none
"Remote Desktop connection has stopped working." problem in Windows 8 RRS feed

  • Question

  • here is the event log.  Only happens on a few of our servers

     

    Faulting application name: mstsc.exe, version: 6.2.9200.16384, time stamp: 0x50108ae1

    Faulting module name: ntdll.dll, version: 6.2.9200.16420, time stamp: 0x505ab405

    Exception code: 0xc0000005

    Fault offset: 0x0000000000002acd

    Faulting process id: 0x13c4

    Faulting application start time: 0x01cdbd0d09091fcd

    Faulting application path: C:\Windows\System32\mstsc.exe

    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

    Report Id: 4d923a55-2900-11e2-be73-cc52af4d02a3

    Faulting package full name:

     

    Thursday, November 8, 2012 2:53 PM

Answers

  • Your Ricoh printer drivers cause the crashes:

    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for RC5BE130.DLL - 
    
    FAULTING_IP: 
    ntdll!memcpy+21a
    000007f8`1fed2acd f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007f81fed2acd (ntdll!memcpy+0x000000000000021a)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 00000000bd9e440c
    Attempt to read from address 00000000bd9e440c
    
    DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  00000000bd9e440c
    
    READ_ADDRESS:  00000000bd9e440c 
    
    FOLLOWUP_IP: 
    RC5BE130!PrinterProperties+2a1ea
    00000000`71c4c46a 8b442430        mov     eax,dword ptr [rsp+30h]
    
    DETOURED_IMAGE: 1
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000001198
    
    PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
    
    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ
    
    LAST_CONTROL_TRANSFER:  from 0000000071c4c46a to 000007f81fed2acd
    
    STACK_TEXT:  
    000000bb`ba9cf248 00000000`71c4c46a : 000000bb`00000040 000000bb`ba9cf618 000000bb`bd7a1458 00000000`00000000 : ntdll!memcpy+0x21a
    000000bb`ba9cf250 00000000`71c4bf68 : 000000bb`b45ccc40 000000bb`bae6e7c8 000000bb`bd7a1458 00000000`00000000 : RC5BE130!PrinterProperties+0x2a1ea
    000000bb`ba9cf2a0 00000000`71c4b2f9 : 000000bb`bd7a1458 000000bb`bd7a1458 00000000`00000000 00000000`71c10000 : RC5BE130!PrinterProperties+0x29ce8
    000000bb`ba9cf380 00000000`71c2a08a : 000000bb`bd7a1458 000000bb`bd7a1458 00000000`00000000 00000000`02000000 : RC5BE130!PrinterProperties+0x29079
    000000bb`ba9cf3d0 00000000`71c283de : 000000bb`ba9cf618 000000bb`badfb050 000000bb`00000000 00650074`00730079 : RC5BE130!PrinterProperties+0x7e0a
    000000bb`ba9cf440 00000000`71c2209d : 00000000`00000000 000000bb`ba9cf618 00007989`001a0019 000007f8`169fafa0 : RC5BE130!PrinterProperties+0x615e
    000000bb`ba9cf550 000007f8`169e5ea0 : 00000000`00000000 000000bb`ba9cf618 000000bb`bd7a1458 000000bb`bd7a1458 : RC5BE130!DrvDocumentPropertySheets+0x1d
    000000bb`ba9cf580 000007f8`169e6b9f : 000000bb`00000000 000000bb`ba9cf670 00000000`00000000 00000000`00000004 : winspool!DocumentPropertySheets+0xb0
    000000bb`ba9cf5f0 000007f8`169e6aa5 : 00000000`00000002 000007f8`ffffffff 00000000`00000000 00000000`00000000 : winspool!DocumentPropertiesWNative+0xcf
    000000bb`ba9cf680 000007ff`f4f3dc32 : 00000000`00000000 000000bb`b93f3990 00000000`000004d4 000000bb`ba9cf790 : winspool!DocumentPropertiesW+0x7d
    000000bb`ba9cf6e0 000007ff`f4f9a09b : 00000000`00000000 000000bb`ba9cf7b0 00000000`00000000 000000bb`b93c7530 : mstscax!CTSClientPrintDriver::DocumentPropertiesW+0x37e
    000000bb`ba9cf730 000007ff`f4f994d4 : 000000bb`b93c7530 000007f8`00000000 00000000`00000000 000000bb`00000000 : mstscax!CStubITS_PrintDriver<ITS_PrintDriver>::Invoke_DocumentPropertiesW+0x12b
    000000bb`ba9cf7e0 000007ff`f4f8ff0c : 000000bb`b93c7530 000000bb`b93f29e0 000000bb`b94060d0 00000000`00000000 : mstscax!CStubITS_PrintDriver<ITS_PrintDriver>::Dispatch_Invoke+0x68
    000000bb`ba9cf840 000007ff`f4f95a84 : 000000bb`b93c7530 00000000`00000000 000000bb`b93c7530 000000bb`b93cccc0 : mstscax!CStub<IMMClientNotifications>::Invoke+0x64
    000000bb`ba9cf8b0 000007ff`f4f94310 : 000000bb`b93cccc0 000000bb`b93c7530 000000bb`ba9cf930 000000bb`b693b3c0 : mstscax!CRIMStreamStub::OnDataReceived+0x98
    000000bb`ba9cf8e0 000007ff`f4f18c5a : 000000bb`b93cccc0 000000bb`b93f4cd8 000000bb`b93f4b10 000000bb`b93f4cd8 : mstscax!CRIMObjManager::OnDataReceived+0x150
    000000bb`ba9cf960 000007ff`f4f20132 : 000000bb`b93c6908 00000000`00000000 000000bb`b93c6908 00000000`00000e28 : mstscax!CDynVCChannel::HandleAsyncCall+0x12e
    000000bb`ba9cf9b0 000007ff`f4ed94e7 : 000000bb`b93f36a0 000000bb`b93c68c0 00000000`00000000 000000bb`b93f40d0 : mstscax!CDynVCThreadPoolThread::ThreadPoolEntry+0x102
    000000bb`ba9cfa00 000007ff`f4c5aba9 : 000000bb`b7ddeb58 00000000`00000000 000007ff`f4b50000 00000000`00000000 : mstscax!CTSThread::TSStaticThreadEntry+0x33b
    000000bb`ba9cfa90 000007f8`1e41167e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mstscax!PAL_System_Win32_ThreadProcWrapper+0x25
    000000bb`ba9cfac0 000007f8`1fef3501 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
    000000bb`ba9cfaf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
    
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  rc5be130!PrinterProperties+2a1ea
    
    FOLLOWUP_NAME:  wintriag
    
    MODULE_NAME: RC5BE130
    
    IMAGE_NAME:  RC5BE130.DLL
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4bd67428
    
    STACK_COMMAND:  ~18s; .ecxr ; kb
    
    FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_RC5BE130.DLL!PrinterProperties
    
    BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_DETOURED_rc5be130!PrinterProperties+2a1ea
    
    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/mstsc_exe/6_2_9200_16384/50108ae1/ntdll_dll/6_2_9200_16420/505ab405/c0000005/00002acd.htm?Retriage=1
    
    Followup: wintriag
    ---------
    
    0:018> lmvm RC5BE130
    start             end                 module name
    00000000`71b00000 00000000`71cdd000   RC5BE130   (export symbols)       RC5BE130.DLL
        Loaded symbol image file: RC5BE130.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\RC5BE130.DLL
        Image name: RC5BE130.DLL
        Timestamp:        Tue Apr 27 07:20:40 2010 (4BD67428)
        CheckSum:         001E2D52
        ImageSize:        001DD000
        File version:     0.3.0.0
        Product version:  1.0.0.0
        File flags:       1 (Mask 3F) Debug
        File OS:          40004 NT Win32
        File type:        2.1 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      RICOH CO., LTD.
        ProductName:      RICOH RPCS Printer Driver
        InternalName:     RC5BE130.DLL
        OriginalFilename: RC5BE130.DLL
        ProductVersion:   1.0.0
        FileVersion:      7.6.9
        FileDescription:  RICOH RPCS Printer Driver
        LegalCopyright:   Copyright(C) 1999-2010 RICOH CO., LTD.

    so check for a printer driver update and what you can also do is to avoid mapping your printer to the Remote Desktop. Maybe this also fixes the issue.


    "A programmer is just a tool which converts caffeine into code"

    Friday, November 9, 2012 3:37 PM
    Answerer
  •  I unchecked all my local setting and still getting the same error sporadically.  Can you look at this?

    this time a combination of 2X Client and your RICOH Driver is the cause:

    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for RC5BE100.DLL - 
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for 2XDevRedir.dll - 
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for 2XVirtualPrinter.dll - 
    
    FAULTING_IP: 
    msvcrt!memcpy+21a
    000007f8`c1e5122a f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007f8c1e5122a (msvcrt!memcpy+0x000000000000021a)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000000008b1ea29c
    Attempt to read from address 000000008b1ea29c
    
    DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  000000008b1ea29c
    
    READ_ADDRESS:  000000008b1ea29c 
    
    FOLLOWUP_IP: 
    msvcrt!memcpy+21a
    000007f8`c1e5122a f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    DETOURED_IMAGE: 1
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000000e08
    
    PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
    
    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ
    
    LAST_CONTROL_TRANSFER:  from 000000000050645a to 000007f8c1e5122a
    
    STACK_TEXT:  
    ntdll!NtWaitForMultipleObjects
    KERNELBASE!WaitForMultipleObjectsEx
    kernel32!WerpReportFaultInternal
    kernel32!WerpReportFault
    KERNELBASE!UnhandledExceptionFilter
    ntdll!LdrpLogFatalUserCallbackException
    ntdll!KiUserCallbackDispatcherHandler
    ntdll!RtlpExecuteHandlerForException
    ntdll!RtlDispatchException
    ntdll!KiUserExceptionDispatch
    msvcrt!memcpy
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    gdi32!GdiPrinterThunk
    user32!_ClientPrinterThunk
    ntdll!KiUserCallbackDispatcherContinue
    gdi32!NtGdiOpenDCW
    gdi32!hdcCreateDCW
    gdi32!bCreateDCW
    gdi32!CreateDCW
    2XDevRedir
    2XDevRedir
    2XDevRedir
    2XDevRedir
    2XDevRedir
    kernel32!BaseThreadInitThunk
    ntdll!RtlUserThreadStart
    
    
    
    
        Loaded symbol image file: 2XDevRedir.dll
        Image path: C:\Program Files\2X\Client\2XDevRedir.dll
        Image name: 2XDevRedir.dll
        Timestamp:        Sun Oct 14 17:28:03 2012 (507ADA03)
        CheckSum:         000F4E42
        ImageSize:        000F9000
        File version:     10.5.1323.0
        Product version:  10.5.1323.0
        File flags:       22 (Mask 3F) Pre-release Special
        File OS:          4 Unknown Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0
        CompanyName:      2X Software Ltd.
        ProductName:      2X ApplicationServer
        InternalName:     AsyncChannelClient.dll
        OriginalFilename: AsyncChannelClient.dll
        ProductVersion:   10.5 (build 1323)
        FileVersion:      10.5 (build 1323)
        FileDescription:  AsyncChannelClient plug-in
        LegalCopyright:   © 2012 2X Software Ltd. All rights reserved.
    
    
    
        Loaded symbol image file: RC5BE100.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\RC5BE100.DLL
        Image name: RC5BE100.DLL
        Timestamp:        Tue Apr 27 07:22:29 2010 (4BD67495)
        CheckSum:         001A2108
        ImageSize:        00198000
        File version:     0.3.0.0
        Product version:  1.0.0.0
        File flags:       1 (Mask 3F) Debug
        File OS:          40004 NT Win32
        File type:        2.1 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      RICOH CO., LTD.
        ProductName:      RICOH RPCS Printer Driver
        InternalName:     RC5BE100.DLL
        OriginalFilename: RC5BE100.DLL
        ProductVersion:   1.0.0
        FileVersion:      7.6.9
        FileDescription:  RICOH RPCS Printer Driver
        LegalCopyright:   Copyright(C) 1999-2010 RICOH CO., LTD.
    


    "A programmer is just a tool which converts caffeine into code"

    Wednesday, November 28, 2012 3:29 PM
    Answerer

All replies

  • please download this reg file from my SkyDrive:

    http://cid-128fc518635be2dc.office.live.com/self.aspx/.Public/MS%20Foren/Registry/LocalDumps.reg

    and make a double click on the file to import it.

    When an application crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps. Please upload the dump of remote desktop (zip it first) to your public Skydrive [2] folder and post the link here. I take a look at the dump with the Debugger, maybe I can see the cause.

    André

    [1] http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65

    "A programmer is just a tool which converts caffeine into code"

    Thursday, November 8, 2012 3:20 PM
    Answerer
  • one is from my RDP to a Virtual Server the other is to a RAS Server
    Friday, November 9, 2012 3:36 PM
  • Your Ricoh printer drivers cause the crashes:

    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for RC5BE130.DLL - 
    
    FAULTING_IP: 
    ntdll!memcpy+21a
    000007f8`1fed2acd f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007f81fed2acd (ntdll!memcpy+0x000000000000021a)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 00000000bd9e440c
    Attempt to read from address 00000000bd9e440c
    
    DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  00000000bd9e440c
    
    READ_ADDRESS:  00000000bd9e440c 
    
    FOLLOWUP_IP: 
    RC5BE130!PrinterProperties+2a1ea
    00000000`71c4c46a 8b442430        mov     eax,dword ptr [rsp+30h]
    
    DETOURED_IMAGE: 1
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000001198
    
    PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
    
    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ
    
    LAST_CONTROL_TRANSFER:  from 0000000071c4c46a to 000007f81fed2acd
    
    STACK_TEXT:  
    000000bb`ba9cf248 00000000`71c4c46a : 000000bb`00000040 000000bb`ba9cf618 000000bb`bd7a1458 00000000`00000000 : ntdll!memcpy+0x21a
    000000bb`ba9cf250 00000000`71c4bf68 : 000000bb`b45ccc40 000000bb`bae6e7c8 000000bb`bd7a1458 00000000`00000000 : RC5BE130!PrinterProperties+0x2a1ea
    000000bb`ba9cf2a0 00000000`71c4b2f9 : 000000bb`bd7a1458 000000bb`bd7a1458 00000000`00000000 00000000`71c10000 : RC5BE130!PrinterProperties+0x29ce8
    000000bb`ba9cf380 00000000`71c2a08a : 000000bb`bd7a1458 000000bb`bd7a1458 00000000`00000000 00000000`02000000 : RC5BE130!PrinterProperties+0x29079
    000000bb`ba9cf3d0 00000000`71c283de : 000000bb`ba9cf618 000000bb`badfb050 000000bb`00000000 00650074`00730079 : RC5BE130!PrinterProperties+0x7e0a
    000000bb`ba9cf440 00000000`71c2209d : 00000000`00000000 000000bb`ba9cf618 00007989`001a0019 000007f8`169fafa0 : RC5BE130!PrinterProperties+0x615e
    000000bb`ba9cf550 000007f8`169e5ea0 : 00000000`00000000 000000bb`ba9cf618 000000bb`bd7a1458 000000bb`bd7a1458 : RC5BE130!DrvDocumentPropertySheets+0x1d
    000000bb`ba9cf580 000007f8`169e6b9f : 000000bb`00000000 000000bb`ba9cf670 00000000`00000000 00000000`00000004 : winspool!DocumentPropertySheets+0xb0
    000000bb`ba9cf5f0 000007f8`169e6aa5 : 00000000`00000002 000007f8`ffffffff 00000000`00000000 00000000`00000000 : winspool!DocumentPropertiesWNative+0xcf
    000000bb`ba9cf680 000007ff`f4f3dc32 : 00000000`00000000 000000bb`b93f3990 00000000`000004d4 000000bb`ba9cf790 : winspool!DocumentPropertiesW+0x7d
    000000bb`ba9cf6e0 000007ff`f4f9a09b : 00000000`00000000 000000bb`ba9cf7b0 00000000`00000000 000000bb`b93c7530 : mstscax!CTSClientPrintDriver::DocumentPropertiesW+0x37e
    000000bb`ba9cf730 000007ff`f4f994d4 : 000000bb`b93c7530 000007f8`00000000 00000000`00000000 000000bb`00000000 : mstscax!CStubITS_PrintDriver<ITS_PrintDriver>::Invoke_DocumentPropertiesW+0x12b
    000000bb`ba9cf7e0 000007ff`f4f8ff0c : 000000bb`b93c7530 000000bb`b93f29e0 000000bb`b94060d0 00000000`00000000 : mstscax!CStubITS_PrintDriver<ITS_PrintDriver>::Dispatch_Invoke+0x68
    000000bb`ba9cf840 000007ff`f4f95a84 : 000000bb`b93c7530 00000000`00000000 000000bb`b93c7530 000000bb`b93cccc0 : mstscax!CStub<IMMClientNotifications>::Invoke+0x64
    000000bb`ba9cf8b0 000007ff`f4f94310 : 000000bb`b93cccc0 000000bb`b93c7530 000000bb`ba9cf930 000000bb`b693b3c0 : mstscax!CRIMStreamStub::OnDataReceived+0x98
    000000bb`ba9cf8e0 000007ff`f4f18c5a : 000000bb`b93cccc0 000000bb`b93f4cd8 000000bb`b93f4b10 000000bb`b93f4cd8 : mstscax!CRIMObjManager::OnDataReceived+0x150
    000000bb`ba9cf960 000007ff`f4f20132 : 000000bb`b93c6908 00000000`00000000 000000bb`b93c6908 00000000`00000e28 : mstscax!CDynVCChannel::HandleAsyncCall+0x12e
    000000bb`ba9cf9b0 000007ff`f4ed94e7 : 000000bb`b93f36a0 000000bb`b93c68c0 00000000`00000000 000000bb`b93f40d0 : mstscax!CDynVCThreadPoolThread::ThreadPoolEntry+0x102
    000000bb`ba9cfa00 000007ff`f4c5aba9 : 000000bb`b7ddeb58 00000000`00000000 000007ff`f4b50000 00000000`00000000 : mstscax!CTSThread::TSStaticThreadEntry+0x33b
    000000bb`ba9cfa90 000007f8`1e41167e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mstscax!PAL_System_Win32_ThreadProcWrapper+0x25
    000000bb`ba9cfac0 000007f8`1fef3501 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
    000000bb`ba9cfaf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
    
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  rc5be130!PrinterProperties+2a1ea
    
    FOLLOWUP_NAME:  wintriag
    
    MODULE_NAME: RC5BE130
    
    IMAGE_NAME:  RC5BE130.DLL
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4bd67428
    
    STACK_COMMAND:  ~18s; .ecxr ; kb
    
    FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_RC5BE130.DLL!PrinterProperties
    
    BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_DETOURED_rc5be130!PrinterProperties+2a1ea
    
    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/mstsc_exe/6_2_9200_16384/50108ae1/ntdll_dll/6_2_9200_16420/505ab405/c0000005/00002acd.htm?Retriage=1
    
    Followup: wintriag
    ---------
    
    0:018> lmvm RC5BE130
    start             end                 module name
    00000000`71b00000 00000000`71cdd000   RC5BE130   (export symbols)       RC5BE130.DLL
        Loaded symbol image file: RC5BE130.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\RC5BE130.DLL
        Image name: RC5BE130.DLL
        Timestamp:        Tue Apr 27 07:20:40 2010 (4BD67428)
        CheckSum:         001E2D52
        ImageSize:        001DD000
        File version:     0.3.0.0
        Product version:  1.0.0.0
        File flags:       1 (Mask 3F) Debug
        File OS:          40004 NT Win32
        File type:        2.1 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      RICOH CO., LTD.
        ProductName:      RICOH RPCS Printer Driver
        InternalName:     RC5BE130.DLL
        OriginalFilename: RC5BE130.DLL
        ProductVersion:   1.0.0
        FileVersion:      7.6.9
        FileDescription:  RICOH RPCS Printer Driver
        LegalCopyright:   Copyright(C) 1999-2010 RICOH CO., LTD.

    so check for a printer driver update and what you can also do is to avoid mapping your printer to the Remote Desktop. Maybe this also fixes the issue.


    "A programmer is just a tool which converts caffeine into code"

    Friday, November 9, 2012 3:37 PM
    Answerer
  • Andre'

    IT WORKED THANKS!!!

    That is probably the DUMBEST way to figure it out! I was chasing my tail because the event log was sending me completely in the wrong direction?  we all have migrated to Win 8 and we use a product called 2X and I was the only one having this problem. (I even uninstalled 2X, which our Senior guy said should alleviate the problem.)

    You are THE MAN!!!!

    Thanks

    Barmace Drachewolf

    Friday, November 9, 2012 4:46 PM
  • I was chasing my tail because the event log was sending me completely in the wrong direction? 
    no, it shows that the NTdll is involved and yes, the dll is providing the memcpy function which failed, but you can't see who calls it from eventlog. That's why I never look there for information. If I have crashes I try to generate dumps and look at them with WinDbg.

    "A programmer is just a tool which converts caffeine into code"

    Saturday, November 10, 2012 9:08 AM
    Answerer
  • I had the same problem and Disabling Printers in 'Local devices and resources' fixed it. Thanks for the great tip.

    Bernard.

    Monday, November 12, 2012 6:49 PM
  • Andre,

    I need you again.  I unchecked all my local setting and still getting the same error sporadically.  Can you look at this?

    https://skydrive.live.com/redir?resid=880F09279B951A7D!116

    YOU ARE THE MAN!!!!

    Barmace.

    Wednesday, November 28, 2012 2:36 PM
  •  I unchecked all my local setting and still getting the same error sporadically.  Can you look at this?

    this time a combination of 2X Client and your RICOH Driver is the cause:

    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for RC5BE100.DLL - 
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for 2XDevRedir.dll - 
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for 2XVirtualPrinter.dll - 
    
    FAULTING_IP: 
    msvcrt!memcpy+21a
    000007f8`c1e5122a f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007f8c1e5122a (msvcrt!memcpy+0x000000000000021a)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000000008b1ea29c
    Attempt to read from address 000000008b1ea29c
    
    DEFAULT_BUCKET_ID:  INVALID_POINTER_READ
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  000000008b1ea29c
    
    READ_ADDRESS:  000000008b1ea29c 
    
    FOLLOWUP_IP: 
    msvcrt!memcpy+21a
    000007f8`c1e5122a f30f6f4402f0    movdqu  xmm0,xmmword ptr [rdx+rax-10h]
    
    DETOURED_IMAGE: 1
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000000e08
    
    PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ
    
    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ
    
    LAST_CONTROL_TRANSFER:  from 000000000050645a to 000007f8c1e5122a
    
    STACK_TEXT:  
    ntdll!NtWaitForMultipleObjects
    KERNELBASE!WaitForMultipleObjectsEx
    kernel32!WerpReportFaultInternal
    kernel32!WerpReportFault
    KERNELBASE!UnhandledExceptionFilter
    ntdll!LdrpLogFatalUserCallbackException
    ntdll!KiUserCallbackDispatcherHandler
    ntdll!RtlpExecuteHandlerForException
    ntdll!RtlDispatchException
    ntdll!KiUserExceptionDispatch
    msvcrt!memcpy
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    RC5BE100!DrvDisableDriver
    gdi32!GdiPrinterThunk
    user32!_ClientPrinterThunk
    ntdll!KiUserCallbackDispatcherContinue
    gdi32!NtGdiOpenDCW
    gdi32!hdcCreateDCW
    gdi32!bCreateDCW
    gdi32!CreateDCW
    2XDevRedir
    2XDevRedir
    2XDevRedir
    2XDevRedir
    2XDevRedir
    kernel32!BaseThreadInitThunk
    ntdll!RtlUserThreadStart
    
    
    
    
        Loaded symbol image file: 2XDevRedir.dll
        Image path: C:\Program Files\2X\Client\2XDevRedir.dll
        Image name: 2XDevRedir.dll
        Timestamp:        Sun Oct 14 17:28:03 2012 (507ADA03)
        CheckSum:         000F4E42
        ImageSize:        000F9000
        File version:     10.5.1323.0
        Product version:  10.5.1323.0
        File flags:       22 (Mask 3F) Pre-release Special
        File OS:          4 Unknown Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0
        CompanyName:      2X Software Ltd.
        ProductName:      2X ApplicationServer
        InternalName:     AsyncChannelClient.dll
        OriginalFilename: AsyncChannelClient.dll
        ProductVersion:   10.5 (build 1323)
        FileVersion:      10.5 (build 1323)
        FileDescription:  AsyncChannelClient plug-in
        LegalCopyright:   © 2012 2X Software Ltd. All rights reserved.
    
    
    
        Loaded symbol image file: RC5BE100.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\RC5BE100.DLL
        Image name: RC5BE100.DLL
        Timestamp:        Tue Apr 27 07:22:29 2010 (4BD67495)
        CheckSum:         001A2108
        ImageSize:        00198000
        File version:     0.3.0.0
        Product version:  1.0.0.0
        File flags:       1 (Mask 3F) Debug
        File OS:          40004 NT Win32
        File type:        2.1 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      RICOH CO., LTD.
        ProductName:      RICOH RPCS Printer Driver
        InternalName:     RC5BE100.DLL
        OriginalFilename: RC5BE100.DLL
        ProductVersion:   1.0.0
        FileVersion:      7.6.9
        FileDescription:  RICOH RPCS Printer Driver
        LegalCopyright:   Copyright(C) 1999-2010 RICOH CO., LTD.
    


    "A programmer is just a tool which converts caffeine into code"

    Wednesday, November 28, 2012 3:29 PM
    Answerer
  • Again thanks.  I did go back to our Senior Engineer and he told me 2x (DOES NOT work with RDP on Win 8)....I misunderstood him. 
    Wednesday, November 28, 2012 6:55 PM
  • Hello there, I have similar problem with RDP and i have tried with disabling printers, clipboard and drives but with no help. On this link is my dump file (i have imported your registry file) so if you could help me with this problem.

    Link sky drive:

    https://skydrive.live.com/redir?resid=757C34929BC6E8B4!259

    Thank you very much



    • Edited by LuX_CRO Wednesday, July 3, 2013 10:13 AM public folder
    Wednesday, July 3, 2013 10:07 AM
  • Hello there, I have similar problem with RDP and i have tried with disabling printers, clipboard and drives but with no help. On this link is my dump file (i have imported your registry file) so if you could help me with this problem.


    try if the crash stops if you remove TeamViewver from the PC:

    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for tv_x64.dll - 
    
    FAULTING_IP: 
    dui70!DirectUI::Element::_SetValue+e
    000007fb`037b27ee 488b01          mov     rax,qword ptr [rcx]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007fb037b27ee (dui70!DirectUI::Element::_SetValue+0x000000000000000e)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000000
    Attempt to read from address 0000000000000000
    
    CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
    rax=000000c2ce180000 rbx=0000000000000002 rcx=000000c2ce180000
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000002
    rip=000007fb08cf319b rsp=000000c2c9249368 rbp=000000c2c9249920
     r8=0000000000000000  r9=0000000000000040 r10=0000000000000000
    r11=0000000000000286 r12=0000000000000008 r13=000000c2c9249698
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    ntdll!NtWaitForMultipleObjects+0xa:
    000007fb`08cf319b c3              ret
    
    DEFAULT_BUCKET_ID:  NULL_POINTER_READ
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000000
    
    READ_ADDRESS:  0000000000000000 
    
    FOLLOWUP_IP: 
    dui70!DirectUI::Element::_SetValue+e
    000007fb`037b27ee 488b01          mov     rax,qword ptr [rcx]
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
    
    FAULTING_THREAD:  0000000000001050
    
    PRIMARY_PROBLEM_CLASS:  NULL_POINTER_READ
    
    BUGCHECK_STR:  APPLICATION_FAULT_NULL_POINTER_READ
    
    LAST_CONTROL_TRANSFER:  from 000007fb037b7db8 to 000007fb037b27ee
    
    STACK_TEXT:  
    ntdll!NtWaitForMultipleObjects
    KERNELBASE!WaitForMultipleObjectsEx
    kernel32!WerpReportFaultInternal
    kernel32!WerpReportFault
    KERNELBASE!UnhandledExceptionFilter
    ntdll!LdrpLogFatalUserCallbackException
    ntdll!KiUserCallbackDispatcherHandler
    ntdll!RtlpExecuteHandlerForException
    ntdll!RtlDispatchException
    ntdll!KiUserExceptionDispatch
    dui70!DirectUI::Element::_SetValue
    dui70!DirectUI::Element::SetLayoutPos
    authui!UserList::_OnEnumerationSyncReply
    authui!CCredDialog::UIJobEvent
    authui!CEnumerationSyncReplyJob::DeferredExecute
    authui!CDeferredUIThreadJob::Do
    authui!CCredentialJobQueue::_ProcessJobs
    authui!CCredDialog::DialogProc
    authui!CCredDialog::s_DialogProc
    user32!UserCallDlgProcCheckWow
    user32!DefDlgProcWorker
    user32!DefDlgProcW
    user32!UserCallWinProcCheckWow
    user32!DispatchMessageWorker
    user32!IsDialogMessageW
    user32!DialogBox2
    user32!InternalDialogBox
    user32!DialogBoxIndirectParamAorW
    user32!DialogBoxIndirectParamW
    authui!CCredDialog::Dialog
    authui!CCredUI::CredUIPromptForWindowsCredentialsW
    credui!CredUIPromptForWindowsCredentialsWorker
    credui!CredUIPromptForWindowsCredentialsW
    mstscax!CTscCredentialsQueryUi::PromptForCredentialsNew
    mstscax!CTscCredsAssistant::PromptForTsCredentials
    mstscax!CTscCredsAssistant::AcquireTsCredentials
    mstscax!CTscCredsAssistant::OnSecurityLayerNegotiationComplete
    mstscax!CUI::OnSecurityLayerNegotiationComplete
    mstscax!CTSThread::RunQueueEvent
    mstscax!CTSThread::RunAllQueueEvents
    mstscax!CTSThread::OnNotifyThreadEventQueue
    mstscax!CTSThread::OnNotifyThreadMessage
    mstscax!PAL_System_Win32_ThreadWndProc
    user32!UserCallWinProcCheckWow
    user32!DispatchMessageWorker
    user32!DialogBox2
    user32!InternalDialogBox
    user32!DialogBoxIndirectParamAorW
    user32!DialogBoxParamW
    mstsc!CDlgBase::CreateModalDialog
    mstsc!CDlgBase::DoModal
    mstsc!CDefaultContWndExt::OnConnectionIssued
    mstsc!CContainerWnd::StartConnection
    mstsc!CMainDlg::DialogBoxProc
    mstsc!CMainDlg::StaticDialogBoxProc
    user32!UserCallDlgProcCheckWow
    user32!DefDlgProcWorker
    user32!DefDlgProcW
    user32!UserCallWinProcCheckWow
    user32!CallWindowProcW
    tv_x64!GetLoaderInterface
    user32!UserCallWinProcCheckWow
    user32!DispatchClientMessage
    user32!_fnDWORD
    ntdll!KiUserCallbackDispatcherContinue
    user32!NtUserMessageCall
    user32!SendMessageWorker
    user32!SendMessageW
    comctl32!Button_ReleaseCapture
    comctl32!Button_WndProc
    user32!UserCallWinProcCheckWow
    user32!DispatchMessageWorker
    user32!IsDialogMessageW
    mstsc!TSCMain
    mstsc!WinMain
    mstsc!ATL::AtlWinModuleTerm
    kernel32!BaseThreadInitThunk
    ntdll!RtlUserThreadStart
    
    
    
    STACK_COMMAND:  ~0s; .ecxr ; kb
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  dui70!DirectUI::Element::_SetValue+e
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: dui70
    
    IMAGE_NAME:  dui70.dll
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  50108e6a
    
    FAILURE_BUCKET_ID:  NULL_POINTER_READ_c0000005_dui70.dll!DirectUI::Element::_SetValue
    
    BUCKET_ID:  APPLICATION_FAULT_NULL_POINTER_READ_dui70!DirectUI::Element::_SetValue+e
    
    ANALYSIS_SOURCE:  UM
    
    FAILURE_ID_HASH_STRING:  um:null_pointer_read_c0000005_dui70.dll!directui::element::_setvalue
    
    FAILURE_ID_HASH:  {930095c3-5c0c-2f4d-937a-6b3b8df05df5}
    
    
    
        Loaded symbol image file: tv_x64.dll
        Image path: C:\Program Files (x86)\TeamViewer\Version8\tv_x64.dll
        Image name: tv_x64.dll
        Timestamp:        Thu Jun 13 11:08:18 2013 (51B98C02)
        CheckSum:         000215D0
        ImageSize:        00020000
        File version:     8.0.19045.0
        Product version:  8.0.0.0
        File flags:       0 (Mask 17)
        File OS:          40000 NT Base
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0
        CompanyName:      TeamViewer GmbH
        ProductName:      TeamViewer Remote Control
        InternalName:     TeamViewer
        OriginalFilename: tv_x64.dll
        ProductVersion:   8.0
        FileVersion:      8.0.19045.0
        FileDescription:  TeamViewer 8
        LegalCopyright:   TeamViewer GmbH
        Comments:         Used by TeamViewer Remote Control
    


    "A programmer is just a tool which converts caffeine into code"

    Wednesday, July 3, 2013 7:09 PM
    Answerer
  • Andre,

    I have the same issue and I follow what learned from your way to find the root cause finally.

    next step I will inform the researchers to modify there program and fix the issue.

    Thanks for your teaching and I have one more question: what editor you use to open the dump file to make it readable ? I opened it with notepad but got mostly messy code, which is very hard to read.

    Thanks again for your great help!

    Yipeng

    Thursday, November 28, 2013 7:08 AM

  • Thanks for your teaching and I have one more question: what editor you use to open the dump file to make it readable ? I opened it with notepad but got mostly messy code, which is very hard to read.


    I use Windbg.exe from the Windows Debugging Tools.

    After joining the forum 4 years ago, I'll leave it soon. The abusive behavior of moderator and CGS users to repost already posted answers or only posting generic and useless replies like "Do a clean boot" to nearly all question and marking their own replies as answer reduces the quality of the forum dramatically. I'm tired of such trolls and no longer wasting my spare free time. If you're an user who whats high quality answers and help by analyzing your crash dumps, xperf/xbootmgr trace or CBS logs ask on msfn.org, I'll take a look at them. After December 1st 2013 I'll only post to topics where I already replies to. So hurry up and ask your question.

    Thursday, November 28, 2013 6:28 PM
    Answerer
  • I had the same problem but i can't resolve.

    Can you check my dump file? please? http://sdrv.ms/1bnxzl1

    Saturday, December 7, 2013 12:03 PM
  • Your registry file is no longer available.  What are the registry keys it creates? I tried creating some in the HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\ but the the full and mini dumps aren't giving me all the data that you are getting.

    Thanks!

    Tuesday, July 22, 2014 7:54 PM