Bluescreen nach Abmeldung am Terminal Server

[kerics 10]

Ich versuchte die Ursache für den Bluescreen zu finden, ich analysierte die dmp Datei, nur komme ich da nicht weiter. WinDbg zeigt mir folgende Informationen an:

 

BITTE um Hilfe

 

mfg

 

Peter

[kerics 10]

Loading Dump File [i:\xxxxx\xxxxx\xxxxx\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

 

Symbol search path is: SRV*c:\test*Symbol information

Executable search path is:

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible

Product: Server, suite: TerminalServer

Built by: 3790.srv03_sp2_gdr.100216-1301

Machine Name:

Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8

Debug session time: Wed May 26 16:33:06.030 2010 (GMT+2)

System Uptime: 0 days 23:37:48.626

Loading Kernel Symbols

...............................................................

........................................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Loading unloaded module list

.....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck BA, {4, 1, e5f081d0, 1f}

 

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Probably caused by : memory_corruption ( nt!MiFreeSessionSpaceMap+2c )

 

Followup: MachineOwner

---------

 

windbg> .hh dbgerr001

4: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

SESSION_HAS_VALID_VIEWS_ON_EXIT (ba)

Caused by a session driver not unmapping its mapped views prior to a

session unload. This indicates a bug in win32k.sys, atmfd.dll,

rdpdd.dll or a video driver.

Arguments:

Arg1: 00000004, session ID

Arg2: 00000001, number of mapped views that are leaking

Arg3: e5f081d0, address of this session's mapped views table

Arg4: 0000001f, size of this session's mapped views table.

 

Debugging Details:

------------------

 

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

 

DEFAULT_BUCKET_ID: DRIVER_FAULT

 

BUGCHECK_STR: 0xBA

 

PROCESS_NAME: csrss.exe

 

CURRENT_IRQL: 0

 

LAST_CONTROL_TRANSFER: from 8095f6dc to 8087c4a0

 

STACK_TEXT:

f5bf5c4c 8095f6dc 000000ba 00000004 00000001 nt!KeBugCheckEx+0x1b

f5bf5c68 809c63e1 87840d88 87840d88 00000000 nt!MiFreeSessionSpaceMap+0x2c

f5bf5ce8 8082a2e6 87840d88 00000000 87168a58 nt!MiDereferenceSessionFinal+0x23f

f5bf5d04 8090e5dc 87840d88 87168a58 87168c98 nt!MmCleanProcessAddressSpace+0x6b

f5bf5d8c 8092076c 00000000 00000000 87168a58 nt!PspExitThread+0x5f1

f5bf5da4 809208c9 87168a58 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b

f5bf5ddc 8083fe9f bf919dc6 87213648 00000000 nt!PspSystemThreadStartup+0x3c

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

nt!MiFreeSessionSpaceMap+2c

8095f6dc cc int 3

 

SYMBOL_STACK_INDEX: 1

 

SYMBOL_NAME: nt!MiFreeSessionSpaceMap+2c

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7aa3ac

 

IMAGE_NAME: memory_corruption

 

FAILURE_BUCKET_ID: 0xBA_nt!MiFreeSessionSpaceMap+2c

 

BUCKET_ID: 0xBA_nt!MiFreeSessionSpaceMap+2c

 

Followup: MachineOwner---------

[NilsK 2.971]

Moin,

 

die Ausgabe des Dumps ist doch eigentlich recht deutlich:

 

 

Probably caused by : memory_corruption ( nt!MiFreeSessionSpaceMap+2c )

[...]

 

SESSION_HAS_VALID_VIEWS_ON_EXIT (ba)

Caused by a session driver not unmapping its mapped views prior to a

session unload. This indicates a bug in win32k.sys, atmfd.dll,

rdpdd.dll or a video driver.

[...]

 

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

 

Ich würde da jetzt mal den Grafiktreiber als ersten Hauptverdächtigen ansehen. Schau doch mal im Debugger, ob - wie vorgeschlagen - ".hh dbgerr001" noch Erhellung bringt.

 

Gruß, Nils

[kerics 10]

Der Befehl bringt nichts. Aber ich hab jetzt ein Hotfix installiert (RDP Fehlerkorrektur), alte Windows Druckertreiber entfernt und Netzteil von HP wechseln lassen.