Crashes in ntshrui.dll with error code 0xc0000005
Hi,
I have several scheduled tasks on a Windows Server 2008 R2 (64-bit) with WinSCP transfers. There are a lot of intermittent crashes with exception code 0xc0000005 (Access violation) in module ntshrui.dll. These crashes have occurred since we moved all our scheduled tasks from an old server with Windows Server 2008 to a newer one with Windows Server 2008 R2 (about 6 months ago). I have analyzed several crash dumps and the stack traces are identical.
I will e-mail you the log and the script from this crash. I get these crashes in other scripts too, and on different lines.
=====================================================================================================
Windows event log:
Faulting application name: winscp.exe, version: 5.5.1.3970, time stamp: 0x00000000
Faulting module name: ntshrui.dll, version: 6.1.7601.17755, time stamp: 0x4f0412c9
Exception code: 0xc0000005
Fault offset: 0x00001c94
Faulting process id: 0x6510
Faulting application start time: 0x01cf21a79f148079
Faulting application path: C:\Program Files (x86)\Tools\winscp.exe
Faulting module path: C:\Windows\system32\ntshrui.dll
Report Id: de2ade24-8d9a-11e3-b976-000c2904048d
=====================================================================================================
Crash dump:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Machine Name:
Debug session time: Tue Feb 4 13:50:09.000 2014 (GMT+1)
System Uptime: 0 days 11:49:06.301
Process Uptime: 0 days 0:00:07.000
................................................................
...........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(6510.141c): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=025ff1bc ecx=765664e8 edx=01000180 esi=00000002 edi=00000000
eip=77cc015d esp=025ff16c ebp=025ff208 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwWaitForMultipleObjects+0x15:
77cc015d 83c404 add esp,4
0:003> !analyze -v
FAULTING_IP:
ntshrui!__delayLoadHelper2+0
6d101c94 8bff mov edi,edi
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6d101c94 (ntshrui!__delayLoadHelper2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 6d101c94
Attempt to execute non-executable address 6d101c94
PROCESS_NAME: WinSCP.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: 6d101c94
WRITE_ADDRESS: 6d101c94
FOLLOWUP_IP:
ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
6d128740 5a pop edx
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
FAULTING_THREAD: 0000141c
BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT
PRIMARY_PROBLEM_CLASS: SOFTWARE_NX_FAULT_FALSE_POSITIVE
DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT_FALSE_POSITIVE
LAST_CONTROL_TRANSFER: from 6d128740 to 6d101c94
STACK_TEXT:
025ff7ec 6d128740 6d12ce48 6d13000c 01000180 ntshrui!__delayLoadHelper2
025ff848 6d10e23a 776043c0 00000000 00000000 ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+0xd
025ff84c 776043c0 00000000 00000000 00000000 ntshrui!WaitForServerThread+0x5
025ff8d4 75c9336a 00eade40 025ff920 77cd9f72 shlwapi!WrapperThreadProc+0x1b5
025ff8e0 77cd9f72 00eade40 770ccb49 00000000 kernel32!BaseThreadInitThunk+0xe
025ff920 77cd9f45 776042ed 00eade40 ffffffff ntdll!__RtlUserThreadStart+0x70
025ff938 00000000 776042ed 00eade40 00000000 ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND: ~3s; .ecxr ; kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ntshrui
IMAGE_NAME: ntshrui.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4f0412c9
FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_FALSE_POSITIVE_c0000005_ntshrui.dll!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll
BUCKET_ID: APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT_ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WinSCP_exe/5_5_1_3970/52de658e/ntshrui_dll/6_1_7601_17755/4f0412c9/c0000005/00001c94.htm?Retriage=1
Followup: MachineOwner
---------
=====================================================================================================
Your help would be appreciated.
Kind regards,
Johan
I have several scheduled tasks on a Windows Server 2008 R2 (64-bit) with WinSCP transfers. There are a lot of intermittent crashes with exception code 0xc0000005 (Access violation) in module ntshrui.dll. These crashes have occurred since we moved all our scheduled tasks from an old server with Windows Server 2008 to a newer one with Windows Server 2008 R2 (about 6 months ago). I have analyzed several crash dumps and the stack traces are identical.
I will e-mail you the log and the script from this crash. I get these crashes in other scripts too, and on different lines.
=====================================================================================================
Windows event log:
Faulting application name: winscp.exe, version: 5.5.1.3970, time stamp: 0x00000000
Faulting module name: ntshrui.dll, version: 6.1.7601.17755, time stamp: 0x4f0412c9
Exception code: 0xc0000005
Fault offset: 0x00001c94
Faulting process id: 0x6510
Faulting application start time: 0x01cf21a79f148079
Faulting application path: C:\Program Files (x86)\Tools\winscp.exe
Faulting module path: C:\Windows\system32\ntshrui.dll
Report Id: de2ade24-8d9a-11e3-b976-000c2904048d
=====================================================================================================
Crash dump:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Machine Name:
Debug session time: Tue Feb 4 13:50:09.000 2014 (GMT+1)
System Uptime: 0 days 11:49:06.301
Process Uptime: 0 days 0:00:07.000
................................................................
...........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(6510.141c): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=025ff1bc ecx=765664e8 edx=01000180 esi=00000002 edi=00000000
eip=77cc015d esp=025ff16c ebp=025ff208 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!ZwWaitForMultipleObjects+0x15:
77cc015d 83c404 add esp,4
0:003> !analyze -v
FAULTING_IP:
ntshrui!__delayLoadHelper2+0
6d101c94 8bff mov edi,edi
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6d101c94 (ntshrui!__delayLoadHelper2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 6d101c94
Attempt to execute non-executable address 6d101c94
PROCESS_NAME: WinSCP.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: 6d101c94
WRITE_ADDRESS: 6d101c94
FOLLOWUP_IP:
ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
6d128740 5a pop edx
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
FAULTING_THREAD: 0000141c
BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT
PRIMARY_PROBLEM_CLASS: SOFTWARE_NX_FAULT_FALSE_POSITIVE
DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT_FALSE_POSITIVE
LAST_CONTROL_TRANSFER: from 6d128740 to 6d101c94
STACK_TEXT:
025ff7ec 6d128740 6d12ce48 6d13000c 01000180 ntshrui!__delayLoadHelper2
025ff848 6d10e23a 776043c0 00000000 00000000 ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+0xd
025ff84c 776043c0 00000000 00000000 00000000 ntshrui!WaitForServerThread+0x5
025ff8d4 75c9336a 00eade40 025ff920 77cd9f72 shlwapi!WrapperThreadProc+0x1b5
025ff8e0 77cd9f72 00eade40 770ccb49 00000000 kernel32!BaseThreadInitThunk+0xe
025ff920 77cd9f45 776042ed 00eade40 ffffffff ntdll!__RtlUserThreadStart+0x70
025ff938 00000000 776042ed 00eade40 00000000 ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND: ~3s; .ecxr ; kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ntshrui
IMAGE_NAME: ntshrui.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4f0412c9
FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_FALSE_POSITIVE_c0000005_ntshrui.dll!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll
BUCKET_ID: APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT_ntshrui!_tailMerge_API_MS_WIN_Service_Management_L1_1_0_dll+d
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/WinSCP_exe/5_5_1_3970/52de658e/ntshrui_dll/6_1_7601_17755/4f0412c9/c0000005/00001c94.htm?Retriage=1
Followup: MachineOwner
---------
=====================================================================================================
Your help would be appreciated.
Kind regards,
Johan
