Hi,
I've recently experienced problems with latest novell client on Windows 7 Pro 64bit. Users were working with Office and suddenly system crashed to black screen and restarted (Windows Event ID 0x3B). After readin dozens of forums I've successed a little and dig out some info from crash minidump (attached below). It seems that problem is in excel and nclp.sys. Has anyone here a similar problem?

Thanks for answers

Pavel Cisar


MINIDUMP:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\120110-20295-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Inaccessible path: 'c:\windows\i386'
Symbol search path is: srv*c:\symboly*Symbol information
Executable search path is: c:\windows\i386
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c4c000 PsLoadedModuleList = 0xfffff800`02e89e50
Debug session time: Wed Dec 1 16:16:58.954 2010 (UTC + 1:00)
System Uptime: 0 days 3:14:24.987
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
..................................................
Loading User Symbols
Loading unloaded module list
....
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88007f38ce1, fffff8800906a750, 0}

Unable to load image ncpl.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ncpl.sys
*** ERROR: Module load completed but symbols could not be loaded for ncpl.sys
Probably caused by : ncpl.sys ( ncpl+6ce1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88007f38ce1, Address of the instruction which caused the bugcheck
Arg3: fffff8800906a750, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukce na adrese 0x%08lx odkazovala na adresu pam

FAULTING_IP:
ncpl+6ce1
fffff880`07f38ce1 817a204c4f434b cmp dword ptr [rdx+20h],4B434F4Ch

CONTEXT: fffff8800906a750 -- (.cxr 0xfffff8800906a750)
rax=0000000000000000 rbx=fffffa800bb26308 rcx=fffffa800860f3f0
rdx=0000000000000001 rsi=0000000000000003 rdi=fffffa800bb26380
rip=fffff88007f38ce1 rsp=fffff8800906b120 rbp=0000000000000003
r8=fffff88007f3c160 r9=0000000000000000 r10=fffffffffffffffe
r11=fffff88008bdeab0 r12=0000000000018000 r13=0000000000000000
r14=0000000000000200 r15=fffff8800906b2d8
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
ncpl+0x6ce1:
fffff880`07f38ce1 817a204c4f434b cmp dword ptr [rdx+20h],4B434F4Ch ds:002b:00000000`00000021=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: EXCEL.EXE

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88007f38ce1

STACK_TEXT:
fffff880`0906b120 00000000`00000000 : fffffa80`0c1e29d0 00000000`00000000 fffffa80`0c1e2a28 00000000`00000000 : ncpl+0x6ce1


FOLLOWUP_IP:
ncpl+6ce1
fffff880`07f38ce1 817a204c4f434b cmp dword ptr [rdx+20h],4B434F4Ch

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ncpl+6ce1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ncpl

IMAGE_NAME: ncpl.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4b2b905c

STACK_COMMAND: .cxr 0xfffff8800906a750 ; kb

FAILURE_BUCKET_ID: X64_0x3B_ncpl+6ce1

BUCKET_ID: X64_0x3B_ncpl+6ce1

Followup: MachineOwner
---------