New
#1
BSOD with Word 2007
Hello everyone,
I have a recurring BSOD problem that is pretty annoying, particularly because it involves Word 2007, which also means lots of lost changes to documents
Word will start having trouble saving to files to a shared drive, then after a while, BSOD.
I would love to attach the dmp file, but it's 1 Gb in size. So instead, can someone help me interpret the winDbg output? Let me know what else I can do to get to the heart of this.
thanks a lot!
HJP
==============================================
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*f:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670
Debug session time: Tue Mar 13 07:01:42.277 2012 (UTC - 4:00)
System Uptime: 5 days 6:01:31.202
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, 520000008c, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46485 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 000000520000008c
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41287
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: UNS.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003716900 -- (.trap 0xfffff88003716900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000082a000 rbx=0000000000000000 rcx=0000005200000054
rdx=fffff8a003f8aef0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031e3b37 rsp=fffff88003716a90 rbp=0000000000000000
r8=fffffa8006e5000b r9=fffffa80148b2048 r10=fffffa800dcfeca0
r11=fffffa800bf16970 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiEmptyPageAccessLog+0xe7:
fffff800`031e3b37 8b4138 mov eax,dword ptr [rcx+38h] ds:4ae0:008c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003075d7e to fffff800030e2c40
STACK_TEXT:
fffff880`03716798 fffff800`03075d7e : 00000000`0000001a 00000000`00041287 00000052`0000008c 00000000`00000000 : nt!KeBugCheckEx
fffff880`037167a0 fffff800`030e0d6e : 00000000`00000000 00000052`0000008c 00000000`00000000 00000000`0007240b : nt! ?? ::FNODOBFM::`string'+0x46485
fffff880`03716900 fffff800`031e3b37 : fffffa80`06e50b30 fffffa80`0dcfece0 00000000`00000002 fffff800`032594f0 : nt!KiPageFault+0x16e
fffff880`03716a90 fffff800`0315eb13 : fffffa80`06e50b30 00000003`00000000 00000052`00000054 00000000`0082a000 : nt!MiEmptyPageAccessLog+0xe7
fffff880`03716b00 fffff800`030cd826 : 00000000`0000e3ca 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4d7db
fffff880`03716b80 fffff800`030cdcd3 : 00000000`00000008 fffff880`03716c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03716bd0 fffff800`0337dfee : fffffa80`06c84ae0 00000000`00000080 fffffa80`06c69b30 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03716d40 fffff800`030d45e6 : fffff880`009eb180 fffffa80`06c84ae0 fffff880`009f5fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03716d80 00000000`00000000 : fffff880`03717000 fffff880`03711000 fffff880`03716700 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46485
fffff800`03075d7e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46485
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
fffff800`03066000 fffff800`0364f000 nt (pdb symbols) f:\symbols\ntkrnlmp.pdb\47F5C3BF9E0A493C9F63BB8F6413358B2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Wed Jun 22 22:53:23 2011 (4E02AAA3)
CheckSum: 0055C228
ImageSize: 005E9000
File version: 6.1.7601.17640
Product version: 6.1.7601.17640
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17640
FileVersion: 6.1.7601.17640 (win7sp1_gdr.110622-1506)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
Quote