We get the exact same problem on one of our servers and it reboots it in the middle of the night. Here is my MiniDump
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini112812-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Nov 28 06:29:34.443 2012 (GMT-8)
System Uptime: 0 days 2:07:15.094
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
...............................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image \SystemRoot\System32\Drivers\aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, b6e02817, b60cb6c8, 0}
Probably caused by : aswSnx.SYS ( aswSnx+3c817 )
Followup: MachineOwner
---------
2: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b6e02817, The address that the exception occurred at
Arg3: b60cb6c8, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
aswSnx+3c817
b6e02817 8904b3 mov dword ptr [ebx+esi*4],eax
TRAP_FRAME: b60cb6c8 -- (.trap 0xffffffffb60cb6c8)
ErrCode = 00000002
eax=00000000 ebx=00000000 ecx=b60cb788 edx=8e715e5c esi=00000000 edi=00000000
eip=b6e02817 esp=b60cb73c ebp=b60cb748 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
aswSnx+0x3c817:
b6e02817 8904b3 mov dword ptr [ebx+esi*4],eax ds:0023:00000000=00000000
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x8E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from b6e03c5c to b6e02817
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b60cb748 b6e03c5c ffffffff b60cb788 00000000 aswSnx+0x3c817
b60cb770 b6e03de7 b60cb7a4 00000032 8e0c5ab4 aswSnx+0x3dc5c
b60cb7c8 b6e041cf 00000000 00000000 00000000 aswSnx+0x3dde7
b60cb80c b6e045a9 b60cb8f0 8e715e5c b6e12e6e aswSnx+0x3e1cf
b60cb8e4 b6e04716 b60cb920 b6e12dfa 80000514 aswSnx+0x3e5a9
b60cb90c b6de6944 b60cb958 b6e12dfa 80000514 aswSnx+0x3e716
b60cb994 b6ded7c0 000ce904 e7fb63e8 00000001 aswSnx+0x20944
b60cb9bc b6dedf92 000006d0 000ce904 e7fb63e8 aswSnx+0x277c0
b60cbb14 b6deebd5 fbf6cbc8 000ce904 b60cbb38 aswSnx+0x27f92
b60cbb78 8094a1d2 000006d0 000ce904 00000001 aswSnx+0x28bd5
b60cbcc8 8094af23 00b2d90c 001f03ff 00000000 nt!MiCloneProcessAddressSpace+0x4df0
b60cbd3c 8088983c 00b2d90c 001f03ff 00000000 nt!MiDecrementCloneBlockReference+0xd1b
b60cbd64 7c82845c badb0d00 00b2d59c 00000000 nt!MiRemoveUnusedSegments+0xbd4
b60cbd68 badb0d00 00b2d59c 00000000 00000000 0x7c82845c
b60cbd6c 00b2d59c 00000000 00000000 00000000 0xbadb0d00
b60cbd70 00000000 00000000 00000000 00000000 0xb2d59c
STACK_COMMAND: kb
FOLLOWUP_IP:
aswSnx+3c817
b6e02817 8904b3 mov dword ptr [ebx+esi*4],eax
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: aswSnx+3c817
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: aswSnx
IMAGE_NAME: aswSnx.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ff44ee3
FAILURE_BUCKET_ID: 0x8E_aswSnx+3c817
BUCKET_ID: 0x8E_aswSnx+3c817
Followup: MachineOwner
---------
2: kd> lmvm aswSnx
start end module name
b6dc6000 b6e60000 aswSnx T (no symbols)
Loaded symbol image file: aswSnx.SYS
Image path: \SystemRoot\System32\Drivers\aswSnx.SYS
Image name: aswSnx.SYS
Timestamp: Wed Jul 04 07:10:43 2012 (4FF44EE3)
CheckSum: 0009DC0D
ImageSize: 0009A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Not sure what I need to do to fix this but it is getting annoying to have to come in at 5 am to make sure all of the services are up and running when this server crashes.