I have a machine running 2008 R2 SP1 and all the latest updates that got a BSOD all of a sudden. I don't really find any particular reason so I'm posting it here to see if any of you have an idea.
This is the BSOD message:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000018 (0xfffffa8048be5d80, 0xfffffa804a2aadd0, 0x0000000000000001, 0x0000000000000800). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101612-23415-01.
This is what the dmp bedug gives me:
============
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [H:\A_Old FS_SYS\2012-10-16_BSOD_T530\BSOD 2012-10-16\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
WARNING: Whitespace at end of path element
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`05457000 PsLoadedModuleList = 0xfffff800`0569ce90
Debug session time: Tue Oct 16 09:03:32.104 2012 (UTC + 2:00)
System Uptime: 98 days 0:00:07.777
Loading Kernel Symbols
...............................................................
..............................................................Page d72008 not present in the dump file. Type ".hh dbgerr004" for details
..
............................Page db1d4c not present in the dump file. Type ".hh dbgerr004" for details
.......
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd7018). Type ".hh dbgerr001" for details
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 18, {fffffa8048be5d80, fffffa804a2aadd0, 1, 800}
Page d72008 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+49e1a )
Followup: MachineOwner
---------
windbg> .hh dbgerr004
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8048be5d80, Object type of the object whose reference count is being lowered
Arg2: fffffa804a2aadd0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000800, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
Page d72008 not present in the dump file. Type ".hh dbgerr004" for details
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: mmc.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000547818d to fffff800054d7640
STACK_TEXT:
fffff880`09824ad8 fffff800`0547818d : 00000000`00000018 fffffa80`48be5d80 fffffa80`4a2aadd0 00000000`00000001 : nt!KeBugCheckEx
fffff880`09824ae0 fffff800`057ce484 : fffffa80`ac1d4060 00000000`00000000 fffffa80`4d5558e0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x49e1a
fffff880`09824b40 fffff800`057cea34 : 00000000`00002a48 fffffa80`ac1d4060 fffff8a0`0a1acf40 00000000`00002a48 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`09824bd0 fffff800`054d68d3 : fffffa80`4d5558e0 fffff880`09824ca0 00000000`0544e7e0 fffffa80`4d6e4e60 : nt!ObpCloseHandle+0x94
fffff880`09824c20 00000000`7731140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0544e3a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7731140a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+49e1a
fffff800`0547818d cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+49e1a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+49e1a
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+49e1a
Followup: MachineOwner
---------
=============
All help is appreciated