Windows Server 2008 R2 STD BSOD crash reason

hi,

recently our server started crash. have managed dmp file analized, not sure causing crash, can me dmp file thank in advance.

microsoft (r) windows debugger version 6.2.9200.16384 amd64

copyright (c) microsoft corporation. rights reserved.

 loading dump file [c:\windows\memory.dmp]

kernel summary dump file: kernel address space available

 symbol search path is: srv*f:\symbols*

executable search path is:

windows 7 kernel version 7601 (service pack 1) mp (16 procs) free x64

product: lanmannt, suite: terminalserver

built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030

machine name:

kernel base = 0xfffff800`01856000 psloadedmodulelist = 0xfffff800`01a9a670

debug session time: sun oct  7 07:22:32.513 2012 (utc + 3:00)

system uptime: 2 days 9:56:46.865

loading kernel symbols

...............................................................

................................................................

.................................

loading user symbols

peb paged out (peb.ldr = 000007ff`fffdd018).  type ".hh dbgerr001" details

loading unloaded module list

..........

*******************************************************************************

*                                                                             *

*                        bugcheck analysis                                    *

*                                                                             *

*******************************************************************************

 use !analyze -v detailed debugging information.

 bugcheck 3b, {c0000005, fffff960000bd010, fffff8800e684c10, 0}

 page 1632 not present in dump file. type ".hh dbgerr004" details

probably caused : win32k.sys ( win32k!xxxprocesseventmessage+1c0 )

 followup: machineowner

---------

 12: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        bugcheck analysis                                    *

*                                                                             *

*******************************************************************************

 system_service_exception (3b)

an exception happened while executing system service routine.

arguments:

arg1: 00000000c0000005, exception code caused bugcheck

arg2: fffff960000bd010, address of instruction caused bugcheck

arg3: fffff8800e684c10, address of context record exception caused bugcheck

arg4: 0000000000000000, zero.

 

debugging details:

------------------

 exception_code: (ntstatus) 0xc0000005 - instruction @ 0x%08lx referenced memory @ 0x%08lx. memory not %s.

 faulting_ip:

win32k!xxxprocesseventmessage+1c0

fffff960`000bd010 017308          add     dword ptr [rbx+8],esi

 context:  fffff8800e684c10 -- (.cxr 0xfffff8800e684c10)

rax=fffff8800e685640 rbx=0000000000000000 rcx=fffff8800e685598

rdx=fffff900c0a0c010 rsi=0000000000000001 rdi=0000000000000000

rip=fffff960000bd010 rsp=fffff8800e6855f0 rbp=fffff8800e685790

r8=0000000000000000  r9=0000000000000000 r10=0000000000000000

r11=fffff8800e685510 r12=fffff900c2059c20 r13=fffff8800e685b68

r14=fffff900c2059c20 r15=0000000000000001

iopl=0         nv ei ng nz na pe nc

cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282

win32k!xxxprocesseventmessage+0x1c0:

fffff960`000bd010 017308          add     dword ptr [rbx+8],esi ds:002b:00000000`00000008=????????

resetting default scope

 default_bucket_id:  win7_driver_fault

 bugcheck_str:  0x3b

 process_name:  tp.shell.xaf.w

current_irql:  0

last_control_transfer:  fffff960000d0b6d fffff960000bd010

stack_text: 

fffff880`0e6855f0 fffff960`000d0b6d : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000018 : win32k!xxxprocesseventmessage+0x1c0

fffff880`0e6856c0 fffff960`0010b747 : fffff900`c2059c20 fffff880`0e685b68 fffff900`c0a066e0 00000000`00000400 : win32k!xxxscansysqueue+0x575

fffff880`0e685a00 fffff960`0010bbd5 : 00000000`00000400 fffff800`000020c8 00000000`00000400 fffffa80`00007fff : win32k!xxxrealinternalgetmessage+0x453

fffff880`0e685ae0 fffff960`00104627 : 00000000`00000000 00000000`00000000 fffff900`c0a09c30 fffff900`c01194a0 : win32k!xxxinternalgetmessage+0x35

fffff880`0e685b20 fffff800`018d4453 : fffffa80`13d75b00 00000000`001dc6b8 fffff880`0e685bc8 00000000`00000000 : win32k!ntuserpeekmessage+0x77

fffff880`0e685bb0 00000000`772f908a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!kisystemservicecopyend+0x13

00000000`001dc698 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772f908a

followup_ip:

win32k!xxxprocesseventmessage+1c0

fffff960`000bd010 017308          add     dword ptr [rbx+8],esi

symbol_stack_index:  0

symbol_name:  win32k!xxxprocesseventmessage+1c0

followup_name:  machineowner

module_name: win32k

image_name:  win32k.sys

debug_flr_image_timestamp:  5006fd0d

stack_command:  .cxr 0xfffff8800e684c10 ; kb

failure_bucket_id:  x64_0x3b_win32k!xxxprocesseventmessage+1c0

 bucket_id:  x64_0x3b_win32k!xxxprocesseventmessage+1c0 

followup: machineowner

---------

perform ram diagnosis , replace bad ones, check other hardware well. restore server earlier date before changes made have caused server crash. suggestion contact microsoft customer service , support (css) via telephone dedicated support professional can assist request. please advised contacting phone support charged call.
 
 
obtain phone numbers specific technology request please take @ http://support.microsoft.com/default.aspx?scid=fh;en-us;phonenumbers if outside please see http://support.microsoft.com regional support phone numbers.
 
 
thanks
zhang

Windows Server  >  Windows Server General Forum