I have a terminal server 2008 that gave me BSOD 3 times in the last 30
days. I pasted bugcheck Analysis below.
Any help would be appriciated.


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [Z:\Z\Clients\IBEW\Mini Dumps\Mini101309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*your local folder for symbols*http://
msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1)
MP (8 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 6001.18226.x86fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0x81a34000 PsLoadedModuleList = 0x81b4bc70
Debug session time: Tue Oct 13 13:48:13.210 2009 (GMT-7)
System Uptime: 0 days 13:59:19.774
Loading Kernel Symbols
................................................................
.................................................................
.....
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 9978e908, caab1bf0, 0}

Probably caused by : win32k.sys ( win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ
+ac )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this
address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never
have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9978e908, The address that the exception occurred at
Arg3: caab1bf0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
9978e908 833800 cmp dword ptr [eax],0

TRAP_FRAME: caab1bf0 -- (.trap 0xffffffffcaab1bf0)
ErrCode = 00000000
eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
edi=caab1c8c
eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
9978e908 833800 cmp dword ptr [eax],0 ds:
0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 9978fb79 to 9978e908

STACK_TEXT:
caab1c68 9978fb79 5e21087b 9978f565 02b34de4 win32k!
DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac
caab1d30 81a8ba1a fdc3f420 ffa872a8 fe000410 win32k!NtGdiBitBlt+0x615
caab1d30 776e9a94 fdc3f420 ffa872a8 fe000410 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be
wrong.
02b34df4 00000000 00000000 00000000 00000000 0x776e9a94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
9978e908 833800 cmp dword ptr [eax],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 498f9e9d

FAILURE_BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac

BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this
address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never
have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9978e908, The address that the exception occurred at
Arg3: caab1bf0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
9978e908 833800 cmp dword ptr [eax],0

TRAP_FRAME: caab1bf0 -- (.trap 0xffffffffcaab1bf0)
ErrCode = 00000000
eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
edi=caab1c8c
eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
9978e908 833800 cmp dword ptr [eax],0 ds:
0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0



LAST_CONTROL_TRANSFER: from 9978fb79 to 9978e908

STACK_TEXT:
caab1c68 9978fb79 5e21087b 9978f565 02b34de4 win32k!
DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac
caab1d30 81a8ba1a fdc3f420 ffa872a8 fe000410 win32k!NtGdiBitBlt+0x615
caab1d30 776e9a94 fdc3f420 ffa872a8 fe000410 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be
wrong.
02b34df4 00000000 00000000 00000000 00000000 0x776e9a94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
9978e908 833800 cmp dword ptr [eax],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 498f9e9d

FAILURE_BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac

BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac

Followup: MachineOwner
---------

3: kd> .trap 0xffffffffcaab1bf0
ErrCode = 00000000
eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
edi=caab1c8c
eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
9978e908 833800 cmp dword ptr [eax],0 ds:
0023:00000000=????????

Looks like the fault comes from iexplore.exe.
Did you install some unusual add-ins?
Check Internet Explorer and remove any unnecessary/suspicious add-ins.


"Lici" <mizerajkula@newsgroup> wrote in message
news:7b9864a4-05da-4c79-909c-924b00977778@newsgroup

> I have a terminal server 2008 that gave me BSOD 3 times in the last 30
> days. I pasted bugcheck Analysis below.
> Any help would be appriciated.
>
>
> Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [Z:\Z\Clients\IBEW\Mini Dumps\Mini101309-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: SRV*your local folder for symbols*http://
> msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1)
> MP (8 procs) Free x86 compatible
> Product: Server, suite: TerminalServer
> Built by: 6001.18226.x86fre.vistasp1_gdr.090302-1506
> Machine Name:
> Kernel base = 0x81a34000 PsLoadedModuleList = 0x81b4bc70
> Debug session time: Tue Oct 13 13:48:13.210 2009 (GMT-7)
> System Uptime: 0 days 13:59:19.774
> Loading Kernel Symbols
> ...............................................................
> ................................................................
> ....
> Loading User Symbols
> Loading unloaded module list
> .....
> *******************************************************************************
> *
> *
> * Bugcheck
> Analysis *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 1000008E, {c0000005, 9978e908, caab1bf0, 0}
>
> Probably caused by : win32k.sys ( win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ
> +ac )
>
> Followup: MachineOwner
> ---------
>
> 3: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck
> Analysis *
> *
> *
> *******************************************************************************
>
> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
> This is a very common bugcheck. Usually the exception address
> pinpoints
> the driver/function that caused the problem. Always note this address
> as well as the link date of the driver/image that contains this
> address.
> Some common problems are exception code 0x80000003. This means a hard
> coded breakpoint or assertion was hit, but this system was booted
> /NODEBUG. This is not supposed to happen as developers should never
> have
> hardcoded breakpoints in retail code, but ...
> If this happens, make sure a debugger gets connected, and the
> system is booted /DEBUG. This will let us see why this breakpoint is
> happening.
> Arguments:
> Arg1: c0000005, The exception code that was not handled
> Arg2: 9978e908, The address that the exception occurred at
> Arg3: caab1bf0, Trap Frame
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
> referenced memory at 0x%08lx. The memory could not be %s.
>
> FAULTING_IP:
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
> 9978e908 833800 cmp dword ptr [eax],0
>
> TRAP_FRAME: caab1bf0 -- (.trap 0xffffffffcaab1bf0)
> ErrCode = 00000000
> eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
> edi=caab1c8c
> eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
> na pe nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
> 9978e908 833800 cmp dword ptr [eax],0 ds:
> 0023:00000000=????????
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
> BUGCHECK_STR: 0x8E
>
> PROCESS_NAME: iexplore.exe
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from 9978fb79 to 9978e908
>
> STACK_TEXT:
> caab1c68 9978fb79 5e21087b 9978f565 02b34de4 win32k!
> DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac
> caab1d30 81a8ba1a fdc3f420 ffa872a8 fe000410 win32k!NtGdiBitBlt+0x615
> caab1d30 776e9a94 fdc3f420 ffa872a8 fe000410 nt!KiFastCallEntry+0x12a
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 02b34df4 00000000 00000000 00000000 00000000 0x776e9a94
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
> 9978e908 833800 cmp dword ptr [eax],0
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: win32k
>
> IMAGE_NAME: win32k.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 498f9e9d
>
> FAILURE_BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac
>
> BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac
>
> Followup: MachineOwner
> ---------
>
> 3: kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck
> Analysis *
> *
> *
> *******************************************************************************
>
> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
> This is a very common bugcheck. Usually the exception address
> pinpoints
> the driver/function that caused the problem. Always note this address
> as well as the link date of the driver/image that contains this
> address.
> Some common problems are exception code 0x80000003. This means a hard
> coded breakpoint or assertion was hit, but this system was booted
> /NODEBUG. This is not supposed to happen as developers should never
> have
> hardcoded breakpoints in retail code, but ...
> If this happens, make sure a debugger gets connected, and the
> system is booted /DEBUG. This will let us see why this breakpoint is
> happening.
> Arguments:
> Arg1: c0000005, The exception code that was not handled
> Arg2: 9978e908, The address that the exception occurred at
> Arg3: caab1bf0, Trap Frame
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
> referenced memory at 0x%08lx. The memory could not be %s.
>
> FAULTING_IP:
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
> 9978e908 833800 cmp dword ptr [eax],0
>
> TRAP_FRAME: caab1bf0 -- (.trap 0xffffffffcaab1bf0)
> ErrCode = 00000000
> eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
> edi=caab1c8c
> eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
> na pe nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
> 9978e908 833800 cmp dword ptr [eax],0 ds:
> 0023:00000000=????????
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
> BUGCHECK_STR: 0x8E
>
> PROCESS_NAME: iexplore.exe
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from 9978fb79 to 9978e908
>
> STACK_TEXT:
> caab1c68 9978fb79 5e21087b 9978f565 02b34de4 win32k!
> DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac
> caab1d30 81a8ba1a fdc3f420 ffa872a8 fe000410 win32k!NtGdiBitBlt+0x615
> caab1d30 776e9a94 fdc3f420 ffa872a8 fe000410 nt!KiFastCallEntry+0x12a
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 02b34df4 00000000 00000000 00000000 00000000 0x776e9a94
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
> 9978e908 833800 cmp dword ptr [eax],0
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+ac
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: win32k
>
> IMAGE_NAME: win32k.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 498f9e9d
>
> FAILURE_BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac
>
> BUCKET_ID: 0x8E_win32k!DEVLOCKBLTOBJ::_DEVLOCKBLTOBJ+ac
>
> Followup: MachineOwner
> ---------
>
> 3: kd> .trap 0xffffffffcaab1bf0
> ErrCode = 00000000
> eax=00000000 ebx=ff096018 ecx=caab1c38 edx=00000971 esi=caab1c7c
> edi=caab1c8c
> eip=9978e908 esp=caab1c64 ebp=caab1d30 iopl=0 nv up ei pl zr
> na pe nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> win32k!DEVLOCKBLTOBJ::~DEVLOCKBLTOBJ+0xac:
> 9978e908 833800 cmp dword ptr [eax],0 ds:
> 0023:00000000=????????
>
>