BSOD with Word 2007

[hhjjpp]

Hello everyone,

I have a recurring BSOD problem that is pretty annoying, particularly because it involves Word 2007, which also means lots of lost changes to documents

Word will start having trouble saving to files to a shared drive, then after a while, BSOD.

I would love to attach the dmp file, but it's 1 Gb in size. So instead, can someone help me interpret the winDbg output? Let me know what else I can do to get to the heart of this.


thanks a lot!


HJP



==============================================



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*f:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670
Debug session time: Tue Mar 13 07:01:42.277 2012 (UTC - 4:00)
System Uptime: 5 days 6:01:31.202
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 520000008c, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46485 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 000000520000008c
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41287

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: UNS.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff88003716900 -- (.trap 0xfffff88003716900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000082a000 rbx=0000000000000000 rcx=0000005200000054
rdx=fffff8a003f8aef0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031e3b37 rsp=fffff88003716a90 rbp=0000000000000000
r8=fffffa8006e5000b r9=fffffa80148b2048 r10=fffffa800dcfeca0
r11=fffffa800bf16970 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiEmptyPageAccessLog+0xe7:
fffff800`031e3b37 8b4138 mov eax,dword ptr [rcx+38h] ds:4ae0:008c=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003075d7e to fffff800030e2c40

STACK_TEXT:
fffff880`03716798 fffff800`03075d7e : 00000000`0000001a 00000000`00041287 00000052`0000008c 00000000`00000000 : nt!KeBugCheckEx
fffff880`037167a0 fffff800`030e0d6e : 00000000`00000000 00000052`0000008c 00000000`00000000 00000000`0007240b : nt! ?? ::FNODOBFM::`string'+0x46485
fffff880`03716900 fffff800`031e3b37 : fffffa80`06e50b30 fffffa80`0dcfece0 00000000`00000002 fffff800`032594f0 : nt!KiPageFault+0x16e
fffff880`03716a90 fffff800`0315eb13 : fffffa80`06e50b30 00000003`00000000 00000052`00000054 00000000`0082a000 : nt!MiEmptyPageAccessLog+0xe7
fffff880`03716b00 fffff800`030cd826 : 00000000`0000e3ca 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4d7db
fffff880`03716b80 fffff800`030cdcd3 : 00000000`00000008 fffff880`03716c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03716bd0 fffff800`0337dfee : fffffa80`06c84ae0 00000000`00000080 fffffa80`06c69b30 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03716d40 fffff800`030d45e6 : fffff880`009eb180 fffffa80`06c84ae0 fffff880`009f5fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03716d80 00000000`00000000 : fffff880`03717000 fffff880`03711000 fffff880`03716700 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46485
fffff800`03075d7e cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46485

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3

FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485

BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
fffff800`03066000 fffff800`0364f000 nt (pdb symbols) f:\symbols\ntkrnlmp.pdb\47F5C3BF9E0A493C9F63BB8F6413358B2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Wed Jun 22 22:53:23 2011 (4E02AAA3)
CheckSum: 0055C228
ImageSize: 005E9000
File version: 6.1.7601.17640
Product version: 6.1.7601.17640
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17640
FileVersion: 6.1.7601.17640 (win7sp1_gdr.110622-1506)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

 

[zigzag3143]

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[hhjjpp]

Ok, sure thing, but it's 1 Gb large. Any ideas as how best to upload this?


Thanks!


Hjp

 

[zigzag3143]

Ok, sure thing, but it's 1 Gb large. Any ideas as how best to upload this?


Thanks!


Hjp

Evidently your System control panel isnt configured for "small" DMP files, Read the instructions in configuring for small dmp in the previous posts