none
BSOD 0x0000003b error RRS feed

  • Question

  • Hi,

    We setup a new Windows 2012 server and enabled hyper v on that server. We are facing the problem of Dump error. it is giving following error in event viewer. 

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80289caa9d0, 0xfffff8800582fbe0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 021313-59857-01.

    There is no hardware error on server. Please help us to resolve the issue. 

    Thanks

    Sarfaraz

    Wednesday, February 13, 2013 4:14 PM

Answers

  • I've seen this before with some high end Acer servers we had, which was fixed with a CPU related patch. Usually the issue either points to a conflict that occurred during the running of a certain Windows process or some fundamental hardware issue. You'll need to run through a series of diagnostic checks to ensure that you don't have physical faults -- your hardware vendor can provide information about what tools are available. Of course, you may first want to do a search against your hardware model for any Hyper-V KBs.

     

    Saturday, February 16, 2013 12:41 AM

All replies

  • Thursday, February 14, 2013 3:38 PM
  • Perhaps this might help as well:

    http://www.aidanfinn.com/?p=12235

    Thursday, February 14, 2013 3:42 PM
  • Hi,

    Please find the below crash dump analysis.

    oading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff801f50a79d0, fffff880056785b0, 0}

    Probably caused by : win32k.sys ( win32k!RtlLoadStringOrError+47 )

    Followup: MachineOwner
    ---------

    22: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff801f50a79d0, Address of the instruction which caused the bugcheck
    Arg3: fffff880056785b0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP: 
    nt!_security_check_cookie+0
    fffff801`f50a79d0 483b0dc19f1d00  cmp     rcx,qword ptr [nt!_security_cookie (fffff801`f5281998)]

    CONTEXT:  fffff880056785b0 -- (.cxr 0xfffff880056785b0)
    rax=0000000000000000 rbx=0000000000000000 rcx=0000e691db83a26c
    rdx=fffff88001b80618 rsi=fffff88005679098 rdi=fffff9600000b000
    rip=fffff801f50a79d0 rsp=fffff88005678fb8 rbp=0000000000000000
     r8=00000000ffffffff  r9=fffff88001b801a8 r10=0000000000000001
    r11=fffff88005678f40 r12=0000000000000000 r13=0000000000000000
    r14=fffff88005679208 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!_security_check_cookie:
    fffff801`f50a79d0 483b0dc19f1d00  cmp     rcx,qword ptr [nt!_security_cookie (fffff801`f5281998)] ds:002b:fffff801`f5281998=????????????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  winlogon.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff801f54b36c1 to fffff801f50a79d0

    STACK_TEXT:  
    fffff880`05678fb8 fffff801`f54b36c1 : 00000000`00018878 00000000`00000093 00000000`00000000 fffff960`00000028 : nt!_security_check_cookie
    fffff880`05678fc0 fffff960`00106747 : fffff901`00000030 00000000`00000000 ffffd0ed`a8a1551c 00000000`00000018 : nt!RtlFindMessage+0xcd
    fffff880`05679050 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!RtlLoadStringOrError+0x47


    FOLLOWUP_IP: 
    win32k!RtlLoadStringOrError+47
    fffff960`00106747 85c0            test    eax,eax

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  win32k!RtlLoadStringOrError+47

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  5010aae5

    STACK_COMMAND:  .cxr 0xfffff880056785b0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_win32k!RtlLoadStringOrError+47

    BUCKET_ID:  X64_0x3B_win32k!RtlLoadStringOrError+47

    Followup: MachineOwner
    ---------

    22: kd> lmvm win32k
    start             end                 module name
    fffff960`0000b000 fffff960`00400000   win32k     (private pdb symbols)  downstream_store\win32k.pdb\1EA37AD2C29047A39BD934AC16BF5E672\win32k.pdb
        Loaded symbol image file: win32k.sys
        Mapped memory image file: downstream_store\win32k.sys\5010AAE53f5000\win32k.sys
        Image path: \SystemRoot\System32\win32k.sys
        Image name: win32k.sys
        Timestamp:        Thu Jul 26 07:56:45 2012 (5010AAE5)
        CheckSum:         003E8084
        ImageSize:        003F5000
        File version:     6.2.9200.16384
        Product version:  6.2.9200.16384
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     win32k.sys
        OriginalFilename: win32k.sys
        ProductVersion:   6.2.9200.16384
        FileVersion:      6.2.9200.16384 (win8_rtm.120725-1247)
        FileDescription:  Multi-User Win32 Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    Friday, February 15, 2013 3:32 PM
  • I've seen this before with some high end Acer servers we had, which was fixed with a CPU related patch. Usually the issue either points to a conflict that occurred during the running of a certain Windows process or some fundamental hardware issue. You'll need to run through a series of diagnostic checks to ensure that you don't have physical faults -- your hardware vendor can provide information about what tools are available. Of course, you may first want to do a search against your hardware model for any Hyper-V KBs.

     

    Saturday, February 16, 2013 12:41 AM