Hi guys,

I've been checking out the forums for a while now and finally had an issue I couldn't find a resolve for. I'm running Server 2008 w/Terminal services on a Dell box. I narrowed the issue down to a single application (firerms5) that is causing the trouble. I know that it's based on some version of foxpro and it used to run flawlessly on 2003 server w/ terminal services. Any ideas?

Thank you,

Justin
_____________

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\dump\Mini091508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81606000 PsLoadedModuleList = 0x8171dc70
Debug session time: Mon Sep 15 05:39:40.782 2008 (GMT-7)
System Uptime: 0 days 11:33:50.328
Loading Kernel Symbols
........................................................................... ................................................
Loading User Symbols
Loading unloaded module list
....
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 81658323, 920c6840, 0}

Probably caused by : win32k.sys ( win32k!xxxRealDrawMenuItem+80b )

Followup: MachineOwner
---------

kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81658323, The address that the exception occurred at
Arg3: 920c6840, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!RtlInitUnicodeString+1b
81658323 f266af repne scas word ptr es:[edi]

TRAP_FRAME: 920c6840 -- (.trap 0xffffffff920c6840)
ErrCode = 00000000
eax=00000000 ebx=fe407fd8 ecx=ffffffec edx=920c6914 esi=fe4055e0 edi=fe408000
eip=81658323 esp=920c68b4 ebp=920c6924 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!RtlInitUnicodeString+0x1b:
81658323 f266af repne scas word ptr es:[edi]
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

PROCESS_NAME: firerms5.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8168a99f to 81658323

STACK_TEXT:
920c68f0 8168a99f 00000000 8f7beb39 c047bdf0 nt!RtlInitUnicodeString+0x1b
920c6924 8f7af1b5 29010363 00000006 00000002 nt!MiDispatchFault+0x9a6
920c6a0c 8f7bed02 29010363 00000006 00000002 win32k!xxxRealDrawMenuItem+0x80b
920c6abc 8f79473a 29010363 0110007e 920c6b04 win32k!xxxDrawState+0x1c9
920c6b2c 8f7955c0 29010363 fe405568 00c8d0d4 win32k!xxxDrawMenuItem+0x3f8
920c6b98 8f7af71b 29010363 00000000 fe404ae8 win32k!xxxMenuDraw+0x1f2
920c6bf0 8f6fd153 00000017 29010363 00000004 win32k!xxxMenuBarDraw+0x1bf
920c6c38 8f71c075 fe404ae8 29010363 00000001 win32k!xxxDrawWindowFrame+0xf7
920c6cb4 8f71d6bd fe404ae8 00000085 00000001 win32k!xxxRealDefWindowProc+0x88b
920c6ccc 8f6f66ed fe404ae8 00000085 00000001 win32k!xxxWrapRealDefWindowProc+0x2b
920c6ce8 8f71d674 fe404ae8 00000085 00000001 win32k!NtUserfnDWORD+0x27
920c6d20 8165da7a 00010056 00000085 00000001 win32k!NtUserMessageCall+0xc6
920c6d20 77b39a94 00010056 00000085 00000001 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012c7e8 00000000 00000000 00000000 00000000 0x77b39a94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!xxxRealDrawMenuItem+80b
8f7af1b5 837df800 cmp dword ptr [ebp-8],0

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: win32k!xxxRealDrawMenuItem+80b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851

FAILURE_BUCKET_ID: 0x8E_win32k!xxxRealDrawMenuItem+80b

BUCKET_ID: 0x8E_win32k!xxxRealDrawMenuItem+80b

Followup: MachineOwner
---------

NM.. Solved..

From the depths of Microsofts KB:

Error message when you run an application on a terminal server that is running Windows Server 2008 or Windows Vista with Service Pack 1: "Stop 0x0000008E"

support.microsoft.com/kb/951954/en-us

I applied the patch, and no more reboots