Windows 8.1 RDP crashes very frequently after upgrade from Windows 8

Question

Hello,
I installed Windows 8.1 EE x64 as upgrade from Windows 8 EE x64 on my personal computer. After that RDP crashes very frequently.
Here is my errors from event viewer (I have Czech language so sorry for it)
Application Error (ID: 1000)
==================
General
Název chybující aplikace: mstsc.exe, verze: 6.3.9600.16384, časové razítko: 0x5215e2b5
Název chybujícího modulu: ntdll.dll, verze: 6.3.9600.16384, časové razítko: 0x5215f938
Kód výjimky: 0xc0000005
Posun chyby: 0x000000000002de46
ID chybujícího procesu: 0x1ef8
Čas spuštění chybující aplikace: 0x01ceb5de1d230682
Cesta k chybující aplikaci: C:\Windows\System32\mstsc.exe
Cesta k chybujícímu modulu: C:\WINDOWS\SYSTEM32\ntdll.dll
ID zprávy: 6e76e3a0-21d1-11e3-824d-005056c00008
Úplný název chybujícího balíčku: 
ID aplikace související s chybujícím balíčkem: 
Details
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Application Error" /> 
  <EventID Qualifiers="0">1000</EventID> 
  <Level>2</Level> 
  <Task>100</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2013-09-20T08:48:34.000000000Z" /> 
  <EventRecordID>36478</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>JIRKA-PC.sandster.local</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>mstsc.exe</Data> 
  <Data>6.3.9600.16384</Data> 
  <Data>5215e2b5</Data> 
  <Data>ntdll.dll</Data> 
  <Data>6.3.9600.16384</Data> 
  <Data>5215f938</Data> 
  <Data>c0000005</Data> 
  <Data>000000000002de46</Data> 
  <Data>1ef8</Data> 
  <Data>01ceb5de1d230682</Data> 
  <Data>C:\Windows\System32\mstsc.exe</Data> 
  <Data>C:\WINDOWS\SYSTEM32\ntdll.dll</Data> 
  <Data>6e76e3a0-21d1-11e3-824d-005056c00008</Data> 
  <Data /> 
  <Data /> 
  </EventData>
  </Event>
Windows Error Reporting (ID: 1001)
=======================
General
Chybný blok 127057472, typ 4
Název události: APPCRASH
Reakce: Není k dispozici.
ID souboru CAB: 0
Podpis problému:
P1: mstsc.exe
P2: 6.3.9600.16384
P3: 5215e2b5
P4: ntdll.dll
P5: 6.3.9600.16384
P6: 5215f938
P7: c0000005
P8: 000000000002de46
P9: 
P10: 
Připojené soubory:
C:\Users\Jirka.SANDSTER\AppData\Local\Temp\WER3B11.tmp.WERInternalMetadata.xml
C:\Users\Jirka.SANDSTER\AppData\Local\Temp\WER440B.tmp.appcompat.txt
Tyto soubory mohou být k dispozici zde:
C:\Users\Jirka.SANDSTER\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_mstsc.exe_b612095447011e21536732396929f9b226636_4012f314_1494441a
Symbol analýzy: 
Opětovné hledání řešení: 0
ID hlášení: 6e76e3a0-21d1-11e3-824d-005056c00008
Stav hlášení: 1
Zakódovaný interval: 9db086049b946847d22aeaa96b0e9f58
Details
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Windows Error Reporting" /> 
  <EventID Qualifiers="0">1001</EventID> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2013-09-20T08:48:37.000000000Z" /> 
  <EventRecordID>36479</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>JIRKA-PC.sandster.local</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>127057472</Data> 
  <Data>4</Data> 
  <Data>APPCRASH</Data> 
  <Data>Není k dispozici.</Data> 
  <Data>0</Data> 
  <Data>mstsc.exe</Data> 
  <Data>6.3.9600.16384</Data> 
  <Data>5215e2b5</Data> 
  <Data>ntdll.dll</Data> 
  <Data>6.3.9600.16384</Data> 
  <Data>5215f938</Data> 
  <Data>c0000005</Data> 
  <Data>000000000002de46</Data> 
  <Data /> 
  <Data /> 
  <Data>C:\Users\Jirka.SANDSTER\AppData\Local\Temp\WER3B11.tmp.WERInternalMetadata.xml C:\Users\Jirka.SANDSTER\AppData\Local\Temp\WER440B.tmp.appcompat.txt</Data> 
  <Data>C:\Users\Jirka.SANDSTER\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_mstsc.exe_b612095447011e21536732396929f9b226636_4012f314_1494441a</Data> 
  <Data /> 
  <Data>0</Data> 
  <Data>6e76e3a0-21d1-11e3-824d-005056c00008</Data> 
  <Data>1</Data> 
  <Data>9db086049b946847d22aeaa96b0e9f58</Data> 
  </EventData>
  </Event>
Could you help me please?
Thanks

Answer 1

Hi Jiří,
looks like a bad Audio codec (bdmpega64.acm) causes the crash:
* Exception Analysis *
*** WARNING: Unable to verify timestamp for bdmpega64.acm
*** ERROR: Module load completed but symbols could not be loaded for bdmpega64.acm
APPLICATION_VERIFIER_HEAPS_CORRUPTED_HEAP_BLOCK_EXCEPTION_RAISED_FOR_PROBING (c)
Exception raised while verifying the heap block.
This situation happens if we really cannot determine any particular
type of corruption for the block. For instance you will get this if
during a heap free operation you pass an address that points to a
non-accessible memory area.
This can also happen for double free situations if we do not find the
block among full page heap blocks and we probe it as a light page heap block.
Arguments:
Arg1: 000000aa6c971000, Heap handle used in the call.
Arg2: 000000005d0b4440, Heap block involved in the operation.
Arg3: 0000000000000000, Size of the heap block.
Arg4: 00000000c0000005, Reserved.
FAULTING_IP:
verifier!VerifierStopMessage+28a
00007ffd`f922a43a cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00007ffdf922a43a (verifier!VerifierStopMessage+0x000000000000028a)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=000000aa5cfc0000 rbx=0000000000000000 rcx=000000aa5cfc0000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffe08bc808a rsp=000000aa5e83cb08 rbp=000000aa5e83d950
r8=0000000000001000 r9=0000000000000000 r10=0000000000000040
r11=0000000000000286 r12=0000000000000000 r13=0000000000000000
r14=000000aa5cfb0000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000203
ntdll!NtWaitForMultipleObjects+0xa:
00007ffe`08bc808a c3 ret
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: mstsc.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: mstsc.exe
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
FAULTING_THREAD: 0000000000001630
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 00007ffdf92292e4 to 00007ffdf922a43a
STACK_TEXT:
ntdll!NtWaitForMultipleObjects
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
verifier!AVrfpDphReportCorruptedBlock
verifier!AVrfpDphCheckNormalHeapBlock$filt$0
ntdll!_C_specific_handler
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!AVrfpDphFindBusyMemoryNoCheck
verifier!AVrfpDphFindBusyMemory
verifier!VerifierCheckPageHeapAllocation
verifier!AVrfpHeapFree
bdmpega64
0x0
0x0
0x0
IMAGE_NAME: bdmpega64.acm
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_bdmpega64.acm!Unknown
Loaded symbol image file: bdmpega64.acm
Image path: C:\Windows\System32\bdmpega64.acm
Image name: bdmpega64.acm
Timestamp: Thu Aug 09 09:40:14 2012
From what I can see the file bdmpega64.acm belongs to a tool called http://www.bandicam.com
Update the tool to the latest version 1.9.0.397:
http://www.bandicam.com/downloads/
If this doesn't fix it, remove it or disable Audio in the RDP options.
"A programmer is just a tool which converts caffeine into code"