Hi,
advice needed....
We have strange problem with our Windows Server 2003... problem with our Print Spooler... it rapedly crash... we tried to analyze crash dump but we not realy familar with it...
Could you help us to figure out the cose of Print Spooler crashing...?
thank you....
dump :
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(4d0.29dc): Access violation - code c0000005 (first/second chance not available)
eax=00000200 ebx=80070000 ecx=003a0038 edx=00000000 esi=000003a8 edi=00000000
eip=7c82ed54 esp=028ea438 ebp=028ea4a8 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet:
7c82ed54 c3 ret
0:025> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for CNAB4LMK.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CNAB4LMK.DLL -
*** WARNING: Unable to verify checksum for CNAB4SMK.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CNAB4SMK.DLL -
*** WARNING: Unable to verify checksum for HPBHEALR.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPBHEALR.DLL -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPZUI041.DLL -
FAULTING_IP:
rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
77c71861 6639481e cmp word ptr [eax+1Eh],cx
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 77c71861 (rpcrt4!LRPC_ADDRESS::ReferenceAssociation+0x0000002c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 006f0090
Attempt to read from address 006f0090
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: spoolsv.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 006f0090
BUGCHECK_STR: ACCESS_VIOLATION
LAST_CONTROL_TRANSFER: from 77c7541c to 77c71861
STACK_TEXT:
028efe2c 77c7541c 80150007 00800068 00000000 rpcrt4!LRPC_ADDRESS::ReferenceAssociation+0x2c
028eff84 77c5778f 028effac 77c5f7dd 000b45d0 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+0x366
028eff8c 77c5f7dd 000b45d0 00000000 00000000 rpcrt4!RecvLotsaCallsWrapper+0xd
028effac 77c5de88 00084e48 028effec 77e66063 rpcrt4!BaseCachedThreadRoutine+0x9d
028effb8 77e66063 000a0d10 00000000 00000000 rpcrt4!ThreadStartRoutine+0x1b
028effec 00000000 77c5de6d 000a0d10 00000000 kernel32!BaseThreadStart+0x34
FAULTING_THREAD: 000029dc
FOLLOWUP_IP:
rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
77c71861 6639481e cmp word ptr [eax+1Eh],cx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: rpcrt4
IMAGE_NAME: rpcrt4.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 424377d0
STACK_COMMAND: ~25s; .ecxr ; kb
FAILURE_BUCKET_ID: ACCESS_VIOLATION_rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
BUCKET_ID: ACCESS_VIOLATION_rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
Followup: MachineOwner
---------
0:025> lmvm rpcrt4
start end module name
77c50000 77cef000 rpcrt4 (pdb symbols) C:\Program Files\Debugging Tools for Windows\DownstreamStore\rpcrt4.pdb\187CE4439F4C425994FA1EF24ADD452B2\rpcrt4.pdb
Loaded symbol image file: rpcrt4.dll
Mapped memory image file: C:\Program Files\Debugging Tools for Windows\DownstreamStore\rpcrt4.dll\424377D09f000\rpcrt4.dll
Image path: C:\WINDOWS\system32\rpcrt4.dll
Image name: rpcrt4.dll
Timestamp: Fri Mar 25 04:30:40 2005 (424377D0)
CheckSum: 0009D530
ImageSize: 0009F000
File version: 5.2.3790.1830
Product version: 5.2.3790.1830
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: rpcrt4.dll
OriginalFilename: rpcrt4.dll
ProductVersion: 5.2.3790.1830
FileVersion: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
FileDescription: Remote Procedure Call Runtime
LegalCopyright: © Microsoft Corporation. All rights reserved.
advice needed....
We have strange problem with our Windows Server 2003... problem with our Print Spooler... it rapedly crash... we tried to analyze crash dump but we not realy familar with it...
Could you help us to figure out the cose of Print Spooler crashing...?
thank you....
dump :
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(4d0.29dc): Access violation - code c0000005 (first/second chance not available)
eax=00000200 ebx=80070000 ecx=003a0038 edx=00000000 esi=000003a8 edi=00000000
eip=7c82ed54 esp=028ea438 ebp=028ea4a8 iopl=0 nv up ei ng nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
ntdll!KiFastSystemCallRet:
7c82ed54 c3 ret
0:025> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for CNAB4LMK.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CNAB4LMK.DLL -
*** WARNING: Unable to verify checksum for CNAB4SMK.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for CNAB4SMK.DLL -
*** WARNING: Unable to verify checksum for HPBHEALR.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPBHEALR.DLL -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for HPZUI041.DLL -
FAULTING_IP:
rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
77c71861 6639481e cmp word ptr [eax+1Eh],cx
EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
ExceptionAddress: 77c71861 (rpcrt4!LRPC_ADDRESS::ReferenceAssociation+0x0000002c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 006f0090
Attempt to read from address 006f0090
DEFAULT_BUCKET_ID: APPLICATION_FAULT
PROCESS_NAME: spoolsv.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 006f0090
BUGCHECK_STR: ACCESS_VIOLATION
LAST_CONTROL_TRANSFER: from 77c7541c to 77c71861
STACK_TEXT:
028efe2c 77c7541c 80150007 00800068 00000000 rpcrt4!LRPC_ADDRESS::ReferenceAssociation+0x2c
028eff84 77c5778f 028effac 77c5f7dd 000b45d0 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+0x366
028eff8c 77c5f7dd 000b45d0 00000000 00000000 rpcrt4!RecvLotsaCallsWrapper+0xd
028effac 77c5de88 00084e48 028effec 77e66063 rpcrt4!BaseCachedThreadRoutine+0x9d
028effb8 77e66063 000a0d10 00000000 00000000 rpcrt4!ThreadStartRoutine+0x1b
028effec 00000000 77c5de6d 000a0d10 00000000 kernel32!BaseThreadStart+0x34
FAULTING_THREAD: 000029dc
FOLLOWUP_IP:
rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
77c71861 6639481e cmp word ptr [eax+1Eh],cx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: rpcrt4
IMAGE_NAME: rpcrt4.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 424377d0
STACK_COMMAND: ~25s; .ecxr ; kb
FAILURE_BUCKET_ID: ACCESS_VIOLATION_rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
BUCKET_ID: ACCESS_VIOLATION_rpcrt4!LRPC_ADDRESS::ReferenceAssociation+2c
Followup: MachineOwner
---------
0:025> lmvm rpcrt4
start end module name
77c50000 77cef000 rpcrt4 (pdb symbols) C:\Program Files\Debugging Tools for Windows\DownstreamStore\rpcrt4.pdb\187CE4439F4C425994FA1EF24ADD452B2\rpcrt4.pdb
Loaded symbol image file: rpcrt4.dll
Mapped memory image file: C:\Program Files\Debugging Tools for Windows\DownstreamStore\rpcrt4.dll\424377D09f000\rpcrt4.dll
Image path: C:\WINDOWS\system32\rpcrt4.dll
Image name: rpcrt4.dll
Timestamp: Fri Mar 25 04:30:40 2005 (424377D0)
CheckSum: 0009D530
ImageSize: 0009F000
File version: 5.2.3790.1830
Product version: 5.2.3790.1830
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: rpcrt4.dll
OriginalFilename: rpcrt4.dll
ProductVersion: 5.2.3790.1830
FileVersion: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
FileDescription: Remote Procedure Call Runtime
LegalCopyright: © Microsoft Corporation. All rights reserved.
