOD occurs, which was when attaching Pictures from a network shared drive. However, the BSOD are random after reboot we could attach the same pictures with out any problems with the next couple weeks. I have attached links to minidumps if someone can point me in the right direction that would be great. https://skydrive.live.com/embed?cid=6DE3DFC9901E8DC4&resid=6DE3DFC9901E8DC4%21155&authkey=AMahHM2kUNRC9Ao

1. There is hotfix http://support.microsoft.com/kb/951418 Call local MS support and ask for hotfix 2. If you have factory installation ask local HP support for help and for the case of non factory installation address HP community forum 3. Double check the memory (RAM) Regards Milos

Interesting theory, but I think it may actually be due to Eset Antivirus, 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: baad0073 Arg2: 8fc703bc Arg3: 8fc6ffa0 Arg4: 91255ede Debugging Details: ------------------ EXCEPTION_RECORD: 8fc703bc -- (.exr 0xffffffff8fc703bc) ExceptionAddress: 91255ede (rdbss!RxCreateFromNetRoot+0x000005b7) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 00000024 Attempt to write to address 00000024 CONTEXT: 8fc6ffa0 -- (.cxr 0xffffffff8fc6ffa0) eax=00000000 ebx=888db0dc ecx=00000003 edx=00000008 esi=e3246008 edi=00000000 eip=91255ede esp=8fc70484 ebp=8fc70508 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 rdbss!RxCreateFromNetRoot+0x5b7: 91255ede 81482400040000 or dword ptr [eax+24h],400h ds:0023:00000024=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: ekrn.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 00000024 WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d6a848 Unable to read MiSystemVaType memory at 82d49e20 00000024 FOLLOWUP_IP: rdbss!RxCreateFromNetRoot+5b7 91255ede 81482400040000 or dword ptr [eax+24h],400h FAULTING_IP: rdbss!RxCreateFromNetRoot+5b7 91255ede 81482400040000 or dword ptr [eax+24h],400h BUGCHECK_STR: 0x27 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LAST_CONTROL_TRANSFER: from 91257117 to 91255ede STACK_TEXT: 8fc70508 91257117 e3246008 89655d01 00c70528 rdbss!RxCreateFromNetRoot+0x5b7 8fc7053c 9123befc 00000000 89655d20 1ee3c070 rdbss!RxCommonCreate+0x2ae 8fc705c4 912522c9 9124c240 89655d20 863977e8 rdbss!RxFsdCommonDispatch+0x646 8fc705f4 972f76a2 88443a68 00655d20 89655dd8 rdbss!RxFsdDispatch+0x1ab 8fc70610 82c385be 88443a68 01655d20 89655dfc mrxsmb!MRxSmbFsdDispatch+0x9a 8fc70628 8bf27bb0 00000103 89eed778 863977e8 nt!IofCallDriver+0x63 8fc70644 8bf26b52 89eed778 c0000016 89655dd8 mup!MupiCallUncProvider+0x10f 8fc7065c 8bf26f5b 89eed778 043556a5 00000000 mup!MupStateMachine+0x9b 8fc706a8 82c385be 857146a8 89655d20 89655d20 mup!MupCreate+0x109 8fc706c0 8bb2120c 89655d20 00000000 89655dfc nt!IofCallDriver+0x63 8fc706e4 8bb348c9 8fc70704 85714120 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa 8fc70730 82c385be 85714120 87bc4008 86397844 fltmgr!FltpCreate+0x2db 8fc70748 82e473e7 a5801d1c 8fc708f0 00000000 nt!IofCallDriver+0x63 8fc70820 82e26bee 857146a8 856f5f78 888db0c0 nt!IopParseDevice+0xed7 8fc7089c 82e37000 00000000 8fc708f0 00000040 nt!ObpLookupObjectName+0x4fa 8fc708f8 82e2dade 0692db64 856f5f78 82c78701 nt!ObOpenObjectByName+0x165 8fc70974 82e1506c 0692db48 80100080 0692db64 nt!IopCreateFile+0x673 8fc709bc 885090c9 0692db48 80100080 0692db64 nt!IoCreateFile+0x38 WARNING: Frame IP not in any known module. Following frames may be wrong. 8fc709c0 0692db48 80100080 0692db64 0692db5c 0x885090c9 8fc709c4 80100080 0692db64 0692db5c 00000000 0x692db48 8fc709c8 0692db64 0692db5c 00000000 00000080 0x80100080 8fc709cc 0692db5c 00000000 00000080 00000007 0x692db64 8fc709d0 00000000 00000080 00000007 00000001 0x692db5c SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: rdbss!RxCreateFromNetRoot+5b7 FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a04 STACK_COMMAND: .cxr 0xffffffff8fc6ffa0 ; kb FAILURE_BUCKET_ID: 0x27_rdbss!RxCreateFromNetRoot+5b7 BUCKET_ID: 0x27_rdbss!RxCreateFromNetRoot+5b7 Followup: MachineOwner --------- -- Mike Burr Enterprise High Availability, Disaster Recovery, and Business Continuity Planning Learn to Troubleshoot Windows BSODs

Hi Mike, i think that might have been problem, we had eset to setup to network scan all files as well scan any file that is open created etc. We have disabled network scans for now to see how it goes for the next couple days/weeks. To see if the problem persists. Regards, Paul

Interesting theory, but I think it may actually be due to Eset Antivirus, 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: baad0073 Arg2: 8fc703bc Arg3: 8fc6ffa0 Arg4: 91255ede Debugging Details: ------------------ EXCEPTION_RECORD: 8fc703bc -- (.exr 0xffffffff8fc703bc) ExceptionAddress: 91255ede (rdbss!RxCreateFromNetRoot+0x000005b7) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 00000024 Attempt to write to address 00000024 CONTEXT: 8fc6ffa0 -- (.cxr 0xffffffff8fc6ffa0) eax=00000000 ebx=888db0dc ecx=00000003 edx=00000008 esi=e3246008 edi=00000000 eip=91255ede esp=8fc70484 ebp=8fc70508 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 rdbss!RxCreateFromNetRoot+0x5b7: 91255ede 81482400040000 or dword ptr [eax+24h],400h ds:0023:00000024=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: ekrn.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 00000024 WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d6a848 Unable to read MiSystemVaType memory at 82d49e20 00000024 FOLLOWUP_IP: rdbss!RxCreateFromNetRoot+5b7 91255ede 81482400040000 or dword ptr [eax+24h],400h FAULTING_IP: rdbss!RxCreateFromNetRoot+5b7 91255ede 81482400040000 or dword ptr [eax+24h],400h BUGCHECK_STR: 0x27 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LAST_CONTROL_TRANSFER: from 91257117 to 91255ede STACK_TEXT: 8fc70508 91257117 e3246008 89655d01 00c70528 rdbss!RxCreateFromNetRoot+0x5b7 8fc7053c 9123befc 00000000 89655d20 1ee3c070 rdbss!RxCommonCreate+0x2ae 8fc705c4 912522c9 9124c240 89655d20 863977e8 rdbss!RxFsdCommonDispatch+0x646 8fc705f4 972f76a2 88443a68 00655d20 89655dd8 rdbss!RxFsdDispatch+0x1ab 8fc70610 82c385be 88443a68 01655d20 89655dfc mrxsmb!MRxSmbFsdDispatch+0x9a 8fc70628 8bf27bb0 00000103 89eed778 863977e8 nt!IofCallDriver+0x63 8fc70644 8bf26b52 89eed778 c0000016 89655dd8 mup!MupiCallUncProvider+0x10f 8fc7065c 8bf26f5b 89eed778 043556a5 00000000 mup!MupStateMachine+0x9b 8fc706a8 82c385be 857146a8 89655d20 89655d20 mup!MupCreate+0x109 8fc706c0 8bb2120c 89655d20 00000000 89655dfc nt!IofCallDriver+0x63 8fc706e4 8bb348c9 8fc70704 85714120 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa 8fc70730 82c385be 85714120 87bc4008 86397844 fltmgr!FltpCreate+0x2db 8fc70748 82e473e7 a5801d1c 8fc708f0 00000000 nt!IofCallDriver+0x63 8fc70820 82e26bee 857146a8 856f5f78 888db0c0 nt!IopParseDevice+0xed7 8fc7089c 82e37000 00000000 8fc708f0 00000040 nt!ObpLookupObjectName+0x4fa 8fc708f8 82e2dade 0692db64 856f5f78 82c78701 nt!ObOpenObjectByName+0x165 8fc70974 82e1506c 0692db48 80100080 0692db64 nt!IopCreateFile+0x673 8fc709bc 885090c9 0692db48 80100080 0692db64 nt!IoCreateFile+0x38 WARNING: Frame IP not in any known module. Following frames may be wrong. 8fc709c0 0692db48 80100080 0692db64 0692db5c 0x885090c9 8fc709c4 80100080 0692db64 0692db5c 00000000 0x692db48 8fc709c8 0692db64 0692db5c 00000000 00000080 0x80100080 8fc709cc 0692db5c 00000000 00000080 00000007 0x692db64 8fc709d0 00000000 00000080 00000007 00000001 0x692db5c SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: rdbss!RxCreateFromNetRoot+5b7 FOLLOWUP_NAME: MachineOwner MODULE_NAME: rdbss IMAGE_NAME: rdbss.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a04 STACK_COMMAND: .cxr 0xffffffff8fc6ffa0 ; kb FAILURE_BUCKET_ID: 0x27_rdbss!RxCreateFromNetRoot+5b7 BUCKET_ID: 0x27_rdbss!RxCreateFromNetRoot+5b7 Followup: MachineOwner --------- -- Mike Burr Enterprise High Availability, Disaster Recovery, and Business Continuity Planning Learn to Troubleshoot Windows BSODs

Hi Mike, i think that might have been problem, we had eset to setup to network scan all files as well scan any file that is open created etc. We have disabled network scans for now to see how it goes for the next couple days/weeks. To see if the problem persists. Regards, Paul Paul I think I might have seen this elsewhere. Have you gotten an answer either here or there that has fixed the situation?

Yes you have posted reply to this on another forum that i have asked it. Right now we think it might be eset that is causing this. Will keep an eye and see what happens.

Yes you have posted reply to this on another forum that i have asked it. Right now we think it might be eset that is causing this. Will keep an eye and see what happens.