Dump Data: Win 2k3 Standard Terminal Server

Hi All,

I have a Windows 2003 Standard Server set up as a Terminal Server. The server is giving BSOD's. The crashes only occur when people are using the server (i.e. never occurs on weekends/holiday periods). The crash consistently occurs at the end of a working day. It seems to happen as a user logs off the terminal server. I have run a 12 hour Memtest over the RAM and it passed. I have even performed a full software reload on the server! Even after the reload, I still think the problem could be software related because the error is exactly the same each time and seems to be triggered by users logging off the server.

Anyway, here are three separate Dumps, would appretiate it if someone could take a look! Thanks very much.

C:\Program Files\Debugging Tools for Windows>kd -y srv*c:\symbols*http://msdl.mi
crosoft.com/download/symbols -i z:\i386 -z c:\windows\minidump\Mini122404-01.dmp


Microsoft (R) Windows Debugger Version 6.4.0004.4
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini122404-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: z:\i386
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Fri Dec 24 14:50:54.890 2004 (GMT+11)
System Uptime: 0 days 21:14:55.905
Loading Kernel Symbols
................................................................................
........................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {bc468018, 0, bf90716a, 1}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!UnmapPrintKView+17 )

Followup: MachineOwner
---------

3: kd> !analyse -v;r;kv;lmtn;.logclose;q
No export analyse found
eax=f774f13c ebx=00000050 ecx=895461f8 edx=804e5bb0 esi=f774f120 edi=895461f8
eip=80543ac9 esp=f70f6a18 ebp=f70f6a30 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d pop ebp
ChildEBP RetAddr Args to Child
f70f6a30 8052fa2f 00000050 bc468018 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo
])
f70f6a80 804e2dfc 00000000 bc468018 00000000 nt!MmAccessFault+0x796 (FPO: [Non-F
po])
f70f6a80 bf90716a 00000000 bc468018 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFr
ame @ f70f6a98)
f70f6b10 bf85c647 bc0e5620 00000000 f70f6b84 win32k!UnmapPrintKView+0x17 (FPO: [
1,0,0])
f70f6b2c bf85c4f3 bc0f1a68 f70f6bf4 00000000 win32k!PDEVOBJ:estroyFont+0x4c (F
PO: [Non-Fpo])
f70f6b50 bf81b279 00000000 f70f6b68 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x8c
(FPO: [Non-Fpo])
f70f6b7c bf81a337 bc0f1a68 00000000 f70f6bf4 win32k!RFONTOBJ::bMakeInactiveHelpe
r+0x217 (FPO: [Non-Fpo])
f70f6bc8 bf80505a bc01d018 bf8053ab bc0f1a68 win32k!RFONTOBJ::vMakeInactive+0x61
(FPO: [Non-Fpo])
f70f6bd0 bf8053ab bc0f1a68 00000000 00000ec4 win32k!RFONTOBJ::RFONTOBJ+0x12 (FPO
: [1,0,0])
f70f6c00 bf80b777 010100fb 00000ec4 bc11e9c8 win32k!XDCOBJ::bCleanDC+0x22c (FPO:
[Non-Fpo])
f70f6c14 bf90bc21 010100fb 00000001 00000001 win32k!bDeleteDCInternal+0x24 (FPO:
[Non-Fpo])
f70f6c28 bf90b7ac 00000ec4 00000000 00000ec4 win32k!vCleanupDCs+0x23 (FPO: [1,0,
0])
f70f6c44 bf952ec6 8057fb54 895361f8 bf916b3a win32k!NtGdiCloseProcess+0x16 (FPO:
[EBP 0xf7a05000] [0,1,0])
f70f6c48 8057fb54 895361f8 bf916b3a 8057fb54 win32k!MultiUserNtGreCleanup+0x2b (
FPO: [0,0,0])
f70f6c50 bf916b3a 8057fb54 895361f8 00000000 nt!MmExpansionLock
f70f6c60 8069672f 00000000 89858020 89858020 win32k!Win32KDriverUnload+0xf (FPO:
[1,0,0])
f70f6ce0 805d211f 89858020 895461f8 f70f6d8c nt!MiDereferenceSessionFinal+0x140
(FPO: [EBP 0xf70f6d8c] [0,26,0])
f70f6cf8 805d2927 89858020 895461f8 89546448 nt!MmCleanProcessAddressSpace+0x6a
(FPO: [EBP 0xf70f6d8c] [1,1,0])
f70f6d8c 80595e6e 00000000 00000000 895461f8 nt!PspExitThread+0x673 (FPO: [Non-F
po])
f70f6da4 8059700c 895461f8 00000000 00000001 nt!PspTerminateThreadByPointer+0x49
(FPO: [Non-Fpo])
start end module name
804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
bfa1e000 bfa37f40 acpdf205 acpdf205.dll Wed Mar 06 06:55:12 2002 (3C8522A0)
bff60000 bff7b000 RDPDD RDPDD.dll Wed Mar 26 07:12:05 2003 (3E80B815)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
bffa0000 bffe8000 ATMFD ATMFD.DLL Tue Mar 25 20:46:23 2003 (3E80256F)
f4c07000 f4c10000 asyncmac asyncmac.sys Tue Mar 25 18:11:27 2003 (3E80011F)
f54c7000 f54e9000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
f5621000 f562b000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f5881000 f58e0000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
f5bb0000 f5bdf000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
f5d47000 f5d5f000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
f5ff6000 f6009000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
f6009000 f6074000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
f6074000 f609f000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
f609f000 f60d4000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
f60d4000 f6136000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
f615e000 f617a000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
f621a000 f6224000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f622a000 f6238000 dump_iirsp dump_iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205
)
f623a000 f624a760 naveng naveng.sys Fri Oct 01 11:59:17 2004 (415CB9F5)
f624b000 f62e3680 navex15 navex15.sys Fri Oct 01 12:11:15 2004 (415CBCC3)
f63a0000 f63b2f00 SYMEVENT SYMEVENT.SYS Thu Jan 15 13:02:13 2004 (4005F4A5)
f63b3000 f6402000 savrt savrt.sys Tue Feb 10 10:24:30 2004 (402816AE)
f640a000 f6411000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
f6472000 f6485000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
f64cd000 f6500000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
f6500000 f6534000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
f6534000 f6549000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
f6549000 f6564000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
f6564000 f657b000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
f657b000 f65a5000 ks ks.sys Tue Mar 25 19:47:36 2003 (3E8017A8)
f65a5000 f65b9000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
f65b9000 f65cd000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f65cd000 f65e4000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
f65e4000 f65fc000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
f65fc000 f6612000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
f6612000 f662b000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
f662b000 f667ed80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
f667f000 f66a0e80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
f66a1000 f66b9c00 e1000325 e1000325.sys Tue Jan 14 06:12:12 2003 (3E230F8C)
f6b00000 f6b0e000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
f6b10000 f6b19000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E
7FFFAB)
f6b30000 f6b3f000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f6b40000 f6b49000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
f6b50000 f6b5b000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
f6b60000 f6b6b000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
f6b70000 f6b7e000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
f6b80000 f6b89000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
f7183000 f71a5000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
f71a5000 f71e6000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
f71e6000 f7283000 Ntfs Ntfs.sys Tue Mar 25 18:40:05 2003 (3E8007D5)
f7283000 f72a4000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
f72a4000 f7367000 dmboot dmboot.sys Tue Mar 25 18:08:18 2003 (3E800062)
f7367000 f737d000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
f737d000 f7394000 storport storport.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f74c7000 f74d0000 ACPIEC ACPIEC.sys Tue Mar 25 18:16:26 2003 (3E80024A)
f74d7000 f74e5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
f74e7000 f74f5000 iirsp iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205)
f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
f7527000 f7531000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f7537000 f7547000 Savrtpel Savrtpel.sys Tue Feb 10 10:24:34 2004 (402816B2)
f7557000 f7563000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
f7567000 f7571000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
f7577000 f7583000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
f7587000 f7596000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
f7597000 f75a4000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
f75a7000 f75b4000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
f7607000 f7610000 ndisuio ndisuio.sys Tue Mar 25 18:09:47 2003 (3E8000BB)
f7667000 f7673000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
f7677000 f7680000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
f7687000 f7691000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f7697000 f76a1000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f76a7000 f76b2000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
f76b7000 f76c1000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f7717000 f771e000 intelide intelide.sys Tue Mar 25 18:04:45 2003 (3E7FFF8D)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f7727000 f772f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
f7797000 f779e000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f77b7000 f77bbe80 usbuhci usbuhci.sys Tue Mar 25 18:10:43 2003 (3E8000F3)
f77bf000 f77c7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f77df000 f77e7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f77e7000 f77ee000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f77ef000 f77f6000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f77f7000 f77ff000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f77ff000 f7807000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f7807000 f780f000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f7999000 f799a200 swenum swenum.sys Tue Mar 25 18:03:22 2003 (3E7FFF3A)
f799b000 f799c580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)

Unloaded modules:
f75c7000 f75d5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77d7000 f77df000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
quit:

 

C:\Program Files\Debugging Tools for Windows>kd -y srv*c:\symbols*http://msdl.mi
crosoft.com/download/symbols -i z:\i386 -z c:\windows\minidump\Mini123004-01.dmp


Microsoft (R) Windows Debugger Version 6.4.0004.4
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini123004-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: z:\i386
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Thu Dec 30 16:52:52.375 2004 (GMT+11)
System Uptime: 6 days 2:00:27.002
Loading Kernel Symbols
................................................................................
........................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {bc504a80, 0, bf90716a, 1}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!UnmapPrintKView+17 )

Followup: MachineOwner
---------

3: kd> !analyse -v;r;kv;lmtn;.logclose;q
No export analyse found
eax=f774f13c ebx=00000050 ecx=8940c020 edx=804e5bb0 esi=f774f120 edi=8940c020
eip=80543ac9 esp=f4125a18 ebp=f4125a30 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d pop ebp
ChildEBP RetAddr Args to Child
f4125a30 8052fa2f 00000050 bc504a80 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo
])
f4125a80 804e2dfc 00000000 bc504a80 00000000 nt!MmAccessFault+0x796 (FPO: [Non-F
po])
f4125a80 bf90716a 00000000 bc504a80 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFr
ame @ f4125a98)
f4125b10 bf85c647 bc138620 00000000 f4125b84 win32k!UnmapPrintKView+0x17 (FPO: [
1,0,0])
f4125b2c bf85c4f3 bc144a68 f4125bf4 00000000 win32k!PDEVOBJ:estroyFont+0x4c (F
PO: [Non-Fpo])
f4125b50 bf81b279 00000000 f4125b68 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x8c
(FPO: [Non-Fpo])
f4125b7c bf81a337 bc144a68 00000000 f4125bf4 win32k!RFONTOBJ::bMakeInactiveHelpe
r+0x217 (FPO: [Non-Fpo])
f4125bc8 bf80505a bc01d018 bf8053ab bc144a68 win32k!RFONTOBJ::vMakeInactive+0x61
(FPO: [Non-Fpo])
f4125bd0 bf8053ab bc144a68 00000000 00001094 win32k!RFONTOBJ::RFONTOBJ+0x12 (FPO
: [1,0,0])
f4125c00 bf80b777 010100fb 00001094 bc16d9c8 win32k!XDCOBJ::bCleanDC+0x22c (FPO:
[Non-Fpo])
f4125c14 bf90bc21 010100fb 00000001 00000001 win32k!bDeleteDCInternal+0x24 (FPO:
[Non-Fpo])
f4125c28 bf90b7ac 00001094 00000000 00001094 win32k!vCleanupDCs+0x23 (FPO: [1,0,
0])
f4125c44 bf952ec6 8057fb54 88d881f8 bf916b3a win32k!NtGdiCloseProcess+0x16 (FPO:
[EBP 0xba66a000] [0,1,0])
f4125c48 8057fb54 88d881f8 bf916b3a 8057fb54 win32k!MultiUserNtGreCleanup+0x2b (
FPO: [0,0,0])
f4125c50 bf916b3a 8057fb54 88d881f8 00000000 nt!MmExpansionLock
f4125c60 8069672f 00000000 89091020 89091020 win32k!Win32KDriverUnload+0xf (FPO:
[1,0,0])
f4125ce0 805d211f 89091020 8940c020 f4125d8c nt!MiDereferenceSessionFinal+0x140
(FPO: [EBP 0xf4125d8c] [0,26,0])
f4125cf8 805d2927 89091020 8940c020 8940c270 nt!MmCleanProcessAddressSpace+0x6a
(FPO: [EBP 0xf4125d8c] [1,1,0])
f4125d8c 80595e6e 00000000 00000000 8940c020 nt!PspExitThread+0x673 (FPO: [Non-F
po])
f4125da4 8059700c 8940c020 00000000 00000001 nt!PspTerminateThreadByPointer+0x49
(FPO: [Non-Fpo])
start end module name
804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
bfa1e000 bfa37f40 acpdf205 acpdf205.dll Wed Mar 06 06:55:12 2002 (3C8522A0)
bff60000 bff7b000 RDPDD RDPDD.dll Wed Mar 26 07:12:05 2003 (3E80B815)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
bffa0000 bffe8000 ATMFD ATMFD.DLL Tue Mar 25 20:46:23 2003 (3E80256F)
f4cca000 f4cda760 naveng naveng.sys Fri Oct 01 11:59:17 2004 (415CB9F5)
f4cdb000 f4d73680 navex15 navex15.sys Fri Oct 01 12:11:15 2004 (415CBCC3)
f4f84000 f4f8d000 asyncmac asyncmac.sys Tue Mar 25 18:11:27 2003 (3E80011F)
f583c000 f585e000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
f597e000 f5988000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f5bf6000 f5c55000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
f5f25000 f5f54000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
f60bc000 f60d4000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
f636b000 f637e000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
f637e000 f63e9000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
f63e9000 f6414000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
f6414000 f6449000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
f6471000 f64d3000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
f64d3000 f64ef000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
f659f000 f65a9000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f6715000 f6727f00 SYMEVENT SYMEVENT.SYS Thu Jan 15 13:02:13 2004 (4005F4A5)
f6728000 f6777000 savrt savrt.sys Tue Feb 10 10:24:30 2004 (402816AE)
f6787000 f678e000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
f67e7000 f67fa000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
f6842000 f6875000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
f6875000 f68a9000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
f68a9000 f68be000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
f68be000 f68d9000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
f68d9000 f68f0000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
f68f0000 f691a000 ks ks.sys Tue Mar 25 19:47:36 2003 (3E8017A8)
f691a000 f692e000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
f692e000 f6942000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f6942000 f6959000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
f6959000 f6971000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
f6971000 f6987000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
f6987000 f69a0000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
f69a0000 f69f3d80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
f69f4000 f6a15e80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
f6a16000 f6a2ec00 e1000325 e1000325.sys Tue Jan 14 06:12:12 2003 (3E230F8C)
f6ac8000 f6ad2000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f6ae8000 f6af6000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
f6af8000 f6b06000 dump_iirsp dump_iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205
)
f6b08000 f6b11000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E
7FFFAB)
f6b28000 f6b37000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f6b38000 f6b41000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
f6b48000 f6b53000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
f6b58000 f6b63000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
f7183000 f71a5000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
f71a5000 f71e6000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
f71e6000 f7283000 Ntfs Ntfs.sys Tue Mar 25 18:40:05 2003 (3E8007D5)
f7283000 f72a4000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
f72a4000 f7367000 dmboot dmboot.sys Tue Mar 25 18:08:18 2003 (3E800062)
f7367000 f737d000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
f737d000 f7394000 storport storport.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f74c7000 f74d0000 ACPIEC ACPIEC.sys Tue Mar 25 18:16:26 2003 (3E80024A)
f74d7000 f74e5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
f74e7000 f74f5000 iirsp iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205)
f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
f7527000 f7531000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
f7537000 f7540000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
f7547000 f7555000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
f7557000 f7567000 Savrtpel Savrtpel.sys Tue Feb 10 10:24:34 2004 (402816B2)
f7567000 f7573000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
f7577000 f7581000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
f7587000 f7593000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
f7597000 f75a6000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
f75a7000 f75b4000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
f75b7000 f75c4000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
f7627000 f7630000 ndisuio ndisuio.sys Tue Mar 25 18:09:47 2003 (3E8000BB)
f7677000 f7683000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
f7687000 f7690000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
f7697000 f76a1000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f76a7000 f76b1000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f76b7000 f76c2000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f7717000 f771e000 intelide intelide.sys Tue Mar 25 18:04:45 2003 (3E7FFF8D)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f7727000 f772f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
f777f000 f7786000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f77b7000 f77bbe80 usbuhci usbuhci.sys Tue Mar 25 18:10:43 2003 (3E8000F3)
f77bf000 f77c7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f77df000 f77e7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f77e7000 f77ee000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f77ef000 f77f6000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f77f7000 f77ff000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f77ff000 f7807000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f7807000 f780f000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f799f000 f79a0200 swenum swenum.sys Tue Mar 25 18:03:22 2003 (3E7FFF3A)
f79a5000 f79a6580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)

Unloaded modules:
f662f000 f6640000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6640000 f66d9000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f75c7000 f75d5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77d7000 f77df000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
quit:

 

C:\Program Files\Debugging Tools for Windows>kd -y srv*c:\symbols*http://msdl.mi
crosoft.com/download/symbols -i z:\i386 -z c:\windows\minidump\Mini010305-01.dmp


Microsoft (R) Windows Debugger Version 6.4.0004.4
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini010305-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: z:\i386
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Mon Jan 3 18:54:04.156 2005 (GMT+11)
System Uptime: 1 days 9:08:38.781
Loading Kernel Symbols
................................................................................
.......................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {bc3a25a8, 0, bf90716a, 1}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!UnmapPrintKView+17 )

Followup: MachineOwner
---------

0: kd> !analyse -v;r;kv;lmtn;.logclose;q
No export analyse found
eax=ffdff13c ebx=00000050 ecx=892d6020 edx=804e5bb0 esi=ffdff120 edi=892d6020
eip=80543ac9 esp=f6423a1c ebp=f6423a34 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d pop ebp
ChildEBP RetAddr Args to Child
f6423a34 8052fa2f 00000050 bc3a25a8 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo
])
f6423a84 804e2dfc 00000000 bc3a25a8 00000000 nt!MmAccessFault+0x796 (FPO: [Non-F
po])
f6423a84 bf90716a 00000000 bc3a25a8 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFr
ame @ f6423a9c)
f6423b14 bf85c647 bc0e5620 00000000 f6423b84 win32k!UnmapPrintKView+0x17 (FPO: [
1,0,0])
f6423b30 bf85c49c bc0f1a68 00000000 f6423bf4 win32k!PDEVOBJ:estroyFont+0x4c (F
PO: [Non-Fpo])
f6423b50 bf81b279 00000000 f6423b68 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x35
(FPO: [Non-Fpo])
f6423b7c bf81a337 bc0f1a68 00000000 f6423bf4 win32k!RFONTOBJ::bMakeInactiveHelpe
r+0x217 (FPO: [Non-Fpo])
f6423bc8 bf80505a bc01d018 bf8053ab bc0f1a68 win32k!RFONTOBJ::vMakeInactive+0x61
(FPO: [Non-Fpo])
f6423bd0 bf8053ab bc0f1a68 00000000 00000230 win32k!RFONTOBJ::RFONTOBJ+0x12 (FPO
: [1,0,0])
f6423c00 bf80b777 010100fb 00000230 bc11e9c8 win32k!XDCOBJ::bCleanDC+0x22c (FPO:
[Non-Fpo])
f6423c14 bf90bc21 010100fb 00000001 00000001 win32k!bDeleteDCInternal+0x24 (FPO:
[Non-Fpo])
f6423c28 bf90b7ac 00000230 00000000 00000230 win32k!vCleanupDCs+0x23 (FPO: [1,0,
0])
f6423c44 bf952ec6 8057fb54 893369d0 bf916b3a win32k!NtGdiCloseProcess+0x16 (FPO:
[EBP 0xf79a7000] [0,1,0])
f6423c48 8057fb54 893369d0 bf916b3a 8057fb54 win32k!MultiUserNtGreCleanup+0x2b (
FPO: [0,0,0])
f6423c50 bf916b3a 8057fb54 893369d0 00000000 nt!MmExpansionLock
f6423c60 8069672f 00000000 89f2bc88 89f2bc88 win32k!Win32KDriverUnload+0xf (FPO:
[1,0,0])
f6423ce0 805d211f 89f2bc88 892d6020 f6423d8c nt!MiDereferenceSessionFinal+0x140
(FPO: [EBP 0xf6423d8c] [0,26,0])
f6423cf8 805d2927 89f2bc88 892d6020 892d6270 nt!MmCleanProcessAddressSpace+0x6a
(FPO: [EBP 0xf6423d8c] [1,1,0])
f6423d8c 80595e6e 00000000 00000000 892d6020 nt!PspExitThread+0x673 (FPO: [Non-F
po])
f6423da4 8059700c 892d6020 00000000 00000001 nt!PspTerminateThreadByPointer+0x49
(FPO: [Non-Fpo])
start end module name
804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
bfa1e000 bfa37f40 acpdf205 acpdf205.dll Wed Mar 06 06:55:12 2002 (3C8522A0)
bff60000 bff7b000 RDPDD RDPDD.dll Wed Mar 26 07:12:05 2003 (3E80B815)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
bffa0000 bffe8000 ATMFD ATMFD.DLL Tue Mar 25 20:46:23 2003 (3E80256F)
f56f7000 f5719000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
f5899000 f58a3000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f5bf1000 f5c50000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
f5ed0000 f5eff000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
f60cf000 f60d8000 ndisuio ndisuio.sys Tue Mar 25 18:09:47 2003 (3E8000BB)
f6107000 f611f000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
f6147000 f615a000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
f615a000 f61c5000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
f61c5000 f61f0000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
f61f0000 f6225000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
f6225000 f6287000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
f6287000 f62a3000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
f6564000 f6574760 naveng naveng.sys Fri Oct 01 11:59:17 2004 (415CB9F5)
f6575000 f660d680 navex15 navex15.sys Fri Oct 01 12:11:15 2004 (415CBCC3)
f660e000 f6620f00 SYMEVENT SYMEVENT.SYS Thu Jan 15 13:02:13 2004 (4005F4A5)
f6621000 f6670000 savrt savrt.sys Tue Feb 10 10:24:30 2004 (402816AE)
f6760000 f6773000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
f6817000 f684a000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
f684a000 f687e000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
f687e000 f6893000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
f6893000 f68ae000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
f690e000 f6918000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f691e000 f692c000 dump_iirsp dump_iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205
)
f692e000 f6937000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E
7FFFAB)
f694e000 f6965000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
f6965000 f698f000 ks ks.sys Tue Mar 25 19:47:36 2003 (3E8017A8)
f698f000 f69a3000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
f69a3000 f69b7000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f69b7000 f69ce000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
f69ce000 f69e6000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
f69e6000 f69fc000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
f69fc000 f6a15000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
f6a15000 f6a68d80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
f6a69000 f6a8ae80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
f6a8b000 f6aab200 e1000325 e1000325.sys Sat Mar 13 05:45:35 2004 (4052054F)
f7183000 f71a5000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
f71a5000 f71e6000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
f71e6000 f7283000 Ntfs Ntfs.sys Tue Mar 25 18:40:05 2003 (3E8007D5)
f7283000 f72a4000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
f72a4000 f7367000 dmboot dmboot.sys Tue Mar 25 18:08:18 2003 (3E800062)
f7367000 f737d000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
f737d000 f7394000 storport storport.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f74c7000 f74d0000 ACPIEC ACPIEC.sys Tue Mar 25 18:16:26 2003 (3E80024A)
f74d7000 f74e5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
f74e7000 f74f5000 iirsp iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205)
f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
f7527000 f7530000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
f7537000 f7546000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f7547000 f7555000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
f7567000 f7571000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f7577000 f7587000 Savrtpel Savrtpel.sys Tue Feb 10 10:24:34 2004 (402816B2)
f75c7000 f75d3000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
f75d7000 f75e1000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
f75e7000 f75f3000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
f75f7000 f7606000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
f7607000 f7614000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
f7617000 f7624000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
f7627000 f7633000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
f7637000 f7640000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
f7647000 f7651000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f7657000 f7661000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f7667000 f7672000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
f7677000 f7681000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
f7687000 f7690000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
f7697000 f76a5000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
f76a7000 f76b2000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
f76b7000 f76c2000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f7717000 f771e000 intelide intelide.sys Tue Mar 25 18:04:45 2003 (3E7FFF8D)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f7727000 f772f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
f775f000 f7767000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f7767000 f776f000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f777f000 f7786000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f779f000 f77a6000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
f77d7000 f77dbe80 usbuhci usbuhci.sys Tue Mar 25 18:10:43 2003 (3E8000F3)
f77df000 f77e7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f7807000 f780f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f780f000 f7816000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f7817000 f781e000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f781f000 f7827000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f7991000 f7992200 swenum swenum.sys Tue Mar 25 18:03:22 2003 (3E7FFF3A)
f7993000 f7994580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)

Unloaded modules:
f693e000 f694c000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77ef000 f77f7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
quit:

 

Well, thats odd.
In english, a user is logging off, so windows is tearing down the processes and threads. As part of this action, it is cleaning up and leftover DCs (device context, the thing used for drawing to screen or printing). This is a kind of a container, and holds things like fonts, palettes, etc.. Its in the middle of cleaning up a font object, and blowing up.

" !analyse -v;r;kv;lmtn;.logclose;q "
you spelled analyze wrong please rerun that on just one of the dumps with the correct spelling, so i can get the trap frame out of this stack, i beleive it to be quite relevant.

Also, configure your system to collect a COMPLETE dump. I'll need to see what the stack looks like from your redo, but we may need a full one to take this to ground.

also, kudos for using some kungfu and cracking it old school.

 

Hi Ben,

Thanks for your response, it is most appreciated.

Sorry about the spelling of analyze - here in Australia we spell it with an s! I have redone the last dump for you.

Regarding the full memory dump, I already have a full dump, but it is 24Mb zipped! Is there any way I can get that file to you?

Thanks again for your help

Peter





Loading Dump File [c:\windows\minidump\Mini010305-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: z:\i386
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Mon Jan 3 18:54:04.156 2005 (GMT+11)
System Uptime: 1 days 9:08:38.781
Loading Kernel Symbols
................................................................................
.......................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {bc3a25a8, 0, bf90716a, 1}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!UnmapPrintKView+17 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: bc3a25a8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf90716a, If non-zero, the instruction address which referenced the bad me
mory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: bc3a25a8

FAULTING_IP:
win32k!UnmapPrintKView+17
bf90716a 8b06 mov eax,[esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x50

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from bf85c647 to bf90716a

TRAP_FRAME: f6423a9c -- (.trap fffffffff6423a9c)
ErrCode = 00000000
eax=00000001 ebx=bc0f1a68 ecx=00000000 edx=00000000 esi=bc3a25a8 edi=89702fc8
eip=bf90716a esp=f6423b10 ebp=f6423b30 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
win32k!UnmapPrintKView+0x17:
bf90716a 8b06 mov eax,[esi] ds:0023:bc3a25a8=????????
Resetting default scope

STACK_TEXT:
f6423b14 bf85c647 bc0e5620 00000000 f6423b84 win32k!UnmapPrintKView+0x17
f6423b30 bf85c49c bc0f1a68 00000000 f6423bf4 win32k!PDEVOBJ:estroyFont+0x4c
f6423b50 bf81b279 00000000 f6423b68 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x35
f6423b7c bf81a337 bc0f1a68 00000000 f6423bf4 win32k!RFONTOBJ::bMakeInactiveHelpe
r+0x217
f6423bc8 bf80505a bc01d018 bf8053ab bc0f1a68 win32k!RFONTOBJ::vMakeInactive+0x61

f6423bd0 bf8053ab bc0f1a68 00000000 00000230 win32k!RFONTOBJ::RFONTOBJ+0x12
f6423c00 bf80b777 010100fb 00000230 bc11e9c8 win32k!XDCOBJ::bCleanDC+0x22c
f6423c14 bf90bc21 010100fb 00000001 00000001 win32k!bDeleteDCInternal+0x24
f6423c28 bf90b7ac 00000230 00000000 00000230 win32k!vCleanupDCs+0x23
f6423c44 bf952ec6 8057fb54 893369d0 bf916b3a win32k!NtGdiCloseProcess+0x16
f6423c48 8057fb54 893369d0 bf916b3a 8057fb54 win32k!MultiUserNtGreCleanup+0x2b
f6423c50 bf916b3a 8057fb54 893369d0 00000000 nt!MmExpansionLock
f6423c60 8069672f 00000000 89f2bc88 89f2bc88 win32k!Win32KDriverUnload+0xf
f6423ce0 805d211f 89f2bc88 892d6020 f6423d8c nt!MiDereferenceSessionFinal+0x140
f6423cf8 805d2927 89f2bc88 892d6020 892d6270 nt!MmCleanProcessAddressSpace+0x6a
f6423d8c 80595e6e 00000000 00000000 892d6020 nt!PspExitThread+0x673
f6423da4 8059700c 892d6020 00000000 00000001 nt!PspTerminateThreadByPointer+0x49

f6423ddc 805008c6 bf921d53 89196080 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
win32k!UnmapPrintKView+17
bf90716a 8b06 mov eax,[esi]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!UnmapPrintKView+17

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4117ff27

STACK_COMMAND: .trap fffffffff6423a9c ; kb

FAILURE_BUCKET_ID: 0x50_win32k!UnmapPrintKView+17

BUCKET_ID: 0x50_win32k!UnmapPrintKView+17

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000050 ecx=892d6020 edx=804e5bb0 esi=ffdff120 edi=892d6020
eip=80543ac9 esp=f6423a1c ebp=f6423a34 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d pop ebp
ChildEBP RetAddr Args to Child
f6423a34 8052fa2f 00000050 bc3a25a8 00000000 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo
])
f6423a84 804e2dfc 00000000 bc3a25a8 00000000 nt!MmAccessFault+0x796 (FPO: [Non-F
po])
f6423a84 bf90716a 00000000 bc3a25a8 00000000 nt!KiTrap0E+0xc8 (FPO: [0,0] TrapFr
ame @ f6423a9c)
f6423b14 bf85c647 bc0e5620 00000000 f6423b84 win32k!UnmapPrintKView+0x17 (FPO: [
1,0,0])
f6423b30 bf85c49c bc0f1a68 00000000 f6423bf4 win32k!PDEVOBJ:estroyFont+0x4c (F
PO: [Non-Fpo])
f6423b50 bf81b279 00000000 f6423b68 00000000 win32k!RFONTOBJ::bDeleteRFONT+0x35
(FPO: [Non-Fpo])
f6423b7c bf81a337 bc0f1a68 00000000 f6423bf4 win32k!RFONTOBJ::bMakeInactiveHelpe
r+0x217 (FPO: [Non-Fpo])
f6423bc8 bf80505a bc01d018 bf8053ab bc0f1a68 win32k!RFONTOBJ::vMakeInactive+0x61
(FPO: [Non-Fpo])
f6423bd0 bf8053ab bc0f1a68 00000000 00000230 win32k!RFONTOBJ::RFONTOBJ+0x12 (FPO
: [1,0,0])
f6423c00 bf80b777 010100fb 00000230 bc11e9c8 win32k!XDCOBJ::bCleanDC+0x22c (FPO:
[Non-Fpo])
f6423c14 bf90bc21 010100fb 00000001 00000001 win32k!bDeleteDCInternal+0x24 (FPO:
[Non-Fpo])
f6423c28 bf90b7ac 00000230 00000000 00000230 win32k!vCleanupDCs+0x23 (FPO: [1,0,
0])
f6423c44 bf952ec6 8057fb54 893369d0 bf916b3a win32k!NtGdiCloseProcess+0x16 (FPO:
[EBP 0xf79a7000] [0,1,0])
f6423c48 8057fb54 893369d0 bf916b3a 8057fb54 win32k!MultiUserNtGreCleanup+0x2b (
FPO: [0,0,0])
f6423c50 bf916b3a 8057fb54 893369d0 00000000 nt!MmExpansionLock
f6423c60 8069672f 00000000 89f2bc88 89f2bc88 win32k!Win32KDriverUnload+0xf (FPO:
[1,0,0])
f6423ce0 805d211f 89f2bc88 892d6020 f6423d8c nt!MiDereferenceSessionFinal+0x140
(FPO: [EBP 0xf6423d8c] [0,26,0])
f6423cf8 805d2927 89f2bc88 892d6020 892d6270 nt!MmCleanProcessAddressSpace+0x6a
(FPO: [EBP 0xf6423d8c] [1,1,0])
f6423d8c 80595e6e 00000000 00000000 892d6020 nt!PspExitThread+0x673 (FPO: [Non-F
po])
f6423da4 8059700c 892d6020 00000000 00000001 nt!PspTerminateThreadByPointer+0x49
(FPO: [Non-Fpo])
start end module name
804de000 80745000 nt ntkrnlmp.exe Thu May 27 10:32:57 2004 (40B53739)
80745000 8076d000 hal halmacpi.dll Tue Mar 25 18:07:28 2003 (3E800030)
bf800000 bf9c7000 win32k win32k.sys Tue Aug 10 08:48:07 2004 (4117FF27)
bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 20:43:37 2003 (3E8024C9)
bfa1e000 bfa37f40 acpdf205 acpdf205.dll Wed Mar 06 06:55:12 2002 (3C8522A0)
bff60000 bff7b000 RDPDD RDPDD.dll Wed Mar 26 07:12:05 2003 (3E80B815)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 20:46:23 2003 (3E80256F)
bffa0000 bffe8000 ATMFD ATMFD.DLL Tue Mar 25 20:46:23 2003 (3E80256F)
f56f7000 f5719000 RDPWD RDPWD.SYS Tue Mar 25 18:03:00 2003 (3E7FFF24)
f5899000 f58a3000 TDTCP TDTCP.SYS Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f5bf1000 f5c50000 srv srv.sys Tue Mar 25 19:49:51 2003 (3E80182F)
f5ed0000 f5eff000 afd afd.sys Tue Mar 25 18:40:50 2003 (3E800802)
f60cf000 f60d8000 ndisuio ndisuio.sys Tue Mar 25 18:09:47 2003 (3E8000BB)
f6107000 f611f000 Cdfs Cdfs.SYS Tue Mar 25 19:17:19 2003 (3E80108F)
f6147000 f615a000 Fips Fips.SYS Tue Mar 25 19:54:59 2003 (3E801963)
f615a000 f61c5000 mrxsmb mrxsmb.sys Tue Oct 12 10:38:12 2004 (416B2774)
f61c5000 f61f0000 rdbss rdbss.sys Tue Oct 12 10:38:09 2004 (416B2771)
f61f0000 f6225000 netbt netbt.sys Sat Jul 19 03:16:03 2003 (3F182B53)
f6225000 f6287000 tcpip tcpip.sys Tue Mar 25 19:04:01 2003 (3E800D71)
f6287000 f62a3000 ipsec ipsec.sys Tue Mar 25 18:55:45 2003 (3E800B81)
f6564000 f6574760 naveng naveng.sys Fri Oct 01 11:59:17 2004 (415CB9F5)
f6575000 f660d680 navex15 navex15.sys Fri Oct 01 12:11:15 2004 (415CBCC3)
f660e000 f6620f00 SYMEVENT SYMEVENT.SYS Thu Jan 15 13:02:13 2004 (4005F4A5)
f6621000 f6670000 savrt savrt.sys Tue Feb 10 10:24:30 2004 (402816AE)
f6760000 f6773000 usbhub usbhub.sys Tue Mar 25 18:10:46 2003 (3E8000F6)
f6817000 f684a000 update update.sys Tue Mar 25 19:59:59 2003 (3E801A8F)
f684a000 f687e000 rdpdr rdpdr.sys Tue Mar 25 18:09:30 2003 (3E8000AA)
f687e000 f6893000 raspptp raspptp.sys Tue Mar 25 19:19:09 2003 (3E8010FD)
f6893000 f68ae000 ndiswan ndiswan.sys Tue Mar 25 19:48:19 2003 (3E8017D3)
f690e000 f6918000 Dxapi Dxapi.sys Tue Mar 25 18:06:01 2003 (3E7FFFD9)
f691e000 f692c000 dump_iirsp dump_iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205
)
f692e000 f6937000 dump_diskdump dump_diskdump.sys Tue Mar 25 18:05:15 2003 (3E
7FFFAB)
f694e000 f6965000 rasl2tp rasl2tp.sys Tue Mar 25 18:54:46 2003 (3E800B46)
f6965000 f698f000 ks ks.sys Tue Mar 25 19:47:36 2003 (3E8017A8)
f698f000 f69a3000 redbook redbook.sys Tue Mar 25 18:04:38 2003 (3E7FFF86)
f69a3000 f69b7000 cdrom cdrom.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f69b7000 f69ce000 parport parport.sys Tue Mar 25 18:03:56 2003 (3E7FFF5C)
f69ce000 f69e6000 serial serial.sys Tue Mar 25 18:40:08 2003 (3E8007D8)
f69e6000 f69fc000 i8042prt i8042prt.sys Tue Mar 25 20:01:43 2003 (3E801AF7)
f69fc000 f6a15000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 18:08:02 2003 (3E800052)
f6a15000 f6a68d80 ati2mpad ati2mpad.sys Fri Jul 19 11:13:20 2002 (3D3767B0)
f6a69000 f6a8ae80 USBPORT USBPORT.SYS Tue Mar 25 18:10:43 2003 (3E8000F3)
f6a8b000 f6aab200 e1000325 e1000325.sys Sat Mar 13 05:45:35 2004 (4052054F)
f7183000 f71a5000 Mup Mup.sys Tue Mar 25 19:55:58 2003 (3E80199E)
f71a5000 f71e6000 NDIS NDIS.sys Tue Mar 25 19:45:35 2003 (3E80172F)
f71e6000 f7283000 Ntfs Ntfs.sys Tue Mar 25 18:40:05 2003 (3E8007D5)
f7283000 f72a4000 KSecDD KSecDD.sys Tue Mar 25 18:05:39 2003 (3E7FFFC3)
f72a4000 f7367000 dmboot dmboot.sys Tue Mar 25 18:08:18 2003 (3E800062)
f7367000 f737d000 CLASSPNP CLASSPNP.SYS Tue Mar 25 18:38:14 2003 (3E800766)
f737d000 f7394000 storport storport.sys Tue Mar 25 18:05:18 2003 (3E7FFFAE)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 18:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 18:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 18:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 18:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 18:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 18:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 18:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 18:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 18:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f74c7000 f74d0000 ACPIEC ACPIEC.sys Tue Mar 25 18:16:26 2003 (3E80024A)
f74d7000 f74e5000 PartMgr PartMgr.sys Tue Mar 25 19:04:02 2003 (3E800D72)
f74e7000 f74f5000 iirsp iirsp.sys Sat Nov 09 11:08:37 2002 (3DCC5205)
f74f7000 f7506000 disk disk.sys Tue Mar 25 18:05:20 2003 (3E7FFFB0)
f7507000 f7513000 Dfs Dfs.sys Tue Mar 25 18:09:52 2003 (3E8000C0)
f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 18:07:23 2003 (3E80002B)
f7527000 f7530000 raspti raspti.sys Tue Mar 25 18:11:36 2003 (3E800128)
f7537000 f7546000 termdd termdd.sys Tue Mar 25 18:02:52 2003 (3E7FFF1C)
f7547000 f7555000 NDProxy NDProxy.SYS Tue Mar 25 18:11:30 2003 (3E800122)
f7567000 f7571000 flpydisk flpydisk.sys Tue Mar 25 18:04:32 2003 (3E7FFF80)
f7577000 f7587000 Savrtpel Savrtpel.sys Tue Feb 10 10:24:34 2004 (402816B2)
f75c7000 f75d3000 vga vga.sys Tue Mar 25 18:08:03 2003 (3E800053)
f75d7000 f75e1000 Msfs Msfs.SYS Tue Mar 25 18:08:56 2003 (3E800088)
f75e7000 f75f3000 Npfs Npfs.SYS Tue Mar 25 18:08:59 2003 (3E80008B)
f75f7000 f7606000 msgpc msgpc.sys Tue Mar 25 18:10:12 2003 (3E8000D4)
f7607000 f7614000 wanarp wanarp.sys Tue Mar 25 18:11:22 2003 (3E80011A)
f7617000 f7624000 netbios netbios.sys Tue Mar 25 18:09:53 2003 (3E8000C1)
f7627000 f7633000 processr processr.sys Tue Mar 25 18:07:36 2003 (3E800038)
f7637000 f7640000 watchdog watchdog.sys Tue Mar 25 18:09:01 2003 (3E80008D)
f7647000 f7651000 mouclass mouclass.sys Tue Mar 25 18:03:09 2003 (3E7FFF2D)
f7657000 f7661000 kbdclass kbdclass.sys Tue Mar 25 18:03:10 2003 (3E7FFF2E)
f7667000 f7672000 fdc fdc.sys Tue Mar 25 18:04:31 2003 (3E7FFF7F)
f7677000 f7681000 serenum serenum.sys Tue Mar 25 18:04:01 2003 (3E7FFF61)
f7687000 f7690000 ndistapi ndistapi.sys Tue Mar 25 18:11:28 2003 (3E800120)
f7697000 f76a5000 raspppoe raspppoe.sys Tue Mar 25 18:11:37 2003 (3E800129)
f76a7000 f76b2000 TDI TDI.SYS Tue Mar 25 18:14:28 2003 (3E8001D4)
f76b7000 f76c2000 ptilink ptilink.sys Tue Mar 25 18:03:51 2003 (3E7FFF57)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 18:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 18:07:58 2003 (3E80004E)
f7717000 f771e000 intelide intelide.sys Tue Mar 25 18:04:45 2003 (3E7FFF8D)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 18:08:08 2003 (3E800058)
f7727000 f772f000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 18:16:25 2003 (3E800249)
f775f000 f7767000 rasacd rasacd.sys Tue Mar 25 18:11:50 2003 (3E800136)
f7767000 f776f000 RDPCDD RDPCDD.sys Tue Mar 25 18:03:05 2003 (3E7FFF29)
f777f000 f7786000 dxgthk dxgthk.sys Tue Mar 25 18:05:52 2003 (3E7FFFD0)
f779f000 f77a6000 parvdm parvdm.sys Tue Mar 25 18:03:49 2003 (3E7FFF55)
f77d7000 f77dbe80 usbuhci usbuhci.sys Tue Mar 25 18:10:43 2003 (3E8000F3)
f77df000 f77e7000 audstub audstub.sys Tue Mar 25 18:09:12 2003 (3E800098)
f7807000 f780f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 18:08:36 2003 (3E800074)
f780f000 f7816000 Null Null.SYS Tue Mar 25 18:03:05 2003 (3E7FFF29)
f7817000 f781e000 Beep Beep.SYS Tue Mar 25 18:03:04 2003 (3E7FFF28)
f781f000 f7827000 mnmdd mnmdd.SYS Tue Mar 25 18:07:53 2003 (3E800049)
f7991000 f7992200 swenum swenum.sys Tue Mar 25 18:03:22 2003 (3E7FFF3A)
f7993000 f7994580 USBD USBD.SYS Tue Mar 25 18:10:39 2003 (3E8000EF)

Unloaded modules:
f693e000 f694c000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77ef000 f77f7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
quit:

 

I already have a full dump, but it is 24Mb zipped! Is there any way I can get that file to you?
Unfortunatly, the constraints of my involvement on this board preclude me taking that level of detailed data from you. I try to help out where i can, but ultimatly, my goal in participating here is to provide education and awareness. If i started taking dumps from random people, the next guy who has a problem doesnt get the value of finding this old post, and the methodology we used to identify and resolve the problem. Sorry. If you are in a hurry, i recommend you visit support.microsoft.com and open up an incident with microsoft PSS.

thanks for rerunning that data, thats what i need. I dont have a 2003 machine at home to crossreference. Our next goal will be to try to figure out what font its trying to kill and what process opened that DC and left it open.


I'll need to research that tomorrow at work, where i can look at a 2003 machine. Save this dump c:\windows\minidump\Mini010305-01.dmp, we are not done with it.

 

Sorry about that, I am new to WindowsBBS so did not know!

I won't open an incident with microsoft PSS. I am keen to see if you can help me via the forum.

Thanking you

 

I won't open an incident with microsoft PSS.
I think you are going to have to.

This crash is resolved by this hotfix:

830648 BugCheck 50 error when you use Remote Desktop Connection to disconnect
http://support.microsoft.com/?id=830648

Heres the problem, your Win32k.sys is newer than the file in that hotfix. If you tried to apply it, it wouldnt install.

You need to call PSS, open up a ticket to get that hotfix sent to you, verify it doesnt update the file, then complain it doesn't do anything and seek further investigation from Microsoft.


As a side note, this IS caused by broken fonts. If you have any custom fonts, or do a lot of PDF (with embedded fonts) printing, thats your vector.

 

Hi Ben,

Thankyou so much for your assistance.

Our server ran fine for a few months.Then around the time we put on a new software package the crashes started occuring. I had suspected this software from the beginning but was not able to prove that it was causing the problem. This new software installs a PDF printer, and I am pretty sure it would use custom fonts. Based on what you have said I am 99.9% sure that this software has caused our problem.

Do you think the hotfix by itself will fix my problem, or do I also need to contact the software provider and get them to fix something in their software? (e.g. the PDF printer)

If the problem is caused by the installation of this new software, do you think this crash is the fault of the software provider, or Microsoft, or both? Personally, I am not a finger pointer and will be happy just to get this problem fixed, however my clients and employer will want to know who is at fault.

Thanks again!

Peter

 

I think you missed part of the point of my post. I do not beleive this hotfix would work for you. Please reread my above post for clarification.

I can only suggest a potential vector with such a limited dataset (which i have, above). I would need detailed time with the data to make any sort of judgement as to where the defect is or verify the suspected cause of the problem. Root cause takes a lot of time, effort and specialized skills (which do not come free on the internet). However, Microsoft can assist you in tracking down the root cause of the phenomenon, for more information, please visit http://support.microsoft.com.

If my recommendation for your course of action is confusing, please ask questions.

 

Call PSS - Ask for KB830648 (free call)
This will install, but not change any files, nor fix your problem.

When this happens, you will need to call back to obtain a newer QFE that contains WIN32K.SYS from KB840987/MS04-032 or later. Or get walked through tricking the installed for 04-023.

You are in a catch 22 situation right now. Your file is newer than the hotfix, so you cannot install the hotfix. The file you ACTUALLY need are in ms04-032 (or later), but you already have that installed, so you cannot get the QFE build out of it. You have to either find a hotfix that is newer than 04-023, or uninstall the security fix, install the hotfix, then reinstall the security fix.

This is complicated and doesnt always work as expected. Which is why i recommended you talk to PSS rather than writeup a less than detailed explination here.

 

When I said: "Do you think the hotfix by itself will fix my problem" I assumed that when I tell MS that the fix doesn't work they will simply update the win32k.sys in their fix. Sorry, I don't know what I was thinking when I thought it would be that easy!

I have opened the incident and have received the hotfix. I am going to try and install it in the next couple of hours and will then get MS to persue the matter further as you have suggested.

Thanks for your help, I will let you know how it works out.

 

Oh, i see what you meant. When you get the correct version of win32k on the machine, i would wager that your problem will not occur again.

 

Looks like the problem has been resolved

I contacted Microsoft to obtain the KB830648 hotfix. As Ben said, this did not do anything because the hotfix has an older version of Win32k.sys (5.2.3790.92) than on the server due to other updates provided as part of WinodwsUpdate. I was then instructed to install hotfix KB885450 which contains the most recent version of Win32k.sys (5.2.3790.231).

You were spot on Ben. Well done and thank you very much. I have one final question though:

In the case summary the Microsoft Professional that I was dealing with wrote: "Analysed memory dump and determined problem was related to Terminal Server and 3rd party Fonts/Printers and Win32k.sys ". I am certain I know what software package triggered this phenomenon because it was installed at the same time the server started giving BSOD's. I assume that because the problem was rectified by a bugfix then the problem is Microsoft's fault? (even though MS can't give me an info on the actual bug) I am wondering if any blame can be attributed to the software vendor, especially if they claim that their software is "fully compatible with Windows 2003 Terminal Server ". Surely if they had thoroughly tested the software on a Windows 2003 TS they would have experienced the same problem. I took the drastic measure of re-installing the whole server from scratch and the problem re-occured immediately, which suggest it would occur on any fresh install of Windows 2003 TS. Do you think I am being a bit harsh towards the vendor?

Thanks again.

 

Great, im glad it all worked out.

I will not speak towards your questions except to say the only important difference between a good vendor and a bad vendor is how they handle problems.