Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


help interpreting windbg memory dump log

Posted on 2008-10-16
Medium Priority
Last Modified: 2013-12-04
windows server 2003 sp2 received memory dump error 0x0000020 (0x00000000,0x00000fff1 ran windbg diagnostics.  Was unable to interpert logs.  windbg log attached.
Microsoft (R) Windows Debugger  Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini101408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Oct 14 17:18:00.625 2008 (GMT-4)
System Uptime: 2 days 4:39:32.390
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
Use !analyze -v to get detailed debugging information.
BugCheck 20, {0, fff1, 0, 1}
Probably caused by : ntkrpamp.exe ( nt!PspExitThread+64c )
Followup: MachineOwner
1: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem.  The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.  Since these calls should always be in
pairs, this value should be zero when a thread exits.  A negative value
indicates that a driver has disabled APC calls without re-enabling them.  A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers.  Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0.  If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL.  Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash.  This symptom is usually a severe bug in a third party
Arg1: 00000000, The address of the APC found pending during exit.
Arg2: 0000fff1, The thread's APC disable count
Arg3: 00000000, The current IRQL
Arg4: 00000001
Debugging Details:
PROCESS_NAME:  winlogon.exe
LAST_CONTROL_TRANSFER:  from 8094c546 to 80827c63
b8096c80 8094c546 00000020 00000000 0000fff1 nt!KeBugCheckEx+0x1b
b8096d18 8094c63f 00000000 00000000 88dc2578 nt!PspExitThread+0x64c
b8096d30 8094c991 88dc2578 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
b8096d54 8088978c 00000000 00000000 00f1ffb8 nt!NtTerminateThread+0x71
b8096d54 7c8285ec 00000000 00000000 00f1ffb8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f1ffb8 00000000 00000000 00000000 00000000 0x7c8285ec
8094c546 cc              int     3
SYMBOL_NAME:  nt!PspExitThread+64c
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  ntkrpamp.exe
Followup: MachineOwner

Open in new window

Question by:mmsppm

Expert Comment

ID: 22732691
Did an event show up in the Windows Event Log? What is the Event ID?

Author Comment

ID: 22733741
Event ID 1003

Accepted Solution

simadownnow earned 1500 total points
ID: 22758626
Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
View products that this article applies to.
Article ID : 920911
Last Review : October 11, 2007
Revision : 2.4
On This Page
On a Microsoft Windows Server 2003-based computer, you receive the following Stop error message:
Stop 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001)
Note The four parameters in the error message vary.

Additionally, the computer restarts automatically. After this problem occurs, an event that resembles the following is logged in the System log:
Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: Date
Time: Time
User: N/A
Computer: Computer
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000020 (0x00000000, 0x0000fffc, 0x00000000, 0x00000001). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

Back to the top

This problem occurs because the Win32k.sys module incorrectly manages font objects. This causes an asynchronous procedure call (APC) leak. When the system detects an APC leak, the system reports the Stop error that is described in the "Symptoms" section.
Back to the top

Service pack information
To resolve this problem, install the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Back to the top

Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
To apply this hotfix, you must have Windows Server 2003 Service Pack 1 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 (http://kbalertz.com/Feedback.aspx?kbNumber=889100/) How to obtain the latest service pack for Windows Server 2003
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003 with Service Pack 1, x86-based versions
File name File version File size Date Time Platform SP requirement
Gdi32.dll 5.2.3790.2811 282,112 12-Oct-2006 14:57 x86 SP1
Win32k.sys 5.2.3790.2811 1,851,392 12-Oct-2006 13:11 x86 SP1

Windows Server 2003 with Service Pack 1, Itanium-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 906,240 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 5,546,496 12-Oct-2006 00:46 IA-64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:46 x86 SP1 WOW

Windows Server 2003, x64-based versions
File name File version File size Date Time Platform SP requirement Service branch
Gdi32.dll 5.2.3790.2811 610,304 12-Oct-2006 00:45 x64 SP1 Not Applicable
Win32k.sys 5.2.3790.2811 4,529,664 12-Oct-2006 00:45 x64 SP1 Not Applicable
Wgdi32.dll 5.2.3790.2811 285,184 12-Oct-2006 00:45 x86 SP1 WOW

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 (http://kbalertz.com/Feedback.aspx?kbNumber=824684/) Description of the standard terminology that is used to describe Microsoft software updates

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
How can you see what you are working on when you want to see it while you to save a copy? Add a "Save As" icon to the Quick Access Toolbar, or QAT. That way, when you save a copy of a query, form, report, or other object you are modifying, you…

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question