Hello folks,
I have a virtual windows server 2003 acting as a FTP server. This guy has been BSOD'ing more and more frequently I have generated the mini dump report. What I get from these mini dump reports is always the same, DEFAULT_BUCKET_ID: DRIVER_FAULT, PROCESS_NAME: dllhost.exe, which tells me that a driver failed related to dllhost.exe. Now I believe that dllhost.exe is related to COM+ but that's as far as I know how to troubleshoot.
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
Debug session time: Wed Oct 31 11:35:19.138 2012 (UTC - 4:00)
System Uptime: 3 days 0:28:32.031
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e6f46074, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf869f6a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
READ_ADDRESS: GetUlongFromAddress: unable to read from 808a47b8
e6f46074
FAULTING_IP:
win32k!IFIOBJR::IFIOBJR+63
bf869f6a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: dllhost.exe
CURRENT_IRQL: 1
TRAP_FRAME: b86ebb9c -- (.trap 0xffffffffb86ebb9c)
ErrCode = 00000000
eax=e6f45f78 ebx=b86ebc3c ecx=00000005 edx=00006000 esi=e6f46074 edi=b86ebc48
eip=bf869f6a esp=b86ebc10 ebp=b86ebc1c iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
win32k!IFIOBJR::IFIOBJR+0x63:
bf869f6a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
LAST_CONTROL_TRANSFER: from 8085a55f to 80826dcb
STACK_TEXT:
b86ebb10 8085a55f 00000050 e6f46074 00000000 nt!KeBugCheckEx+0x1b
b86ebb84 80886928 00000000 e6f46074 00000000 nt!MmAccessFault+0xa91
b86ebb84 bf869f6a 00000000 e6f46074 00000000 nt!KiTrap0E+0xd8
b86ebc1c bf86a154 e6f45e88 b86ebce0 b86ebccc win32k!IFIOBJR::IFIOBJR+0x63
b86ebc74 bf86de29 b86ebce0 b86ebccc b86ebcf4 win32k!bIFIMetricsToTextMetricWStrict+0x1e
b86ebc98 bf888836 b86ebce0 b86ebccc b86ebcf4 win32k!bIFIMetricsToTextMetricW+0x1c
b86ebcb4 bf8887a0 b86ebce0 b86ebccc b86ebcf4 win32k!bGetTextMetrics+0x75
b86ebcd8 bf88f5a0 e58b0d08 b86ebcf4 b86ebd64 win32k!GreGetTextMetricsW+0x3f
b86ebd50 80883968 b82101eb 00e3f204 00000044 win32k!NtGdiGetTextMetricsW+0x22
b86ebd50 7c82845c b82101eb 00e3f204 00000044 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e3f248 00000000 00000000 00000000 00000000 0x7c82845c
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!IFIOBJR::IFIOBJR+63
bf869f6a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!IFIOBJR::IFIOBJR+63
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ff30d05
FAILURE_BUCKET_ID: 0x50_win32k!IFIOBJR::IFIOBJR+63
BUCKET_ID: 0x50_win32k!IFIOBJR::IFIOBJR+63
Followup: MachineOwner
Any information would be appreciated,
Regards,
Eddie