Salamander crashes Vista with BSOD, Dell laptop

[pganelin]

The problem described below was extensively discussed with Altap technical support (Jan Rysavy) and Jan proposed to post to this forum. May be Windows gurus can help me.

Here is the scenario to force BSOD with Salamander:

1. Open a few text viewer windows (using Alt-F3)
2. Cycle between them using Alt Tab
3. Start closing viewer windows using Alt-F4.

Sometimes after step 3 Windows freezes for a few seconds, LCD displays garbage and then Vista crashes with BSOD (see stack below)
This is not a hardware failure!!! I spent a few weeks with Dell replacing all parts. Finally Dell replaced one laptop (Dell 1720) with a different model (Dell XPS) and I still have the same issue. Dell checked for malware and did not find anything. I installed the latest version of Kasperky and also did not find anything. Vista and Salamander are out of the box. I usually do not change default options. For Salamander I only increased font size.

Crash dump is below.

I also attached list of all autorun entries as reported by sysinternals autorunsc


I searched the web looking for "xxxSendMenuDrawItemMessage" and found only one reference, describing almost the same crash with a different program.

http://social.msdn.microsoft.com/Forums ... 657abdede1

Jan suggested that Dell installs some drivers which can cause the problem.

Any help would be greatly appreciated.

Crash Dump:

Code: Select all

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Minidump\Mini112309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\CACHE\localsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\Windows\system32
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18304.x86fre.vistasp1_gdr.090805-0102
Machine Name:
Kernel base = 0x81e1e000 PsLoadedModuleList = 0x81f35c70
Debug session time: Mon Nov 23 04:20:08.155 2009 (GMT-5)
System Uptime: 1 days 8:59:46.350
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 9dda4d0f, daf50ae8, 0}

Probably caused by : win32k.sys ( win32k!xxxSendMenuDrawItemMessage+d3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9dda4d0f, The address that the exception occurred at
Arg3: daf50ae8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!xxxSendMenuDrawItemMessage+d3
9dda4d0f ff4604          inc     dword ptr [esi+4]

TRAP_FRAME:  daf50ae8 -- (.trap 0xffffffffdaf50ae8)
ErrCode = 00000002
eax=daf50b70 ebx=00000000 ecx=daf50be4 edx=daf50bac esi=00000000 edi=fe8710d0
eip=9dda4d0f esp=daf50b5c ebp=daf50bf0 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
win32k!xxxSendMenuDrawItemMessage+0xd3:
9dda4d0f ff4604          inc     dword ptr [esi+4]    ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  salamand.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 9dda4714 to 9dda4d0f

STACK_TEXT:  
daf50bf0 9dda4714 d801192f 00000001 00000001 win32k!xxxSendMenuDrawItemMessage+0xd3
daf50c5c 9dda5861 d801192f fe8710d0 00000001 win32k!xxxDrawMenuItem+0x131
daf50cc8 9dda392f d801192f 00000000 00000000 win32k!xxxMenuDraw+0x1f2
daf50cf4 9dda3e8f fe899578 d801192f 00000009 win32k!xxxPaintMenuBar+0xdf
daf50d24 81e75a1a 000608cc d801192f 00000009 win32k!NtUserPaintMenuBar+0x73
daf50d24 77c39a94 000608cc d801192f 00000009 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
09d9c984 00000000 00000000 00000000 00000000 0x77c39a94


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!xxxSendMenuDrawItemMessage+d3
9dda4d0f ff4604          inc     dword ptr [esi+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!xxxSendMenuDrawItemMessage+d3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a856c3f

FAILURE_BUCKET_ID:  0x8E_win32k!xxxSendMenuDrawItemMessage+d3

BUCKET_ID:  0x8E_win32k!xxxSendMenuDrawItemMessage+d3

Followup: MachineOwner
---------

[Ether]

Jan suggested that Dell installs some drivers which can cause the problem.

I couldn't find any hints in the files you attached, but from my experience BSOD can be caused by bugs in only three things: hardware, drivers or the kernel. Since hardware failure has been excluded and a fair amount of people use the same Windows kernel without any problems, we should blame drivers.

Try running the DriverView utility from NirSoft and look for any Dell or other non-Microsoft entries.

[therube]

Are the earlier discussions available somewhere?

If you boot in Safe Mode, does the problem repeat itself?

I assume you only see the problem on the specific Dell machines, not elsewhere?

Have you checked Dell for updated drivers?

Not sure how you got your "autorun" report, but maybe Sysinternals Autoruns might point something out.

[manison]

Also try to identify the faulting driver with the Driver Verifier (installs as a part of the Windows, just run verifier.exe from the command line, select non-Microsoft drivers and reboot).

[Jan Rysavy]

Are the earlier discussion available somewhere?

Remaining (not mentioned) facts from our conversation:

1. It is not hardware related. My laptop (DELL 1730, NVidia driver) was replaced with Dell XPS (ATT vide driver) two months ago and I still have the same issue. I reinstalled OS mutliple times. It did not help. So we may rule out bad memory, bug in OEM video driver or corrupted windows installation.
2. Today another person reported the same issue when he upgraded from Altap 2.51 to the latest version Altap 2.52.

Also http://www.memtest86.com/ passed on first notebook.

[pganelin]

I attached output from DriverView. BYNET is from Teradata Database. Kasperovsky was installed a few days ago to help resolve the crashes. The rest came from Dell default install

[Jan Patera]

I assume you only see the problem on the specific Dell machines, not elsewhere?
Have you checked Dell for updated drivers?

I also had a problem with a Dell machine (poor performance of OpenGL code). Exhaustive search for an updated driver on Dell's website solved the problem. IIRC it was not straightforward to find the right (=latest) driver.
I would also blame a (Dell) driver for this problem...

[Ether]

I attached output from DriverView.

I see a lot of custom drivers, the worst being Macrovision's secdrv.sys, or maybe some hardware drivers customized by Dell. Any of those could cause the problem. Did you install the drivers from the hardware vendors or from Dell?

Ultimately, you should try booting in Safe Mode and see if it helps, then probably deactivate as many drivers as possible and boot normally, see if it still shows BSOD's. Then enable the drivers one by one and see which one causes the problem. You need a very reliable way to reproduce the issue for this to work, of course.

[Jan Rysavy]

Then enable the drivers one by one and see which one causes the problem.

Is there easier way how to disable driver than uninstall it?

[therube]

Obviously Safe Mode is a good place to start to look.

After that, when I came across Problem: Delayed View and Delete Operations, I used Autoruns to disable "things". Makes it easy to disable stuff "by area". So if you disable all the "junk" from Logon & the problem continues, you can start exploring other areas, like maybe Services. You do not want to wholesale disable stuff lest you leave yourself in a bad position.

Note that there are certain things that you do NOT want to disable, userinit.exe I believe is one in particular.

(There was no ctfmon.exe in pganelin's autorun report, but there was a msctfmonitor.dll. Don't know what that is, or if it is related?)

Also note:

BTW, instead of rebooting (which I've now done thousands of times ) between each unselection, it is easier to Logout & then log back in.

[SelfMan]

Boot with VGA enabled Mode. In the boot menu choose VGA mode (not safe mode).
This way windows boots only with basic VGA drivers. With them you can do the test.
I am quite positive, that the problem lies within the ATI Graphics card drivers.

There are many post on atikmdag related BSODs. Just google "atikmdag" and you'll see.
Check for a newer version of the drivers.

The only problem I am having now is that I don't know which Dell 1720 you have. Neither Vostro nor Inspiron series do have ATI GFx. Both are either Intel or NVidia based. That driver list confuses me.


And one more thing... before you proceed, install the Vista SP2 < hint: click

[Ether]

I am quite positive, that the problem lies within the ATI Graphics card drivers.

Well, since the system BSOD'd within a graphic routine (xxxSendMenuDrawItemMessage), I thought the graphics driver was responsible, too, but I kind of hoped that ATi hadn't bugs in their drivers, moreover they surely (?) have WHQL certification.

[Jan Rysavy]

Note: both nVidia and ATi notebooks crashed, see http://forum.altap.cz/viewtopic.php?p=17818#p17818

pganelin, it would be interesting to know some datails about another person with this problem. Is it Dell notebook too?

[SelfMan]

Then I would suggest to install the service pack and see then...

[pganelin]

Additional info:

1. Another person who experienced the crash also has Dell 1720. I looked at his core dump. It is exactly the same crash with the same dump.

2. I run verifier.exe and put all non Microsoft drivers under verifier. For three days it was running OK (better then usual crash once a day) and then it crashed again. But this time it behaved differently after crash. The computer freezes, the LCD displays some garbage but there is NO BSOD after a few seconds the way it was before. The laptop just freezes with the fan spinning as crazy (indicating CPU was 100% busy). I waited for a minute and then I rebooted the computer by power cyclicng. After reboot there were no memory dump or any indication of crash.

3. All service packs are installed. The computer is up to date with Microsoft updates.