Can anyone help reading this memory dump. I posted in the server
group and someone suggested that someone here may be able to assist
further. Dell Poweredge 1800, 3.2 xeon dual processors with 4gb RAM.

Below is the BSOD message along with the memory dump.

Thank you in advance for any help.


Ron


Can someone help me read this "analyze -v" from a memory dump file.

I have a Windows 2003 terminal server, SP2, Dell Poweredge 1800, Dual
3.2 xeon hyperthreaded, 4gb RAM.


Every night BSOD 0x00000050. Below is System eventlog entry and the
result file of a memory.dmp file, read with the Microsoft debugger.


Can anyone tell me why the server is abending? Thank you very much
in
advance.


Ron Floyd
R...@gbftech.com


Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1076
Date: 4/30/2008
Time: 10:50:43 PM
User: EOASGA\administrator
Computer: EOATS01
Description:
The reason supplied by user EOASGA\Administrator for the last
unexpected shutdown of this computer is: System Failure: Stop error
Reason Code: 0x805000f
Bug ID:
Bugcheck String: 0x00000050 (0xc48e2000, 0x00000001, 0x808dea34,
0x00000000)
Comment: 0x00000050 (0xc48e2000, 0x00000001, 0x808dea34, 0x00000000)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0f 00 05 08 ....


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/
download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Apr 30 18:01:05.668 2008 (GMT-4)
System Uptime: 0 days 17:40:15.568
Loading Kernel Symbols
.................................................. ..........................*....................... ....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for
details
Loading unloaded module list
..
************************************************** **************************
****
*
*
* Bugcheck
Analysis *
*
*
************************************************** **************************
****


Use !analyze -v to get detailed debugging information.


BugCheck 50, {c48e2000, 1, 808dea34, 0}


Page 11a472 not present in the dump file. Type ".hh dbgerr004" for
details
Page 11a4e1 not present in the dump file. Type ".hh dbgerr004" for
details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for
details
Probably caused by : ntkrpamp.exe ( nt!HvpRecoverData+4a0 )


Followup: MachineOwner
---------


1: kd> !analyze -v
************************************************** **************************
****
*
*
* Bugcheck
Analysis *
*
*
************************************************** **************************
****


PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-
except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: c48e2000, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 808dea34, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)


Debugging Details:
------------------


Page 11a472 not present in the dump file. Type ".hh dbgerr004" for
details
Page 11a4e1 not present in the dump file. Type ".hh dbgerr004" for
details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for
details


WRITE_ADDRESS: c48e2000


FAULTING_IP:
nt!HvpRecoverData+4a0
808dea34 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]


MM_INTERNAL_CODE: 0


DEFAULT_BUCKET_ID: DRIVER_FAULT


BUGCHECK_STR: 0x50


PROCESS_NAME: wmiprvse.exe


CURRENT_IRQL: 1


TRAP_FRAME: f4b7e9dc -- (.trap 0xfffffffff4b7e9dc)
ErrCode = 00000002
eax=00004000 ebx=e480b000 ecx=00001000 edx=00000000 esi=e480b000
edi=c48e2000
eip=808dea34 esp=f4b7ea50 ebp=f4b7ea98 iopl=0 nv up ei pl nz
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010206
nt!HvpRecoverData+0x4a0:
808dea34 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope


LAST_CONTROL_TRANSFER: from 8085eced to 80827c63


STACK_TEXT:
f4b7e94c 8085eced 00000050 c48e2000 00000001 nt!KeBugCheckEx+0x1b
f4b7e9c4 8088c798 00000001 c48e2000 00000000 nt!MmAccessFault+0xb25
f4b7e9c4 808dea34 00000001 c48e2000 00000000 nt!KiTrap0E+0xdc
f4b7ea98 808deeb4 e62afa80 00000000 00000000 nt!HvpRecoverData+0x4a0
f4b7eae8 808df719 e62afa80 00000000 e62affec nt!HvMapHive+0x188
f4b7eb00 808d7523 e62afc01 00000005 00000000 nt!HvInitializeHive
+0x42d
f4b7eb6c 808c8cf3 f4b7eba8 00000005 00000000 nt!CmpInitializeHive
+0x203
f4b7ebc4 808ca7c0 f4b7ecf4 00000000 f4b7ec54 nt!CmpInitHiveFromFile
+0x91
f4b7ebe8 808c4757 f4b7ecbc f4b7ec58 f4b7ec4c nt!CmpCmdHiveOpen+0x1e
f4b7ec98 808bc1e5 f4b7ecd4 f4b7ecbc 00000000 nt!CmLoadKey+0xcf
f4b7ed3c 808bc3fc 00e7d9ec 00e7da04 00000000 nt!NtLoadKeyEx+0x25b
f4b7ed54 8088978c 00e7d9ec 00e7da04 00e7da34 nt!NtLoadKey+0x14
f4b7ed54 7c8285ec 00e7d9ec 00e7da04 00e7da34 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00e7da34 00000000 00000000 00000000 00000000 0x7c8285ec


STACK_COMMAND: kb


FOLLOWUP_IP:
nt!HvpRecoverData+4a0
808dea34 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]


SYMBOL_STACK_INDEX: 3


SYMBOL_NAME: nt!HvpRecoverData+4a0


FOLLOWUP_NAME: MachineOwner


MODULE_NAME: nt


IMAGE_NAME: ntkrpamp.exe


DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19


FAILURE_BUCKET_ID: 0x50_W_nt!HvpRecoverData+4a0


BUCKET_ID: 0x50_W_nt!HvpRecoverData+4a0


Followup: MachineOwner