Crash dump

[Ola]

Can someone shed more lights on the dump below?

I can see that the ATI Rage Grafik in connection with one application called LUNAR from Dolphin on my server is the culprit here.

Any ideas will be appreciated


Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [U:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/downloads/symbols

Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Mon Oct 23 08:20:23.128 2006 (GMT+2)
System Uptime: 0 days 3:33:41.719
Loading Kernel Symbols
........................................................................................................................Unable to add module at bf9e6000
..Unable to add module at bfaf8000
.
Loading User Symbols
......................................................................................
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bfa9e22f, f6fae3e0, 0}

*** ERROR: Module load completed but symbols could not be loaded for vdtw30.DLL
Probably caused by : vdtw30.DLL ( vdtw30+1e22f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bfa9e22f, The address that the exception occurred at
Arg3: f6fae3e0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.

FAULTING_IP:
vdtw30+1e22f
bfa9e22f 8b4010 mov eax,[eax+0x10]

TRAP_FRAME: f6fae3e0 -- (.trap fffffffff6fae3e0)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000001 edx=bc0155b0 esi=bc134640 edi=00000004
eip=bfa9e22f esp=f6fae454 ebp=f6fae4b4 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
vdtw30+0x1e22f:
bfa9e22f 8b4010 mov eax,[eax+0x10] ds:0023:00000010=????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8085b4b3 to 8087b6be

STACK_TEXT:
f6fadfac 8085b4b3 0000008e c0000005 bfa9e22f nt!KeBugCheckEx+0x1b
f6fae370 808357a4 f6fae38c 00000000 f6fae3e0 nt!KiDispatchException+0x3a2
f6fae3d8 80835758 f6fae4b4 bfa9e22f badb0d00 nt!CommonDispatchException+0x4a
f6fae3fc bf90fa91 ff09ff09 bf90fa9a 00000000 nt!Kei386EoiHelper+0x186
f6fae4b4 f6fae4d4 bf86d535 00000000 01050040 win32k!vDIBPatBltSrccopy8x8+0x213
WARNING: Frame IP not in any known module. Following frames may be wrong.
f6fae4e8 bf86d83f bf86d589 bc0155a0 bf86d862 0xf6fae4d4
f6fae514 bf9e9889 bc01c5f8 bc0155b0 bc134640 win32k!HmgDecrementShareReferenceCount+0x29
f6fae574 bf895feb bc01c5f8 bc2684d8 bc134640 0xbf9e9889
f6fae60c bf915743 bc188c48 bc014008 bf9e9820 win32k!bGetRealizedBrush+0x698
f6fae624 bf9e964b bc01c5f8 f6fae698 bf9f5aaf win32k!BRUSHOBJ_pvGetRbrush+0x27
f6fae698 bf86f679 bc2684d8 bfa6aab4 00000000 0xbf9e964b
f6fae698 bf86f679 bc2684d8 bfa6aab4 00000000 win32k!GrePatBltLockedDC+0x1ea
f6fae6e8 bf875ea6 bc01c5f8 f6fae73c f6fae720 win32k!GrePatBltLockedDC+0x1ea
f6fae780 bf8760b4 f6fae7b0 0000f0f0 f6fae7f8 win32k!GrePolyPatBltInternal+0x17c
f6fae7b8 bf827ff5 03010046 00f00021 f6fae7f8 win32k!GrePolyPatBlt+0x44
f6fae820 bf827e93 00ffffff 00000000 00000408 win32k!DrawBox+0x187
f6fae8e0 bf825451 03010046 f6fae918 00000004 win32k!DrawFrameControl+0x1a4
f6fae930 bf813e42 0000000d 00000004 88492064 win32k!CreateBitmapStrip+0x24a
f6faeb38 bf82295a bc21eff0 00000000 00000001 win32k!xxxSetWindowNCMetrics+0x1da
f6faed44 bf8145c4 00000005 0006e414 f6faed64 win32k!xxxUpdatePerUserSystemParameters+0x461
f6faed54 80834d3f 00000000 00000005 0006e43c win32k!NtUserUpdatePerUserSystemParameters+0x13
f6faed54 7c94ed54 00000000 00000005 0006e43c nt!KiFastCallEntry+0xfc
0006e400 77e271c3 77e27442 00000000 00000005 ntdll!KiFastSystemCallRet
0006e43c 0103ebc0 00000000 00000005 00000004 USER32!NtUserUpdatePerUserSystemParameters+0xc
0006e718 0102dc9c 000003b8 00000025 00000001 winlogon!RDFilter_ApplyRemoteFilter+0x1fc
0006f884 01035764 0007b9b8 00000002 0007b9b8 winlogon!SetupUserEnvironment+0x254
0006fee4 01037120 0007b9b8 7c82ec9d 7c801f1e winlogon!LogonAttempt+0x7b2
0006ff08 010315f0 0007b9b8 ffffffff 00000004 winlogon!MainLoop+0x1dd
0006ff50 0103da9e 0007b9b8 00000000 000724fc winlogon!WUNotify+0x515
0006fff4 00000000 7ffda000 000000c8 00000126 winlogon!__report_gsfailure+0x26b


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
vdtw30+1e22f
bfa9e22f 8b4010 mov eax,[eax+0x10]

FAULTING_SOURCE_CODE:


FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: vdtw30+1e22f

MODULE_NAME: vdtw30

IMAGE_NAME: vdtw30.DLL

DEBUG_FLR_IMAGE_TIMESTAMP: 438c9e75

FAILURE_BUCKET_ID: 0x8E_vdtw30+1e22f

BUCKET_ID: 0x8E_vdtw30+1e22f

Followup: MachineOwner
---------

2: kd> kd
f6fadfac f6fae370
f6fadfb0 8085b4b3 nt!KiDispatchException+0x3a2
f6fadfb4 0000008e
f6fadfb8 c0000005
f6fadfbc bfa9e22f vdtw30+0x1e22f
f6fadfc0 f6fae3e0
f6fadfc4 00000000
f6fadfc8 00000010
f6fadfcc 00000010
f6fadfd0 f6fae3a0
f6fadfd4 00000000
f6fadfd8 00000000
f6fadfdc 00000600
f6fadfe0 00000f00
f6fadfe4 00000f00
f6fadfe8 00000600
f6fadfec 00000000
f6fadff0 00000000
f6fadff4 00000000
f6fadff8 00000000

[VDO]

Looks like Citrix video driver is involved: vdtw30.dll
What is the output of

!lmi vdtw30

You can search for hot fixes which include newer version of that driver on Citrix support or open the case with them.