help interpreting windbg memory dump log

Posted on 2008-10-16
Medium Priority
Last Modified: 2013-12-04
windows server 2003 sp2 received memory dump error 0x0000020 (0x00000000,0x00000fff1 ran windbg diagnostics.  Was unable to interpert logs.  windbg log attached.
Microsoft (R) Windows Debugger  Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini101408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Oct 14 17:18:00.625 2008 (GMT-4)
System Uptime: 2 days 4:39:32.390
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
Use !analyze -v to get detailed debugging information.
BugCheck 20, {0, fff1, 0, 1}
Probably caused by : ntkrpamp.exe ( nt!PspExitThread+64c )
Followup: MachineOwner
1: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem.  The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.  Since these calls should always be in
pairs, this value should be zero when a thread exits.  A negative value
indicates that a driver has disabled APC calls without re-enabling them.  A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers.  Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0.  If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL.  Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash.  This symptom is usually a severe bug in a third party
Arg1: 00000000, The address of the APC found pending during exit.
Arg2: 0000fff1, The thread's APC disable count
Arg3: 00000000, The current IRQL
Arg4: 00000001
Debugging Details:
PROCESS_NAME:  winlogon.exe
LAST_CONTROL_TRANSFER:  from 8094c546 to 80827c63
b8096c80 8094c546 00000020 00000000 0000fff1 nt!KeBugCheckEx+0x1b
b8096d18 8094c63f 00000000 00000000 88dc2578 nt!PspExitThread+0x64c
b8096d30 8094c991 88dc2578 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
b8096d54 8088978c 00000000 00000000 00f1ffb8 nt!NtTerminateThread+0x71
b8096d54 7c8285ec 00000000 00000000 00f1ffb8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f1ffb8 00000000 00000000 00000000 00000000 0x7c8285ec
8094c546 cc              int     3
SYMBOL_NAME:  nt!PspExitThread+64c
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  ntkrpamp.exe
Followup: MachineOwner

Open in new window

Question by:mmsppm
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 22732691
Did an event show up in the Windows Event Log? What is the Event ID?

Author Comment

ID: 22733741
Event ID 1003

Accepted Solution

simadownnow earned 1500 total points
ID: 22758626
Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
View products that this article applies to.
Article ID : 920911
Last Review : October 11, 2007
Revision : 2.4
On This Page
On a Microsoft Windows Server 2003-based computer, you receive the following Stop error message:
Stop 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001)
Note The four parameters in the error message vary.

Additionally, the computer restarts automatically. After this problem occurs, an event that resembles the following is logged in the System log:
Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: Date
Time: Time
User: N/A
Computer: Computer
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

Back to the top

This problem occurs because the Win32k.sys module incorrectly manages font objects. This causes an asynchronous procedure call (APC) leak. When the system detects an APC leak, the system reports the Stop error that is described in the "Symptoms" section.
Back to the top

Service pack information
To resolve this problem, install the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Back to the top

Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
To apply this hotfix, you must have Windows Server 2003 Service Pack 1 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003 with Service Pack 1, x86-based versions
File name File version File size Date Time Platform SP requirement
Gdi32.dll 5.2.3790.2811 282,112 12-Oct-2006 14:57 x86 SP1
Win32k.sys 5.2.3790.2811 1,851,392 12-Oct-2006 13:11 x86 SP1

Windows Server 2003 with Service Pack 1, Itanium-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 906,240 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 5,546,496 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:46 x86 SP1 WOW

Windows Server 2003, x64-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 610,304 12-Oct-2006 00:45 x64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 4,529,664 12-Oct-2006 00:45 x64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:45 x86 SP1 WOW

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 (http://kbalertz.com/Feedback.aspx?kbNumber=824684/) Description of the standard terminology that is used to describe Microsoft software updates

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question