Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Windows Server General Help » BSOD rdbss.sys uphcleanhlp
BSOD rdbss.sys uphcleanhlp [message #164038] Fri, 12 June 2009 10:10 Go to next message
Babu VT  is currently offline Babu VT  India
Messages: 20
Registered: August 2009
Junior Member
Hi,
I have been facing a strange problem in one of my Windows 2000(SP4) terminal
servers.Whenever user right clicks file and selects "Properties" , the
server shows Blue Screen and generates a memory dump.
Sometimes, the memory.dmp analyzed with windbg says faulty module is
rdbss.sys and sometimes uphcleanhlp.I have now disabled UPHClean but problem
still exists.

Can you please help.

Below are the windbg outputs

Output 1:

Loading Dump File [C:\Documents and
Settings\Administrator\Desktop\Mini061009-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Wed Jun 10 23:37:15.835 2009 (GMT+5)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
............................................................ ....
............................................................ .....
......
Loading User Symbols
Loading unloaded module list
........
*** WARNING: Unable to verify timestamp for rdbss.sys
*** ERROR: Module load completed but symbols could not be loaded for
rdbss.sys
************************************************************ *******************
*
*
* Bugcheck Analysis
*
*
*
************************************************************ *******************

Use !analyze -v to get detailed debugging information.

BugCheck 27, {baad00d5, 0, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
Probably caused by : rdbss.sys ( rdbss+12ce3 )

Followup: MachineOwner
---------

3: kd> !analyze -v
************************************************************ *******************
*
*
* Bugcheck Analysis
*
*
*
************************************************************ *******************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd
parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and
then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code,
which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad00d5
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to
set symbol path and load symbols.

MODULE_NAME: rdbss

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48b580c8

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x27

LAST_CONTROL_TRANSFER: from 00000000 to bfabece3

STACK_TEXT:
bd7145f4 00000000 baad00d5 00000000 00000000 rdbss+0x12ce3


STACK_COMMAND: kb

FOLLOWUP_IP:
rdbss+12ce3
bfabece3 ?? ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: rdbss+12ce3

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: rdbss.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------




Output 2:
-------

Loading Dump File [C:\Documents and
Settings\Administrator\Desktop\Mini061109-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Thu Jun 11 21:30:31.820 2009 (GMT+5)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
............................................................ ....
............................................................ .....
......
Loading User Symbols
Loading unloaded module list
...............
************************************************************ *******************
*
*
* Bugcheck Analysis
*
*
*
************************************************************ *******************

Use !analyze -v to get detailed debugging information.

BugCheck CE, {eb56e63c, 0, eb56e63c, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
Probably caused by : uphcleanhlp. ( uphcleanhlp+63c )

Followup: MachineOwner
---------

3: kd> !analyze -v
************************************************************ *******************
*
*
* Bugcheck Analysis
*
*
*
************************************************************ *******************

DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
Arguments:
Arg1: eb56e63c, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: eb56e63c, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, Mm internal code.

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************
************************************************************ *************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************************ *************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to
set symbol path and load symbols.

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 0

READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
eb56e63c

FAULTING_IP:
uphcleanhlp+63c
eb56e63c ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xCE

LAST_CONTROL_TRANSFER: from 00000000 to 8044c790

FAILED_INSTRUCTION_ADDRESS:
uphcleanhlp+63c
eb56e63c ?? ???

STACK_TEXT:
bd854c88 00000000 eb56e63c 00000000 eb56e63c nt+0x4c790


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
uphcleanhlp+63c
eb56e63c ?? ???

SYMBOL_NAME: uphcleanhlp+63c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: uphcleanhlp

IMAGE_NAME: uphcleanhlp.

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------
Re: BSOD rdbss.sys uphcleanhlp [message #164048 is a reply to message #164038] Fri, 12 June 2009 17:58 Go to previous messageGo to next message
Peter Foldes  is currently offline Peter Foldes  Canada
Messages: 1900
Registered: July 2009
Senior Member
> Unable to load image ntoskrnl.exe, Win32 error 0n2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
> *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Babu

Check the following. All the info you posted is pointing to the below MS KB issue
http://support.microsoft.com/kb/124550

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Babu VT" <babuvt@hotmail.com> wrote in message
news:eKzsOe26JHA.4100@TK2MSFTNGP06.phx.gbl...
> Hi,
> I have been facing a strange problem in one of my Windows 2000(SP4) terminal
> servers.Whenever user right clicks file and selects "Properties" , the server
> shows Blue Screen and generates a memory dump.
> Sometimes, the memory.dmp analyzed with windbg says faulty module is rdbss.sys and
> sometimes uphcleanhlp.I have now disabled UPHClean but problem still exists.
>
> Can you please help.
>
> Below are the windbg outputs
>

<snip>
Re: BSOD rdbss.sys uphcleanhlp [message #164057 is a reply to message #164048] Sat, 13 June 2009 03:47 Go to previous message
Babu VT  is currently offline Babu VT  India
Messages: 20
Registered: August 2009
Junior Member
Hi Peter,

The KB article mentioned by you talks of windows failing to boot.But I have
fully functional server and it crashes only when non-administrators of that
machine right click on a file and choose file properties.
This problem of BSOD however doesn't exist for administrators of the same
machine.

cheers
Babu

"Peter Foldes" <okf22@hotmail.com> wrote in message
news:%23ld%23tj66JHA.3860@TK2MSFTNGP05.phx.gbl...
>> Unable to load image ntoskrnl.exe, Win32 error 0n2
>> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
>> *** ERROR: Module load completed but symbols could not be loaded for
>> ntoskrnl.exe
>
> Babu
>
> Check the following. All the info you posted is pointing to the below MS
> KB issue
> http://support.microsoft.com/kb/124550
>
> --
> Peter
>
> Please Reply to Newsgroup for the benefit of others
> Requests for assistance by email can not and will not be acknowledged.
>
> "Babu VT" <babuvt@hotmail.com> wrote in message
> news:eKzsOe26JHA.4100@TK2MSFTNGP06.phx.gbl...
>> Hi,
>> I have been facing a strange problem in one of my Windows 2000(SP4)
>> terminal servers.Whenever user right clicks file and selects "Properties"
>> , the server shows Blue Screen and generates a memory dump.
>> Sometimes, the memory.dmp analyzed with windbg says faulty module is
>> rdbss.sys and sometimes uphcleanhlp.I have now disabled UPHClean but
>> problem still exists.
>>
>> Can you please help.
>>
>> Below are the windbg outputs
>>
>
> <snip>
Previous Topic:Problem Compatibility settings for all users
Next Topic:Recommendation for Server 2008 books
Goto Forum:
  


Current Time: Wed Aug 23 08:00:31 EDT 2017

Total time taken to generate the page: 0.04083 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software