0

I have a virtual machine with Windows Server 2016 on it, after installing active directory it starts to restart randomly.

  • I tried installing windows from different sources.
  • I tried in another host.

but the network was the same, this problem solves when I isolate the network (there is another active directory on the network).

any special log in event viewer except restarting suddenly.

I don't know, any solution?!

this is mini dump file analyze:

PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffe08f0d0da000, memory referenced. Arg2: 0000000000000002, value 0 = read operation, 1 = write operation. Arg3: fffff8076b8b28b0, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved)

Debugging Details:

Could not read faulting driver name TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart unable to get nt!MmSpecialPoolEnd unable to get nt!MmPagedPoolEnd unable to get nt!MmNonPagedPoolStart unable to get nt!MmSizeOfNonPagedPoolInBytes ffffe08f0d0da000

FAULTING_IP: srv!SrvOs2FeaToNt+48 fffff807`6b8b28b0 c60300
mov byte ptr [rbx],0

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER

BUGCHECK_STR: AV

PROCESS_NAME: System

CURRENT_IRQL: 2

TRAP_FRAME: ffff9081bdf026e0 -- (.trap 0xffff9081bdf026e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=ffffe08f0d0da000 rdx=ffffa609828a109a rsi=0000000000000000 rdi=0000000000000000 rip=fffff8076b8b28b0 rsp=ffff9081bdf02870 rbp=ffffa609828a1095 r8=0000000000000000 r9=0000000000000000 r10=0000000000010000 r11=ffffe08f0d0da000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc srv!SrvOs2FeaToNt+0x48: fffff8076b8b28b0 c60300 mov byte ptr [rbx],0 ds:0000000000000000=00 Resetting default scope

LAST_CONTROL_TRANSFER: from fffff801bfdb7945 to fffff801bfd666f0

STACK_TEXT: ffff9081bdf023e8 fffff801bfdb7945 : 0000000000000050 ffffe08f0d0da000 0000000000000002 ffff9081bdf026e0 : nt!KeBugCheckEx ffff9081bdf023f0 fffff801bfcc47ba : 0000000000000002 0000000000000000 ffff9081bdf026e0 0000000000000200 : nt! ?? ::FNODOBFM::string'+0x41db5 ffff9081bdf024e0 fffff801bfd6fcfc : ffff84d300000000 fffff801bfce0cfd 0000000000000000 0000000000000000 : nt!MmAccessFault+0x9ca ffff9081bdf026e0 fffff8076b8b28b0 : 00003a856264534c 0000000000000018 ffff9081bdf02998 ffff9081bdf02990 : nt!KiPageFault+0x13c ffff9081bdf02870 fffff8076b8b27f9 : ffffa609828a1095 ffffe08f0d0d9ff8 3051324769414d62 ffffa609828a1138 : srv!SrvOs2FeaToNt+0x48 ffff9081bdf028a0 fffff8076b8d3ec3 : ffffe08f0e76ca60 0000000000000000 ffffa60982891010 ffffe08f0f2c52c0 : srv!SrvOs2FeaListToNt+0x125 ffff9081bdf028f0 fffff8076b8dcebe : 0000000000000000 fffff80700010fe8 ffffe08f0d0c9010 ffffe08f0e76ca60 : srv!SrvSmbOpen2+0xc3 ffff9081bdf02990 fffff8076b8e007b : ffffe08f0e78fdb0 ffffa60982891010 0000000000000002 0000000000001000 : srv!ExecuteTransaction+0x1be ffff9081bdf029d0 fffff8076b86da4e : fffff80700000000 0000000000000000 ffffe08f00000035 000000000000f3d0 : srv!SrvSmbTransactionSecondary+0x40b ffff9081bdf02a70 fffff8076b86dc24 : ffffe08f0e76ca60 0000000000000000 ffffe08f0e76d4d0 fffff8076b878000 : srv!SrvProcessSmb+0x236 ffff9081bdf02af0 fffff8076b8aca36 : ffffe08f0e8dd320 ffffe08f0e76ca70 0000000000000000 ffffe08f0e76ca70 : srv!SrvRestartReceive+0x114 ffff9081bdf02b30 fffff801c0150668 : ffffa609831884c0 ffffe08f0ca9b700 ffffe08f0f2c5180 0000000000000080 : srv!WorkerThread+0x67a6 ffff9081bdf02bb0 fffff801bfc1e729 : a001030a59840104 030200010208300a 0208300aa160e316 3020a10703020001 : nt!IopThreadStart+0x34 ffff9081bdf02c10 fffff801bfd6bbb6 : ffff9081bbe80180 ffffe08f0f2c5180 fffff801bfc1e6e8 287e635cb3596583 : nt!PspSystemThreadStartup+0x41 ffff9081bdf02c60 0000000000000000 : ffff9081bdf03000 ffff9081bdefd000 0000000000000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP: srv!SrvOs2FeaToNt+48 fffff807`6b8b28b0 c60300
mov byte ptr [rbx],0

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: srv!SrvOs2FeaToNt+48

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: srv

IMAGE_NAME: srv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 57cf9c45

FAILURE_BUCKET_ID: X64_AV_srv!SrvOs2FeaToNt+48

BUCKET_ID: X64_AV_srv!SrvOs2FeaToNt+48

Followup: MachineOwner

  • Hi, please add some detail, we can’t help much if nothing is added – yagmoth555 Nov 3 '18 at 14:10
  • @yagmoth555 I added mini dump file analyze – Mehdi Nov 6 '18 at 9:34
  • Looks like SMBcrash (remote vuln) or bad memory. – bjoster Jan 4 at 16:13
2

Your server seem hit by a SMB vulnerability.

srv!SrvSmbOpen2+0xc3
srv!SrvSmbTransactionSecondary+0x40b
srv!SrvRestartReceive+0x114

And you indirectly confirm me it at the same time;

this problem solves when I isolate the network

Please close your SMB port. TCP 139, 445, UDP 137 and 138 and after to see the dropped packet afterhand to identify the culprit, please activate the firewall log (Select Log dropped packets), and check there after;

%windir%\system32\logfiles\firewall\pfirewall.log

You will be able to trace back the problem.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.