PROCESS_HAS_LOCKED_PAGES (76)
DRIVER_FAULT_0x76
tcpip!TcpCleanupEndpointWorkQueueRoutine
X64_0x76_MoHMPGame.exe_tcpip!
X64_0x76_fifa.exe_nt!
The PROCESS_HAS_LOCKED_PAGES bug check has a value of 0x00000076. This bug check indicates that a driver failed to release locked pages after an I/O operation, or that it attempted to unlock pages that were already unlocked.
1. Uninstall Kaspersky, MSE is enough:
klif.sys Wed Nov 11 15:32:16 2009
MpFilter.sys Sat Mar 20 07:58:08 2010
Removal tool for Kaspersky Lab products
* Later if you want to switch back to Kaspersky, make sure to get the latest (2010) version of it. Use only 1 AV brand, do not mix them. For now use MSE, it never causes blue screens.
2. Update:
hamachi.sys Thu Feb 19 12:36:41 2009
HAMACHI
ElbyCDIO.sys Fri Dec 18 00:25:16 2009
VClone.sys Mon Aug 10 00:25:45 2009
VirtualCloneCD Elaborate Bytes AG
JmtFltr.sys Fri Sep 28 20:04:57 2007
Some device, have no idea what it is, but you must update as it's too old for 7
Kone.sys Thu Dec 11 08:56:52 2008
ROCCAT Kone Gaming Mouse
Rt64win7.sys Thu Feb 26 11:04:13 2009
Realtek 8136/8168/8169
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\100610-18734-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c4ce50
Debug session time: Wed Oct 6 05:48:19.254 2010 (GMT-5)
System Uptime: 1 days 7:41:29.051
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 76, {0, fffffa800bd39060, 4, 0}
Probably caused by : tcpip.sys ( tcpip!TcpCleanupEndpointWorkQueueRoutine+152 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa800bd39060, Process address.
Arg3: 0000000000000004, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: MoHMPGame.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d21c25 to fffff80002a7f740
STACK_TEXT:
fffff880`031cb928 fffff800`02d21c25 : 00000000`00000076 00000000`00000000 fffffa80`0bd39060 00000000`00000004 : nt!KeBugCheckEx
fffff880`031cb930 fffff800`02d3cd27 : fffffa80`0bd39060 00000000`00000008 fffffa80`00000000 fffffa80`00000001 : nt! ?? ::NNGAKEGL::`string'+0x18126
fffff880`031cb970 fffff800`02a848b4 : 00000000`00000000 00000000`00000000 fffffa80`0bd39030 fffffa80`069a0de0 : nt!PspProcessDelete+0x177
fffff880`031cb9d0 fffff880`0166bc12 : 00000000`00000000 fffffa80`07e4c010 fffffa80`078a2000 fffffa80`09eab1e0 : nt!ObfDereferenceObject+0xd4
fffff880`031cba30 fffff880`0166b885 : fffff880`031cbba0 fffffa80`0b6a4a50 00000000`0000afd1 fffffa80`0b6a4a50 : tcpip!TcpCleanupEndpointWorkQueueRoutine+0x152
fffff880`031cbad0 fffff880`0166b8d9 : 00000000`0000afd2 fffffa80`0b6a4930 00000000`0000afd1 00000000`0000afd1 : tcpip!TcpCloseEndpoint+0x95
fffff880`031cbb40 fffff880`02d016c3 : 00000000`0000afd4 fffffa80`0b6a4a50 00000000`58646641 00000000`000006b1 : tcpip!TcpTlEndpointCloseEndpoint+0x9
fffff880`031cbb70 fffff880`02d0be41 : fffffa80`0b6a4a50 fffff880`02d067f0 fffff880`02cf5c90 fffff880`02d0be20 : afd! ?? ::NNGAKEGL::`string'+0x13ac
fffff880`031cbc20 fffff880`02cd1ff7 : fffffa80`0b6a4a50 fffffa80`0b6a4a50 fffff880`02d067f0 fffff880`02cf5c90 : afd!AfdFreeEndpointTditl+0x21
fffff880`031cbc50 fffff800`02d7bc43 : fffffa80`07f23950 fffffa80`07e06c50 fffff800`02c245f8 fffffa80`06a31b60 : afd!AfdDoWork+0x67
fffff880`031cbc80 fffff800`02a8c961 : fffff800`02c24500 fffff800`02d7bc20 fffffa80`06a31b60 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`031cbcb0 fffff800`02d23c06 : 00000000`00000000 fffffa80`06a31b60 00000000`00000080 fffffa80`06a20040 : nt!ExpWorkerThread+0x111
fffff880`031cbd40 fffff800`02a5dc26 : fffff880`02f64180 fffffa80`06a31b60 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031cbd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!TcpCleanupEndpointWorkQueueRoutine+152
fffff880`0166bc12 4c8b5f50 mov r11,qword ptr [rdi+50h]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: tcpip!TcpCleanupEndpointWorkQueueRoutine+152
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c15a458
FAILURE_BUCKET_ID: X64_0x76_MoHMPGame.exe_tcpip!TcpCleanupEndpointWorkQueueRoutine+152
BUCKET_ID: X64_0x76_MoHMPGame.exe_tcpip!TcpCleanupEndpointWorkQueueRoutine+152
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\100410-13234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a0a000 PsLoadedModuleList = 0xfffff800`02c47e50
Debug session time: Mon Oct 4 22:06:09.455 2010 (GMT-5)
System Uptime: 0 days 0:15:15.173
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 76, {0, fffffa80070f3060, 3, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+18126 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa80070f3060, Process address.
Arg3: 0000000000000003, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: MoHMPGame.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d1cc25 to fffff80002a7a740
STACK_TEXT:
fffff880`0aed4a38 fffff800`02d1cc25 : 00000000`00000076 00000000`00000000 fffffa80`070f3060 00000000`00000003 : nt!KeBugCheckEx
fffff880`0aed4a40 fffff800`02d37d27 : fffffa80`070f3060 00000000`00000008 fffffa80`00000000 fffffa80`00000002 : nt! ?? ::NNGAKEGL::`string'+0x18126
fffff880`0aed4a80 fffff800`02a7f8b4 : 00000000`00000000 fffffa80`070f3060 fffffa80`070f3030 fffff800`02e07e25 : nt!PspProcessDelete+0x177
fffff880`0aed4ae0 fffff800`02b804b9 : fffffa80`070f3060 fffffa80`07742000 fffffa80`07742ff0 fffffa80`07742fe8 : nt!ObfDereferenceObject+0xd4
fffff880`0aed4b40 fffff800`02ecb6ae : fffffa80`00000328 fffffa80`07761000 fffffa80`070f3060 fffffa80`07742ff0 : nt!MmFreeAccessPfnBuffer+0x29
fffff880`0aed4b70 fffff800`02eeccd0 : fffffa80`0ae72601 00000000`00000080 fffffa80`06a1e040 fffff800`02c08568 : nt!PfpFlushBuffers+0x23e
fffff880`0aed4c10 fffff800`02d1ec06 : ffffffff`ff676980 fffffa80`0ae726f0 fffff880`0aed4db0 fffffa80`0ae726f0 : nt!PfTLoggingWorker+0xe0
fffff880`0aed4d40 fffff800`02a58c26 : fffff880`02fd5180 fffffa80`0ae726f0 fffff880`02fdffc0 fffff880`01249a90 : nt!PspSystemThreadStartup+0x5a
fffff880`0aed4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+18126
fffff800`02d1cc25 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+18126
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x76_MoHMPGame.exe_nt!_??_::NNGAKEGL::_string_+18126
BUCKET_ID: X64_0x76_MoHMPGame.exe_nt!_??_::NNGAKEGL::_string_+18126
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\101310-20500-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a02000 PsLoadedModuleList = 0xfffff800`02c3fe50
Debug session time: Wed Oct 13 17:28:23.194 2010 (GMT-5)
System Uptime: 0 days 23:17:04.975
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 76, {0, fffffa800da66950, 6, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+18126 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa800da66950, Process address.
Arg3: 0000000000000006, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: fifa.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d14c25 to fffff80002a72740
STACK_TEXT:
fffff880`0e9b8a38 fffff800`02d14c25 : 00000000`00000076 00000000`00000000 fffffa80`0da66950 00000000`00000006 : nt!KeBugCheckEx
fffff880`0e9b8a40 fffff800`02d2fd27 : fffffa80`0da66950 00000000`00000008 fffffa80`00000000 fffffa80`00000000 : nt! ?? ::NNGAKEGL::`string'+0x18126
fffff880`0e9b8a80 fffff800`02a778b4 : 00000000`00000000 fffffa80`0c78b730 fffffa80`0da66920 fffff880`0e9b8bc0 : nt!PspProcessDelete+0x177
fffff880`0e9b8ae0 fffff800`02d88514 : fffffa80`0c78b730 00000000`00000000 fffffa80`0ac37b60 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`0e9b8b40 fffff800`02d88414 : 00000000`00000810 fffffa80`0c78b730 fffff8a0`00a42470 00000000`00000810 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`0e9b8bd0 fffff800`02a71993 : fffffa80`0ac37b60 fffff880`0e9b8ca0 00000000`7efad000 fffffa80`0d2aede0 : nt!ObpCloseHandle+0x94
fffff880`0e9b8c20 00000000`777cfe4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0092e0e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777cfe4a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+18126
fffff800`02d14c25 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+18126
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x76_fifa.exe_nt!_??_::NNGAKEGL::_string_+18126
BUCKET_ID: X64_0x76_fifa.exe_nt!_??_::NNGAKEGL::_string_+18126
start end module name
fffff800`00b97000 fffff800`00ba1000 kdcom kdcom.dll Tue Jul 14 04:31:07 2009 (4A5BDFDB)
fffff800`02a02000 fffff800`02fde000 nt ntkrnlmp.exe Sat Jun 19 07:16:41 2010 (4C1C44A9)
fffff800`02fde000 fffff800`03027000 hal hal.dll Tue Jul 14 04:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00c5c000 volmgrx volmgrx.sys Tue Jul 14 02:20:33 2009 (4A5BC141)
fffff880`00c5c000 fffff880`00c63000 pciide pciide.sys Tue Jul 14 02:19:49 2009 (4A5BC115)
fffff880`00c63000 fffff880`00c73000 PCIIDEX PCIIDEX.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`00c73000 fffff880`00c8d000 mountmgr mountmgr.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00c8d000 fffff880`00c96000 atapi atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`00cb7000 fffff880`00cfb000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 04:29:10 2009 (4A5BDF66)
fffff880`00cfb000 fffff880`00d0f000 PSHED PSHED.dll Tue Jul 14 04:32:23 2009 (4A5BE027)
fffff880`00d0f000 fffff880`00d6d000 CLFS CLFS.SYS Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00d6d000 fffff880`00da0000 pci pci.sys Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00da0000 fffff880`00db5000 volmgr volmgr.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00db5000 fffff880`00ddf000 ataport ataport.SYS Tue Jul 14 02:19:52 2009 (4A5BC118)
fffff880`00ddf000 fffff880`00dea000 amdxata amdxata.sys Tue May 19 20:56:59 2009 (4A12F2EB)
fffff880`00dea000 fffff880`00e00000 disk disk.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00e00000 fffff880`00e15000 partmgr partmgr.sys Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00e16000 fffff880`00ed6000 CI CI.dll Tue Jul 14 04:32:13 2009 (4A5BE01D)
fffff880`00ed6000 fffff880`00f7a000 Wdf01000 Wdf01000.sys Tue Jul 14 02:22:07 2009 (4A5BC19F)
fffff880`00f7a000 fffff880`00f89000 WDFLDR WDFLDR.SYS Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00f89000 fffff880`00fe0000 ACPI ACPI.sys Tue Jul 14 02:19:34 2009 (4A5BC106)
fffff880`00fe0000 fffff880`00fe9000 WMILIB WMILIB.SYS Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00fe9000 fffff880`00ff3000 msisadrv msisadrv.sys Tue Jul 14 02:19:26 2009 (4A5BC0FE)
fffff880`00ff3000 fffff880`01000000 vdrvroot vdrvroot.sys Tue Jul 14 03:01:31 2009 (4A5BCADB)
fffff880`01000000 fffff880`0103a000 fvevol fvevol.sys Sat Sep 26 05:34:26 2009 (4ABD7DB2)
fffff880`0103a000 fffff880`01086000 fltmgr fltmgr.sys Tue Jul 14 02:19:59 2009 (4A5BC11F)
fffff880`01086000 fffff880`0109a000 fileinfo fileinfo.sys Tue Jul 14 02:34:25 2009 (4A5BC481)
fffff880`0109a000 fffff880`010f8000 msrpc msrpc.sys Tue Jul 14 02:21:32 2009 (4A5BC17C)
fffff880`010f8000 fffff880`0116b000 cng cng.sys Tue Jul 14 02:49:40 2009 (4A5BC814)
fffff880`0116b000 fffff880`011b7000 volsnap volsnap.sys Tue Jul 14 02:20:08 2009 (4A5BC128)
fffff880`011b7000 fffff880`011f1000 rdyboost rdyboost.sys Tue Jul 14 02:34:34 2009 (4A5BC48A)
fffff880`01200000 fffff880`01211000 pcw pcw.sys Tue Jul 14 02:19:27 2009 (4A5BC0FF)
fffff880`01211000 fffff880`0121b000 Fs_Rec Fs_Rec.sys Tue Jul 14 02:19:45 2009 (4A5BC111)
fffff880`0121b000 fffff880`01229000 klbg klbg.sys Wed Oct 14 20:18:13 2009 (4AD607D5)
fffff880`0123c000 fffff880`013df000 Ntfs Ntfs.sys Tue Jul 14 02:20:47 2009 (4A5BC14F)
fffff880`013df000 fffff880`013f9000 ksecdd ksecdd.sys Tue Jul 14 02:20:54 2009 (4A5BC156)
fffff880`01400000 fffff880`01409000 hwpolicy hwpolicy.sys Tue Jul 14 02:19:22 2009 (4A5BC0FA)
fffff880`0140d000 fffff880`014ff000 ndis ndis.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`014ff000 fffff880`0155f000 NETIO NETIO.SYS Tue Jul 14 02:21:46 2009 (4A5BC18A)
fffff880`0155f000 fffff880`0158a000 ksecpkg ksecpkg.sys Fri Dec 11 08:03:32 2009 (4B21E0B4)
fffff880`0158a000 fffff880`015d4000 fwpkclnt fwpkclnt.sys Tue Jul 14 02:21:08 2009 (4A5BC164)
fffff880`015d4000 fffff880`015e4000 vmstorfl vmstorfl.sys Tue Jul 14 02:42:54 2009 (4A5BC67E)
fffff880`015e4000 fffff880`015ec000 spldr spldr.sys Mon May 11 19:56:27 2009 (4A0858BB)
fffff880`015ec000 fffff880`015fe000 mup mup.sys Tue Jul 14 02:23:45 2009 (4A5BC201)
fffff880`01600000 fffff880`017fd000 tcpip tcpip.sys Mon Jun 14 06:39:04 2010 (4C15A458)
fffff880`01800000 fffff880`0181e000 tdx tdx.sys Tue Jul 14 02:21:15 2009 (4A5BC16B)
fffff880`0181e000 fffff880`0182b000 TDI TDI.SYS Tue Jul 14 02:21:18 2009 (4A5BC16E)
fffff880`01856000 fffff880`01886000 CLASSPNP CLASSPNP.SYS Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`018bc000 fffff880`018e6000 cdrom cdrom.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`018e6000 fffff880`01913000 MpFilter MpFilter.sys Sat Mar 20 07:58:08 2010 (4BA463F0)
fffff880`01913000 fffff880`01970000 klif klif.sys Wed Nov 11 15:32:16 2009 (4AFABCE0)
fffff880`01970000 fffff880`01979000 Null Null.SYS Tue Jul 14 02:19:37 2009 (4A5BC109)
fffff880`01979000 fffff880`01980000 Beep Beep.SYS Tue Jul 14 03:00:13 2009 (4A5BCA8D)
fffff880`01980000 fffff880`0198e000 vga vga.sys Tue Jul 14 02:38:47 2009 (4A5BC587)
fffff880`0198e000 fffff880`019b3000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:38:51 2009 (4A5BC58B)
fffff880`019b3000 fffff880`019c3000 watchdog watchdog.sys Tue Jul 14 02:37:35 2009 (4A5BC53F)
fffff880`019c3000 fffff880`019cc000 RDPCDD RDPCDD.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`019cc000 fffff880`019d5000 rdpencdd rdpencdd.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`019d5000 fffff880`019de000 rdprefmp rdprefmp.sys Tue Jul 14 03:16:35 2009 (4A5BCE63)
fffff880`019de000 fffff880`019e9000 Msfs Msfs.SYS Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`019e9000 fffff880`019fa000 Npfs Npfs.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`02c00000 fffff880`02c51000 rdbss rdbss.sys Tue Jul 14 02:24:09 2009 (4A5BC219)
fffff880`02c51000 fffff880`02c5d000 nsiproxy nsiproxy.sys Tue Jul 14 02:21:02 2009 (4A5BC15E)
fffff880`02c5d000 fffff880`02c68000 mssmbios mssmbios.sys Tue Jul 14 02:31:10 2009 (4A5BC3BE)
fffff880`02c68000 fffff880`02c77000 discache discache.sys Tue Jul 14 02:37:18 2009 (4A5BC52E)
fffff880`02c77000 fffff880`02cd1000 usbhub usbhub.sys Tue Jul 14 03:07:09 2009 (4A5BCC2D)
fffff880`02cd1000 fffff880`02ce6000 NDProxy NDProxy.SYS Tue Jul 14 03:10:05 2009 (4A5BCCDD)
fffff880`02cec000 fffff880`02d31000 netbt netbt.sys Tue Jul 14 02:21:28 2009 (4A5BC178)
fffff880`02d31000 fffff880`02d3c000 ws2ifsl ws2ifsl.sys Tue Jul 14 03:10:33 2009 (4A5BCCF9)
fffff880`02d3c000 fffff880`02d45000 wfplwf wfplwf.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02d45000 fffff880`02d6b000 pacer pacer.sys Tue Jul 14 03:09:41 2009 (4A5BCCC5)
fffff880`02d6b000 fffff880`02d75000 klim6 klim6.sys Mon Sep 14 13:46:26 2009 (4AAE1F02)
fffff880`02d75000 fffff880`02d84000 netbios netbios.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02d84000 fffff880`02d9f000 wanarp wanarp.sys Tue Jul 14 03:10:21 2009 (4A5BCCED)
fffff880`02d9f000 fffff880`02db3000 termdd termdd.sys Tue Jul 14 03:16:36 2009 (4A5BCE64)
fffff880`04000000 fffff880`0408a000 afd afd.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`04095000 fffff880`045be000 kl1 kl1.sys Tue Sep 01 14:29:21 2009 (4A9D0591)
fffff880`04800000 fffff880`0480f000 mouclass mouclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`0480f000 fffff880`04821000 umbus umbus.sys Tue Jul 14 03:06:56 2009 (4A5BCC20)
fffff880`04821000 fffff880`0482b000 Edge7x64 Edge7x64.sys Mon May 03 23:31:28 2010 (4BDF32A0)
fffff880`0482b000 fffff880`04836000 flpydisk flpydisk.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`04840000 fffff880`048c3000 csc csc.sys Tue Jul 14 02:24:26 2009 (4A5BC22A)
fffff880`048c3000 fffff880`048e1000 dfsc dfsc.sys Tue Jul 14 02:23:44 2009 (4A5BC200)
fffff880`048e1000 fffff880`048f2000 blbdrive blbdrive.sys Tue Jul 14 02:35:59 2009 (4A5BC4DF)
fffff880`048f2000 fffff880`04918000 tunnel tunnel.sys Tue Jul 14 03:09:37 2009 (4A5BCCC1)
fffff880`04918000 fffff880`0492e000 intelppm intelppm.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
fffff880`0492e000 fffff880`04952000 rasl2tp rasl2tp.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04952000 fffff880`04981000 ndiswan ndiswan.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04981000 fffff880`0499c000 raspppoe raspppoe.sys Tue Jul 14 03:10:17 2009 (4A5BCCE9)
fffff880`0499c000 fffff880`049bd000 raspptp raspptp.sys Tue Jul 14 03:10:18 2009 (4A5BCCEA)
fffff880`049bd000 fffff880`049d7000 rassstp rassstp.sys Tue Jul 14 03:10:25 2009 (4A5BCCF1)
fffff880`049d7000 fffff880`049eb380 pcouffin pcouffin.sys Tue Dec 05 16:39:30 2006 (457584A2)
fffff880`049ec000 fffff880`049f7000 rdpbus rdpbus.sys Tue Jul 14 03:17:46 2009 (4A5BCEAA)
fffff880`04a00000 fffff880`04a56000 USBPORT USBPORT.SYS Tue Jul 14 03:06:31 2009 (4A5BCC07)
fffff880`04a56000 fffff880`04a67000 usbehci usbehci.sys Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`04a6d000 fffff880`04b61000 dxgkrnl dxgkrnl.sys Fri Oct 02 04:00:14 2009 (4AC5509E)
fffff880`04b61000 fffff880`04ba7000 dxgmms1 dxgmms1.sys Tue Jul 14 02:38:32 2009 (4A5BC578)
fffff880`04ba7000 fffff880`04bb4000 usbuhci usbuhci.sys Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`04bb4000 fffff880`04bd8000 HDAudBus HDAudBus.sys Tue Jul 14 03:06:13 2009 (4A5BCBF5)
fffff880`04bd8000 fffff880`04c00000 Xeno7x64 Xeno7x64.sys Mon May 03 23:31:29 2010 (4BDF32A1)
fffff880`04e00000 fffff880`04e22000 drmk drmk.sys Tue Jul 14 04:01:25 2009 (4A5BD8E5)
fffff880`04e22000 fffff880`04e27200 ksthunk ksthunk.sys Tue Jul 14 03:00:19 2009 (4A5BCA93)
fffff880`04e28000 fffff880`04e35000 fdc fdc.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`04e35000 fffff880`04e36480 swenum swenum.sys Tue Jul 14 03:00:18 2009 (4A5BCA92)
fffff880`04e3b000 fffff880`05000000 cmudaxp cmudaxp.sys Wed Apr 07 10:08:42 2010 (4BBC2F7A)
fffff880`0762e000 fffff880`0764b000 cdfs cdfs.sys Tue Jul 14 02:19:46 2009 (4A5BC112)
fffff880`0764b000 fffff880`07659000 crashdmp crashdmp.sys Tue Jul 14 03:01:01 2009 (4A5BCABD)
fffff880`07659000 fffff880`07665000 dump_dumpata dump_dumpata.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`07665000 fffff880`0766e000 dump_atapi dump_atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`0766e000 fffff880`07681000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
fffff880`07681000 fffff880`076a4000 luafv luafv.sys Tue Jul 14 02:26:13 2009 (4A5BC295)
fffff880`076a4000 fffff880`076c5000 WudfPf WudfPf.sys Tue Jul 14 03:05:37 2009 (4A5BCBD1)
fffff880`076c5000 fffff880`076da000 lltdio lltdio.sys Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`076da000 fffff880`076f2000 rspndr rspndr.sys Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`076fb000 fffff880`07757000 HdAudio HdAudio.sys Tue Jul 14 03:06:59 2009 (4A5BCC23)
fffff880`07757000 fffff880`07763000 Dxapi Dxapi.sys Tue Jul 14 02:38:28 2009 (4A5BC574)
fffff880`07763000 fffff880`07780000 usbccgp usbccgp.sys Tue Jul 14 03:06:45 2009 (4A5BCC15)
fffff880`07780000 fffff880`07781f00 USBD USBD.SYS Tue Jul 14 03:06:23 2009 (4A5BCBFF)
fffff880`07782000 fffff880`07785c80 Kone Kone.sys Thu Dec 11 08:56:52 2008 (4940B9B4)
fffff880`07786000 fffff880`07794000 hidusb hidusb.sys Tue Jul 14 03:06:22 2009 (4A5BCBFE)
fffff880`07794000 fffff880`077ad000 HIDCLASS HIDCLASS.SYS Tue Jul 14 03:06:21 2009 (4A5BCBFD)
fffff880`077ad000 fffff880`077b5080 HIDPARSE HIDPARSE.SYS Tue Jul 14 03:06:17 2009 (4A5BCBF9)
fffff880`077b6000 fffff880`077c3000 mouhid mouhid.sys Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`077c3000 fffff880`077cd000 klmouflt klmouflt.sys Fri Oct 02 18:38:29 2009 (4AC61E75)
fffff880`077cd000 fffff880`077db000 kbdhid kbdhid.sys Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`077db000 fffff880`077e9000 monitor monitor.sys Tue Jul 14 02:38:52 2009 (4A5BC58C)
fffff880`077e9000 fffff880`077f4580 JmtFltr JmtFltr.sys Fri Sep 28 20:04:57 2007 (46FD3439)
fffff880`08800000 fffff880`0882d000 mrxsmb mrxsmb.sys Sat Feb 27 09:52:19 2010 (4B88CF33)
fffff880`0882d000 fffff880`0887b000 mrxsmb10 mrxsmb10.sys Sat Feb 27 09:52:28 2010 (4B88CF3C)
fffff880`0887b000 fffff880`0889e000 mrxsmb20 mrxsmb20.sys Sat Feb 27 09:52:26 2010 (4B88CF3A)
fffff880`0889e000 fffff880`088ae000 MpNWMon MpNWMon.sys Sat Mar 20 07:58:00 2010 (4BA463E8)
fffff880`088e3000 fffff880`089ab000 HTTP HTTP.sys Tue Jul 14 02:22:16 2009 (4A5BC1A8)
fffff880`089ab000 fffff880`089c9000 bowser bowser.sys Tue Jul 14 02:23:50 2009 (4A5BC206)
fffff880`089c9000 fffff880`089e1000 mpsdrv mpsdrv.sys Tue Jul 14 03:08:25 2009 (4A5BCC79)
fffff880`09400000 fffff880`09468000 srv2 srv2.sys Tue Jun 22 06:20:47 2010 (4C202C0F)
fffff880`094b4000 fffff880`0955a000 peauth peauth.sys Tue Jul 14 04:01:19 2009 (4A5BD8DF)
fffff880`0955a000 fffff880`09565000 secdrv secdrv.SYS Wed Sep 13 16:18:38 2006 (4508052E)
fffff880`09565000 fffff880`09592000 srvnet srvnet.sys Tue Jun 22 06:20:32 2010 (4C202C00)
fffff880`09592000 fffff880`095a4000 tcpipreg tcpipreg.sys Tue Jul 14 03:09:49 2009 (4A5BCCCD)
fffff880`0b000000 fffff880`0b02f000 SCSIPORT SCSIPORT.SYS Tue Jul 14 03:01:04 2009 (4A5BCAC0)
fffff880`0b02f000 fffff880`0b040000 usbaapl64 usbaapl64.sys Thu Apr 01 06:20:15 2010 (4BB410EF)
fffff880`0b040000 fffff880`0b051000 WinUsb WinUsb.sys Tue Jul 14 03:06:28 2009 (4A5BCC04)
fffff880`0b051000 fffff880`0b082000 WUDFRd WUDFRd.sys Tue Jul 14 03:06:06 2009 (4A5BCBEE)
fffff880`0b082000 fffff880`0b094100 xusb21 xusb21.sys Fri Aug 14 01:10:17 2009 (4A848F49)
fffff880`0b0a1000 fffff880`0b137000 srv srv.sys Tue Jun 22 06:21:11 2010 (4C202C27)
fffff880`0b137000 fffff880`0b16d000 fastfat fastfat.SYS Tue Jul 14 02:23:28 2009 (4A5BC1F0)
fffff880`0b19b000 fffff880`0b1c8200 usbvideo usbvideo.sys Thu Mar 04 06:40:57 2010 (4B8F39D9)
fffff880`0b1d7000 fffff880`0b1e2000 ElbyCDIO ElbyCDIO.sys Fri Dec 18 00:25:16 2009 (4B2AAFCC)
fffff880`0b1e2000 fffff880`0b1f1000 VClone VClone.sys Mon Aug 10 00:25:45 2009 (4A7F3ED9)
fffff880`0fe00000 fffff880`0fe43000 ks ks.sys Thu Mar 04 06:32:25 2010 (4B8F37D9)
fffff880`0fe43000 fffff880`0fe61000 i8042prt i8042prt.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`0fe61000 fffff880`0fe70000 kbdclass kbdclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`0fe70000 fffff880`0fe80000 CompositeBus CompositeBus.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`0fe80000 fffff880`0fe96000 AgileVpn AgileVpn.sys Tue Jul 14 03:10:24 2009 (4A5BCCF0)
fffff880`0fe9a000 fffff880`10b2be00 nvlddmkm nvlddmkm.sys Sat Jul 10 00:15:58 2010 (4C37918E)
fffff880`10b2c000 fffff880`10b2d180 nvBridge nvBridge.kmd Sat Jul 10 00:07:54 2010 (4C378FAA)
fffff880`10b2e000 fffff880`10b3b000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 15:17:04 2009 (4A1151C0)
fffff880`10b3b000 fffff880`10b6d000 Rt64win7 Rt64win7.sys Thu Feb 26 11:04:13 2009 (49A65B0D)
fffff880`10b6d000 fffff880`10bab000 1394ohci 1394ohci.sys Tue Jul 14 03:07:12 2009 (4A5BCC30)
fffff880`10bab000 fffff880`10be8000 portcls portcls.sys Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`10be8000 fffff880`10bf4000 ndistapi ndistapi.sys Tue Jul 14 03:10:00 2009 (4A5BCCD8)
fffff880`10bf4000 fffff880`10bff000 hamachi hamachi.sys Thu Feb 19 12:36:41 2009 (499D3639)
fffff960`000d0000 fffff960`003df000 win32k win32k.sys Sat Jun 19 07:32:00 2010 (4C1C4840)
fffff960`005b0000 fffff960`005ba000 TSDDD TSDDD.dll unavailable (00000000)
fffff960`00680000 fffff960`006a7000 cdd cdd.dll Wed May 19 22:48:26 2010 (4BF4408A)
fffff960`00940000 fffff960`009a1000 ATMFD ATMFD.DLL Thu May 27 07:11:31 2010 (4BFDF0F3)
Unloaded modules:
fffff880`0b1d5000 fffff880`0b1d7000 MSPCLOCK.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1d3000 fffff880`0b1d5000 MSPQM.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1d1000 fffff880`0b1d3000 MSPQM.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1cf000 fffff880`0b1d1000 MSPCLOCK.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1cd000 fffff880`0b1cf000 MSPQM.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1cb000 fffff880`0b1cd000 MSPCLOCK.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b1c9000 fffff880`0b1cb000 MSPQM.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`0b16d000 fffff880`0b19b000 usbvideo.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`07600000 fffff880`0762e000 usbvideo.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`01886000 fffff880`01894000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`01894000 fffff880`018a0000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`018a0000 fffff880`018a9000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`018a9000 fffff880`018bc000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000