[2000] Aanhoudende problemen met print spooler

[Grolsch]

Hallo Mensen,

Ik heb hier een probleem, waar ik al wel 3 jaar last van heb, en waar ik NIET uit kom.

De server is een windows 2000 SP4 machine, met alle recente update's en patches.

Het probleem is dat de print spooler af en toe (meerdere keren per week) vast loopt.
Het is niet zo dat de service "spooler" op de status gestopped staat, maar hij "hangt".
Als je dan op de client bij printers kijkt staan alle netwerk printers op "bezig met openen".
Het enige wat helpt is een net stop spooler vervolgens 10 seconden wachten, en dan net start spooler.

Ik krijg deze melding in m'n eventvwr:

code:

Event Type: Information
Event Source:   Application Popup
Event Category: None
Event ID:   26
Date:       1-5-2006
Time:       7:50:26
User:       N/A
Computer:   *****
Description:
Application popup: spoolsv.exe - Application Error : The instruction at "0x77f9d0ee" referenced memory at "0x000ff500". The memory could not be "read".

Click on OK to terminate the program

Als ik zoek op google en technet, kom ik met name dit artikel tegen:

http://support.microsoft.com/kb/260142/en-us

Ik heb alle ports weg gegooit, en ook heb ik alle overbodige drivers en print stuur programma's er af gegooit.

Ik heb momenteel alleen deze drivers nog:





Toch blijft dat "kreng" crashen en vastlopen.
Welke stappen zou ik verder kunnen onder nemen

[ Voor 7% gewijzigd door Grolsch op 01-05-2006 11:01 ]

[Verwijderd]

Staan er nog print jobs in c:WINNT\system32\spool\printers? Toevallig een virusscanner die die folder scant? http://support.microsoft....aspx?scid=kb;en-us;312052 ook al bekeken?

[Verwijderd]

is dit niet een symptoom van die data execution prevention (DEP).
gewoon als exclusion toevoegen of uitschakelen.

[Grolsch]

Verwijderd schreef op maandag 01 mei 2006 @ 11:12:
Staan er nog print jobs in c:WINNT\system32\spool\printers?

Geen overbodige rommel, alleen wat er hoort te staan

Toevallig een virusscanner die die folder scant?

Nu een exclusion in de virusscanner gezet

http://support.microsoft....aspx?scid=kb;en-us;312052 ook al bekeken?

Heb ik ook al doorlopen

Verwijderd schreef op maandag 01 mei 2006 @ 11:29:
is dit niet een symptoom van die data execution prevention (DEP).
gewoon als exclusion toevoegen of uitschakelen.

DEP is niet van toepassing op windows 2000

[ Voor 24% gewijzigd door Grolsch op 01-05-2006 11:32 ]

[Verwijderd]

Heeft die machine toevallig een Novell client geinstalleerd? Google laat daar een hoop problemen mee zien
_{maar die was je zelf ook wel tegengekomen dan}

[Grolsch]

nope, geen novell client.
Ook geen citrix zaken, die worden ook veel vermeld op google.

[mutsje]

Heb je dit toevallig ook op je terminal server? http://support.microsoft....aspx?scid=kb;en-us;822834 (high cpu usage & spooler.exe )

[Grolsch]

mutsje schreef op maandag 01 mei 2006 @ 13:26:
Heb je dit toevallig ook op je terminal server? http://support.microsoft....aspx?scid=kb;en-us;822834 (high cpu usage & spooler.exe )

De server in kwestie is geen Terminal Server, dus dat artikel is niet relevant.

[Wincenty]

Andere drivers proberen voor de printers. En een driver voor een sort printer.

[elevator]

Je hebt nog 2 NT4 drivers erin staan - die zijn sowieso niet goed meer op een 2000 server dus ik zou beginnen die te vervangen, verder zal het inderdaad een van je printerdrivers zijn die deze problemen geeft...

[Grolsch]

en het ging een paar dagen goed na de spooler map op een andere partitie te hebben geplaatst + virusscanner ge-disabled, maar hier issie weer

Type gebeurtenis: Informatie
Bron van gebeurtenis: Application Popup
Categorie van gebeurtenis: Geen
Gebeurtenis-ID: 26
Datum: 4-5-2006
Tijd: 11:36:58
Gebruiker: n.v.t.
Computer: ***
Beschrijving:
Application popup: spoolsv.exe - Application Error : The instruction at "0x77fcb0c8" referenced memory at "0x00000000". The memory could not be "written".

Click on OK to terminate the program

gevolgd door:

Type gebeurtenis: Fout
Bron van gebeurtenis: Service Control Manager
Categorie van gebeurtenis: Geen
Gebeurtenis-ID: 7023
Datum: 4-5-2006
Tijd: 11:38:01
Gebruiker: n.v.t.
Computer: ***
Beschrijving:
The Print Spooler service terminated with the following error:
The access code is invalid.

Kga nu maar eens wat drivers weg keilen

[ Voor 3% gewijzigd door Grolsch op 04-05-2006 13:47 ]

[elevator]

Je zou - kijkende in C:\Documents and Settings\All Users\My Documents\DrWatson\" eens een kijkje kunnen nemen in de crash logfile. Misschien staat er een hint in naar een bepaalde DLL die crashed ofzo die jou vervolgens weer op het goede spoor zet naar de slechte printer driver?

[Verwijderd]

Helaas vangt dr watson dit soort foutmeldingen niet altijd af maar je zou eventueel met adplus in crash mode een user dump kunnen maken van het spooler process en die daarna door de debugger kunnen halen: http://support.microsoft....aspx?scid=kb;en-us;286350

[Grolsch]

ok, het is een beste logfile, maar kun jij hier iets uithalen

code:

Application exception occurred:
        App: spoolsv.exe (pid=4664)
        When: 5/3/2006 @ 17:10:17.714
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: ****
        User Name: SYSTEM
        Number of Processors: 2
        Processor Type: x86 Family 15 Model 2 Stepping 9
        Windows 2000 Version: 5.0
        Current Build: 2195
        Service Pack: 4
        Current Type: Multiprocessor Free
        Registered Organization: ****
        Registered Owner: ****

*----> Task List <----*
   0 Idle.exe
   8 System.exe
 184 SMSS.exe
 204 CSRSS.exe
 228 WINLOGON.exe
 256 SERVICES.exe
 268 LSASS.exe
 360 termsrv.exe
 456 svchost.exe
 504 svchost.exe
 868 amgrsrvc.exe
 880 pbeagent.exe
 900 PBESER~1.exe
 980 dfssvc.exe
1044 SRVANY.exe
1072 dbsrv6.exe
1076 inetinfo.exe
1108 LLSSRV.exe
1136 tcpsvcs.exe
1176 FrameworkServic.exe
1280 Mcshield.exe
1296 VsTskMgr.exe
1396 iscsiexe.exe
1412 sqlservr.exe
1444 sqlservr.exe
1564 ntfrs.exe
1712 SVRemoteConnect.exe
1760 regsvc.exe
1780 LOCATOR.exe
1816 tomcat.exe
1828 RsiSvc.exe
1836 naPrdMgr.exe
2012 SrScanDr.exe
2044 mstask.exe
2140 SNMP.exe
2176 SrvCtrl.exe
2280 WinMgmt.exe
2316 WINS.exe
2336 svchost.exe
2356 WUSyncSvc.exe
2744 DdsSchedNT.exe
2772 dns.exe
2784 ismserv.exe
2792 Dds.exe
2804 msdtc.exe
3008 mssearch.exe
3268 spooler.exe
3284 sqlagent.exe
3372 EventParser.exe
3616 NaiMServ.exe
3704 SrvMon.exe
4260 svchost.exe
 508 DLLHOST.exe
 772 DLLHOST.exe
5352 svchost.exe
3928 explorer.exe
5236 atiptaxx.exe
5392 shstat.exe
5628 UpdaterUI.exe
5588 VxTaskbarMgr.ex.exe
5536 TBMon.exe
5576 internat.exe
5356 sqlmangr.exe
5960 beremote.exe
 940 pvlsvr.exe
6020 beserver.exe
3948 bengine.exe
4944 benetns.exe
5440 ECM.exe
6048 java.exe
1912 RSSensor.exe
4664 spoolsv.exe
5472 MEls32.exe
5144 DRWTSN32.exe
   0 _Total.exe

(01000000 - 0100E000) 
(77F80000 - 77FFC000) 
(78000000 - 78045000) 
(7C570000 - 7C623000) 
(7C2D0000 - 7C335000) 
(77D30000 - 77DA8000) 
(75030000 - 75044000) 
(75020000 - 75028000) 
(77F40000 - 77F7C000) 
(77E10000 - 77E79000) 
(76A90000 - 76AA6000) 
(7CDC0000 - 7CE13000) 
(77980000 - 779A4000) 
(75050000 - 75058000) 
(751C0000 - 751C6000) 
(77BF0000 - 77C01000) 
(77950000 - 7797B000) 
(7C340000 - 7C34F000) 
(75150000 - 75160000) 
(77340000 - 77353000) 
(77520000 - 77525000) 
(77320000 - 77337000) 
(7CE20000 - 7CF0F000) 
(779B0000 - 77A4B000) 
(773B0000 - 773DF000) 
(77380000 - 773A3000) 
(77830000 - 7783E000) 
(77880000 - 7790E000) 
(7C0F0000 - 7C154000) 
(774E0000 - 77514000) 
(774C0000 - 774D1000) 
(77530000 - 77552000) 
(71710000 - 71794000) 
(70A70000 - 70AD6000) 
(77360000 - 77379000) 
(777F0000 - 777F5000) 
(76120000 - 76164000) 
(76980000 - 7699B000) 
(68010000 - 68101000) 
(77820000 - 77827000) 
(759B0000 - 759B6000) 
(77800000 - 7781E000) 
(76620000 - 76631000) 
(733E0000 - 733EE000) 
(10000000 - 1000B000) 
(00EC0000 - 00ED4000) 
(01410000 - 01424000) 
(76AB0000 - 76AB7000) 
(76A70000 - 76A76000) 
(67200000 - 67217000) 
(01880000 - 01896000) 
(018A0000 - 018A7000) 
(6CA40000 - 6CA48000) 
(6CA50000 - 6CA56000) 
(76A80000 - 76A8D000) 
(75640000 - 75647000) 
(75630000 - 75637000) 
(754C0000 - 754C8000) 
(75610000 - 7561D000) 
(74FD0000 - 74FEE000) 
(75010000 - 75017000) 
(01AC0000 - 01AD2000) 
(01AE0000 - 01AF3000) 
(715E0000 - 715ED000) 
(71600000 - 71607000) 
(715D0000 - 715D6000) 
(71130000 - 71145000) 
(782C0000 - 782CC000) 
(777E0000 - 777E8000) 
(7C950000 - 7C9DF000) 
(76A50000 - 76A70000) 
(76B00000 - 76B13000) 
(7CA00000 - 7CA23000) 
(7C740000 - 7C7CC000) 
(77430000 - 77441000) 
(7CF30000 - 7D175000) 
(74FF0000 - 75002000) 
(78280000 - 782B5000) 
(76670000 - 7667E000) 
(767F0000 - 76823000) 
(02420000 - 02463000) 
(76EF0000 - 76F13000) 
(73E10000 - 73E83000) 
(6B770000 - 6B783000) 
(04740000 - 048D4000) 
(049A0000 - 049C6000) 
(04DD0000 - 04E59000) 
(76B30000 - 76B6E000) 
(74D90000 - 74DB3000) 
(74D70000 - 74D82000) 

State Dump for Thread Id 0xfc8

eax=7c2e4376 ebx=00000000 ecx=7c2e0070 edx=00000000 esi=00000000 edi=00000030
eip=77f88a87 esp=0006fbf0 ebp=0006fc60 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: NtReadFile
        77f88a7c b8a1000000       mov     eax,0xa1
        77f88a81 8d542404         lea     edx,[esp+0x4]          ss:008d9ad7=????????
        77f88a85 cd2e             int     2e
        77f88a87 c22400           ret     0x24
        77f88a8a 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0006FC60 7C2DD578 00000030 0006FD38 00000216 0006FC88 ntdll!NtReadFile 
0006FC8C 7C2DD61E 00000030 0006FD38 00000216 0006FCC4 advapi32!StartServiceW 
0006FD08 7C2DD05D 00000030 0006FD38 00000216 00000000 advapi32!StartServiceW 
0006FF68 010041F1 0100C0D8 01004A1F 00000001 00244678 advapi32!StartServiceCtrlDispatcherW 
0006FFC0 7C598989 00000000 005C005C 7FFDF000 0054004E spoolsv!<nosymbols> 
0006FFF0 00000000 01004920 00000000 003A0043 0057005C kernel32!ProcessIdToSessionId 

*----> Raw Stack Dump <----*
0006fbf0  35 63 58 7c 30 00 00 00 - 00 00 00 00 00 00 00 00  5cX|0...........
0006fc00  00 00 00 00 38 fc 06 00 - 38 fd 06 00 16 02 00 00  ....8...8.......
0006fc10  00 00 00 00 00 00 00 00 - c4 fc 06 00 b4 61 58 7c  .............aX|
0006fc20  38 fd 06 00 00 00 00 00 - 01 00 00 00 f0 5c 08 00  8............\..
0006fc30  4c fd 06 00 00 00 00 00 - 68 00 00 00 80 4f 08 00  L.......h....O..
0006fc40  38 12 00 00 00 00 00 00 - 18 fc 06 00 f8 fc 06 00  8...............
0006fc50  f8 fc 06 00 54 1f 5c 7c - 80 1e 57 7c ff ff ff ff  ....T.\|..W|....
0006fc60  8c fc 06 00 78 d5 2d 7c - 30 00 00 00 38 fd 06 00  ....x.-|0...8...
0006fc70  16 02 00 00 88 fc 06 00 - 00 00 00 00 f0 5c 08 00  .............\..
0006fc80  38 fd 06 00 00 00 00 00 - 00 00 00 00 08 fd 06 00  8...............
0006fc90  1e d6 2d 7c 30 00 00 00 - 38 fd 06 00 16 02 00 00  ..-|0...8.......
0006fca0  c4 fc 06 00 00 00 00 00 - 00 00 00 00 00 f0 fd 7f  ................
0006fcb0  2b 0e d5 77 a0 52 08 00 - 4c fd 06 00 00 00 00 00  +..w.R..L.......
0006fcc0  f4 fc 06 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
0006fcd0  a0 53 08 00 80 4f 08 00 - 48 19 00 00 70 00 65 00  .S...O..H...p.e.
0006fce0  31 00 34 00 01 00 00 00 - 33 cf 2d 7c 00 00 00 00  1.4.....3.-|....
0006fcf0  a4 fc 06 00 a0 52 08 00 - 58 ff 06 00 b6 1f 2d 7c  .....R..X.....-|
0006fd00  60 d7 2d 7c ff ff ff ff - 68 ff 06 00 5d d0 2d 7c  `.-|....h...].-|
0006fd10  30 00 00 00 38 fd 06 00 - 16 02 00 00 00 00 00 00  0...8...........
0006fd20  5c 00 5c 00 00 f0 fd 7f - 00 ff 06 00 64 7e fb 77  \.\.........d~.w

State Dump for Thread Id 0x1948

eax=00000001 ebx=00000000 ecx=002dfba8 edx=00000000 esi=77f88f08 edi=00000068
eip=77f88f13 esp=002dff60 ebp=002dff84 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: ZwWaitForSingleObject
        77f88f08 b8ea000000       mov     eax,0xea
        77f88f0d 8d542404         lea     edx,[esp+0x4]          ss:00b49e47=????????
        77f88f11 cd2e             int     2e
        77f88f13 c20c00           ret     0xc
        77f88f16 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
002DFF84 7C57B3DB 00000068 FFFFFFFF 00000000 010048DC ntdll!ZwWaitForSingleObject 
002DFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!WaitForSingleObject 

State Dump for Thread Id 0x18a8

eax=01a20008 ebx=000493e0 ecx=00ca0000 edx=00000000 esi=00085840 edi=000493e0
eip=77f88af7 esp=0031febc ebp=0031fee4 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297


function: NtRemoveIoCompletion
        77f88aec b8a8000000       mov     eax,0xa8
        77f88af1 8d542404         lea     edx,[esp+0x4]          ss:00b89da3=????????
        77f88af5 cd2e             int     2e
        77f88af7 c21400           ret     0x14
        77f88afa 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0031FEE4 77D4FA03 00000044 0031FF1C 0031FF0C 0031FF14 ntdll!NtRemoveIoCompletion 
0031FF20 77D4F964 000493E0 0031FF60 0031FF5C 0031FF70 rpcrt4!PerformRpcInitialization 
0031FF74 77D43DD7 77D4E003 00085840 002DFAEA 77F86775 rpcrt4!PerformRpcInitialization 
0031FFA8 77D4AF16 000878D8 0031FFEC 7C57B388 00087900 rpcrt4!RpcBindingSetOption 
0031FFB4 7C57B388 00087900 002DFAEA 77F86775 00087900 rpcrt4!RpcMgmtSetCancelTimeout 
0031FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x18fc

eax=0000001c ebx=00089fbc ecx=00010101 edx=00000000 esi=00087fac edi=0100c960
eip=77f522e3 esp=0082ff80 ebp=77f87fc0 iopl=0         nv up ei ng nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000296


function: GdiGetSpoolMessage
        77f522d8 b8c2100000       mov     eax,0x10c2
        77f522dd 8d542404         lea     edx,[esp+0x4]          ss:01099e67=????????
        77f522e1 cd2e             int     2e
        77f522e3 c21000           ret     0x10

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
77F87FC0 4AFFC033 89257508 FFF00C42 037D044A 520004C2 gdi32!GdiGetSpoolMessage 
0424548B 00000000 00000000 00000000 00000000 00000000 <nosymbols> 

State Dump for Thread Id 0x185c

eax=e2e039f0 ebx=00080000 ecx=00000000 edx=000c67b0 esi=000c6760 edi=000c67b0
eip=77fcd989 esp=0086fcac ebp=0086fcb8 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000286


function: RtlZeroHeap
        77fcd96d 740b             jz      RtlZeroHeap+0x1704 (77fce87a)
        77fcd96f 0fb64604         movzx   eax,byte ptr [esi+0x4]       ds:00930647=??
        77fcd973 8b448358         mov     eax,[ebx+eax*4+0x58]   ds:e366d8d7=????????
        77fcd977 897038           mov     [eax+0x38],esi         ds:e366d8d6=????????
        77fcd97a 57               push    edi
        77fcd97b 53               push    ebx
        77fcd97c e86efafcff       call    RtlIsValidIndexHandle+0x182f (77f9d3ef)
        77fcd981 8b4f0c           mov     ecx,[edi+0xc]          ds:00930696=????????
        77fcd984 8b4708           mov     eax,[edi+0x8]          ds:00930696=????????
        77fcd987 3bc1             cmp     eax,ecx
FAULT ->77fcd989 8901             mov     [ecx],eax              ds:00000000=????????
        77fcd98b 894804           mov     [eax+0x4],ecx          ds:e366d8d6=????????
        77fcd98e 7522             jnz     77fd3fb2
        77fcd990 668b07           mov     ax,[edi]                   ds:000c67b0=0000
        77fcd993 663d8000         cmp     ax,0x80
        77fcd997 7319             jnb     RtlZeroHeap+0x173c (77fce8b2)
        77fcd999 0fb7c8           movzx   ecx,ax
        77fcd99c 6a01             push    0x1
        77fcd99e 8bc1             mov     eax,ecx
        77fcd9a0 83e107           and     ecx,0x7
        77fcd9a3 5a               pop     edx
        77fcd9a4 c1e803           shr     eax,0x3

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0086FCB8 77FCB80C 00080000 000C6770 0086FD30 00000000 ntdll!RtlZeroHeap 
0086FD64 77D4F798 00080000 00000000 000C6778 77D4A011 ntdll!RtlFreeHeap 
0086FD98 77D5DC9B 001036F8 000C6778 0010375C 77D5D56C rpcrt4!PerformRpcInitialization 
0086FDF4 77D5D44E 0000001D 00000000 0086FE40 0010375C rpcrt4!I_RpcSetServerContextList 
0086FE14 77D53F52 0010375C 00000000 0086FE40 00103520 rpcrt4!NdrSimpleTypeMarshall 
0086FE44 77D53E93 00000000 00103858 001036F8 0086FE90 rpcrt4!I_RpcTransConnectionAllocatePacket 
0086FE58 77D53E16 00000000 00000000 7C57B580 001036F8 rpcrt4!I_RpcTransConnectionAllocatePacket 
0086FE90 77D53D13 000FEC20 00000003 0000001D 000FEC20 rpcrt4!I_RpcTransConnectionAllocatePacket 
00087C48 00000000 00000000 00000001 00000000 00000000 rpcrt4!I_RpcTransConnectionAllocatePacket 

*----> Raw Stack Dump <----*
0086fcac  00 00 08 00 70 67 0c 00 - 78 67 0c 00 64 fd 86 00  ....pg..xg..d...
0086fcbc  0c b8 fc 77 00 00 08 00 - 70 67 0c 00 30 fd 86 00  ...w....pg..0...
0086fccc  00 00 00 00 98 8e 0d 00 - 00 00 00 00 78 67 0c 00  ............xg..
0086fcdc  00 00 00 00 78 67 0c 00 - ae 37 d5 77 58 03 00 00  ....xg...7.wX...
0086fcec  b8 de 0d 00 30 00 00 00 - b9 37 d5 77 b8 36 10 00  ....0....7.w.6..
0086fcfc  b8 de 0d 00 20 35 10 00 - 00 00 00 00 00 00 00 00  .... 5..........
0086fd0c  30 00 00 00 00 00 00 00 - 00 00 00 00 bd 00 00 00  0...............
0086fd1c  30 00 00 00 ac fd 86 00 - 17 35 d5 77 b8 36 10 00  0........5.w.6..
0086fd2c  00 00 08 00 0a 00 00 00 - 01 00 08 00 03 00 00 00  ................
0086fd3c  00 a3 d3 77 18 d2 d5 77 - 01 ff ff ff 64 fd 86 00  ...w...w....d...
0086fd4c  d0 fc 86 00 f8 f8 86 00 - dc ff 86 00 64 7e fb 77  ............d~.w
0086fd5c  78 16 f8 77 01 00 00 00 - 98 fd 86 00 98 f7 d4 77  x..w...........w
0086fd6c  00 00 08 00 00 00 00 00 - 78 67 0c 00 11 a0 d4 77  ........xg.....w
0086fd7c  78 67 0c 00 f8 a0 d4 77 - 78 67 0c 00 00 00 00 00  xg.....wxg......
0086fd8c  48 7c 08 00 f8 36 10 00 - 28 40 13 00 f4 fd 86 00  H|...6..(@......
0086fd9c  9b dc d5 77 f8 36 10 00 - 78 67 0c 00 5c 37 10 00  ...w.6..xg..\7..
0086fdac  6c d5 d5 77 5c 37 10 00 - 48 7c 08 00 00 00 00 00  l..w\7..H|......
0086fdbc  d0 36 10 00 d0 36 10 00 - 38 ec 0f 00 70 05 00 00  .6...6..8...p...
0086fdcc  d8 fd 86 00 00 00 00 00 - a0 36 10 00 00 00 00 00  .........6......
0086fddc  00 00 00 00 fc fd 86 00 - de 36 d5 77 98 ab 08 00  .........6.w....

State Dump for Thread Id 0xaa8

eax=00000000 ebx=00000002 ecx=00000020 edx=00000000 esi=77f88ef8 edi=00000002
eip=77f88f03 esp=00cef838 ebp=00cef884 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246


function: NtWaitForMultipleObjects
        77f88ef8 b8e9000000       mov     eax,0xe9
        77f88efd 8d542404         lea     edx,[esp+0x4]          ss:0155971f=????????
        77f88f01 cd2e             int     2e
        77f88f03 c21400           ret     0x14
        77f88f06 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00CEF884 77E4169F 00CEF85C 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects 
00CEF8E0 77E41706 00CEF8AC 00CEF928 FFFFFFFF 000000FF user32!MsgWaitForMultipleObjectsEx 
00CEF8FC 76A951F8 00000001 00CEF928 00000000 FFFFFFFF user32!MsgWaitForMultipleObjects 
FFFFFFFF 00000000 00000000 00000000 00000000 00000000 spoolss!EnumPrinterDriversW 

*----> Raw Stack Dump <----*
00cef838  fb a1 59 7c 02 00 00 00 - 5c f8 ce 00 01 00 00 00  ..Y|....\.......
00cef848  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00cef858  02 00 00 00 38 01 00 00 - 28 03 00 00 00 00 00 00  ....8...(.......
00cef868  70 f8 ce 00 00 00 00 00 - 70 f8 ce 00 70 f8 ce 00  p.......p...p...
00cef878  7a 26 e4 77 00 00 00 00 - 00 00 00 00 e0 f8 ce 00  z&.w............
00cef888  9f 16 e4 77 5c f8 ce 00 - 01 00 00 00 00 00 00 00  ...w\...........
00cef898  00 00 00 00 00 00 00 00 - d2 ed 57 7c cb 72 8f 79  ..........W|.r.y
00cef8a8  00 00 00 00 38 01 00 00 - 28 03 00 00 00 00 88 77  ....8...(......w
00cef8b8  40 f9 ce 00 40 42 a9 76 - 44 f4 e1 77 00 00 88 77  @[e-mail]..w...w
00cef8c8  00 00 00 00 98 9f 0c 00 - 00 00 00 00 cc 76 fd 7f  .............v..
00cef8d8  00 00 00 00 28 03 00 00 - fc f8 ce 00 06 17 e4 77  ....(..........w
00cef8e8  ac f8 ce 00 28 f9 ce 00 - ff ff ff ff ff 00 00 00  ....(...........
00cef8f8  00 00 00 00 ff ff ff ff - f8 51 a9 76 01 00 00 00  .........Q.v....
00cef908  28 f9 ce 00 00 00 00 00 - ff ff ff ff ff 00 00 00  (...............
00cef918  ba 4a 2f 7c 01 00 00 00 - b4 ff ce 00 00 00 00 00  .J/|............
00cef928  38 01 00 00 00 00 00 00 - b8 52 9d 01 03 00 00 00  8........R......
00cef938  03 00 00 00 01 00 00 00 - 01 00 00 00 b4 ff ce 00  ................
00cef948  ce 98 a9 76 00 00 00 00 - 04 fc 39 00 88 6b 08 00  ...v......9..k..
00cef958  69 00 6e 00 65 00 74 00 - 70 00 70 00 2e 00 64 00  i.n.e.t.p.p...d.
00cef968  6c 00 6c 00 00 00 6c 00 - 00 00 00 00 00 00 00 00  l.l...l.........

State Dump for Thread Id 0x1420

eax=76aa04d7 ebx=00000001 ecx=00000000 edx=00000000 esi=77f88ef8 edi=00000001
eip=77f88f03 esp=00d2ff08 ebp=00d2ff54 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: NtWaitForMultipleObjects
        77f88ef8 b8e9000000       mov     eax,0xe9
        77f88efd 8d542404         lea     edx,[esp+0x4]          ss:01599def=????????
        77f88f01 cd2e             int     2e
        77f88f03 c21400           ret     0x14
        77f88f06 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00D2FF54 7C59A10E 00D2FF2C 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects 
00D2FFB4 7C57B388 00000120 00000000 00000000 00243970 kernel32!WaitForMultipleObjects 
00D2FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x166c

eax=778321fe ebx=00000003 ecx=00ceedc4 edx=00000000 esi=77f88ef8 edi=00000003
eip=77f88f03 esp=00dafd24 ebp=00dafd70 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: NtWaitForMultipleObjects
        77f88ef8 b8e9000000       mov     eax,0xe9
        77f88efd 8d542404         lea     edx,[esp+0x4]          ss:01619c0b=????????
        77f88f01 cd2e             int     2e
        77f88f03 c21400           ret     0x14
        77f88f06 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00DAFD70 7C59A10E 00DAFD48 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects 
00DAFFB4 7C57B388 00000004 000B000A 7C3280D0 000A3348 kernel32!WaitForMultipleObjects 
00DAFFEC 00000000 778321FE 000A3348 00000000 000000C8 kernel32!lstrcmpiW 

*----> Raw Stack Dump <----*
00dafd24  fb a1 59 7c 03 00 00 00 - 48 fd da 00 01 00 00 00  ..Y|....H.......
00dafd34  00 00 00 00 00 00 00 00 - 00 00 00 00 48 33 0a 00  ............H3..
00dafd44  01 00 00 00 80 01 00 00 - 84 01 00 00 94 01 00 00  ................
00dafd54  00 00 00 00 00 02 00 00 - 01 00 00 00 00 00 00 00  ................
00dafd64  00 40 00 00 fc 07 30 c0 - 18 4b c1 bb b4 ff da 00  .@....0..K......
00dafd74  0e a1 59 7c 48 fd da 00 - 01 00 00 00 00 00 00 00  ..Y|H...........
00dafd84  00 00 00 00 00 00 00 00 - b2 22 83 77 03 00 00 00  .........".w....
00dafd94  b0 fe da 00 00 00 00 00 - ff ff ff ff 48 33 0a 00  ............H3..
00dafda4  d0 80 32 7c 0a 00 0b 00 - 01 00 00 00 f0 30 da 85  ..2|.........0..
00dafdb4  00 00 00 00 00 00 00 00 - 00 00 00 00 38 00 00 00  ............8...
00dafdc4  23 00 00 00 23 00 00 00 - 0a 00 0b 00 d0 80 32 7c  #...#.........2|
00dafdd4  48 33 0a 00 ff ff ff ff - c4 ed ce 00 fe 21 83 77  H3...........!.w
00dafde4  f8 7b fd 7f 00 b7 57 7c - 1b 00 00 00 00 02 00 00  .{....W|........
00dafdf4  fc ff da 00 23 00 00 00 - 00 00 00 00 02 00 00 00  ....#...........
00dafe04  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00dafe14  00 00 04 00 00 00 00 00 - 10 4b c1 bb 10 4b c1 bb  .........K...K..
00dafe24  00 00 00 00 e8 a4 a8 84 - 00 25 66 84 00 40 00 00  .........%f..@..
00dafe34  01 00 00 00 a8 ac 6c e4 - f0 ae 6c e4 01 00 00 00  ......l...l.....
00dafe44  00 4b c1 bb 00 52 06 80 - 01 86 17 86 00 26 05 00  .K...R.......&..
00dafe54  00 00 00 00 00 40 00 00 - 43 a5 44 80 00 66 05 00  .....@..C.D..f..

State Dump for Thread Id 0x1444

eax=6720102d ebx=00000001 ecx=00000000 edx=00000000 esi=77f88ef8 edi=00000001
eip=77f88f03 esp=0187fed0 ebp=0187ff1c iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: NtWaitForMultipleObjects
        77f88ef8 b8e9000000       mov     eax,0xe9
        77f88efd 8d542404         lea     edx,[esp+0x4]          ss:020e9db7=????????
        77f88f01 cd2e             int     2e
        77f88f03 c21400           ret     0x14
        77f88f06 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0187FF1C 7C59A10E 0187FEF4 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects 
0187FFB4 7C57B388 00000000 00CEE764 67201AD7 00000000 kernel32!WaitForMultipleObjects 
0187FFEC 00000000 6720102D 00000000 00000000 00905A4D kernel32!lstrcmpiW 

*----> Raw Stack Dump <----*
0187fed0  fb a1 59 7c 01 00 00 00 - f4 fe 87 01 01 00 00 00  ..Y|............
0187fee0  00 00 00 00 00 00 00 00 - 64 e7 ce 00 d7 1a 20 67  ........d..... g
0187fef0  00 00 00 00 b4 01 00 00 - 20 00 2f 7c d0 01 00 00  ........ ./|....
0187ff00  b4 01 00 00 00 00 00 00 - 00 00 00 00 40 d5 32 7c  ............@.2|
0187ff10  04 00 00 00 01 00 00 00 - 00 00 00 00 b4 ff 87 01  ................
0187ff20  0e a1 59 7c f4 fe 87 01 - 01 00 00 00 00 00 00 00  ..Y|............
0187ff30  00 00 00 00 00 00 00 00 - 38 11 20 67 01 00 00 00  ........8. g....
0187ff40  9c ff 87 01 00 00 00 00 - ff ff ff ff 64 e7 ce 00  ............d...
0187ff50  d7 1a 20 67 00 00 00 00 - 70 cc ce bb d8 22 f5 77  .. g....p....".w
0187ff60  00 10 50 c0 18 07 29 86 - 00 00 00 00 b0 cc ce bb  ..P...).........
0187ff70  00 00 00 00 d0 6b 39 85 - 05 00 00 00 00 00 00 00  .....k9.........
0187ff80  00 00 00 00 00 00 00 00 - 73 10 43 80 00 00 00 00  ........s.C.....
0187ff90  00 00 00 00 36 11 43 80 - 80 a6 4e 84 b4 01 00 00  ....6.C...N.....
0187ffa0  00 00 00 00 00 00 00 00 - 01 00 00 00 d0 01 00 00  ................
0187ffb0  00 00 00 00 ec ff 87 01 - 88 b3 57 7c 00 00 00 00  ..........W|....
0187ffc0  64 e7 ce 00 d7 1a 20 67 - 00 00 00 00 00 50 fd 7f  d..... g.....P..
0187ffd0  00 00 00 00 c0 ff 87 01 - 00 00 00 00 ff ff ff ff  ................
0187ffe0  54 1f 5c 7c 08 2b 57 7c - 00 00 00 00 00 00 00 00  T.\|.+W|........
0187fff0  00 00 00 00 2d 10 20 67 - 00 00 00 00 00 00 00 00  ....-. g........
01880000  4d 5a 90 00 03 00 00 00 - 04 00 00 00 ff ff 00 00  MZ..............

State Dump for Thread Id 0x13a4

eax=0009c004 ebx=00000000 ecx=000003f0 edx=00000000 esi=018ffd80 edi=00162a50
eip=77e41eb3 esp=018ffd3c ebp=018ffd5c iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246


function: DispatchMessageW
        77e41e99 e8349dffff       call    GetFocus+0x50 (77e3bbd2)
        77e41e9e e93effffff       jmp     GetWindowLongW+0x681 (77e41de1)
        77e41ea3 90               nop
        77e41ea4 90               nop
        77e41ea5 90               nop
        77e41ea6 90               nop
        77e41ea7 90               nop
        77e41ea8 b89a110000       mov     eax,0x119a
        77e41ead 8d542404         lea     edx,[esp+0x4]          ss:02169c23=????????
        77e41eb1 cd2e             int     2e
        77e41eb3 c21000           ret     0x10
        77e41eb6 90               nop
        77e41eb7 90               nop
        77e41eb8 90               nop
        77e41eb9 90               nop
        77e41eba 90               nop

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
018FFD5C 75631F63 018FFD80 0B010026 00000000 00000000 user32!DispatchMessageW 
018FFDA0 756322C4 00162A50 00000000 0024DCB8 0024DCB8 mgmtapi!<nosymbols> 
018FFDBC 756415D7 00162A74 018FFDA0 018FFEAC 018FFDEC mgmtapi!SnmpMgrRequest 
018FFDE4 7564195D 018FFEAC 7C5B906F 0024D000 00243948 TCPMIB!CTcpMib::operator= 
018FFEB4 75641BE2 0024D000 0024D031 00000001 75642243 TCPMIB!CTcpMib::operator= 
018FFF50 76A860D2 00000000 00243C98 00000000 00000000 TCPMIB!CTcpMib::operator= 
018FFF6C 76A8794C 00243CB4 00243BD0 76A848CD 00244F88 tcpmon!CTcpMibABC::CTcpMibABC 
76A8A040 00000000 00000258 00000240 00090FA0 FFFFFFFF tcpmon!ConfigPortUIEx 

State Dump for Thread Id 0x49c

eax=00000000 ebx=00000000 ecx=00010101 edx=00000000 esi=77f88398 edi=0193ff48
eip=77f883a3 esp=0193ff34 ebp=0193ff50 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206


function: NtDelayExecution
        77f88398 b832000000       mov     eax,0x32
        77f8839d 8d542404         lea     edx,[esp+0x4]          ss:021a9e1b=????????
        77f883a1 cd2e             int     2e
        77f883a3 c20800           ret     0x8
        77f883a6 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0193FF50 7C59A25A 000003E8 00000000 75615450 000003E8 ntdll!NtDelayExecution 
00000000 00000000 00000000 00000000 00000000 00000000 kernel32!Sleep 

*----> Raw Stack Dump <----*
0193ff34  8f a2 59 7c 00 00 00 00 - 48 ff 93 01 07 b6 f1 7b  ..Y|....H......{
0193ff44  14 bc 09 00 80 69 67 ff - ff ff ff ff 00 00 00 00  .....ig.........
0193ff54  5a a2 59 7c e8 03 00 00 - 00 00 00 00 50 54 61 75  Z.Y|........PTau
0193ff64  e8 03 00 00 00 00 00 00 - 88 a1 24 00 b4 ff 93 01  ..........$.....
0193ff74  88 a1 24 00 01 00 00 00 - 01 00 00 00 bc 85 00 78  ..$............x
0193ff84  00 00 00 00 00 00 00 00 - 00 00 00 00 88 a1 24 00  ..............$.
0193ff94  36 11 43 80 80 a6 4e 84 - 88 ff 93 01 ff ff ff ff  6.C...N.........
0193ffa4  dc ff 93 01 6a bd 00 78 - 20 2f 03 78 00 00 00 00  ....j..x /.x....
0193ffb4  ec ff 93 01 88 b3 57 7c - 88 a1 24 00 00 00 00 00  ......W|..$.....
0193ffc4  00 00 00 00 88 a1 24 00 - 00 f0 fa 7f 00 00 00 00  ......$.........
0193ffd4  c0 ff 93 01 00 00 00 00 - ff ff ff ff 54 1f 5c 7c  ............T.\|
0193ffe4  08 2b 57 7c 00 00 00 00 - 00 00 00 00 00 00 00 00  .+W|............
0193fff4  32 85 00 78 88 a1 24 00 - 00 00 00 00 c8 00 00 00  2..x..$.........
01940004  00 01 00 00 ff ee ff ee - 02 10 00 00 00 00 00 00  ................
01940014  00 fe 00 00 00 00 10 00 - 00 20 00 00 00 02 00 00  ......... ......
01940024  00 20 00 00 aa 00 00 00 - ff ef fd 7f 0d 00 08 06  . ..............
01940034  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
01940044  98 05 94 01 0f 00 00 00 - f8 ff ff ff 50 00 94 01  ............P...
01940054  50 00 94 01 40 06 94 01 - 00 00 00 00 00 00 00 00  P...@...........
01940064  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................

State Dump for Thread Id 0x1920

eax=019bfe44 ebx=ffffffff ecx=00000001 edx=00000000 esi=7fffffff edi=00000102
eip=77f88f13 esp=019bfcac ebp=019bfce4 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000293


function: ZwWaitForSingleObject
        77f88f08 b8ea000000       mov     eax,0xea
        77f88f0d 8d542404         lea     edx,[esp+0x4]          ss:02229b93=????????
        77f88f11 cd2e             int     2e
        77f88f13 c20c00           ret     0xc
        77f88f16 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
019BFCE4 74FD3C59 00000314 00000304 00000000 00000004 ntdll!ZwWaitForSingleObject 
019BFDD0 750312F5 00000305 019BFE5C 00000000 00000000 msafd!WSPSetSockOpt 
019BFE34 75615392 00000305 019BFE5C 00000000 00000000 ws2_32!select 
019BFF7C 780085BC 7561A218 77FABDB6 75010000 0024A298 wsnmp32!SnmpSetPort 
019BFFB4 7C57B388 0024A298 77FABDB6 75010000 0024A298 !endthreadex 
019BFFEC 00000000 78008532 0024A298 00000000 00000008 kernel32!lstrcmpiW 

*----> Raw Stack Dump <----*
019bfcac  94 13 fd 74 14 03 00 00 - 01 00 00 00 d0 fc 9b 01  ...t............
019bfcbc  5c fe 9b 01 58 fd 9b 01 - 48 fd 9b 01 25 10 e1 ad  \...X...H...%...
019bfccc  c3 6e c6 01 ff ff ff ff - ff ff ff 7f d0 04 0a 00  .n..............
019bfcdc  00 00 00 00 00 00 00 00 - d0 fd 9b 01 59 3c fd 74  ............Y<.t
019bfcec  14 03 00 00 04 03 00 00 - 00 00 00 00 04 00 00 00  ................
019bfcfc  00 00 00 00 d0 5d 26 00 - 00 00 00 00 fc fc 9b 01  .....]&.........
019bfd0c  88 06 08 00 b4 fd 9b 01 - 64 7e fb 77 58 31 f8 77  ........d~.wX1.w
019bfd1c  ff ff ff ff c4 fd 9b 01 - 98 31 10 00 90 01 08 00  .........1......
019bfd2c  58 5c 11 00 60 a1 61 75 - 14 bc 09 00 66 11 02 75  X\..`.au....f..u
019bfd3c  24 fb 09 00 9d 11 02 75 - cd 6b fd 74 ff ff ff ff  $......u.k.t....
019bfd4c  ff ff ff 7f 01 00 00 00 - 00 00 00 00 04 03 00 00  ................
019bfd5c  19 00 00 00 94 fd 9b 01 - 18 00 00 00 36 6c fd 74  ............6l.t
019bfd6c  f0 25 94 01 00 00 00 00 - d0 5d 26 00 00 00 00 00  .%.......]&.....
019bfd7c  ff ff ff ff f8 5d 26 00 - 00 00 00 00 d0 04 0a 00  .....]&.........
019bfd8c  d0 04 0a 00 d0 04 0a 00 - 00 00 00 00 48 fd 9b 01  ............H...
019bfd9c  2c 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00  ,...............
019bfdac  03 01 00 00 02 00 00 00 - 64 fd 9b 01 fc fc 9b 01  ........d.......
019bfdbc  04 fe 9b 01 24 fe 9b 01 - 12 ea fd 74 88 3d fd 74  ....$......t.=.t
019bfdcc  ff ff ff ff 34 fe 9b 01 - f5 12 03 75 05 03 00 00  ....4......u....
019bfddc  5c fe 9b 01 00 00 00 00 - 00 00 00 00 00 00 00 00  \...............

State Dump for Thread Id 0x15f0

eax=00000000 ebx=7c59a24f ecx=000000c0 edx=00000000 esi=77f88398 edi=01cdff80
eip=77f883a3 esp=01cdff6c ebp=01cdff88 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202


function: NtDelayExecution
        77f88398 b832000000       mov     eax,0x32
        77f8839d 8d542404         lea     edx,[esp+0x4]          ss:02549e53=????????
        77f883a1 cd2e             int     2e
        77f883a3 c20800           ret     0x8
        77f883a6 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
01CDFF88 7C59A25A 0036EE80 00000000 76151551 0036EE80 ntdll!NtDelayExecution 
01CDFFB4 7C57B388 00000001 00CA0178 00080748 019D49D8 kernel32!Sleep 
01CDFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x177c

eax=00000001 ebx=00000000 ecx=00ca7d40 edx=00000000 esi=77f88f08 edi=0000019c
eip=77f88f13 esp=01d1ff64 ebp=01d1ff88 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: ZwWaitForSingleObject
        77f88f08 b8ea000000       mov     eax,0xea
        77f88f0d 8d542404         lea     edx,[esp+0x4]          ss:02589e4b=????????
        77f88f11 cd2e             int     2e
        77f88f13 c20c00           ret     0xc
        77f88f16 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
01D1FF88 7C57B3DB 0000019C FFFFFFFF 00000000 76129508 ntdll!ZwWaitForSingleObject 
01D1FFB4 7C57B388 00CA2200 00000000 000A4678 00CA2200 kernel32!WaitForSingleObject 
01D1FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x15f8

eax=03a80eb8 ebx=000493e0 ecx=00080838 edx=00000000 esi=00085840 edi=000493e0
eip=77f88af7 esp=0407febc ebp=0407fee4 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297


function: NtRemoveIoCompletion
        77f88aec b8a8000000       mov     eax,0xa8
        77f88af1 8d542404         lea     edx,[esp+0x4]          ss:048e9da3=????????
        77f88af5 cd2e             int     2e
        77f88af7 c21400           ret     0x14
        77f88afa 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0407FEE4 77D4FA03 00000050 0407FF1C 0407FF0C 0407FF14 ntdll!NtRemoveIoCompletion 
0407FF20 77D4F964 000493E0 0407FF60 0407FF5C 0407FF70 rpcrt4!PerformRpcInitialization 
0407FF74 77D43DD7 77D4E003 00085840 00000000 02AAFBA8 rpcrt4!PerformRpcInitialization 
0407FFA8 77D4AF16 000D7780 0407FFEC 7C57B388 00114E18 rpcrt4!RpcBindingSetOption 
0407FFB4 7C57B388 00114E18 00000000 02AAFBA8 00114E18 rpcrt4!RpcMgmtSetCancelTimeout 
0407FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x1528

eax=00000001 ebx=000493e0 ecx=00080688 edx=00000000 esi=00085840 edi=000493e0
eip=77f88af7 esp=052efebc ebp=052efee4 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297


function: NtRemoveIoCompletion
        77f88aec b8a8000000       mov     eax,0xa8
        77f88af1 8d542404         lea     edx,[esp+0x4]          ss:05b59da3=????????
        77f88af5 cd2e             int     2e
        77f88af7 c21400           ret     0x14
        77f88afa 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
052EFEE4 77D4FA03 0000004C 052EFF1C 052EFF0C 052EFF14 ntdll!NtRemoveIoCompletion 
052EFF20 77D4F964 000493E0 052EFF60 052EFF5C 052EFF70 rpcrt4!PerformRpcInitialization 
052EFF74 77D43DD7 77D4E003 00085840 00000018 00000000 rpcrt4!PerformRpcInitialization 
052EFFA8 77D4AF16 000CF8C8 052EFFEC 7C57B388 000DF948 rpcrt4!RpcBindingSetOption 
052EFFB4 7C57B388 000DF948 00000018 00000000 000DF948 rpcrt4!RpcMgmtSetCancelTimeout 
052EFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x1698

eax=77d4aefc ebx=80030000 ecx=00000000 edx=00000000 esi=000a0288 edi=000a02c8
eip=77f88b37 esp=0588fe28 ebp=0588ff74 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000202


function: ZwReplyWaitReceivePortEx
        77f88b2c b8ac000000       mov     eax,0xac
        77f88b31 8d542404         lea     edx,[esp+0x4]          ss:060f9d0f=????????
        77f88b35 cd2e             int     2e
        77f88b37 c21400           ret     0x14
        77f88b3a 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0588FF74 77D4E0C0 77D4E003 000A0288 00000000 00000000 ntdll!ZwReplyWaitReceivePortEx 
0588FFA8 77D4AF16 00158638 0588FFEC 7C57B388 0010AA18 rpcrt4!UuidCreate 
0588FFB4 7C57B388 0010AA18 00000000 00000000 0010AA18 rpcrt4!RpcMgmtSetCancelTimeout 
0588FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x16f4

eax=00000005 ebx=00015f90 ecx=7ffa6000 edx=00000000 esi=00085840 edi=00015f90
eip=77f88af7 esp=06d9febc ebp=06d9fee4 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297


function: NtRemoveIoCompletion
        77f88aec b8a8000000       mov     eax,0xa8
        77f88af1 8d542404         lea     edx,[esp+0x4]          ss:07609da3=????????
        77f88af5 cd2e             int     2e
        77f88af7 c21400           ret     0x14
        77f88afa 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
06D9FEE4 77D4FA03 00000048 06D9FF1C 06D9FF0C 06D9FF14 ntdll!NtRemoveIoCompletion 
06D9FF20 77D4F964 00015F90 06D9FF60 06D9FF5C 06D9FF70 rpcrt4!PerformRpcInitialization 
06D9FF74 77D43DD7 77D4E003 00085840 00000018 00000000 rpcrt4!PerformRpcInitialization 
06D9FFA8 77D4AF16 000D99C0 06D9FFEC 7C57B388 05610F30 rpcrt4!RpcBindingSetOption 
06D9FFB4 7C57B388 05610F30 00000018 00000000 05610F30 rpcrt4!RpcMgmtSetCancelTimeout 
06D9FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x190

eax=00000409 ebx=0002bf20 ecx=7ffa8000 edx=00000000 esi=00085840 edi=0002bf20
eip=77f88af7 esp=096afebc ebp=096afee4 iopl=0         nv up ei ng nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297


function: NtRemoveIoCompletion
        77f88aec b8a8000000       mov     eax,0xa8
        77f88af1 8d542404         lea     edx,[esp+0x4]          ss:09f19da3=????????
        77f88af5 cd2e             int     2e
        77f88af7 c21400           ret     0x14
        77f88afa 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
096AFEE4 77D4FA03 00000044 096AFF1C 096AFF0C 096AFF14 ntdll!NtRemoveIoCompletion 
096AFF20 77D4F964 0002BF20 096AFF60 096AFF5C 096AFF70 rpcrt4!PerformRpcInitialization 
096AFF74 77D43DD7 77D4E003 00085840 00000000 0031FBA8 rpcrt4!PerformRpcInitialization 
096AFFA8 77D4AF16 03B5E798 096AFFEC 7C57B388 001398C8 rpcrt4!RpcBindingSetOption 
096AFFB4 7C57B388 001398C8 00000000 0031FBA8 001398C8 rpcrt4!RpcMgmtSetCancelTimeout 
096AFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW 

State Dump for Thread Id 0x2dc

eax=0b05f394 ebx=80710001 ecx=0b05f374 edx=00000000 esi=00087230 edi=00087270
eip=77f88b37 esp=0b05fe28 ebp=0b05ff74 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000202


function: ZwReplyWaitReceivePortEx
        77f88b2c b8ac000000       mov     eax,0xac
        77f88b31 8d542404         lea     edx,[esp+0x4]          ss:0b8c9d0f=????????
        77f88b35 cd2e             int     2e
        77f88b37 c21400           ret     0x14
        77f88b3a 8bff             mov     edi,edi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
0B05FF74 77D4E0C0 77D4E003 00087230 77D9CBA0 019F4EC8 ntdll!ZwReplyWaitReceivePortEx 
0B05FFA8 77D4AF16 03A917E0 0B05FFEC 7C57B388 03A95748 rpcrt4!UuidCreate 
0B05FFB4 7C57B388 03A95748 77D9CBA0 019F4EC8 03A95748 rpcrt4!RpcMgmtSetCancelTimeout 
0B05FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!lstrcmpiW

[ Voor 3% gewijzigd door Grolsch op 05-05-2006 11:13 ]

[Verwijderd]

Je moet zoeken naar FAULT en vanaf daar naar boven lezen totdat je de stack back trace vindt. In dit geval is dat:

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
77F87FC0 4AFFC033 89257508 FFF00C42 037D044A 520004C2 gdi32!GdiGetSpoolMessage
0424548B 00000000 00000000 00000000 00000000 00000000

Daar zie je staan dus dat is waarschijnlijk een third party driver maar omdat je geen symbols hebt kun je niet zien welke dat is.

Is er een user.dmp file aangemaakt? Zo ja kun je die ergens uploaden?

[Grolsch]

Verwijderd schreef op vrijdag 05 mei 2006 @ 13:35:
Je moet zoeken naar FAULT en vanaf daar naar boven lezen totdat je de stack back trace vindt. In dit geval is dat:

[...]


Daar zie je <nosymbols> staan dus dat is waarschijnlijk een third party driver maar omdat je geen symbols hebt kun je niet zien welke dat is.

Is er een user.dmp file aangemaakt? Zo ja kun je die ergens uploaden?

ik heb het bestand ingepakt met winzip, en dan issie ~10MB groot.
Ik heb hem hier neer gezet:

http://www.savefile.com/files/6336932

[ Voor 4% gewijzigd door Grolsch op 06-05-2006 13:24 ]

[Verwijderd]

Volgens de dump is er heap corruptie en dat wordt zeer waarschijnlijk veroorzaakt door HPBHealr.dll. Om dat zeker te weten moet je met gflags.exe page heap aanzetten voor spoolsv.exe:
http://support.microsoft....aspx?scid=kb;en-us;286470

_{maar veel verder dan dat kom ik niet}

[The Eagle]

Ik heb op mijn afstuderen ook eens een vastlopende printserver gezien. Die vondt het niet zo leuk dat er PDF'jes op een bepaalde manier geprint werden. Door de manier waarop de data naar de printer gestuurd werd, moest deze heel veel geheugen alloceren, en daa liep het mis. Een PDF'je wilde zomaar 80mb worden, en als dat er niet is, tsja, dan houdt het op he
Dus misschien moet je eens naar je driver-installingen kijken. Wellicht vindt je printserver het leuker als de data RAW wordt verstuurd als in PCL-nogwat, valt allicht uit te proberen

Overigens, uit een redpaper van Oracle / PeopleSoft (link kun je niet bij, is support only, maar wellicht heb je er iets aan):

When PS/nVision runs in interactive mode (foreground), it runs within the 3 MB of desktop heap and in non-interactive (background) mode it runs within 512 KB of desktop heap. When PS/nVision and Excel run, they use a fair amount of desktop heap space. Programs run in non-interactive mode have only 512 KB of heap size and this may not be sufficient if you run large number of programs. If there is not enough heap for running PS/nVision reports on the background mode, some reports may not run, may hang during the initial stage, and may block other PS/nVision reports. For running the same reports in foreground and background mode, you need to increase the shared section value for the background heap to the same as the foreground value. The shared section heap value used for testing 30 PS/nVision reports and other applications was 3,072 KB (3 MB). The shared section value needs to be changed in the system registry and users will have to change this value using Registry Editor. The MS article 126962 explains this in detail and contains instructions for changing the shared section value. http://support.Microsoft....aspx?scid=kb;EN-US;126962 A problem incident has been opened in PeopleTools to automate this change and will be addressed in a future release. The following section explains the registry values for shared section memory. Windows uses different shared section memory heap for interactive and non-interactive programs. The size of the desktop heap allocated for a desktop associated with a window station is stored in the registry, in: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\Windows The default values are, SharedSection=1024 KB (common), 3072 KB (interactive), 512 KB (non-interactive) • The first SharedSection value (1024 KB) is the shared heap size common to all desktops.
© Copyright PeopleSoft Corporation 2001. All rights reserved. 13
PS/nVision in the PeopleSoft Internet Architecture 2/3/2004
• The second SharedSection value (3072 KB) is the size of the desktop heap for each desktop that is associated with the "interactive" window. • The third SharedSection value (512 KB ) is the size of the desktop heap for desktops created in non-interactive window stations. 4) Change the Performance Options to optimize performance for background services. By changing this setting, the system will assign equal amounts of processor resources to all forground and background programs. Performance Options dialog box To change the value of this entry, in Control Panel, double-click System, click the Advanced tab, click Performance Options, and then, in the Application response section, select either Applications or Background services. Clicking Applications sets the value of this entry to 100110, and provides for short, variable-length processor intervals in which foreground processes get three times as much processor time as do background processes. Clicking Background services sets the value of this entry to 011000, and provides for longer, fixed-length processor intervals in which foreground processes and background processes get equal processor priority.

Bron: PeopleSoft nVision Redpaper