Author: modira
Subject: Procmon Causes Blue Screen Terminal Server
Posted: 18 June 2013 at 12:55pm
I am running into the same issue on WIndows Sever 2003 SP2, Procmon V3.4 or Procmon 2.94. Blue Screen
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\s3w01791\c$\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
EXCEPTION_RECORD: a3a2ceec -- (.exr 0xffffffffa3a2ceec)
ExceptionAddress: b9e39b22 (rdbss!RxIsThisACscAgentOpen+0x00000038)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008
SYMBOL_STACK_INDEX: 0
Subject: Procmon Causes Blue Screen Terminal Server
Posted: 18 June 2013 at 12:55pm
I am running into the same issue on WIndows Sever 2003 SP2, Procmon V3.4 or Procmon 2.94. Blue Screen
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\s3w01791\c$\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer
Built by: 3790.srv03_sp2_qfe.130306-1435
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8ee8
Debug session time: Fri Jun 14 15:09:12.148 2013 (UTC - 4:00)
System Uptime: 2 days 5:20:26.777
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
................................................................
.......
Loading unloaded module list
.............................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer
Built by: 3790.srv03_sp2_qfe.130306-1435
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8ee8
Debug session time: Fri Jun 14 15:09:12.148 2013 (UTC - 4:00)
System Uptime: 2 days 5:20:26.777
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
................................................................
.......
Loading unloaded module list
.............................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 27, {baad0080, a3a2ceec, a3a2cbe8, b9e39b22}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mfehidk.sys -
*** ERROR: Module load completed but symbols could not be loaded for CtxSbx.sys
*** ERROR: Module load completed but symbols could not be loaded for CtxAltStr.sys
*** ERROR: Module load completed but symbols could not be loaded for PROCMON20.SYS
*** WARNING: Unable to verify checksum for RULW32.DLL
*** ERROR: Module load completed but symbols could not be loaded for RULW32.DLL
*** WARNING: Unable to verify checksum for PDFW32.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for PDFW32.DLL -
*** WARNING: Unable to verify checksum for PRTW32.DLL
*** ERROR: Module load completed but symbols could not be loaded for PRTW32.DLL
*** WARNING: Unable to verify checksum for GENPTW32.EXE
*** ERROR: Module load completed but symbols could not be loaded for GENPTW32.EXE
Probably caused by : rdbss.sys ( rdbss!RxIsThisACscAgentOpen+38 )
*** ERROR: Module load completed but symbols could not be loaded for CtxSbx.sys
*** ERROR: Module load completed but symbols could not be loaded for CtxAltStr.sys
*** ERROR: Module load completed but symbols could not be loaded for PROCMON20.SYS
*** WARNING: Unable to verify checksum for RULW32.DLL
*** ERROR: Module load completed but symbols could not be loaded for RULW32.DLL
*** WARNING: Unable to verify checksum for PDFW32.DLL
*** ERROR: Symbol file could not be found. Defaulted to export symbols for PDFW32.DLL -
*** WARNING: Unable to verify checksum for PRTW32.DLL
*** ERROR: Module load completed but symbols could not be loaded for PRTW32.DLL
*** WARNING: Unable to verify checksum for GENPTW32.EXE
*** ERROR: Module load completed but symbols could not be loaded for GENPTW32.EXE
Probably caused by : rdbss.sys ( rdbss!RxIsThisACscAgentOpen+38 )
Followup: MachineOwner
---------
---------
12: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0080
Arg2: a3a2ceec
Arg3: a3a2cbe8
Arg4: b9e39b22
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0080
Arg2: a3a2ceec
Arg3: a3a2cbe8
Arg4: b9e39b22
Debugging Details:
------------------
------------------
EXCEPTION_RECORD: a3a2ceec -- (.exr 0xffffffffa3a2ceec)
ExceptionAddress: b9e39b22 (rdbss!RxIsThisACscAgentOpen+0x00000038)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008
CONTEXT: a3a2cbe8 -- (.cxr 0xffffffffa3a2cbe8)
eax=00000000 ebx=b9e39b02 ecx=00000009 edx=00000000 esi=00000008 edi=b9e39b02
eip=b9e39b22 esp=a3a2cfb4 ebp=a3a2cfc4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
rdbss!RxIsThisACscAgentOpen+0x38:
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
Resetting default scope
eax=00000000 ebx=b9e39b02 ecx=00000009 edx=00000000 esi=00000008 edi=b9e39b02
eip=b9e39b22 esp=a3a2cfb4 ebp=a3a2cfc4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
rdbss!RxIsThisACscAgentOpen+0x38:
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
Resetting default scope
PROCESS_NAME: GENPTW32.EXE
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000008
READ_ADDRESS: 00000008
FOLLOWUP_IP:
rdbss!RxIsThisACscAgentOpen+38
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
rdbss!RxIsThisACscAgentOpen+38
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
FAULTING_IP:
rdbss!RxIsThisACscAgentOpen+38
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
rdbss!RxIsThisACscAgentOpen+38
b9e39b22 f3a6 repe cmps byte ptr [esi],byte ptr es:[edi]
BUGCHECK_STR: 0x27
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from b9e47cf0 to b9e39b22
STACK_TEXT:
a3a2cfc4 b9e47cf0 8aaaec80 00000000 8aec9508 rdbss!RxIsThisACscAgentOpen+0x38
a3a2cfe4 b9e4443b 00000000 a3a2d014 a3a2d024 rdbss!RxInitializeVNetRootParameters+0x282
a3a2d04c b9e4663e 8aba5e38 8af982b0 a3a2d074 rdbss!RxFindOrConstructVirtualNetRoot+0xf6
a3a2d084 b9e46b76 8aaaec80 8af982b0 8d370fb0 rdbss!RxCanonicalizeNameAndObtainNetRoot+0x1a2
a3a2d0ec b9e378d9 8aaaec80 8af982b0 8d370f80 rdbss!RxCommonCreate+0x2c3
a3a2d17c b9e459a2 b9e42028 8af982b0 8d370f80 rdbss!RxFsdCommonDispatch+0x320
a3a2d19c b9dc3b6d 8eae7030 8af982b0 8d370f80 rdbss!RxFsdDispatch+0xd3
a3a2d1bc 8081e185 00000000 01f982b0 8af982b0 mrxsmb!MRxSmbFsdDispatch+0x134
a3a2d1d0 f7870577 00000000 8dff7008 8f8909d0 nt!IofCallDriver+0x45
a3a2d200 8081e185 8eaad020 8af982b0 a3a2d2f4 fltMgr!FltpCreate+0x1d9
a3a2d214 f7bbc071 8d370f80 8dff7008 a3a2d2f4 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
a3a2d254 f7b7f7fa 8af982b0 8dff7008 8af982b0 mfehidk!DEVICEDISPATCH::LowerDispatchPassThrough+0x71
a3a2d2dc f7bbc829 a3a2d2f4 c000000d 8f88c6b0 mfehidk+0x147fa
a3a2d310 8081e185 01918870 8af982b0 8af982b0 mfehidk!DEVICEDISPATCH::DispatchPassThrough+0x99
a3a2d324 b9ac3bec 8af98368 8e071a98 8af982b0 nt!IofCallDriver+0x45
a3a2d338 b9abf3ee 8dff9780 00000000 a3a2d35c CtxSbx+0x5bec
a3a2d348 8081e185 8dff9780 8af982b0 8af982b0 CtxSbx+0x13ee
a3a2d35c b9d204e1 8af982b0 8dff9020 a3a2d3f8 nt!IofCallDriver+0x45
a3a2d380 b9d20755 8dff9020 00f982b0 00000000 CtxAltStr+0x44e1
a3a2d3a0 8081e185 8dff9020 8af982b0 8af982b0 CtxAltStr+0x4755
a3a2d3b4 f7862b39 00000000 8af982b0 8af9838c nt!IofCallDriver+0x45
a3a2d3d8 f7870608 a3a2d3f8 8e9196d8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
a3a2d414 8081e185 8e9196d8 8af982b0 8d370f80 fltMgr!FltpCreate+0x26a
a3a2d428 baf16bb7 8a9d1dbc 8a9d1db8 00000000 nt!IofCallDriver+0x45
a3a2d45c baf172c9 8a9d1db8 baf13188 8a9d1db8 Mup!DnrRedirectFileOpen+0x443
a3a2d4bc baf16d1e 019d1db8 0078006c 8af983b0 Mup!DnrNameResolve+0x52a
a3a2d4ec baf156e8 8b3c3008 8af982b0 8f436d78 Mup!DnrStartNameResolution+0x28c
a3a2d55c baf15766 8b3c3008 8f436cc0 8af982b0 Mup!DfsCommonCreate+0x237
a3a2d5a4 baf157be 8f436cc0 8af982b0 8d370f80 Mup!DfsFsdCreate+0xde
a3a2d5fc 8081e185 8f436cc0 8af982b0 8af982b0 Mup!MupCreate+0xbc
a3a2d610 808fb3f9 a3a2d7b8 8f436ca8 00000000 nt!IofCallDriver+0x45
a3a2d6f8 80939f1a 8f436cc0 00000000 8aab6b30 nt!IopParseDevice+0xa35
a3a2d778 8093604e 00000000 a3a2d7b8 00000240 nt!ObpLookupObjectName+0x5b0
a3a2d7cc 808ed0b5 00000000 00000000 436d7800 nt!ObOpenObjectByName+0xea
a3a2d848 808ee3e2 8af58ac8 00100000 a3a2d8e0 nt!IopCreateFile+0x447
a3a2d890 f7876c94 8af58ac8 00100000 a3a2d8e0 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
a3a2d938 f78773bb 00000000 00000000 a3a2d9d4 fltMgr!FltpExpandFilePathWorker+0x118
a3a2d950 f78778e1 8af58a80 00000000 8af58a80 fltMgr!FltpExpandFilePath+0x19
a3a2d988 f7877929 8af58a80 8af58a80 a3a2dad8 fltMgr!FltpGetOpenedDestinationFileName+0x303
a3a2d998 f7877ab5 8af58a80 8ad16358 00000000 fltMgr!FltpGetNormalizedDestinationFileName+0x13
a3a2dad8 a5dd1d1b 8abbc890 8efbb028 00000000 fltMgr!FltGetDestinationFileNameInformation+0x12b
a3a2db14 a5dd2063 a3a2db74 8ad16358 a3a2db48 PROCMON20+0x2d1b
a3a2db54 f78604de 8ad1632c a3a2db74 a3a2db90 PROCMON20+0x3063
a3a2dbb4 f7861f3e 00a2dbfc 00000000 a3a2dbfc fltMgr!FltpPerformPreCallbacks+0x2d4
a3a2dbc8 f78628e6 a3a2dbfc 00000000 8e9196d8 fltMgr!FltpPassThroughInternal+0x32
a3a2dbe4 f7862cfa a3a2db00 00000000 8f8909d0 fltMgr!FltpPassThrough+0x1c2
a3a2dc14 8081e185 8e9196d8 8ae1f288 8ae1f3ac fltMgr!FltpDispatch+0x110
a3a2dc28 baf23b27 8ae1f388 8f638ce0 8ae1f288 nt!IofCallDriver+0x45
a3a2dc6c baf23c20 8e0657d0 8ae1f288 8ae1f388 Mup!DfsCommonSetInformation+0xa3
a3a2dcac 8081e185 8f436cc0 8ae1f288 00000000 Mup!DfsFsdSetInformation+0x61
a3a2dcc0 808f34dd a3a2dd64 0012e274 808f2f3e nt!IofCallDriver+0x45
a3a2dd48 8088b55c 00000110 0012e2ac 00155438 nt!NtSetInformationFile+0x59f
a3a2dd48 7c82845c 00000110 0012e2ac 00155438 nt!KiFastCallEntry+0xfc
0012e254 7c827879 77e5ce6d 00000110 0012e2ac ntdll!KiFastSystemCallRet
0012e258 77e5ce6d 00000110 0012e2ac 00155438 ntdll!NtSetInformationFile+0xc
0012e30c 77e4dd32 00151f98 001543e0 00000000 kernel32!MoveFileWithProgressW+0x375
0012e340 77e9f4f3 0012e37c 0012e484 00000000 kernel32!MoveFileWithProgressA+0x56
0012e35c 7c3589e6 0012e37c 0012e484 00814462 kernel32!MoveFileA+0x16
0012e368 00814462 0012e37c 0012e484 0000000a MSVCR71!rename+0xe [f:\vs70builds\3052\vc\crtbld\crt\src\rename.c @ 45]
0012e9d4 01bd0656 01421c10 00000012 01bfdbac RULW32+0x34462
0012ef40 006c2f1b 01421c10 006c2f30 004084ea PDFW32!PDFPrint+0x1a6
0012ef6c 006c2c06 006dfc0c 01bd04b0 006dfd0e PRTW32+0x2f1b
0012efa8 00404a19 01421c10 00000000 004084ea PRTW32+0x2c06
0012efdc 00404569 0040cf80 0012eff4 00000000 GENPTW32+0x4a19
0012f4cc 00404083 0040cf80 0040cd40 01403e10 GENPTW32+0x4569
0012fa28 00402d5a 0040cf80 00000032 00000000 GENPTW32+0x4083
0012fa5c 0040263e 0040cf80 00140000 00000000 GENPTW32+0x2d5a
0012ff60 00408987 00000002 013d2f00 013d31a8 GENPTW32+0x263e
0012ffc0 77e6f1eb 00000000 00000000 7ffd6000 GENPTW32+0x8987
0012fff0 00000000 00408844 00000000 78746341 kernel32!BaseProcessStart+0x23
a3a2cfc4 b9e47cf0 8aaaec80 00000000 8aec9508 rdbss!RxIsThisACscAgentOpen+0x38
a3a2cfe4 b9e4443b 00000000 a3a2d014 a3a2d024 rdbss!RxInitializeVNetRootParameters+0x282
a3a2d04c b9e4663e 8aba5e38 8af982b0 a3a2d074 rdbss!RxFindOrConstructVirtualNetRoot+0xf6
a3a2d084 b9e46b76 8aaaec80 8af982b0 8d370fb0 rdbss!RxCanonicalizeNameAndObtainNetRoot+0x1a2
a3a2d0ec b9e378d9 8aaaec80 8af982b0 8d370f80 rdbss!RxCommonCreate+0x2c3
a3a2d17c b9e459a2 b9e42028 8af982b0 8d370f80 rdbss!RxFsdCommonDispatch+0x320
a3a2d19c b9dc3b6d 8eae7030 8af982b0 8d370f80 rdbss!RxFsdDispatch+0xd3
a3a2d1bc 8081e185 00000000 01f982b0 8af982b0 mrxsmb!MRxSmbFsdDispatch+0x134
a3a2d1d0 f7870577 00000000 8dff7008 8f8909d0 nt!IofCallDriver+0x45
a3a2d200 8081e185 8eaad020 8af982b0 a3a2d2f4 fltMgr!FltpCreate+0x1d9
a3a2d214 f7bbc071 8d370f80 8dff7008 a3a2d2f4 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
a3a2d254 f7b7f7fa 8af982b0 8dff7008 8af982b0 mfehidk!DEVICEDISPATCH::LowerDispatchPassThrough+0x71
a3a2d2dc f7bbc829 a3a2d2f4 c000000d 8f88c6b0 mfehidk+0x147fa
a3a2d310 8081e185 01918870 8af982b0 8af982b0 mfehidk!DEVICEDISPATCH::DispatchPassThrough+0x99
a3a2d324 b9ac3bec 8af98368 8e071a98 8af982b0 nt!IofCallDriver+0x45
a3a2d338 b9abf3ee 8dff9780 00000000 a3a2d35c CtxSbx+0x5bec
a3a2d348 8081e185 8dff9780 8af982b0 8af982b0 CtxSbx+0x13ee
a3a2d35c b9d204e1 8af982b0 8dff9020 a3a2d3f8 nt!IofCallDriver+0x45
a3a2d380 b9d20755 8dff9020 00f982b0 00000000 CtxAltStr+0x44e1
a3a2d3a0 8081e185 8dff9020 8af982b0 8af982b0 CtxAltStr+0x4755
a3a2d3b4 f7862b39 00000000 8af982b0 8af9838c nt!IofCallDriver+0x45
a3a2d3d8 f7870608 a3a2d3f8 8e9196d8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
a3a2d414 8081e185 8e9196d8 8af982b0 8d370f80 fltMgr!FltpCreate+0x26a
a3a2d428 baf16bb7 8a9d1dbc 8a9d1db8 00000000 nt!IofCallDriver+0x45
a3a2d45c baf172c9 8a9d1db8 baf13188 8a9d1db8 Mup!DnrRedirectFileOpen+0x443
a3a2d4bc baf16d1e 019d1db8 0078006c 8af983b0 Mup!DnrNameResolve+0x52a
a3a2d4ec baf156e8 8b3c3008 8af982b0 8f436d78 Mup!DnrStartNameResolution+0x28c
a3a2d55c baf15766 8b3c3008 8f436cc0 8af982b0 Mup!DfsCommonCreate+0x237
a3a2d5a4 baf157be 8f436cc0 8af982b0 8d370f80 Mup!DfsFsdCreate+0xde
a3a2d5fc 8081e185 8f436cc0 8af982b0 8af982b0 Mup!MupCreate+0xbc
a3a2d610 808fb3f9 a3a2d7b8 8f436ca8 00000000 nt!IofCallDriver+0x45
a3a2d6f8 80939f1a 8f436cc0 00000000 8aab6b30 nt!IopParseDevice+0xa35
a3a2d778 8093604e 00000000 a3a2d7b8 00000240 nt!ObpLookupObjectName+0x5b0
a3a2d7cc 808ed0b5 00000000 00000000 436d7800 nt!ObOpenObjectByName+0xea
a3a2d848 808ee3e2 8af58ac8 00100000 a3a2d8e0 nt!IopCreateFile+0x447
a3a2d890 f7876c94 8af58ac8 00100000 a3a2d8e0 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
a3a2d938 f78773bb 00000000 00000000 a3a2d9d4 fltMgr!FltpExpandFilePathWorker+0x118
a3a2d950 f78778e1 8af58a80 00000000 8af58a80 fltMgr!FltpExpandFilePath+0x19
a3a2d988 f7877929 8af58a80 8af58a80 a3a2dad8 fltMgr!FltpGetOpenedDestinationFileName+0x303
a3a2d998 f7877ab5 8af58a80 8ad16358 00000000 fltMgr!FltpGetNormalizedDestinationFileName+0x13
a3a2dad8 a5dd1d1b 8abbc890 8efbb028 00000000 fltMgr!FltGetDestinationFileNameInformation+0x12b
a3a2db14 a5dd2063 a3a2db74 8ad16358 a3a2db48 PROCMON20+0x2d1b
a3a2db54 f78604de 8ad1632c a3a2db74 a3a2db90 PROCMON20+0x3063
a3a2dbb4 f7861f3e 00a2dbfc 00000000 a3a2dbfc fltMgr!FltpPerformPreCallbacks+0x2d4
a3a2dbc8 f78628e6 a3a2dbfc 00000000 8e9196d8 fltMgr!FltpPassThroughInternal+0x32
a3a2dbe4 f7862cfa a3a2db00 00000000 8f8909d0 fltMgr!FltpPassThrough+0x1c2
a3a2dc14 8081e185 8e9196d8 8ae1f288 8ae1f3ac fltMgr!FltpDispatch+0x110
a3a2dc28 baf23b27 8ae1f388 8f638ce0 8ae1f288 nt!IofCallDriver+0x45
a3a2dc6c baf23c20 8e0657d0 8ae1f288 8ae1f388 Mup!DfsCommonSetInformation+0xa3
a3a2dcac 8081e185 8f436cc0 8ae1f288 00000000 Mup!DfsFsdSetInformation+0x61
a3a2dcc0 808f34dd a3a2dd64 0012e274 808f2f3e nt!IofCallDriver+0x45
a3a2dd48 8088b55c 00000110 0012e2ac 00155438 nt!NtSetInformationFile+0x59f
a3a2dd48 7c82845c 00000110 0012e2ac 00155438 nt!KiFastCallEntry+0xfc
0012e254 7c827879 77e5ce6d 00000110 0012e2ac ntdll!KiFastSystemCallRet
0012e258 77e5ce6d 00000110 0012e2ac 00155438 ntdll!NtSetInformationFile+0xc
0012e30c 77e4dd32 00151f98 001543e0 00000000 kernel32!MoveFileWithProgressW+0x375
0012e340 77e9f4f3 0012e37c 0012e484 00000000 kernel32!MoveFileWithProgressA+0x56
0012e35c 7c3589e6 0012e37c 0012e484 00814462 kernel32!MoveFileA+0x16
0012e368 00814462 0012e37c 0012e484 0000000a MSVCR71!rename+0xe [f:\vs70builds\3052\vc\crtbld\crt\src\rename.c @ 45]
0012e9d4 01bd0656 01421c10 00000012 01bfdbac RULW32+0x34462
0012ef40 006c2f1b 01421c10 006c2f30 004084ea PDFW32!PDFPrint+0x1a6
0012ef6c 006c2c06 006dfc0c 01bd04b0 006dfd0e PRTW32+0x2f1b
0012efa8 00404a19 01421c10 00000000 004084ea PRTW32+0x2c06
0012efdc 00404569 0040cf80 0012eff4 00000000 GENPTW32+0x4a19
0012f4cc 00404083 0040cf80 0040cd40 01403e10 GENPTW32+0x4569
0012fa28 00402d5a 0040cf80 00000032 00000000 GENPTW32+0x4083
0012fa5c 0040263e 0040cf80 00140000 00000000 GENPTW32+0x2d5a
0012ff60 00408987 00000002 013d2f00 013d31a8 GENPTW32+0x263e
0012ffc0 77e6f1eb 00000000 00000000 7ffd6000 GENPTW32+0x8987
0012fff0 00000000 00408844 00000000 78746341 kernel32!BaseProcessStart+0x23
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: rdbss!RxIsThisACscAgentOpen+38
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: rdbss
IMAGE_NAME: rdbss.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b854b9b
STACK_COMMAND: .cxr 0xffffffffa3a2cbe8 ; kb
FAILURE_BUCKET_ID: 0x27_rdbss!RxIsThisACscAgentOpen+38
BUCKET_ID: 0x27_rdbss!RxIsThisACscAgentOpen+38
Followup: MachineOwner
---------
---------