A
Andy
Good afternoon,
I have a machine that blue screens occasionally. In 2006, it's done it
10 times (counting from the minidmp files). While not ideal, it hasn't
been that bad up until about a month ago. In the last month, it's done
it five times. I've been researching and have found several possible
solutions, none of which has worked yet.
My first thought was that it was bad memory. I used two different
memory diagnostic utilties (Dell's and Microsoft's) to check out the
memory. Neither reported any problems. I have reseated the memory,
just to see if that was it.
The blue screen sometimes says, "PAGE_FAULT_IN_NONPAGED_AREA
STOP: 0x00000050". One possible problem listed was that the machine
needs an updated driver for a Lexar USB Flashdrive (which I do have).
However, there is no driver update listed on the Lexar site (driver
included in WinXP).
The minidmp reports list a driver problem with "ialmdnt5.dll". I looked
that up and it's part of an Intel graphics driver for the 82845G
chipset. I updated the driver to the latest version (from Dell - the
Intel version is a little older and I haven't tried it yet), but that
didn't help.
The reports usually list that the process name is a Microsoft Office
application, like EXCEL or POWERPNT.EXE. I checked and those are all up
to date.
Anyway, I thought I'd post what WinDbg shows for the last 10 minidumps.
Please let me know if you have any suggestions after looking through
the dumps. I apologize for the massive length of this.
-----------------
1)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini011306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Fri Jan 13 14:10:32.203 2006 (GMT-5)
System Uptime: 0 days 3:09:32.858
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e29ea000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> .reload
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e29ea000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
READ_ADDRESS: e29ea000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9661bc bf83a167 f60e5100 e29e9fb0 00000058 nt!memmove+0x33
ed9661e0 bf839e20 00000016 ed966624 e293c018
win32k!vSrcCopyS32D32Identity+0x5b
ed9663f4 bf9e4ced e293c018 00000000 ed966acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed96641c bf9e4ba6 e293c018 e2784018 ed966acc ialmdnt5+0x2ced
ed96699c bf9d9bd0 e293c018 e2784018 ed966acc ialmdnt5+0x2ba6
ed966a54 bf805d3a e293c018 e2784018 ed966acc ialmrnt5+0x5bd0
ed966aa0 bf8334bc e293c018 e2784018 ed966acc win32k!WatchdogDrvCopyBits+0x53
ed966be0 bf8e1048 00000001 e189b870 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed966c4c bf95af4d 17050e91 17050e91 00000000
win32k!GreSetDIBitsInternal+0x108
ed966c88 bf91b757 0a010e92 17050e91 00000000 win32k!GreSetDIBits+0x5c
ed966cc4 bf91bc3c 00000016 00000000 ed966d30 win32k!DIBtoBMP+0xe5
ed966ce8 bf8e1d7d 85fc0158 000007b8 85fc0158 win32k!xxxGetDummyBitmap+0xc0
ed966d04 bf8e1ded 85fc0158 00000002 ed966d30 win32k!xxxGetClipboardData+0xb4
ed966d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
ed966d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
2)
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: EXCEL.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edb63868 bf83a167 e3ade084 e3f3bfb0 00000058 nt!memmove+0x33
edb6388c bf839e20 00000016 edb63b74 edb63acc
win32k!vSrcCopyS32D32Identity+0x5b
edb63aa0 bf8334bc e3ade018 00000000 edb63acc win32k!EngCopyBits+0x51a
edb63be0 bf8e1048 00000001 e2980358 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edb63c4c bf95af4d 2f050f24 2f050f24 00000000
win32k!GreSetDIBitsInternal+0x108
edb63c88 bf91b757 2101116a 2f050f24 00000000 win32k!GreSetDIBits+0x5c
edb63cc4 bf91bc3c 00000016 00000000 edb63d30 win32k!DIBtoBMP+0xe5
edb63ce8 bf8e1d7d 86023158 000007b8 86023158 win32k!xxxGetDummyBitmap+0xc0
edb63d04 bf8e1ded 86023158 00000002 edb63d30 win32k!xxxGetClipboardData+0xb4
edb63d54 804de7ec 00000002 0013df08 0013df34
win32k!NtUserGetClipboardData+0x72
edb63d54 7c90eb94 00000002 0013df08 0013df34 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013df34 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!vSrcCopyS32D32Identity+5b
bf83a167 83c40c add esp,0Ch
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
SYMBOL_NAME: win32k!vSrcCopyS32D32Identity+5b
FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
Followup: MachineOwner
---------
3)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini022706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Feb 27 13:04:10.265 2006 (GMT-5)
System Uptime: 0 days 0:14:23.278
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e28eb000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e28eb000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e28eb000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee4391bc bf83a167 f60e7300 e28eafb0 00000058 nt!memmove+0x33
ee4391e0 bf839e20 00000016 ee439624 e1f14e90
win32k!vSrcCopyS32D32Identity+0x5b
ee4393f4 bf9e4ced e1f14e90 00000000 ee439acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee43941c bf9e4ba6 e1f14e90 e26a4018 ee439acc ialmdnt5+0x2ced
ee43999c bf9d9bd0 e1f14e90 e26a4018 ee439acc ialmdnt5+0x2ba6
ee439a54 bf805d3a e1f14e90 e26a4018 ee439acc ialmrnt5+0x5bd0
ee439aa0 bf8334bc e1f14e90 e26a4018 ee439acc win32k!WatchdogDrvCopyBits+0x53
ee439be0 bf8e1048 00000001 e2338bb0 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee439c4c bf95af4d 0b050c04 0b050c04 00000000
win32k!GreSetDIBitsInternal+0x108
ee439c88 bf91b757 62010b88 0b050c04 00000000 win32k!GreSetDIBits+0x5c
ee439cc4 bf91bc3c 00000016 00000000 ee439d30 win32k!DIBtoBMP+0xe5
ee439ce8 bf8e1d7d 86052858 000007b8 86052858 win32k!xxxGetDummyBitmap+0xc0
ee439d04 bf8e1ded 86052858 00000002 ee439d30 win32k!xxxGetClipboardData+0xb4
ee439d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
ee439d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
4)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini030806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Mar 8 14:43:03.890 2006 (GMT-5)
System Uptime: 0 days 5:13:27.687
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e384a000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e384a000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e384a000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edfe41bc bf83a167 f60e4400 e3849fb0 00000058 nt!memmove+0x33
edfe41e0 bf839e20 00000016 edfe4624 e2e994e8
win32k!vSrcCopyS32D32Identity+0x5b
edfe43f4 bf9e4ced e2e994e8 00000000 edfe4acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
edfe441c bf9e4ba6 e2e994e8 e2fd3e90 edfe4acc ialmdnt5+0x2ced
edfe499c bf9d9bd0 e2e994e8 e2fd3e90 edfe4acc ialmdnt5+0x2ba6
edfe4a54 bf805d3a e2e994e8 e2fd3e90 edfe4acc ialmrnt5+0x5bd0
edfe4aa0 bf8334bc e2e994e8 e2fd3e90 edfe4acc win32k!WatchdogDrvCopyBits+0x53
edfe4be0 bf8e1048 00000001 e140b488 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edfe4c4c bf95af4d 50050b0e 50050b0e 00000000
win32k!GreSetDIBitsInternal+0x108
edfe4c88 bf91b757 a9010cb9 50050b0e 00000000 win32k!GreSetDIBits+0x5c
edfe4cc4 bf91bc3c 00000016 00000000 edfe4d30 win32k!DIBtoBMP+0xe5
edfe4ce8 bf8e1d7d 862ddbf0 000007b8 862ddbf0 win32k!xxxGetDummyBitmap+0xc0
edfe4d04 bf8e1ded 862ddbf0 00000002 edfe4d30 win32k!xxxGetClipboardData+0xb4
edfe4d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
edfe4d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
5)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini082206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Aug 22 18:48:41.513 2006 (GMT-5)
System Uptime: 0 days 8:25:51.329
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e3148000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e3148000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e3148000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9501bc bf83a167 f64c8a00 e3147fb0 00000058 nt!memmove+0x33
ed9501e0 bf839e20 00000016 ed950624 e34b3630
win32k!vSrcCopyS32D32Identity+0x5b
ed9503f4 bf9e4ced e34b3630 00000000 ed950acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed95041c bf9e4ba6 e34b3630 e2e16690 ed950acc ialmdnt5+0x2ced
ed95099c bf9d9bd0 e34b3630 e2e16690 ed950acc ialmdnt5+0x2ba6
ed950a54 bf805d3a e34b3630 e2e16690 ed950acc ialmrnt5+0x5bd0
ed950aa0 bf8334bc e34b3630 e2e16690 ed950acc win32k!WatchdogDrvCopyBits+0x53
ed950be0 bf8e1048 00000001 e1042c18 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed950c4c bf95af4d ca050d68 ca050d68 00000000
win32k!GreSetDIBitsInternal+0x108
ed950c88 bf91b757 a901143a ca050d68 00000000 win32k!GreSetDIBits+0x5c
ed950cc4 bf91bc3c 00000016 00000000 ed950d30 win32k!DIBtoBMP+0xe5
ed950ce8 bf8e1d7d 862e5960 000007b8 862e5960 win32k!xxxGetDummyBitmap+0xc0
ed950d04 bf8e1ded 862e5960 00000002 ed950d30 win32k!xxxGetClipboardData+0xb4
ed950d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ed950d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
6)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini090506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Sep 5 16:33:46.992 2006 (GMT-5)
System Uptime: 0 days 8:05:48.572
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2f2a000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2f2a000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2f2a000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9d61bc bf83a167 f60e0000 e2f29fb0 00000058 nt!memmove+0x33
ed9d61e0 bf839e20 00000016 ed9d6624 e2e86e90
win32k!vSrcCopyS32D32Identity+0x5b
ed9d63f4 bf9e4ced e2e86e90 00000000 ed9d6acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed9d641c bf9e4ba6 e2e86e90 e28879b0 ed9d6acc ialmdnt5+0x2ced
ed9d699c bf9d9bd0 e2e86e90 e28879b0 ed9d6acc ialmdnt5+0x2ba6
ed9d6a54 bf805d3a e2e86e90 e28879b0 ed9d6acc ialmrnt5+0x5bd0
ed9d6aa0 bf8334bc e2e86e90 e28879b0 ed9d6acc win32k!WatchdogDrvCopyBits+0x53
ed9d6be0 bf8e1048 00000001 e22ff118 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed9d6c4c bf95af4d 050511e5 050511e5 00000000
win32k!GreSetDIBitsInternal+0x108
ed9d6c88 bf91b757 16010d10 050511e5 00000000 win32k!GreSetDIBits+0x5c
ed9d6cc4 bf91bc3c 00000016 00000000 ed9d6d30 win32k!DIBtoBMP+0xe5
ed9d6ce8 bf8e1d7d 862e0d78 000007b8 862e0d78 win32k!xxxGetDummyBitmap+0xc0
ed9d6d04 bf8e1ded 862e0d78 00000002 ed9d6d30 win32k!xxxGetClipboardData+0xb4
ed9d6d54 804de7ec 00000002 0013df98 0013dfc4
win32k!NtUserGetClipboardData+0x72
ed9d6d54 7c90eb94 00000002 0013df98 0013dfc4 nt!KiFastCallEntry+0xf8
0013dfc4 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
7)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini091206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 11 17:09:21.943 2006 (GMT-5)
System Uptime: 0 days 6:44:41.388
Loading Kernel Symbols
...............................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e292c000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e292c000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e292c000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee02308c bf83a167 f64ffa00 e292bfb0 00000058 nt!memmove+0x33
ee0230b0 bf839e20 00000016 ee0234f4 e258e018
win32k!vSrcCopyS32D32Identity+0x5b
ee0232c4 bf9e4ced e258e018 00000000 ee023acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee0232ec bf9e4ba6 e258e018 e304b810 ee023acc ialmdnt5+0x2ced
ee02386c bf9d9bd0 e258e018 e304b810 ee023acc ialmdnt5+0x2ba6
ee023924 bf805d3a e258e018 e304b810 ee023acc ialmrnt5+0x5bd0
ee023970 bf8b62cc e258e018 e304b810 ee023acc win32k!WatchdogDrvCopyBits+0x53
ee0239b8 bf8b60e4 bf805cee ee023a60 e258e018 win32k!OffCopyBits+0x7d
ee023a6c bf8b6319 e258e018 e304b810 00000000 win32k!SpBitBlt+0xfc
ee023aa0 bf8334bc e258e018 e304b810 ee023acc win32k!SpCopyBits+0x27
ee023be0 bf8e1048 00000001 e27bd5d8 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee023c4c bf95af4d 7c0514e0 7c0514e0 00000000
win32k!GreSetDIBitsInternal+0x108
ee023c88 bf91b757 78011521 7c0514e0 00000000 win32k!GreSetDIBits+0x5c
ee023cc4 bf91bc3c 00000016 00000000 ee023d30 win32k!DIBtoBMP+0xe5
ee023ce8 bf8e1d7d 862de4b8 000007b8 862de4b8 win32k!xxxGetDummyBitmap+0xc0
ee023d04 bf8e1ded 862de4b8 00000002 ee023d30 win32k!xxxGetClipboardData+0xb4
ee023d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ee023d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
8)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini092506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 25 09:46:44.841 2006 (GMT-5)
System Uptime: 2 days 23:23:10.883
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e4033000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e4033000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e4033000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ecfb51bc bf83a167 f60df000 e4032fb0 00000058 nt!memmove+0x33
ecfb51e0 bf839e20 00000016 ecfb5624 e32ea3f0
win32k!vSrcCopyS32D32Identity+0x5b
ecfb53f4 bf9e4ced e32ea3f0 00000000 ecfb5acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ecfb541c bf9e4ba6 e32ea3f0 e374fe90 ecfb5acc ialmdnt5+0x2ced
ecfb599c bf9d9bd0 e32ea3f0 e374fe90 ecfb5acc ialmdnt5+0x2ba6
ecfb5a54 bf805d3a e32ea3f0 e374fe90 ecfb5acc ialmrnt5+0x5bd0
ecfb5aa0 bf8334bc e32ea3f0 e374fe90 ecfb5acc win32k!WatchdogDrvCopyBits+0x53
ecfb5be0 bf8e1048 00000001 e1272548 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ecfb5c4c bf95af4d ab050e82 ab050e82 00000000
win32k!GreSetDIBitsInternal+0x108
ecfb5c88 bf91b757 b8010c77 ab050e82 00000000 win32k!GreSetDIBits+0x5c
ecfb5cc4 bf91bc3c 00000016 00000000 ecfb5d30 win32k!DIBtoBMP+0xe5
ecfb5ce8 bf8e1d7d 862a40e0 000007b8 862a40e0 win32k!xxxGetDummyBitmap+0xc0
ecfb5d04 bf8e1ded 862a40e0 00000002 ecfb5d30 win32k!xxxGetClipboardData+0xb4
ecfb5d54 804de7ec 00000002 0013de44 0013de70
win32k!NtUserGetClipboardData+0x72
ecfb5d54 7c90eb94 00000002 0013de44 0013de70 nt!KiFastCallEntry+0xf8
0013de70 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
9)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini092706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Sep 27 11:53:52.802 2006 (GMT-5)
System Uptime: 0 days 21:17:48.956
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2ee8000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2ee8000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2ee8000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee1811bc bf83a167 f64ba700 e2ee7fb0 00000058 nt!memmove+0x33
ee1811e0 bf839e20 00000016 ee181624 e300be90
win32k!vSrcCopyS32D32Identity+0x5b
ee1813f4 bf9e4ced e300be90 00000000 ee181acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee18141c bf9e4ba6 e300be90 e28eb488 ee181acc ialmdnt5+0x2ced
ee18199c bf9d9bd0 e300be90 e28eb488 ee181acc ialmdnt5+0x2ba6
ee181a54 bf805d3a e300be90 e28eb488 ee181acc ialmrnt5+0x5bd0
ee181aa0 bf8334bc e300be90 e28eb488 ee181acc win32k!WatchdogDrvCopyBits+0x53
ee181be0 bf8e1048 00000001 e1249f18 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee181c4c bf95af4d f10507e3 f10507e3 00000000
win32k!GreSetDIBitsInternal+0x108
ee181c88 bf91b757 78010f66 f10507e3 00000000 win32k!GreSetDIBits+0x5c
ee181cc4 bf91bc3c 00000016 00000000 ee181d30 win32k!DIBtoBMP+0xe5
ee181ce8 bf8e1d7d 862ea300 000007b8 862ea300 win32k!xxxGetDummyBitmap+0xc0
ee181d04 bf8e1ded 862ea300 00000002 ee181d30 win32k!xxxGetClipboardData+0xb4
ee181d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ee181d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
10)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini100206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Oct 2 11:10:56.441 2006 (GMT-5)
System Uptime: 0 days 0:50:08.021
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2e39000, 0, 804d9da8, 1}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!vSrcCopyS32D32Identity+5b )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2e39000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2e39000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edfe8868 bf83a167 e2e44084 e2e38fb0 00000058 nt!memmove+0x33
edfe888c bf839e20 00000016 edfe8b74 edfe8acc
win32k!vSrcCopyS32D32Identity+0x5b
edfe8aa0 bf8334bc e2e44018 00000000 edfe8acc win32k!EngCopyBits+0x51a
edfe8be0 bf8e1048 00000001 e2a414e8 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edfe8c4c bf95af4d 69050cb6 69050cb6 00000000
win32k!GreSetDIBitsInternal+0x108
edfe8c88 bf91b757 8d010a46 69050cb6 00000000 win32k!GreSetDIBits+0x5c
edfe8cc4 bf91bc3c 00000016 00000000 edfe8d30 win32k!DIBtoBMP+0xe5
edfe8ce8 bf8e1d7d 85fea260 000007b8 85fea260 win32k!xxxGetDummyBitmap+0xc0
edfe8d04 bf8e1ded 85fea260 00000002 edfe8d30 win32k!xxxGetClipboardData+0xb4
edfe8d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
edfe8d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!vSrcCopyS32D32Identity+5b
bf83a167 83c40c add esp,0Ch
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
SYMBOL_NAME: win32k!vSrcCopyS32D32Identity+5b
FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
Followup: MachineOwner
---------
I have a machine that blue screens occasionally. In 2006, it's done it
10 times (counting from the minidmp files). While not ideal, it hasn't
been that bad up until about a month ago. In the last month, it's done
it five times. I've been researching and have found several possible
solutions, none of which has worked yet.
My first thought was that it was bad memory. I used two different
memory diagnostic utilties (Dell's and Microsoft's) to check out the
memory. Neither reported any problems. I have reseated the memory,
just to see if that was it.
The blue screen sometimes says, "PAGE_FAULT_IN_NONPAGED_AREA
STOP: 0x00000050". One possible problem listed was that the machine
needs an updated driver for a Lexar USB Flashdrive (which I do have).
However, there is no driver update listed on the Lexar site (driver
included in WinXP).
The minidmp reports list a driver problem with "ialmdnt5.dll". I looked
that up and it's part of an Intel graphics driver for the 82845G
chipset. I updated the driver to the latest version (from Dell - the
Intel version is a little older and I haven't tried it yet), but that
didn't help.
The reports usually list that the process name is a Microsoft Office
application, like EXCEL or POWERPNT.EXE. I checked and those are all up
to date.
Anyway, I thought I'd post what WinDbg shows for the last 10 minidumps.
Please let me know if you have any suggestions after looking through
the dumps. I apologize for the massive length of this.
-----------------
1)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini011306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Fri Jan 13 14:10:32.203 2006 (GMT-5)
System Uptime: 0 days 3:09:32.858
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e29ea000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> .reload
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e29ea000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
READ_ADDRESS: e29ea000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9661bc bf83a167 f60e5100 e29e9fb0 00000058 nt!memmove+0x33
ed9661e0 bf839e20 00000016 ed966624 e293c018
win32k!vSrcCopyS32D32Identity+0x5b
ed9663f4 bf9e4ced e293c018 00000000 ed966acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed96641c bf9e4ba6 e293c018 e2784018 ed966acc ialmdnt5+0x2ced
ed96699c bf9d9bd0 e293c018 e2784018 ed966acc ialmdnt5+0x2ba6
ed966a54 bf805d3a e293c018 e2784018 ed966acc ialmrnt5+0x5bd0
ed966aa0 bf8334bc e293c018 e2784018 ed966acc win32k!WatchdogDrvCopyBits+0x53
ed966be0 bf8e1048 00000001 e189b870 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed966c4c bf95af4d 17050e91 17050e91 00000000
win32k!GreSetDIBitsInternal+0x108
ed966c88 bf91b757 0a010e92 17050e91 00000000 win32k!GreSetDIBits+0x5c
ed966cc4 bf91bc3c 00000016 00000000 ed966d30 win32k!DIBtoBMP+0xe5
ed966ce8 bf8e1d7d 85fc0158 000007b8 85fc0158 win32k!xxxGetDummyBitmap+0xc0
ed966d04 bf8e1ded 85fc0158 00000002 ed966d30 win32k!xxxGetClipboardData+0xb4
ed966d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
ed966d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
2)
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: EXCEL.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edb63868 bf83a167 e3ade084 e3f3bfb0 00000058 nt!memmove+0x33
edb6388c bf839e20 00000016 edb63b74 edb63acc
win32k!vSrcCopyS32D32Identity+0x5b
edb63aa0 bf8334bc e3ade018 00000000 edb63acc win32k!EngCopyBits+0x51a
edb63be0 bf8e1048 00000001 e2980358 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edb63c4c bf95af4d 2f050f24 2f050f24 00000000
win32k!GreSetDIBitsInternal+0x108
edb63c88 bf91b757 2101116a 2f050f24 00000000 win32k!GreSetDIBits+0x5c
edb63cc4 bf91bc3c 00000016 00000000 edb63d30 win32k!DIBtoBMP+0xe5
edb63ce8 bf8e1d7d 86023158 000007b8 86023158 win32k!xxxGetDummyBitmap+0xc0
edb63d04 bf8e1ded 86023158 00000002 edb63d30 win32k!xxxGetClipboardData+0xb4
edb63d54 804de7ec 00000002 0013df08 0013df34
win32k!NtUserGetClipboardData+0x72
edb63d54 7c90eb94 00000002 0013df08 0013df34 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013df34 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!vSrcCopyS32D32Identity+5b
bf83a167 83c40c add esp,0Ch
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
SYMBOL_NAME: win32k!vSrcCopyS32D32Identity+5b
FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
Followup: MachineOwner
---------
3)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini022706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Feb 27 13:04:10.265 2006 (GMT-5)
System Uptime: 0 days 0:14:23.278
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e28eb000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e28eb000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e28eb000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee4391bc bf83a167 f60e7300 e28eafb0 00000058 nt!memmove+0x33
ee4391e0 bf839e20 00000016 ee439624 e1f14e90
win32k!vSrcCopyS32D32Identity+0x5b
ee4393f4 bf9e4ced e1f14e90 00000000 ee439acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee43941c bf9e4ba6 e1f14e90 e26a4018 ee439acc ialmdnt5+0x2ced
ee43999c bf9d9bd0 e1f14e90 e26a4018 ee439acc ialmdnt5+0x2ba6
ee439a54 bf805d3a e1f14e90 e26a4018 ee439acc ialmrnt5+0x5bd0
ee439aa0 bf8334bc e1f14e90 e26a4018 ee439acc win32k!WatchdogDrvCopyBits+0x53
ee439be0 bf8e1048 00000001 e2338bb0 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee439c4c bf95af4d 0b050c04 0b050c04 00000000
win32k!GreSetDIBitsInternal+0x108
ee439c88 bf91b757 62010b88 0b050c04 00000000 win32k!GreSetDIBits+0x5c
ee439cc4 bf91bc3c 00000016 00000000 ee439d30 win32k!DIBtoBMP+0xe5
ee439ce8 bf8e1d7d 86052858 000007b8 86052858 win32k!xxxGetDummyBitmap+0xc0
ee439d04 bf8e1ded 86052858 00000002 ee439d30 win32k!xxxGetClipboardData+0xb4
ee439d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
ee439d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
4)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini030806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Mar 8 14:43:03.890 2006 (GMT-5)
System Uptime: 0 days 5:13:27.687
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e384a000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e384a000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e384a000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: POWERPNT.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edfe41bc bf83a167 f60e4400 e3849fb0 00000058 nt!memmove+0x33
edfe41e0 bf839e20 00000016 edfe4624 e2e994e8
win32k!vSrcCopyS32D32Identity+0x5b
edfe43f4 bf9e4ced e2e994e8 00000000 edfe4acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
edfe441c bf9e4ba6 e2e994e8 e2fd3e90 edfe4acc ialmdnt5+0x2ced
edfe499c bf9d9bd0 e2e994e8 e2fd3e90 edfe4acc ialmdnt5+0x2ba6
edfe4a54 bf805d3a e2e994e8 e2fd3e90 edfe4acc ialmrnt5+0x5bd0
edfe4aa0 bf8334bc e2e994e8 e2fd3e90 edfe4acc win32k!WatchdogDrvCopyBits+0x53
edfe4be0 bf8e1048 00000001 e140b488 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edfe4c4c bf95af4d 50050b0e 50050b0e 00000000
win32k!GreSetDIBitsInternal+0x108
edfe4c88 bf91b757 a9010cb9 50050b0e 00000000 win32k!GreSetDIBits+0x5c
edfe4cc4 bf91bc3c 00000016 00000000 edfe4d30 win32k!DIBtoBMP+0xe5
edfe4ce8 bf8e1d7d 862ddbf0 000007b8 862ddbf0 win32k!xxxGetDummyBitmap+0xc0
edfe4d04 bf8e1ded 862ddbf0 00000002 edfe4d30 win32k!xxxGetClipboardData+0xb4
edfe4d54 804de7ec 00000002 0013868c 001386b8
win32k!NtUserGetClipboardData+0x72
edfe4d54 7c90eb94 00000002 0013868c 001386b8 nt!KiFastCallEntry+0xf8
001386b8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
5)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini082206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Aug 22 18:48:41.513 2006 (GMT-5)
System Uptime: 0 days 8:25:51.329
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e3148000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e3148000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e3148000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9501bc bf83a167 f64c8a00 e3147fb0 00000058 nt!memmove+0x33
ed9501e0 bf839e20 00000016 ed950624 e34b3630
win32k!vSrcCopyS32D32Identity+0x5b
ed9503f4 bf9e4ced e34b3630 00000000 ed950acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed95041c bf9e4ba6 e34b3630 e2e16690 ed950acc ialmdnt5+0x2ced
ed95099c bf9d9bd0 e34b3630 e2e16690 ed950acc ialmdnt5+0x2ba6
ed950a54 bf805d3a e34b3630 e2e16690 ed950acc ialmrnt5+0x5bd0
ed950aa0 bf8334bc e34b3630 e2e16690 ed950acc win32k!WatchdogDrvCopyBits+0x53
ed950be0 bf8e1048 00000001 e1042c18 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed950c4c bf95af4d ca050d68 ca050d68 00000000
win32k!GreSetDIBitsInternal+0x108
ed950c88 bf91b757 a901143a ca050d68 00000000 win32k!GreSetDIBits+0x5c
ed950cc4 bf91bc3c 00000016 00000000 ed950d30 win32k!DIBtoBMP+0xe5
ed950ce8 bf8e1d7d 862e5960 000007b8 862e5960 win32k!xxxGetDummyBitmap+0xc0
ed950d04 bf8e1ded 862e5960 00000002 ed950d30 win32k!xxxGetClipboardData+0xb4
ed950d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ed950d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
6)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini090506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Sep 5 16:33:46.992 2006 (GMT-5)
System Uptime: 0 days 8:05:48.572
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2f2a000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2f2a000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2f2a000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ed9d61bc bf83a167 f60e0000 e2f29fb0 00000058 nt!memmove+0x33
ed9d61e0 bf839e20 00000016 ed9d6624 e2e86e90
win32k!vSrcCopyS32D32Identity+0x5b
ed9d63f4 bf9e4ced e2e86e90 00000000 ed9d6acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed9d641c bf9e4ba6 e2e86e90 e28879b0 ed9d6acc ialmdnt5+0x2ced
ed9d699c bf9d9bd0 e2e86e90 e28879b0 ed9d6acc ialmdnt5+0x2ba6
ed9d6a54 bf805d3a e2e86e90 e28879b0 ed9d6acc ialmrnt5+0x5bd0
ed9d6aa0 bf8334bc e2e86e90 e28879b0 ed9d6acc win32k!WatchdogDrvCopyBits+0x53
ed9d6be0 bf8e1048 00000001 e22ff118 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ed9d6c4c bf95af4d 050511e5 050511e5 00000000
win32k!GreSetDIBitsInternal+0x108
ed9d6c88 bf91b757 16010d10 050511e5 00000000 win32k!GreSetDIBits+0x5c
ed9d6cc4 bf91bc3c 00000016 00000000 ed9d6d30 win32k!DIBtoBMP+0xe5
ed9d6ce8 bf8e1d7d 862e0d78 000007b8 862e0d78 win32k!xxxGetDummyBitmap+0xc0
ed9d6d04 bf8e1ded 862e0d78 00000002 ed9d6d30 win32k!xxxGetClipboardData+0xb4
ed9d6d54 804de7ec 00000002 0013df98 0013dfc4
win32k!NtUserGetClipboardData+0x72
ed9d6d54 7c90eb94 00000002 0013df98 0013dfc4 nt!KiFastCallEntry+0xf8
0013dfc4 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
7)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini091206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 11 17:09:21.943 2006 (GMT-5)
System Uptime: 0 days 6:44:41.388
Loading Kernel Symbols
...............................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e292c000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e292c000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e292c000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee02308c bf83a167 f64ffa00 e292bfb0 00000058 nt!memmove+0x33
ee0230b0 bf839e20 00000016 ee0234f4 e258e018
win32k!vSrcCopyS32D32Identity+0x5b
ee0232c4 bf9e4ced e258e018 00000000 ee023acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee0232ec bf9e4ba6 e258e018 e304b810 ee023acc ialmdnt5+0x2ced
ee02386c bf9d9bd0 e258e018 e304b810 ee023acc ialmdnt5+0x2ba6
ee023924 bf805d3a e258e018 e304b810 ee023acc ialmrnt5+0x5bd0
ee023970 bf8b62cc e258e018 e304b810 ee023acc win32k!WatchdogDrvCopyBits+0x53
ee0239b8 bf8b60e4 bf805cee ee023a60 e258e018 win32k!OffCopyBits+0x7d
ee023a6c bf8b6319 e258e018 e304b810 00000000 win32k!SpBitBlt+0xfc
ee023aa0 bf8334bc e258e018 e304b810 ee023acc win32k!SpCopyBits+0x27
ee023be0 bf8e1048 00000001 e27bd5d8 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee023c4c bf95af4d 7c0514e0 7c0514e0 00000000
win32k!GreSetDIBitsInternal+0x108
ee023c88 bf91b757 78011521 7c0514e0 00000000 win32k!GreSetDIBits+0x5c
ee023cc4 bf91bc3c 00000016 00000000 ee023d30 win32k!DIBtoBMP+0xe5
ee023ce8 bf8e1d7d 862de4b8 000007b8 862de4b8 win32k!xxxGetDummyBitmap+0xc0
ee023d04 bf8e1ded 862de4b8 00000002 ee023d30 win32k!xxxGetClipboardData+0xb4
ee023d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ee023d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
8)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini092506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 25 09:46:44.841 2006 (GMT-5)
System Uptime: 2 days 23:23:10.883
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e4033000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e4033000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e4033000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ecfb51bc bf83a167 f60df000 e4032fb0 00000058 nt!memmove+0x33
ecfb51e0 bf839e20 00000016 ecfb5624 e32ea3f0
win32k!vSrcCopyS32D32Identity+0x5b
ecfb53f4 bf9e4ced e32ea3f0 00000000 ecfb5acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ecfb541c bf9e4ba6 e32ea3f0 e374fe90 ecfb5acc ialmdnt5+0x2ced
ecfb599c bf9d9bd0 e32ea3f0 e374fe90 ecfb5acc ialmdnt5+0x2ba6
ecfb5a54 bf805d3a e32ea3f0 e374fe90 ecfb5acc ialmrnt5+0x5bd0
ecfb5aa0 bf8334bc e32ea3f0 e374fe90 ecfb5acc win32k!WatchdogDrvCopyBits+0x53
ecfb5be0 bf8e1048 00000001 e1272548 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ecfb5c4c bf95af4d ab050e82 ab050e82 00000000
win32k!GreSetDIBitsInternal+0x108
ecfb5c88 bf91b757 b8010c77 ab050e82 00000000 win32k!GreSetDIBits+0x5c
ecfb5cc4 bf91bc3c 00000016 00000000 ecfb5d30 win32k!DIBtoBMP+0xe5
ecfb5ce8 bf8e1d7d 862a40e0 000007b8 862a40e0 win32k!xxxGetDummyBitmap+0xc0
ecfb5d04 bf8e1ded 862a40e0 00000002 ecfb5d30 win32k!xxxGetClipboardData+0xb4
ecfb5d54 804de7ec 00000002 0013de44 0013de70
win32k!NtUserGetClipboardData+0x72
ecfb5d54 7c90eb94 00000002 0013de44 0013de70 nt!KiFastCallEntry+0xf8
0013de70 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
9)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini092706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Sep 27 11:53:52.802 2006 (GMT-5)
System Uptime: 0 days 21:17:48.956
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2ee8000, 0, 804d9da8, 1}
Unable to load image ialmdnt5.dll, Win32 error 2
*** WARNING: Unable to verify timestamp for ialmdnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmdnt5.dll
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ialmrnt5.dll
*** ERROR: Module load completed but symbols could not be loaded for
ialmrnt5.dll
Probably caused by : ialmdnt5.dll ( ialmdnt5+2ced )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2ee8000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2ee8000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
ee1811bc bf83a167 f64ba700 e2ee7fb0 00000058 nt!memmove+0x33
ee1811e0 bf839e20 00000016 ee181624 e300be90
win32k!vSrcCopyS32D32Identity+0x5b
ee1813f4 bf9e4ced e300be90 00000000 ee181acc win32k!EngCopyBits+0x51a
WARNING: Stack unwind information not available. Following frames may be
wrong.
ee18141c bf9e4ba6 e300be90 e28eb488 ee181acc ialmdnt5+0x2ced
ee18199c bf9d9bd0 e300be90 e28eb488 ee181acc ialmdnt5+0x2ba6
ee181a54 bf805d3a e300be90 e28eb488 ee181acc ialmrnt5+0x5bd0
ee181aa0 bf8334bc e300be90 e28eb488 ee181acc win32k!WatchdogDrvCopyBits+0x53
ee181be0 bf8e1048 00000001 e1249f18 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
ee181c4c bf95af4d f10507e3 f10507e3 00000000
win32k!GreSetDIBitsInternal+0x108
ee181c88 bf91b757 78010f66 f10507e3 00000000 win32k!GreSetDIBits+0x5c
ee181cc4 bf91bc3c 00000016 00000000 ee181d30 win32k!DIBtoBMP+0xe5
ee181ce8 bf8e1d7d 862ea300 000007b8 862ea300 win32k!xxxGetDummyBitmap+0xc0
ee181d04 bf8e1ded 862ea300 00000002 ee181d30 win32k!xxxGetClipboardData+0xb4
ee181d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
ee181d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
ialmdnt5+2ced
bf9e4ced ?? ???
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ialmdnt5+2ced
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ialmdnt5
IMAGE_NAME: ialmdnt5.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 42b8ab17
FAILURE_BUCKET_ID: 0x50_ialmdnt5+2ced
BUCKET_ID: 0x50_ialmdnt5+2ced
Followup: MachineOwner
---------
10)
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and
Settings\userpath\folder\Mini100206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Oct 2 11:10:56.441 2006 (GMT-5)
System Uptime: 0 days 0:50:08.021
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e2e39000, 0, 804d9da8, 1}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!vSrcCopyS32D32Identity+5b )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e2e39000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804d9da8, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: e2e39000
FAULTING_IP:
nt!memmove+33
804d9da8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: OUTLOOK.EXE
LAST_CONTROL_TRANSFER: from bf83a167 to 804d9da8
STACK_TEXT:
edfe8868 bf83a167 e2e44084 e2e38fb0 00000058 nt!memmove+0x33
edfe888c bf839e20 00000016 edfe8b74 edfe8acc
win32k!vSrcCopyS32D32Identity+0x5b
edfe8aa0 bf8334bc e2e44018 00000000 edfe8acc win32k!EngCopyBits+0x51a
edfe8be0 bf8e1048 00000001 e2a414e8 00000000
win32k!GreSetDIBitsToDeviceInternal+0x943
edfe8c4c bf95af4d 69050cb6 69050cb6 00000000
win32k!GreSetDIBitsInternal+0x108
edfe8c88 bf91b757 8d010a46 69050cb6 00000000 win32k!GreSetDIBits+0x5c
edfe8cc4 bf91bc3c 00000016 00000000 edfe8d30 win32k!DIBtoBMP+0xe5
edfe8ce8 bf8e1d7d 85fea260 000007b8 85fea260 win32k!xxxGetDummyBitmap+0xc0
edfe8d04 bf8e1ded 85fea260 00000002 edfe8d30 win32k!xxxGetClipboardData+0xb4
edfe8d54 804de7ec 00000002 0013f208 0013f234
win32k!NtUserGetClipboardData+0x72
edfe8d54 7c90eb94 00000002 0013f208 0013f234 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013f234 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!vSrcCopyS32D32Identity+5b
bf83a167 83c40c add esp,0Ch
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
SYMBOL_NAME: win32k!vSrcCopyS32D32Identity+5b
FAILURE_BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
BUCKET_ID: 0x50_win32k!vSrcCopyS32D32Identity+5b
Followup: MachineOwner
---------