TechSpot

BSOD twice today seemed to be a memory access please helo

By rsimon78
May 19, 2007
  1. Hello everybody

    I am new on that forum and leaves near Paris
    Usually I am a Unix engeneer but have some Wintel Boxes
    I have suffered a BSOD twice today on one HP DL380 Box
    I have run debug and that is the output
    If somebody could help appreciated

    Opened log file 'c:\debuglog.txt'
    1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    WARNING: Whitespace at end of path element
    1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
    Loading Kernel Symbols
    .................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf8bc708, The address that the exception occurred at
    Arg3: b8dd4b0c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    win32k!EngSetPointerShape+a8
    bf8bc708 39bec4010000 cmp dword ptr [esi+1C4h],edi

    TRAP_FRAME: b8dd4b0c -- (.trap ffffffffb8dd4b0c)
    .trap ffffffffb8dd4b0c
    ErrCode = 00000000
    eax=e1471658 ebx=00000000 ecx=00000000 edx=00000000 esi=00018005 edi=00000001
    eip=bf8bc708 esp=b8dd4b80 ebp=b8dd4b9c iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
    win32k!EngSetPointerShape+0xa8:
    bf8bc708 39bec4010000 cmp dword ptr [esi+1C4h],edi ds:0023:000181c9=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR: 0x8E

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from bf841543 to bf8bc708

    STACK_TEXT:
    b8dd4b9c bf841543 e1471658 00000000 e276f010 win32k!EngSetPointerShape+0xa8
    b8dd4c34 bf832ee3 e1521008 e1471658 00000000 win32k!vSetPointer+0x41e
    b8dd4c68 bf801a7b e1860008 e17d1c20 00000010 win32k!GreSetPointer+0x5e
    b8dd4c90 bf90b007 e2db74f0 bf803be3 00000000 win32k!zzzUpdateCursorImage+0x1b9
    b8dd4d1c 804edc11 b8dd4d64 00007266 bf815786 win32k!zzzCalcStartCursorHide+0xd0
    bf90b007 040840f6 158b1875 bf9ace94 c985ca8b nt!ExReleaseResourceLite+0x118
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    bf90b00b 158b1875 bf9ace94 c985ca8b c83b1b75 0x40840f6
    bf90b00f bf9ace94 c985ca8b c83b1b75 50890874 0x158b1875
    bf90b013 c985ca8b c83b1b75 50890874 ce94a314 win32k!gpwpCalcFirst
    bf90b017 c83b1b75 50890874 ce94a314 4c8bbf9a 0xc985ca8b
    bf90b01b 50890874 ce94a314 4c8bbf9a ce030c24 0xc83b1b75
    bf90b01f ce94a314 4c8bbf9a ce030c24 04084883 0x50890874
    bf90b023 4c8bbf9a ce030c24 04084883 eb104889 0xce94a314
    bf90b027 ce030c24 04084883 eb104889 74c83bae 0x4c8bbf9a
    bf90b02b 04084883 eb104889 74c83bae 14498bed 0xce030c24
    bf90b02f eb104889 74c83bae 14498bed 508bd8eb 0x4084883
    bf90b033 74c83bae 14498bed 508bd8eb 04c2f608 0xeb104889
    bf90b037 14498bed 508bd8eb 04c2f608 c2f60574 0x74c83bae
    bf90b03b 508bd8eb 04c2f608 c2f60574 8b157402 0x14498bed
    bf90b03f 04c2f608 c2f60574 8b157402 01891440 0x508bd8eb
    bf90b043 c2f60574 8b157402 01891440 c085018b 0x4c2f608
    bf90b047 8b157402 01891440 c085018b 3539e875 0xc2f60574
    bf90b04b 01891440 c085018b 3539e875 bf9ac950 0x8b157402
    bf90b04f c085018b 3539e875 bf9ac950 98eba177 0x1891440
    bf90b053 3539e875 bf9ac950 98eba177 3910508b 0xc085018b
    bf90b057 bf9ac950 98eba177 3910508b 9ac95015 0x3539e875
    bf90b05b 98eba177 3910508b 9ac95015 890673bf win32k!gtimeStartCursorHide
    bf90b05f 3910508b 9ac95015 890673bf 9ac95015 0x98eba177
    bf90b063 9ac95015 890673bf 9ac95015 2bd68bbf 0x3910508b

    more stuff only in hexa

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!EngSetPointerShape+a8
    bf8bc708 39bec4010000 cmp dword ptr [esi+1C4h],edi

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: win32k!EngSetPointerShape+a8

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4344671b

    FAILURE_BUCKET_ID: 0x8E_win32k!EngSetPointerShape+a8

    BUCKET_ID: 0x8E_win32k!EngSetPointerShape+a8

    Followup: MachineOwner
    ---------

    eax=e1471658 ebx=00000000 ecx=00000000 edx=00000000 esi=00018005 edi=00000001
    eip=bf8bc708 esp=b8dd4b80 ebp=b8dd4b9c iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
    win32k!EngSetPointerShape+0xa8:
    bf8bc708 39bec4010000 cmp dword ptr [esi+1C4h],edi ds:0023:000181c9=????????
    ChildEBP RetAddr Args to Child
    b8dd4b9c bf841543 e1471658 00000000 e276f010 win32k!EngSetPointerShape+0xa8 (FPO: [Non-Fpo])
    b8dd4c34 bf832ee3 e1521008 e1471658 00000000 win32k!vSetPointer+0x41e (FPO: [Non-Fpo])
    b8dd4c68 bf801a7b e1860008 e17d1c20 00000010 win32k!GreSetPointer+0x5e (FPO: [Non-Fpo])
    b8dd4c90 bf90b007 e2db74f0 bf803be3 00000000 win32k!zzzUpdateCursorImage+0x1b9 (FPO: [Uses EBP] [0,0,0])
    b8dd4d1c 804edc11 b8dd4d64 00007266 bf815786 win32k!zzzCalcStartCursorHide+0xd0 (FPO: [2,0,0])
    bf90b007 040840f6 158b1875 bf9ace94 c985ca8b nt!ExReleaseResourceLite+0x118 (FPO: [Non-Fpo])
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    bf90b00b 158b1875 bf9ace94 c985ca8b c83b1b75 0x40840f6
    bf90b00f bf9ace94 c985ca8b c83b1b75 50890874 0x158b1875
    bf90b013 c985ca8b c83b1b75 50890874 ce94a314 win32k!gpwpCalcFirst
    bf90b017 c83b1b75 50890874 ce94a314 4c8bbf9a 0xc985ca8b
    bf90b01b 50890874 ce94a314 4c8bbf9a ce030c24 0xc83b1b75
    bf90b01f ce94a314 4c8bbf9a ce030c24 04084883 0x50890874
    bf90b023 4c8bbf9a ce030c24 04084883 eb104889 0xce94a314
    bf90b027 ce030c24 04084883 eb104889 74c83bae 0x4c8bbf9a
    bf90b02b 04084883 eb104889 74c83bae 14498bed 0xce030c24
    bf90b02f eb104889 74c83bae 14498bed 508bd8eb 0x4084883
    bf90b033 74c83bae 14498bed 508bd8eb 04c2f608 0xeb104889
    bf90b037 14498bed 508bd8eb 04c2f608 c2f60574 0x74c83bae
    bf90b03b 508bd8eb 04c2f608 c2f60574 8b157402 0x14498bed
    bf90b03f 04c2f608 c2f60574 8b157402 01891440 0x508bd8eb
    start end module name
    804de000 80747000 nt ntkrnlmp.exe Wed Aug 24 07:13:53 2005 (430C0211)

    a long list ........

    Unloaded modules:
    f77e7000 f77ef000 RCMapMem.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f715b000 f7163000 RCMapMem.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f7607000 f7615000 imapi.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f7133000 f713b000 Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    Closing open log file c:\debuglog.txt


    Many thanks by advance

    Roger
     
  2. rsimon78

    rsimon78 TS Rookie Topic Starter

    in fact 3 times just now
    suspect it is due to Excel running on that server

    Could you confirm ?

    Thanks
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...