From: altheys on
Hi,

One of our computer restart alone .

This computer is part of a windows 2003 domain .

This is the result of the minidump :

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)
ExceptionAddress: a8cf58b7
(mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000038
Attempt to read from address 00000038

CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)
eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008
edi=000000b4
eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng nz ac pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010296
mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:
a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
ds:0023:00000038=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000038

READ_ADDRESS: 00000038

FOLLOWUP_IP:
mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7

STACK_TEXT:
a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34
mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16
a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c
mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9
a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40
a7f7bd6c a8d624b1 00000000 00000000 8905d020
mrxsmb!SmbCeDiscardTransactExchange+0x15a
a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc
rdbss!RxpWorkerThreadDispatcher+0x93
a7f7bdac 805cff64 a8d6bfc0 00000000 00000000
rdbss!RxWorkerThreadDispatcher+0x1a
a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mrxsmb

IMAGE_NAME: mrxsmb.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a

STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb

FAILURE_BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16

Followup: MachineOwner



Could You help me.

Best Regards

M Gerard



From: Shenan Stanley on
altheys(a)noemail.noemail wrote:

> One of our computer restart alone .
>
> This computer is part of a windows 2003 domain .
>
> This is the result of the minidump :
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> FAULTING_IP:
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
>
> EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)
> ExceptionAddress: a8cf58b7
> (mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 00000038
> Attempt to read from address 00000038
>
> CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)
> eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008
> edi=000000b4
> eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng
> nz ac pe nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010296
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
> ds:0023:00000038=????????
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> PROCESS_NAME: System
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> EXCEPTION_PARAMETER1: 00000000
>
> EXCEPTION_PARAMETER2: 00000038
>
> READ_ADDRESS: 00000038
>
> FOLLOWUP_IP:
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
>
> BUGCHECK_STR: 0x7E
>
> DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
>
> LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7
>
> STACK_TEXT:
> a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16
> a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c
> mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9
> a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40
> a7f7bd6c a8d624b1 00000000 00000000 8905d020
> mrxsmb!SmbCeDiscardTransactExchange+0x15a
> a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc
> rdbss!RxpWorkerThreadDispatcher+0x93
> a7f7bdac 805cff64 a8d6bfc0 00000000 00000000
> rdbss!RxWorkerThreadDispatcher+0x1a
> a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000
> nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000
> 00000000 nt!KiThreadStartup+0x16
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: mrxsmb
>
> IMAGE_NAME: mrxsmb.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a
>
> STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb
>
> FAILURE_BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
> BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
>
> Followup: MachineOwner
>
>
>
> Could You help me.

Tested the memory?
Tested the hard disk drive (and everything between it and the controller (in
fact - include the controller?)

Update the hardware drivers from the hardware manufacturer's support web
page(s).
Checked for spyware/adware?
Checked for viruses/trojans/worms?
Checked for rootkits?

Changed what programs run all the time?

Machine up to date?

What exact OS is the machine? Service Pack level? Antivirus application in
use? Antimalware application(s) used? How often do you defragment? How
often do you use CHKDSK? What are your backups like?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


From: PA Bear [MS MVP] on
Bug Check 0x5: INVALID_PROCESS_ATTACH_ATTEMPT:
http://msdn.microsoft.com/en-us/library/ff559087(VS.85).aspx

altheys(a)noemail.noemail wrote:
> Hi,
>
> One of our computer restart alone .
>
> This computer is part of a windows 2003 domain .
>
> This is the result of the minidump :
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> FAULTING_IP:
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
>
> EXCEPTION_RECORD: a7f7bc3c -- (.exr 0xffffffffa7f7bc3c)
> ExceptionAddress: a8cf58b7
> (mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x00000016)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 00000000
> Parameter[1]: 00000038
> Attempt to read from address 00000038
>
> CONTEXT: a7f7b938 -- (.cxr 0xffffffffa7f7b938)
> eax=00000000 ebx=ffffff00 ecx=00000000 edx=00000020 esi=88ab9008
> edi=000000b4
> eip=a8cf58b7 esp=a7f7bd04 ebp=a7f7bd24 iopl=0 nv up ei ng nz ac pe
> nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010296
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16:
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
> ds:0023:00000038=????????
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> PROCESS_NAME: System
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced
> memory at "0x%08lx". The memory could not be "%s".
>
> EXCEPTION_PARAMETER1: 00000000
>
> EXCEPTION_PARAMETER2: 00000038
>
> READ_ADDRESS: 00000038
>
> FOLLOWUP_IP:
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
> a8cf58b7 8b4038 mov eax,dword ptr [eax+38h]
>
> BUGCHECK_STR: 0x7E
>
> DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
>
> LAST_CONTROL_TRANSFER: from a8d06cef to a8cf58b7
>
> STACK_TEXT:
> a7f7bd24 a8d06cef 88ab9008 00000000 88a4fb34
> mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+0x16
> a7f7bd44 a8cfd693 88a4fb10 88a74608 a7f7bd6c
> mrxsmb!MRxSmbNotifyChangeDirectoryCompletion+0xb9
> a7f7bd54 a8d182b1 88a4fb34 00000000 8958cb08 mrxsmb!SmbCeResume+0x40
> a7f7bd6c a8d624b1 00000000 00000000 8905d020
> mrxsmb!SmbCeDiscardTransactExchange+0x15a
> a7f7bd9c a8d6c957 00d6bfc0 a8d6c240 a7f7bddc
> rdbss!RxpWorkerThreadDispatcher+0x93
> a7f7bdac 805cff64 a8d6bfc0 00000000 00000000
> rdbss!RxWorkerThreadDispatcher+0x1a
> a7f7bddc 805460de a8d6c93d a8d6bfc0 00000000
> nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: mrxsmb
>
> IMAGE_NAME: mrxsmb.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 48025c2a
>
> STACK_COMMAND: .cxr 0xffffffffa7f7b938 ; kb
>
> FAILURE_BUCKET_ID:
> 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
>
> BUCKET_ID: 0x7E_mrxsmb!MRxSmbInvalidateFullDirectoryCacheParent+16
>
> Followup: MachineOwner
>
>
>
> Could You help me.
>
> Best Regards
>
> M Gerard