Microsoft (R) Windows Debugger Version 6.5.0003.7 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Scott\AppData\Local\Temp\WER96B5.tmp\Mini091806-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols;symsrv*symsrv.dll*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Longhorn Kernel Version 5600 MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 5600.16384.x86fre.vista_rc1.060829-2230 Kernel base = 0x81800000 PsLoadedModuleList = 0x81927ad0 Debug session time: Mon Sep 18 21:47:33.273 2006 (GMT-7) System Uptime: 1 days 11:05:37.546 Loading Kernel Symbols ............................................................................................................................................................................. Loading unloaded module list .......... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, 982ecfc4, 9be7ea0c, 0} Probably caused by : win32k.sys ( win32k!xxxMNOpenHierarchy+ed ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 982ecfc4, The address that the exception occurred at Arg3: 9be7ea0c, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!xxxMNOpenHierarchy+ed 982ecfc4 3b4120 cmp eax,[ecx+0x20] TRAP_FRAME: 9be7ea0c -- (.trap ffffffff9be7ea0c) ErrCode = 00000000 eax=00000000 ebx=983df9c0 ecx=00000000 edx=9be7ed14 esi=983df940 edi=00000001 eip=982ecfc4 esp=9be7ea80 ebp=9be7eb5c iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 win32k!xxxMNOpenHierarchy+0xed: 982ecfc4 3b4120 cmp eax,[ecx+0x20] ds:0023:00000020=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 982ece83 to 982ecfc4 STACK_TEXT: 9be7eb5c 982ece83 983df9c0 983df940 983df9c0 win32k!xxxMNOpenHierarchy+0xed 9be7eb78 982e97cd 983df9c0 983df940 00000000 win32k!xxxMNButtonDown+0x4e 9be7ebd8 982eb643 9be7ebf8 00000000 00000000 win32k!xxxHandleMenuMessages+0x55a 9be7ec24 9826d7d3 983df9c0 983df940 013a0344 win32k!xxxMNLoop+0x11e 9be7ec54 982d7587 ff034dd0 0000f093 013a0344 win32k!xxxSysCommand+0x48c 9be7ecb4 982b571a ff034dd0 00000112 0000f093 win32k!xxxRealDefWindowProc+0xbf3 9be7eccc 982a716f ff034dd0 00000112 0000f093 win32k!xxxWrapRealDefWindowProc+0x16 9be7ece8 982b56e6 ff034dd0 00000112 0000f093 win32k!NtUserfnDWORD+0x27 9be7ed20 8184e4b7 002c08fe 00000112 0000f093 win32k!NtUserMessageCall+0xc6 9be7ed20 7781c6c4 002c08fe 00000112 0000f093 nt!KiFastCallEntry+0x127 WARNING: Frame IP not in any known module. Following frames may be wrong. 00e9f1ac 00000000 00000000 00000000 00000000 0x7781c6c4 FOLLOWUP_IP: win32k!xxxMNOpenHierarchy+ed 982ecfc4 3b4120 cmp eax,[ecx+0x20] SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: win32k!xxxMNOpenHierarchy+ed MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 44f54788 STACK_COMMAND: .trap ffffffff9be7ea0c ; kb FAILURE_BUCKET_ID: 0x8E_win32k!xxxMNOpenHierarchy+ed BUCKET_ID: 0x8E_win32k!xxxMNOpenHierarchy+ed Followup: MachineOwner ---------