Hello
Sincère couple of days my terminal server crash
I try to run the windows debugger but I don t understand a lot from the information I received
Can someone explain me what the problem is, and maybe how to resolve it
Thanks in advance
Michael
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Michael\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: LanManNt, suite: TerminalServer
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff8000181f000 PsLoadedModuleList = 0xfffff80001a5ce50
Debug session time: Wed Jan 12 21:56:47.086 2011 (UTC + 1:00)
System Uptime: 1 days 2:32:40.116
Loading Kernel Symbols
…
…
…
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type “.hh dbgerr001” for details
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff96000218936, fffff8800fe9cef0, 0}
Page 20801f not present in the dump file. Type “.hh dbgerr004” for details
Probably caused by : RDPDD.dll ( RDPDD!DDGetAssociatedMonitorInfo+c6 )
Followup: MachineOwner
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000218936, Address of the instruction which caused the bugcheck
Arg3: fffff8800fe9cef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!EngFileIoControl+22
fffff960`00218936 f6415002 test byte ptr [rcx+50h],2
CONTEXT: fffff8800fe9cef0 – (.cxr 0xfffff8800fe9cef0)
rax=0000000000000000 rbx=fffff8800fe9d9f0 rcx=0000000000000000
rdx=0000000000381483 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000218936 rsp=fffff8800fe9d8c0 rbp=fffffa8006c7e900
r8=fffff8800fe9d9a0 r9=0000000000000014 r10=fffffa8006741a60
r11=fffff8800fe9d8e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!EngFileIoControl+0x22:
fffff96000218936 f6415002 test byte ptr [rcx+50h],2 ds:002b:0000000000000050=??
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: DLS.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000ea33de to fffff96000218936
STACK_TEXT:
fffff8800fe9d8c0 fffff96000ea33de : fffff8800fe9d9f0 fffffa8006c7e900 00000000000000000000000000000000 : win32k!EngFileIoControl+0x22
fffff8800fe9d950 fffff96000ea24b5 : fffffa8006c7e900 0000000000000000 fffff880000000040000000000000000 : RDPDD!DDGetAssociatedMonitorInfo+0xc6
fffff8800fe9d9d0 fffff96000073ca8 : 0000000000000000 00000000000000000000000000000001 0000000000000000 : RDPDD!DrvGetModes+0x65
fffff8800fe9da50 fffff96000073851 : 0000000000000000 0000000004b7e070 fffff900c0ac7b80 fffff900c00b4680 : win32k!ldevGetDriverModes+0xc8
fffff8800fe9dae0 fffff960000b272c : 0000000000000000 00000000000000000000000004b7e070 0000000000000000 : win32k!DrvBuildDevmodeList+0x151
fffff8800fe9db30 fffff960000b2221 : 00000000ffff0000 0000000004b7e9e0 0000000000000000 000000000565dbd8 : win32k!DrvEnumDisplaySettings+0x4cc
fffff8800fe9dbe0 fffff8000188e993 : fffffa800ff04060 fffff8800fe9dca0 0000000000000000fffff900c00c1000 : win32k!NtUserEnumDisplaySettings+0x45
fffff8800fe9dc20 0000000073d50d0a : 0000000000000000 00000000000000000000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13
0000000004b7e048 0000000000000000 : 0000000000000000 00000000000000000000000000000000 0000000000000000 : 0x73d50d0a
FOLLOWUP_IP:
RDPDD!DDGetAssociatedMonitorInfo+c6
fffff960`00ea33de 3bc7 cmp eax,edi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: RDPDD!DDGetAssociatedMonitorInfo+c6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPDD
IMAGE_NAME: RDPDD.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bce76
STACK_COMMAND: .cxr 0xfffff8800fe9cef0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
Followup: MachineOwner
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000218936, Address of the instruction which caused the bugcheck
Arg3: fffff8800fe9cef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!EngFileIoControl+22
fffff960`00218936 f6415002 test byte ptr [rcx+50h],2
CONTEXT: fffff8800fe9cef0 – (.cxr 0xfffff8800fe9cef0)
rax=0000000000000000 rbx=fffff8800fe9d9f0 rcx=0000000000000000
rdx=0000000000381483 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000218936 rsp=fffff8800fe9d8c0 rbp=fffffa8006c7e900
r8=fffff8800fe9d9a0 r9=0000000000000014 r10=fffffa8006741a60
r11=fffff8800fe9d8e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!EngFileIoControl+0x22:
fffff96000218936 f6415002 test byte ptr [rcx+50h],2 ds:002b:0000000000000050=??
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: DLS.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000ea33de to fffff96000218936
STACK_TEXT:
fffff8800fe9d8c0 fffff96000ea33de : fffff8800fe9d9f0 fffffa8006c7e900 00000000000000000000000000000000 : win32k!EngFileIoControl+0x22
fffff8800fe9d950 fffff96000ea24b5 : fffffa8006c7e900 0000000000000000 fffff880000000040000000000000000 : RDPDD!DDGetAssociatedMonitorInfo+0xc6
fffff8800fe9d9d0 fffff96000073ca8 : 0000000000000000 00000000000000000000000000000001 0000000000000000 : RDPDD!DrvGetModes+0x65
fffff8800fe9da50 fffff96000073851 : 0000000000000000 0000000004b7e070 fffff900c0ac7b80 fffff900c00b4680 : win32k!ldevGetDriverModes+0xc8
fffff8800fe9dae0 fffff960000b272c : 0000000000000000 00000000000000000000000004b7e070 0000000000000000 : win32k!DrvBuildDevmodeList+0x151
fffff8800fe9db30 fffff960000b2221 : 00000000ffff0000 0000000004b7e9e0 0000000000000000 000000000565dbd8 : win32k!DrvEnumDisplaySettings+0x4cc
fffff8800fe9dbe0 fffff8000188e993 : fffffa800ff04060 fffff8800fe9dca0 0000000000000000fffff900c00c1000 : win32k!NtUserEnumDisplaySettings+0x45
fffff8800fe9dc20 0000000073d50d0a : 0000000000000000 00000000000000000000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13
0000000004b7e048 0000000000000000 : 0000000000000000 00000000000000000000000000000000 0000000000000000 : 0x73d50d0a
FOLLOWUP_IP:
RDPDD!DDGetAssociatedMonitorInfo+c6
fffff960`00ea33de 3bc7 cmp eax,edi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: RDPDD!DDGetAssociatedMonitorInfo+c6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPDD
IMAGE_NAME: RDPDD.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bce76
STACK_COMMAND: .cxr 0xfffff8800fe9cef0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
Followup: MachineOwner
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000218936, Address of the instruction which caused the bugcheck
Arg3: fffff8800fe9cef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!EngFileIoControl+22
fffff960`00218936 f6415002 test byte ptr [rcx+50h],2
CONTEXT: fffff8800fe9cef0 – (.cxr 0xfffff8800fe9cef0)
rax=0000000000000000 rbx=fffff8800fe9d9f0 rcx=0000000000000000
rdx=0000000000381483 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000218936 rsp=fffff8800fe9d8c0 rbp=fffffa8006c7e900
r8=fffff8800fe9d9a0 r9=0000000000000014 r10=fffffa8006741a60
r11=fffff8800fe9d8e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!EngFileIoControl+0x22:
fffff96000218936 f6415002 test byte ptr [rcx+50h],2 ds:002b:0000000000000050=??
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: DLS.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000ea33de to fffff96000218936
STACK_TEXT:
fffff8800fe9d8c0 fffff96000ea33de : fffff8800fe9d9f0 fffffa8006c7e900 00000000000000000000000000000000 : win32k!EngFileIoControl+0x22
fffff8800fe9d950 fffff96000ea24b5 : fffffa8006c7e900 0000000000000000 fffff880000000040000000000000000 : RDPDD!DDGetAssociatedMonitorInfo+0xc6
fffff8800fe9d9d0 fffff96000073ca8 : 0000000000000000 00000000000000000000000000000001 0000000000000000 : RDPDD!DrvGetModes+0x65
fffff8800fe9da50 fffff96000073851 : 0000000000000000 0000000004b7e070 fffff900c0ac7b80 fffff900c00b4680 : win32k!ldevGetDriverModes+0xc8
fffff8800fe9dae0 fffff960000b272c : 0000000000000000 00000000000000000000000004b7e070 0000000000000000 : win32k!DrvBuildDevmodeList+0x151
fffff8800fe9db30 fffff960000b2221 : 00000000ffff0000 0000000004b7e9e0 0000000000000000 000000000565dbd8 : win32k!DrvEnumDisplaySettings+0x4cc
fffff8800fe9dbe0 fffff8000188e993 : fffffa800ff04060 fffff8800fe9dca0 0000000000000000fffff900c00c1000 : win32k!NtUserEnumDisplaySettings+0x45
fffff8800fe9dc20 0000000073d50d0a : 0000000000000000 00000000000000000000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13
0000000004b7e048 0000000000000000 : 0000000000000000 00000000000000000000000000000000 0000000000000000 : 0x73d50d0a
FOLLOWUP_IP:
RDPDD!DDGetAssociatedMonitorInfo+c6
fffff960`00ea33de 3bc7 cmp eax,edi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: RDPDD!DDGetAssociatedMonitorInfo+c6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPDD
IMAGE_NAME: RDPDD.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bce76
STACK_COMMAND: .cxr 0xfffff8800fe9cef0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
BUCKET_ID: X64_0x3B_RDPDD!DDGetAssociatedMonitorInfo+c6
Followup: MachineOwner
Sent from my mobile device
This message contains confidential information and is intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail
if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed
to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message,
which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.
WizzIT bvba - Lange Herentalsestraat 26 - 2018 Antwerp - Belgium