• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 985
  • Last Modified:

Need help Debugging memory.dmp

Hi all, hoping that someone will be able to help me here, i have a problem with a machine i built and i cant figure out what it is. Im not sure if you will need the spec of the machine but i will leave it at the bottom of my question. Basicly after running the pc fine for over 1 week solid (using as a game server) i keep getting crashes evry 24 hours. At 1st this used to crash the entire system (blue screen) but after changing a few settings it now just crashes certain applications, to be exact counterstrike source and deltaforce black hawk down. These are the only applications that crash and it doesnt matter if they are both being ran at the same time or not. I have analized the dump file amd am able to find the address that the error occurs but i am not able determin what is running at that address. I have searched google about it but im never able to get understand andy of the pages that i find. Here is the information from the dump file:

Microsoft (R) Windows Debugger  Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\Gonzo\Desktop\MEMORY\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Thu Mar 10 15:41:34.046 2005 (GMT+0)
System Uptime: 0 days 7:54:13.720
Loading Kernel Symbols
Loading unloaded module list
Loading User Symbols
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bf80912c, f5b6eba8, 0}

*** WARNING: Unable to verify timestamp for SHELL32.dll
*** ERROR: Module load completed but symbols could not be loaded for G6FTPSrv.exe
Probably caused by : win32k.sys ( win32k!FHungApp+17 )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
Arg1: c0000005, The exception code that was not handled
Arg2: bf80912c, The address that the exception occurred at
Arg3: f5b6eba8, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

bf80912c 8b4e38           mov     ecx,[esi+0x38]

TRAP_FRAME:  f5b6eba8 -- (.trap fffffffff5b6eba8)
ErrCode = 00000000
eax=01b22b56 ebx=0000004a ecx=00000000 edx=0001b22b esi=00a5d1c8 edi=e2388760
eip=bf80912c esp=f5b6ec1c ebp=f5b6ec20 iopl=0         nv up ei pl nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010207
bf80912c 8b4e38           mov     ecx,[esi+0x38]    ds:0023:00a5d200=????????
Resetting default scope



LAST_CONTROL_TRANSFER:  from bf8140fc to bf80912c

f5b6ec20 bf8140fc 00a5d1c8 00004e20 f5b6ec98 win32k!FHungApp+0x17
f5b6ec58 bf82ef38 bc63e4a8 0000004a 000603b8 win32k!xxxSendMessageTimeout+0xe9
f5b6ecbc bf888a32 bc63e4a8 0000004a 000603b8 win32k!xxxSendMessageEx+0x7a
f5b6ed08 bf80f67d bc63e4a8 0000004a 000603b8 win32k!NtUserfnCOPYDATA+0x7d
f5b6ed40 804ddf0f 00040036 0000004a 000603b8 win32k!NtUserMessageCall+0xae
f5b6ed40 7c90eb94 00040036 0000004a 000603b8 nt!KiFastCallEntry+0xfc
0012f334 77d494e3 77d4e705 00040036 0000004a ntdll!KiFastSystemCallRet
0012f374 77d4e73d 00040036 0000004a 000603b8 USER32!NtUserMessageCall+0xc
0012f39c 7ca21c07 00040036 0000004a 000603b8 USER32!SendMessageTimeoutW+0x21
0012f7a8 7ca20cba 00000001 0012f7c0 00b2002c SHELL32!CCDBurn::_GetDiscRecorderForDrive+0x7c
0012fb7c 004b55de 00000001 00b24b4c 00000001 SHELL32!CStartMenuPinEnum::_NextPidlFromStream+0x74
WARNING: Stack unwind information not available. Following frames may be wrong.
0012fb94 004b5406 0012fbb8 004b541c 0012fbb0 G6FTPSrv+0xb55de
0012fbb0 005143cc 0012fbc4 005143e4 0012fc34 G6FTPSrv+0xb5406
0012fc34 0048a8b5 0012fc68 0048a8bf 0012fc54 G6FTPSrv+0x1143cc
0012fc54 0048a6f1 00b2636c 0012fc9c 00425f4f G6FTPSrv+0x8a8b5
0012fc60 00425f4f 0012fc74 00425f59 0012fc9c G6FTPSrv+0x8a6f1
0012fc9c 00452305 0012fd60 00452318 0012fcc4 G6FTPSrv+0x25f4f
0012fcc4 0042753a 00000000 00000000 00000000 G6FTPSrv+0x52305
0012fcdc 77d48709 000d037a 00000000 00000000 G6FTPSrv+0x2753a
0012fd08 77d487eb 003e0fef 000d037a 00000000 USER32!InternalCallWinProc+0x28
0012fd70 77d4c00e 00000000 003e0fef 000d037a USER32!UserCallWinProcCheckWow+0x150
0012fda0 77d4e366 003e0fef 000d037a 00000000 USER32!CallWindowProcAorW+0x98
0012fdc0 004b4ed8 003e0fef 000d037a 00000000 USER32!CallWindowProcA+0x1b
0012fde8 0042753a 00000000 00000000 00000000 G6FTPSrv+0xb4ed8
0012fe00 77d48709 000d037a 00000000 00000000 G6FTPSrv+0x2753a
0012fe2c 77d487eb 003e0eb7 000d037a 00000000 USER32!InternalCallWinProc+0x28
0012fe94 77d489a5 00000000 003e0eb7 000d037a USER32!UserCallWinProcCheckWow+0x150
0012fef4 77d4bccc 0012ff24 00000001 0012ff70 USER32!DispatchMessageWorker+0x306
0012ff04 00452884 0012ff24 0012ff00 0149d79c USER32!DispatchMessageA+0xf
0012ff70 0052efe6 0012ffb4 0052f001 0012ffc0 G6FTPSrv+0x52884
0012ffc0 7c816d4f 0149d79c 7c90e1fe 7ffd7000 G6FTPSrv+0x12efe6
0012fff0 00000000 005a4200 00000000 78746341 kernel32!BaseProcessStart+0x23

bf80912c 8b4e38           mov     ecx,[esi+0x38]


FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  win32k!FHungApp+17

MODULE_NAME:  win32k

IMAGE_NAME:  win32k.sys


STACK_COMMAND:  .trap fffffffff5b6eba8 ; kb

FAILURE_BUCKET_ID:  0x8E_win32k!FHungApp+17

BUCKET_ID:  0x8E_win32k!FHungApp+17

Followup: MachineOwner

If i am doing this correctly i belevie that the error has something to do with this part of the stack? (if thats the right word)

f5b6ec20 bf8140fc 00a5d1c8 00004e20 f5b6ec98 win32k!FHungApp+0x17

particularly at this address: bf80912c

Now maby im going to sound like a complete newb here but im thinking that this win32k!FHungApp+0x17 is the cause of my problem. However if i am correct about that i have no idea what it is or even how to find out what it is (appart from asking the experts here).

I would be eternaly geatfull if anyone could shed some light on this matter for me as its got to the point i think im about to actualy cry, real boo hoo style :)

As prommised here is the spec of the machine

P4 3.06ghz Prescott
1gb ddr400
80 GB SATA (maxtor)
PCCHIPS m955g Motherboard
1 Solution
Hrm... this is a toughie since it doesn't list anything other than Windows files that might have caused it.
I would lean on looking at memory.  First I would try running some memory diagnostics www.memtest86.com and then maybe setting up some performance counters to track how much memory is in use to see if a mem leak is causing it.

Finally, you might try running a System File Checker
Start>Run>sfc /scannow
and make sure you have your XP CD handy as it will check Windows files against what you have install.

Spyware checks are also good.
Norton_SchoolAuthor Commented:
Great, thanks for the quick reply, im currently running some performance counters to see if i can find any memory leaks (hoping its going to be obvious if there is as i dont know what im looking for), as for the mem test its not possible for me to run it as the pc is at a data centre for hosting and its something i cant do remotely, as far as im aware. I did however run the windows memory diognostic for over 24 hours before i shiped it for hosting and there was no problems showing up there. Again the system file checker is going to be a hard one to run remotely so i guess im gonna have to ftp up the i386 directory overnight and run it tomorrow sometime.

Spyware is next on my list, but im not sure its going to bring anything up. I never used the server on the internet before shipping and havent used it online since shipping for anything other than hosting the servers. Not sure if this matters in regards to being infrected by spyware though, but it is something i will most definatly check out.

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now