BugCkeck 0xBE, win32k.sys, iexplore.exe
- From: "George Valkov" <a@xxxxx>
- Date: Tue, 20 Feb 2007 21:38:37 +0200
I am not sure what is in the one of the latest updates that I installed, but
I already have 3 blue screens.
After the second one I removed all PCI, AGP and DDR boards from the main
board and made sure they are perfectly clean, using a brush and cotton with
spirits.
And now I have a third crash. It happend while I was edditing a client side
JavaScript file with Visual Studio 2005, while logged on to console on the
server. Crash occured when I clicked refresh in Internet Explorer 7 (viewing
http://local-server-name/).
All windows updates are installed. I guess there may be some problem with
the update related to bug in Visual Studio 2003 MFC libraries that may cause
programs build by it to have holes causing remote execution of code.
Probable this one:
http://www.microsoft.com/technet/security/bulletin/ms07-012.mspx
If you need any more info, I will keep the complete memmory dump for some
time.
-------- WinDBG report -----------------
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\MEMORY-03.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: D:\WINDOWS\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86
compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
Debug session time: Tue Feb 20 21:06:40.453 2007 (GMT+2)
System Uptime: 0 days 7:39:50.097
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
............................................................................................
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {c0012400, 2db36025, ba5866fc, b}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
win32k.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
GDI32.dll -
*** WARNING: Unable to verify timestamp for mshtml.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
IEFRAME.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
kernel32.dll -
Probably caused by : win32k.sys ( win32k!EngCopyBits+d2b )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on
the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: c0012400, Virtual address for the attempted write.
Arg2: 2db36025, PTE contents.
Arg3: ba5866fc, (reserved)
Arg4: 0000000b, (reserved)
Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 2
TRAP_FRAME: ba5867e0 -- (.trap ffffffffba5867e0)
ErrCode = 00000002
eax=ba5868dc ebx=bf8715c8 ecx=00000074 edx=e14677f8 esi=e1467bb4
edi=02480ae0
eip=bf86ecc3 esp=ba586854 ebp=ba58687c iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!EngCopyBits+0xd2b:
bf86ecc3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
es:0023:02480ae0=???????? ds:0023:e1467bb4=00000000
Resetting default scope
LAST_CONTROL_TRANSFER: from 8085a01b to 80826659
STACK_TEXT:
ba586670 8085a01b 000000be c0012400 2db36025 nt!KeBugCheckEx+0x1b
ba5866e4 80885ed0 00000001 c0012400 00000000 nt!MmAccessFault+0xa91
ba5866e4 8085a578 00000001 c0012400 00000000 nt!KiTrap0E+0xd8
ba5867c8 80885ed0 00000001 02480ae0 00000000 nt!MmAccessFault+0xfee
ba5867c8 bf86ecc3 00000001 02480ae0 00000000 nt!KiTrap0E+0xd8
WARNING: Stack unwind information not available. Following frames may be
wrong.
ba58687c bf870efb e176c008 bf87198a 01ddcee4 win32k!EngCopyBits+0xd2b
ba586900 80882fa8 e176c008 bf9aee78 e1b137c0 win32k!EngBitBlt+0x11be
ba586900 7c82ed54 e176c008 bf9aee78 e1b137c0 nt!KiFastCallEntry+0xf8
01ddceac 77c065d8 77c065c0 f1010ce1 00000000 ntdll!KiFastSystemCallRet
01ddcef4 028c059c f1010ce1 00000000 00000000 GDI32!BitBlt+0x89
01ddcf2c 02877a0b 00209570 01ddd298 00000000 mshtml!CHtmPre::~CHtmPre+0xda
01ddcf2c 02877a0b 00209570 01ddd298 00000000 mshtml!CDoc::OnPaint+0x16
01ddd2b0 02877e4c 00209570 002092b0 00235578 mshtml!CDoc::OnPaint+0x16
01ddf670 028bbb8c 00209570 002092b0 00235578
mshtml!CDispRoot::DrawRoot+0x145
01ddf798 028bd66d 01ddfb08 56041b9b 00000000
mshtml!CLineServices::GleanInfoFromTheRun+0x10d
01ddfc34 0289e373 0000000f 001cdef8 00000000
mshtml!CRecalcLinePtr::CalcBeforeSpace+0x813
01ddfc54 0289e2f0 001cdef8 0000000f 00000000 mshtml!NotifyTreeNode+0x61
01ddfd70 0289e1d7 00000000 0000000f 00000000 mshtml!NotifyAncestors+0xb5
01ddfd9c 7739c3b7 004e0856 0000000f 00000000 mshtml!NotifyAncestors+0x1d
01ddfdc8 773c5946 0289e18b 004e0856 0000000f USER32!InternalCallWinProc+0x28
01ddfe40 7739ca68 00000000 0289e18b 004e0856
USER32!UserCallWinProcCheckWow+0xeb
01ddfe9c 7739ce7a 00677138 0000000f 00000000
USER32!DispatchClientMessage+0xd9
01ddfec4 7c82ec9e 01ddfedc 00000018 01ddff30 USER32!__fnDWORD+0x24
01ddfec4 8082dc64 01ddfedc 00000018 01ddff30
ntdll!KiUserCallbackDispatcher+0x2e
ba586bf0 8091472b ba586ca8 ba586cac ba586c7c nt!KiCallUserMode+0x4
ba586c48 bf89b60d 00000002 ba586c8c 00000018 nt!KeUserModeCallback+0x8f
ba586ccc bf8a2ffa bc7d7138 0000000f 00000000
win32k!CLIPOBJ_cEnumStart+0x1581
ba586d0c bf8a394e 0289e18b ba586d64 01ddff00
win32k!EngAssociateSurface+0x182
ba586d58 80882fa8 01ddff68 01ddff40 7c82ed54
win32k!EngAssociateSurface+0xad6
ba586d58 7c82ed54 01ddff68 01ddff40 7c82ed54 nt!KiFastCallEntry+0xf8
01ddfec4 7c82ec9e 01ddfedc 00000018 01ddff30 ntdll!KiFastSystemCallRet
01ddfef0 773972bc 77393226 01ddff68 00000000
ntdll!KiUserCallbackDispatcher+0x2e
01ddff40 7739c778 01ddff68 00000000 01ddffb8
USER32!NtUserDispatchMessage+0xc
01ddff50 75cae5c3 01ddff68 00000000 00000000 USER32!DispatchMessageW+0xf
01ddffb8 77e6608b 001a53e8 00000000 00000000 IEFRAME!Ordinal300+0x3681
01ddffec 00000000 75cae38c 00197940 00000000
kernel32!GetModuleFileNameA+0xeb
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!EngCopyBits+d2b
bf86ecc3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: win32k!EngCopyBits+d2b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 434471b4
FAILURE_BUCKET_ID: 0xBE_win32k!EngCopyBits+d2b
BUCKET_ID: 0xBE_win32k!EngCopyBits+d2b
Followup: MachineOwner
---------
.
- Prev by Date: Re: Server 2003 and Missing Logon Prompt
- Next by Date: about L2TP?
- Previous by thread: Re: Server 2003 and Missing Logon Prompt
- Next by thread: about L2TP?
- Index(es):
Relevant Pages
|
