Windows Server 2008 R2: APC_INDEX_MISMATCH (1)

I have a Windows 2008 R2 Server which is currently having BSoD(and subsequent reboot) at random times pretty much every day. I have debugged the memory dump and gotten the below output. I have not found a specific post on the Internet that points to the cause of these reboots for Server 2008, only Vista, 7, XP. From what I've read, it is a driver issue? Anyone have a clue as to where I can start digging?

Third-party applications I have running on the server are:
Sophos Antivirus
Junction Link Magic
Secure Copy



*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: fffff8000186c358, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000ffff, Thread->KernelApcDisable
Arg4: 0000000000000001, Previous KernelApcDisable

Debugging Details:
------------------


FAULTING_IP:
nt!CcWorkerThread+0
fffff800`0186c358 488bc4 mov rax,rsp

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x1

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80001823511 to fffff80001878740

STACK_TEXT:
fffff880`099a8ca8 fffff800`01823511 : 00000000`00000001 fffff800`0186c358 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
fffff880`099a8cb0 fffff800`01b1cc06 : fffff880`0c048ae0 fffffa80`0a18f590 00000000`00000080 fffffa80`0396e990 : nt! ?? ::FNODOBFM::`string'+0x54406
fffff880`099a8d40 fffff800`01856c26 : fffff880`009bf180 fffffa80`0a18f590 fffffa80`039de680 fffff880`01657a90 : nt!PspSystemThreadStartup+0x5a
fffff880`099a8d80 00000000`00000000 : fffff880`099a9000 fffff880`099a3000 fffff880`099a8380 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!CcWorkerThread+0
fffff800`0186c358 488bc4 mov rax,rsp

SYMBOL_NAME: nt!CcWorkerThread+0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9

FAILURE_BUCKET_ID: X64_0x1_SysCallNum_0_nt!CcWorkerThread+0

BUCKET_ID: X64_0x1_SysCallNum_0_nt!CcWorkerThread+0

Followup: MachineOwner

 

Hi munoyet!

We have this exact same BSOD on an HP DL 360 G5 server connecting to an HP EVA 6400 SAN Storage (even the memory address is the same). Our third party applications are:
-Undelete 2009 Server
-Eset NOD32 Antivirus 4.2

Would you be so kind to provide some details about you hardware? Maybe it would help us to find the root cause.

Thanks in advance!

--ordoghl

 

Hey ordoghl,
Sorry for the late reply, went for Christmas holiday's and just saw your reply. We have managed to find the cause of the reboots after a painful two weeks. The issue was Undelete/Disk Keeper. Somehow these applications were causing the restarts/BSoD's. We have stopped services for both these applications and have since not experienced any further server reboots.

Of course this has meant that we are unable to recover recently deleted files/folders and rely on backups for restoration. Microsoft are yet to provide a permanent solution to this issue.

 

Hello munoyet!

Thanks for your reply. Would you be so kind to provide your Undelete version? We are currently using Undelete 2009 Version 6.0.163.

--ordoghl

 

Ours I believe is the same, Undelete 2009 6.0.163.64

 

To users who are running Undelete build 6.0.163, there has been a technical update to the UDfilter.sys driver to prevent the driver from crashing, which can also result in a BSOD depending on certain circumstances. It is a very rare occurrence, so the later build UDfilter.sys driver should only be used if you are experiencing issues due to build 6.0.163 being the latest official release version.

If you are experiencing any BSOD issues on servers running Undelete 6.0.163, please contact Diskeeper Corporation Tech Support for the latest build, as it would be one less thing to worry about in troubleshooting.

http://www.diskeeper.com/support/techsupport.aspx