Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: Driver Verifier Detected Violation - ntoskrnl.exe

26 Oct 2010   #1

Windows 7 Home Premium 64bit
 
 
Driver Verifier Detected Violation - ntoskrnl.exe

Hi Guys,
After many problems with my new build I have just had this crash randomly happen:

DRIVER_VERIFIER_DETECTED_VIOLATION

System Spec:
-Windows 7 Home Premium 64 Bit OEM Version. Bought as DVD, installed by me.
-All Hardware was purchased on the 22nd October
-Current OS installed for 1 day
-Intel i5-760 2.88Ghz w/ Freezer 7 Pro Rev 2 Cooler
-Sapphire ATi HD 5450 1GB DDR 3
-4GB (2x2GB) OCZ 1333Mhz DDR 3 Platinum i5 Kit
-500w Arctic Power 500w PSU

Any help on how to fix would be greatly appreciated.

Thanks in advance.
Jamie

My System SpecsSystem Spec
.

26 Oct 2010   #2
Microsoft MVP

Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
 
 

Hello and Welcome !

I wonder how the Driver Verifier got enabled in the First place. Follow this article and Disable the Driver Verifier first Driver Verifier - Enable and Disable

Coming back to your issue i believe the crashes is caused by PowerISO Virtual Driver i.e. SCDEmu.SYS please uninstall it completely.

Bugcheck:

Code:
Unable to load image \SystemRoot\System32\Drivers\SCDEmu.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SCDEmu.SYS
*** ERROR: Module load completed but symbols could not be loaded for SCDEmu.SYS
Probably caused by : SCDEmu.SYS ( SCDEmu+2450 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_0

CURRENT_IRQL:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from fffff80001f583dc to fffff80001ace740

STACK_TEXT:  
fffff880`02d22968 fffff800`01f583dc : 00000000`000000c4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`02d22970 fffff800`01f58e1b : fffffa80`04490ec0 fffff980`27248e4b fffffa80`052dee00 fffffa80`04503000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`02d229b0 fffff800`01f69df8 : 00000000`73736b4b 00000000`00000080 fffffa80`052c5dc0 fffff980`29ce4ff0 : nt!ExAllocatePoolSanityChecks+0xcb
fffff880`02d229f0 fffff800`01f6a09d : fffffa80`044d2000 00000000`00000000 0000f880`73736b4b fffffa80`0449a000 : nt!VeAllocatePoolWithTagPriority+0x88
fffff880`02d22a60 fffff880`03231450 : 00000000`00000004 fffffa80`04503000 fffffa80`044d2000 fffff880`0323860f : nt!VerifierExAllocatePoolWithTag+0x1d
fffff880`02d22aa0 00000000`00000004 : fffffa80`04503000 fffffa80`044d2000 fffff880`0323860f 00000001`01d83b98 : SCDEmu+0x2450
fffff880`02d22aa8 fffffa80`04503000 : fffffa80`044d2000 fffff880`0323860f 00000001`01d83b98 fffff880`03239a60 : 0x4
fffff880`02d22ab0 fffffa80`044d2000 : fffff880`0323860f 00000001`01d83b98 fffff880`03239a60 fffffa80`044d2000 : 0xfffffa80`04503000
fffff880`02d22ab8 fffff880`0323860f : 00000001`01d83b98 fffff880`03239a60 fffffa80`044d2000 00000000`00000000 : 0xfffffa80`044d2000
fffff880`02d22ac0 00000001`01d83b98 : fffff880`03239a60 fffffa80`044d2000 00000000`00000000 fffffa80`044d2000 : SCDEmu+0x960f
fffff880`02d22ac8 fffff880`03239a60 : fffffa80`044d2000 00000000`00000000 fffffa80`044d2000 fffffa80`044d2000 : 0x1`01d83b98
fffff880`02d22ad0 fffffa80`044d2000 : 00000000`00000000 fffffa80`044d2000 fffffa80`044d2000 fffffa80`052c5dc0 : SCDEmu+0xaa60
fffff880`02d22ad8 00000000`00000000 : fffffa80`044d2000 fffffa80`044d2000 fffffa80`052c5dc0 fffffa80`052c5dc0 : 0xfffffa80`044d2000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SCDEmu+2450
fffff880`03231450 ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  SCDEmu+2450

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SCDEmu

IMAGE_NAME:  SCDEmu.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4af78c21

FAILURE_BUCKET_ID:  X64_0xc4_0_VRF_SCDEmu+2450

BUCKET_ID:  X64_0xc4_0_VRF_SCDEmu+2450
Hope this helps,
Captain
My System SpecsSystem Spec
27 Oct 2010   #3

Windows 7 Home Premium 64bit
 
 

Hi Captain,
I did reply yesterday to thank you for your help but it seems to have not posted. I was a bit tired so god only knows what happened. I followed your instructions and everything worked fine until this morning when I started up my PC again.
I am getting a number of BSOD's but can't get into windows long enough to run the program but have managed to quickly retrieve the minidump files if that will help?
Most of the BSOD's have related to MEMORY_MANAGEMENT or fltMgr.sys and have only started to occur on todays startup. Am I right in thinking that it has something to do with some startup programs causing a problem?
Could you have a look at the minidump and advise on what to do. I'm totally stuck and it's starting to make me think I've wasted quite a lot of money!
Thanks again.
Jamie
My System SpecsSystem Spec
.


27 Oct 2010   #4

Windows 7 Ultimate 32 bit
 
 

Captain Jack is not online right now. I looked at your five most recent dumps and got four different error codes. This indicates a hardware problem in itself.
Quote:
error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

error code 19, BAD_POOL_HEADER. Usual causes: Device driver.

error code 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED. Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control.

error code 1A, MEMORY_MANAGEMENT. Usual causes: Device driver, memory, kernel.
Code:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`01a07000 PsLoadedModuleList = 0xfffff800`01c44e50
Debug session time: Wed Oct 27 10:51:22.876 2010 (GMT-4)
System Uptime: 0 days 0:01:07.922
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80001d55d99, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!CmpGetNameControlBlock+12e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80001d55d99, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!CmpGetNameControlBlock+12e
fffff800`01d55d99 3b3e            cmp     edi,dword ptr [rsi]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001caf0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880066add78 -- (.exr 0xfffff880066add78)
ExceptionAddress: fffff80001d55d99 (nt!CmpGetNameControlBlock+0x000000000000012e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880066ade20 -- (.trap 0xfffff880066ade20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a000011000 rbx=0000000000000000 rcx=fffff8a0000177e0
rdx=00000000092e072a rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001d55d99 rsp=fffff880066adfb0 rbp=fffff880066ae048
 r8=000000000000000d  r9=00000000000000ff r10=0000000000000065
r11=fffff8a00271af1a r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!CmpGetNameControlBlock+0x12e:
fffff800`01d55d99 3b3e            cmp     edi,dword ptr [rsi] ds:b330:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001ab1a39 to fffff80001a77740

STACK_TEXT:  
fffff880`066ad5a8 fffff800`01ab1a39 : 00000000`0000001e ffffffff`c0000005 fffff800`01d55d99 00000000`00000000 : nt!KeBugCheckEx
fffff880`066ad5b0 fffff800`01a76d82 : fffff880`066add78 00000000`00000000 fffff880`066ade20 0000ffff`00000004 : nt!KiDispatchException+0x1b9
fffff880`066adc40 fffff800`01a7568a : 00000000`0f6f035c 00000000`0000001a fffff8a0`0271af00 00000000`a079654b : nt!KiExceptionDispatch+0xc2
fffff880`066ade20 fffff800`01d55d99 : fffff880`066ae028 00000000`00000000 00000000`000007ff 00000000`00000040 : nt!KiGeneralProtectionFault+0x10a
fffff880`066adfb0 fffff800`01d566ed : 00000000`0000000d 00000000`000067e0 00000000`000067e0 00000000`00134610 : nt!CmpGetNameControlBlock+0x12e
fffff880`066ae010 fffff800`01d551b7 : fffff8a0`00023010 00000000`008d3178 fffff8a0`00d1817c fffff8a0`01b074a8 : nt!CmpCreateKeyControlBlock+0x35e
fffff880`066ae0b0 fffff800`01d51195 : fffff8a0`00000000 fffff8a0`008d3178 fffff8a0`00023010 fffffa80`05c07270 : nt!CmpDoOpen+0x387
fffff880`066ae170 fffff800`01d70e84 : fffff800`01d50cc0 00000000`00000001 fffffa80`05c07270 00000000`00000000 : nt!CmpParseKey+0x4d5
fffff880`066ae440 fffff800`01d75e4d : fffffa80`05c07270 fffff880`066ae5a0 00000000`00000240 fffffa80`036d31e0 : nt!ObpLookupObjectName+0x585
fffff880`066ae540 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x1cd


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CmpGetNameControlBlock+12e
fffff800`01d55d99 3b3e            cmp     edi,dword ptr [rsi]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!CmpGetNameControlBlock+12e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!CmpGetNameControlBlock+12e

BUCKET_ID:  X64_0x1E_nt!CmpGetNameControlBlock+12e

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, 20000, 0, 0}

GetPointerFromAddress: unable to read from fffff80001cba0e0
GetUlongFromAddress: unable to read from fffff80001c281b0
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72f8 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022, 
Arg2: 0000000000020000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80001c281b0

BUGCHECK_STR:  0x19_22

POOL_ADDRESS:  0000000000020000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80001ad7c80 to fffff80001a82740

STACK_TEXT:  
fffff880`021c7ab8 fffff800`01ad7c80 : 00000000`00000019 00000000`00000022 00000000`00020000 00000000`00000000 : nt!KeBugCheckEx
fffff880`021c7ac0 fffff800`01bb7518 : 00000000`00000000 fffff880`021c7c10 fffff880`021c7b80 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x72f8
fffff880`021c7b50 fffff800`01d76843 : 00000000`38f79f93 fffff880`01bdbbb4 00000000`6c414d43 fffff880`00000000 : nt!ExFreePoolWithTag+0x468
fffff880`021c7c00 fffff800`01d7574b : 00000000`00000000 00000000`00000001 fffff8a0`00023010 fffff800`01d75217 : nt!CmpFreeKeyControlBlock+0x123
fffff880`021c7c30 fffff800`01d759c4 : 00000000`00000000 00000000`00000001 fffff8a0`00023010 fffffa80`036bd680 : nt!CmpDereferenceKeyControlBlock+0x25f
fffff880`021c7c80 fffff800`01a8f961 : fffff800`01d758dc fffff800`01c275f8 fffffa80`036bd680 00000000`00000000 : nt!CmpDelayDerefKCBWorker+0xe8
fffff880`021c7cb0 fffff800`01d26c06 : 8c8d4800`00012224 fffffa80`036bd680 00000000`00000080 fffffa80`036ae040 : nt!ExpWorkerThread+0x111
fffff880`021c7d40 fffff800`01a60c26 : fffff880`0205c180 fffffa80`036bd680 fffff880`02066fc0 2824847f`0ff3076f : nt!PspSystemThreadStartup+0x5a
fffff880`021c7d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+72f8
fffff800`01ad7c80 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+72f8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72f8

BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72f8

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88001503920, fffff880021b25a8, fffff880021b1e10}

Probably caused by : fileinfo.sys ( fileinfo!FIEnumerate+b5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88001503920, The address that the exception occurred at
Arg3: fffff880021b25a8, Exception Record Address
Arg4: fffff880021b1e10, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
fltmgr!FltReferenceFileNameInformation+0
fffff880`01503920 f083417801      lock add dword ptr [rcx+78h],1

EXCEPTION_RECORD:  fffff880021b25a8 -- (.exr 0xfffff880021b25a8)
ExceptionAddress: fffff88001503920 (fltmgr!FltReferenceFileNameInformation)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880021b1e10 -- (.cxr 0xfffff880021b1e10)
rax=fa80054f2e9004c0 rbx=fffff8a007048620 rcx=fa80054f2e9004c0
rdx=0000000000000000 rsi=0000000000000002 rdi=fffffa8004605960
rip=fffff88001503920 rsp=fffff880021b27e8 rbp=fffffa8004f8f720
 r8=fffffa8004605978  r9=fffffa80040f4000 r10=0000000000401802
r11=fffff880021b2828 r12=fffff880021b2890 r13=fffffa80041a34f0
r14=00000000c00000bb r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
fltmgr!FltReferenceFileNameInformation:
fffff880`01503920 f083417801      lock add dword ptr [rcx+78h],1 ds:002b:fa80054f`2e900538=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001cf10e0
 ffffffffffffffff 

FOLLOWUP_IP: 
fileinfo!FIEnumerate+b5
fffff880`0152d3d9 83642440bf      and     dword ptr [rsp+40h],0FFFFFFBFh

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff8800152d3d9 to fffff88001503920

STACK_TEXT:  
fffff880`021b27e8 fffff880`0152d3d9 : fffff8a0`00000000 fffff8a0`07048620 00000000`00000002 fffffa80`04605960 : fltmgr!FltReferenceFileNameInformation
fffff880`021b27f0 fffff880`0152a563 : fffffa80`04f8f720 fffffa80`04f8f720 fffffa80`04f8f70c fffffa80`04f8f720 : fileinfo!FIEnumerate+0xb5
fffff880`021b2870 fffff880`0152a60b : fffff8a0`070a9010 fffff880`021b2a00 00000000`00000000 fffff880`021b2a00 : fileinfo!FIControlDispatchSystemControl+0x73
fffff880`021b28b0 fffff800`01d54aa0 : fffffa80`041a34f0 fffffa80`04f8f70c fffffa80`04f8f720 fffffa80`04f8f70c : fileinfo!FIControlDispatch+0x4b
fffff880`021b28f0 fffff800`01e85706 : 00000000`0000000c 00000000`0000000c 00000000`00000001 fffffa80`04f8f720 : nt!WmipForwardWmiIrp+0x16c
fffff880`021b2970 fffff800`01e863bb : fffff880`021b2ad8 fffffa80`03719f01 00000000`0000000c 00000000`00000000 : nt!WmipSendWmiIrpToTraceDeviceList+0xe6
fffff880`021b29d0 fffff800`01e968e4 : fffffa80`03719c00 00000000`00000001 fffff8a0`070a9010 fffffa80`03719c80 : nt!WmiTraceRundownNotify+0x6b
fffff880`021b2a20 fffff800`01f0198c : 00000000`00401802 fffffa80`03719f28 fffffa80`03719c80 fffffa80`0371f148 : nt!EtwpKernelTraceRundown+0xc4
fffff880`021b2a50 fffff800`01f01a8f : fffffa80`03719c80 00000000`00000002 fffff8a0`023a1240 fffffa80`03719c00 : nt!EtwpUpdateLoggerGroupMasks+0x22c
fffff880`021b2b50 fffff800`01d158c9 : 00000000`00000000 fffff8a0`023a1240 00000000`00000000 fffff800`01ada536 : nt!EtwpStopLoggerInstance+0x4f
fffff880`021b2b90 fffff800`01e1db60 : 00000000`00000000 00000000`00000002 fffffa80`03719c80 ffffffff`88ca6c00 : nt!EtwpStopTrace+0x129
fffff880`021b2c00 fffff800`01f28d95 : ffffffff`ffffffff 00000000`00000001 ffffffff`000000b4 fffff800`01c477f0 : nt! ?? ::NNGAKEGL::`string'+0x5792c
fffff880`021b2c70 fffff800`01ac6961 : fffff800`01c5e500 fffff800`01f28bd0 fffff800`01c5e5f8 fffffa80`0371f040 : nt!PerfDiagpProxyWorker+0x1c5
fffff880`021b2cb0 fffff800`01d5dc06 : 48868b49`05e1c148 fffffa80`0371f040 00000000`00000080 fffffa80`037105f0 : nt!ExpWorkerThread+0x111
fffff880`021b2d40 fffff800`01a97c26 : fffff880`0205c180 fffffa80`0371f040 fffff880`02066fc0 0001b841`00000088 : nt!PspSystemThreadStartup+0x5a
fffff880`021b2d80 00000000`00000000 : fffff880`021b3000 fffff880`021ad000 fffff880`021b26a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  fileinfo!FIEnumerate+b5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME:  fileinfo.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc481

STACK_COMMAND:  .cxr 0xfffff880021b1e10 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_fileinfo!FIEnumerate+b5

BUCKET_ID:  X64_0x7E_fileinfo!FIEnumerate+b5

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001f8b0a0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001f8b0a0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001b46f9e to fffff80001ad3740

STACK_TEXT:  
fffff880`0858d6e8 fffff800`01b46f9e : 00000000`0000001a 00000000`00041790 fffffa80`01f8b0a0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0858d6f0 fffff800`01aa6c23 : ffffffff`00000000 00000000`0269ffff fffffa80`00000000 fffffa80`05e1d060 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`0858d8b0 fffff800`01db8dcf : fffff8a0`02665060 fffff880`0858dc20 00000000`00000000 fffffa80`05e1d060 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`0858d900 fffff800`01d91635 : 00000000`c0000005 fffffa80`05dd9e01 000007ff`fffda000 fffffa80`05e0c060 : nt!PspExitThread+0x92f
fffff880`0858d9c0 fffff800`01ab01db : 00000000`00000001 00000000`00000000 fffff880`00961000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`0858d9f0 fffff800`01ab0620 : 00000000`00000000 fffff880`0858da70 fffff800`01d9174c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0858da70 fffff800`01ad2a37 : fffffa80`05e1d060 00000000`022ff968 fffff880`0858dbc8 fffff8a0`0266da00 : nt!KiInitiateUserApc+0x70
fffff880`0858dbb0 00000000`77a5030a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`022ff948 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a5030a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33906
fffff800`01b46f9e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33906

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

Followup: MachineOwner
---------

3: kd> lmtsmn
start             end                 module name
fffff880`039bf000 fffff880`039fd000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00ec6000 fffff880`00f1d000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02e2b000 fffff880`02eb5000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`03000000 fffff880`03016000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`012c4000 fffff880`012cf000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`02ff7000 fffff880`02fff000   AppleCharger AppleCharger.sys Mon Apr 26 23:54:05 2010 (4BD65FDD)
fffff880`01286000 fffff880`0128f000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0128f000 fffff880`012b9000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`03a6f000 fffff880`03a91000   AtiHdmi  AtiHdmi.sys  Tue Mar 09 05:08:38 2010 (4B961E26)
fffff880`0326c000 fffff880`03937000   atikmdag atikmdag.sys Tue May 04 21:41:02 2010 (4BE0CCAE)
fffff880`0304e000 fffff880`03089000   atikmpag atikmpag.sys Tue May 04 21:23:24 2010 (4BE0C88C)
fffff880`01bda000 fffff880`01be1000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02e1a000 fffff880`02e2b000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`06fc2000 fffff880`06fe0000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00770000 fffff960`00797000   cdd      cdd.dll      Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`01b7a000 fffff880`01ba4000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01b14000 fffff880`01b44000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d37000 fffff880`00d95000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0138d000 fffff880`01400000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`031e0000 fffff880`031f0000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06e9e000 fffff880`06ea7000   cpuz134_x64 cpuz134_x64.sys Fri Jul 09 07:16:58 2010 (4C37052A)
fffff880`04e55000 fffff880`04e63000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`01a97000 fffff880`01ab5000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02e0b000 fffff880`02e1a000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01afe000 fffff880`01b14000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`03bd2000 fffff880`03bf4000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`04e6f000 fffff880`04e78000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04e63000 fffff880`04e6f000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04e78000 fffff880`04e8b000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`04e49000 fffff880`04e55000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`03089000 fffff880`0317d000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`03937000 fffff880`0397d000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`0131b000 fffff880`0132f000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`012cf000 fffff880`0131b000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`015d9000 fffff880`015e3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01ac4000 fffff880`01afe000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01000000 fffff880`0104a000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`01a1a000 fffff800`01a63000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`0397d000 fffff880`039a1000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`039a1000 fffff880`039b2000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`04e99000 fffff880`04eb2000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04eb2000 fffff880`04eba080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04e8b000 fffff880`04e99000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`06efa000 fffff880`06fc2000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`017dd000 fffff880`017e6000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0107e000 fffff880`01286000   iaStor   iaStor.sys   Fri Oct 02 15:58:50 2009 (4AC65B7A)
fffff880`017e6000 fffff880`017fc000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`03b5d000 fffff880`03b6c000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04ef5000 fffff880`04f03000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`0199d000 fffff800`019a7000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03b7d000 fffff880`03bc0000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`015ae000 fffff880`015c8000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01798000 fffff880`017c3000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`03bf4000 fffff880`03bf9200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04f47000 fffff880`04f5c000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04f03000 fffff880`04f26000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cdf000 fffff880`00d23000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`04eca000 fffff880`04ed8000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`03b6c000 fffff880`03b7b000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04ebd000 fffff880`04eca000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00cc0000 fffff880`00cda000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`01ba4000 fffff880`01bd1000   MpFilter MpFilter.sys Sat Mar 20 01:58:08 2010 (4BA463F0)
fffff880`07733000 fffff880`07743000   MpNWMon  MpNWMon.sys  Sat Mar 20 01:58:00 2010 (4BA463E8)
fffff880`06fe0000 fffff880`06ff8000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`06e00000 fffff880`06e2d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`06e2d000 fffff880`06e7b000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`06e7b000 fffff880`06e9e000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`012b9000 fffff880`012c4000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`01a50000 fffff880`01a5b000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f26000 fffff880`00f30000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0132f000 fffff880`0138d000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02e00000 fffff880`02e0b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`017cb000 fffff880`017dd000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01646000 fffff880`01738000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`0303a000 fffff880`03046000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`04faf000 fffff880`04fc2000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`03ad8000 fffff880`03b07000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03a5a000 fffff880`03a6f000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02f3f000 fffff880`02f4e000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02eb5000 fffff880`02efa000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01738000 fffff880`01798000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01a5b000 fffff880`01a6c000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02feb000 fffff880`02ff7000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`01a63000 fffff800`0203f000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0140b000 fffff880`015ae000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01bd1000 fffff880`01bda000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04f5c000 fffff880`04faf000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`02f03000 fffff880`02f29000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00f70000 fffff880`00f85000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f30000 fffff880`00f63000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00ff6000 fffff880`00ffd000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e00000 fffff880`00e10000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`015c8000 fffff880`015d9000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`072f1000 fffff880`07397000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`03a91000 fffff880`03ace000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00d23000 fffff880`00d37000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`03016000 fffff880`0303a000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03b07000 fffff880`03b22000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03b22000 fffff880`03b43000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`03b43000 fffff880`03b5d000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02f9a000 fffff880`02feb000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`01a35000 fffff880`01a3e000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`01a3e000 fffff880`01a47000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`01a47000 fffff880`01a50000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01600000 fffff880`0163a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`04fc2000 fffff880`04fda000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`0317d000 fffff880`031d4000   Rt64win7 Rt64win7.sys Thu Mar 04 08:42:52 2010 (4B8FB8DC)
fffff880`04c17000 fffff880`04e48c00   RTKVHD64 RTKVHD64.sys Fri Mar 26 06:30:50 2010 (4BAC8CDA)
fffff880`07397000 fffff880`073a2000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`031d4000 fffff880`031e0000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02f4e000 fffff880`02f6b000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`017c3000 fffff880`017cb000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0769d000 fffff880`07733000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07200000 fffff880`07267000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`073a2000 fffff880`073cf000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`03b7b000 fffff880`03b7c480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`073cf000 fffff880`073e1000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`01a8a000 fffff880`01a97000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`01a6c000 fffff880`01a8a000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02f86000 fffff880`02f9a000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00410000 fffff960`0041a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`0104a000 fffff880`01070000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`03bc0000 fffff880`03bd2000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04ed8000 fffff880`04ef5000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04ebb000 fffff880`04ebcf00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`03256000 fffff880`03267000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`03a00000 fffff880`03a5a000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`03200000 fffff880`03256000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`039b2000 fffff880`039bf000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00f63000 fffff880`00f70000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01be1000 fffff880`01bef000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01a00000 fffff880`01a25000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00f85000 fffff880`00f9a000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f9a000 fffff880`00ff6000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`00d95000 fffff880`00de1000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02f29000 fffff880`02f3f000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`02f6b000 fffff880`02f86000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`01a25000 fffff880`01a35000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e13000 fffff880`00eb7000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00eb7000 fffff880`00ec6000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02efa000 fffff880`02f03000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`00f1d000 fffff880`00f26000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04f26000 fffff880`04f47000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`01b44000 fffff880`01b52000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01b52000 fffff880`01b5e000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01b5e000 fffff880`01b67000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01b67000 fffff880`01b7a000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
The dumps don't really tell us very much. They point to Windows system drivers (not likely the cause) and indicate memory corruption. Your up time was only a minute or so for each of these dumps except one; that one showed you were up for 10 minutes. Can you boot in the safe mode without crashing? That answer will help us decide where we need to go.

You may have a power supply problem. Do you have access to another power supply you can try?
My System SpecsSystem Spec
27 Oct 2010   #5

Windows 7 Home Premium 64bit
 
 

Thank you so much.
My System SpecsSystem Spec
27 Oct 2010   #6

Windows 7 Home Premium 64bit
 
 

Sorry to post again before your response but I have managed to get into windows long enough to run the program as per the BSOD posting instructions! And I'm not in safe mode! (I'm quite excited about this if I'm honest)
I have attached the zip file below.
Thanks again.
My System SpecsSystem Spec
27 Oct 2010   #7
Microsoft MVP

Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
 
 

Hello,

I see Carl is helping you out. Let me know in case of anything

- Captain
My System SpecsSystem Spec
27 Oct 2010   #8

Windows 7 Home Premium 64bit
 
 

Hi Carl,
Thanks so much for helping.
As per my above post, I have managed to get into windows normally (so far 45 mins without BSOD) and ran the program as per the BSOD posting instructions if that gives any more information (attached above).

I was able to get into windows in safe mode before, but for a max of 10 mins before a BSOD occured.

I don't have access to another PSU, the one I have is only 5 days old (Everything was purchased together). Could this have anything to do with a case fans I fitted? I am running 2 from the power supply unit and one from the motherboard. Looking back, the problems had started after these were fitted.

Any more info required, please let me know.
Thanks again for your help.
Jamie
My System SpecsSystem Spec
27 Oct 2010   #9

Windows 7 Ultimate 32 bit
 
 

I think that makes them very suspect. Why don't you try disconnecting them and see what happens. Let us know. Sure am glad to hear you are running in the normal mode.
My System SpecsSystem Spec
27 Oct 2010   #10

Windows 7 Home Premium 64bit
 
 

Thanks Carl,

I have Shut Down, Switched off PSU and unplugged from mains, Opened the case, Removed the 2 new fans (1 came with case and was OK before) and....

Windows started first time without BSOD!! ..... yet.

Thanks so much for your help, I'm feeling a lot better about building it myself now!

If I get any more issues shall I post them in this thread or start a new one?

Regards,

Jamie
My System SpecsSystem Spec
Reply

 Driver Verifier Detected Violation - ntoskrnl.exe





Thread Tools



Similar help and support threads for2: Driver Verifier Detected Violation - ntoskrnl.exe
Thread Forum
running driver verifier and ntoskrnl.exe does not verify Drivers
BSOD driver verifier error 0x000000c9 IO Manager Violation BSOD Help and Support
Bsod driver verifier detected violation BSOD Help and Support
Driver Verifier inquiry. Drivers
Need Knowledge about Driver Verifier Drivers
ntoskrnl.exe - Driver Verifier detected Violation BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 07:15 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33