Environment: HP compaq nc6000 notebook, WinXP Pro SP2, 512MB RAM
Problem: When, and only when, I connect to my office LAN and I open Outlook'03, my notebook does a BSOD and generates the below mini~.dmp file (also attached). When I connect over VPN and open Outlook'03, everything runs OK. Very strange. I don't notice any more or less services running in either environment that could be causing or adding to the problem.
Any clues or suggestions would be appreciated!
Shawn
----------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\shawn\Desktop\WERac83.dir00\Mini082307-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Windows\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu Aug 23 13:49:47.927 2007 (GMT-4)
System Uptime: 0 days 0:15:30.510
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 80679e98, ec556c5c, ec556958}
Probably caused by : ntoskrnl.exe ( nt!WmipReserveTraceBuffer+dc )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80679e98, The address that the exception occurred at
Arg3: ec556c5c, Exception Record Address
Arg4: ec556958, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!WmipReserveTraceBuffer+dc
80679e98 895f34 mov dword ptr [edi+34h],ebx
EXCEPTION_RECORD: ec556c5c -- (.exr 0xffffffffec556c5c)
ExceptionAddress: 80679e98 (nt!WmipReserveTraceBuffer+0x000000dc)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000034
Attempt to write to address 00000034
CONTEXT: ec556958 -- (.cxr 0xffffffffec556958)
eax=c00000e8 ebx=00000000 ecx=c0000188 edx=804ddc35 esi=ff8ef000 edi=00000000
eip=80679e98 esp=ec556d24 ebp=ec556d58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!WmipReserveTraceBuffer+0xdc:
80679e98 895f34 mov dword ptr [edi+34h],ebx ds:0023:00000034=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
WRITE_ADDRESS: 00000034
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 806404e0 to 80679e98
STACK_TEXT:
ec556d58 806404e0 c00000e8 00000000 00000000 nt!WmipReserveTraceBuffer+0xdc
ec556d80 8064070a ff8ef054 00000000 00000000 nt!WmipCreateLogFile+0x2e3
ec556dac 8057d0f0 00000000 00000000 00000000 nt!WmipFinalizeHeader+0xc2
ec556ddc 804f827a 8064059b ff8ef000 00000000 nt!NtQuerySystemInformation+0x4e3
ec556df8 00000000 00000000 00000000 00001f80 nt!RtlInsertElementGenericTableFullAvl+0xd0
FOLLOWUP_IP:
nt!WmipReserveTraceBuffer+dc
80679e98 895f34 mov dword ptr [edi+34h],ebx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!WmipReserveTraceBuffer+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711
STACK_COMMAND: .cxr 0xffffffffec556958 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!WmipReserveTraceBuffer+dc
BUCKET_ID: 0x7E_nt!WmipReserveTraceBuffer+dc
Followup: MachineOwner
-----------------------------------------------------------
Problem: When, and only when, I connect to my office LAN and I open Outlook'03, my notebook does a BSOD and generates the below mini~.dmp file (also attached). When I connect over VPN and open Outlook'03, everything runs OK. Very strange. I don't notice any more or less services running in either environment that could be causing or adding to the problem.
Any clues or suggestions would be appreciated!
Shawn
----------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\shawn\Desktop\WERac83.dir00\Mini082307-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Windows\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu Aug 23 13:49:47.927 2007 (GMT-4)
System Uptime: 0 days 0:15:30.510
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 80679e98, ec556c5c, ec556958}
Probably caused by : ntoskrnl.exe ( nt!WmipReserveTraceBuffer+dc )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80679e98, The address that the exception occurred at
Arg3: ec556c5c, Exception Record Address
Arg4: ec556958, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!WmipReserveTraceBuffer+dc
80679e98 895f34 mov dword ptr [edi+34h],ebx
EXCEPTION_RECORD: ec556c5c -- (.exr 0xffffffffec556c5c)
ExceptionAddress: 80679e98 (nt!WmipReserveTraceBuffer+0x000000dc)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000034
Attempt to write to address 00000034
CONTEXT: ec556958 -- (.cxr 0xffffffffec556958)
eax=c00000e8 ebx=00000000 ecx=c0000188 edx=804ddc35 esi=ff8ef000 edi=00000000
eip=80679e98 esp=ec556d24 ebp=ec556d58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!WmipReserveTraceBuffer+0xdc:
80679e98 895f34 mov dword ptr [edi+34h],ebx ds:0023:00000034=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
WRITE_ADDRESS: 00000034
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 806404e0 to 80679e98
STACK_TEXT:
ec556d58 806404e0 c00000e8 00000000 00000000 nt!WmipReserveTraceBuffer+0xdc
ec556d80 8064070a ff8ef054 00000000 00000000 nt!WmipCreateLogFile+0x2e3
ec556dac 8057d0f0 00000000 00000000 00000000 nt!WmipFinalizeHeader+0xc2
ec556ddc 804f827a 8064059b ff8ef000 00000000 nt!NtQuerySystemInformation+0x4e3
ec556df8 00000000 00000000 00000000 00001f80 nt!RtlInsertElementGenericTableFullAvl+0xd0
FOLLOWUP_IP:
nt!WmipReserveTraceBuffer+dc
80679e98 895f34 mov dword ptr [edi+34h],ebx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!WmipReserveTraceBuffer+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711
STACK_COMMAND: .cxr 0xffffffffec556958 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!WmipReserveTraceBuffer+dc
BUCKET_ID: 0x7E_nt!WmipReserveTraceBuffer+dc
Followup: MachineOwner
-----------------------------------------------------------
