1. Remove Avast to replace it with MSE:
avast! Uninstall Utility
http://www.microsoft.com/security_essentials/
2. Update drivers:
jraid.sys Mon Nov 03 21:20:23 2008
JMicron JMB36X RAID
Rt86win7.sys Thu Feb 26 04:04:22 2009
Realtek 8101E/8168/8169 PCI/PCIe Adapters
RTKVHDA.sys Tue Jan 20 01:10:46 2009
Realtek Audio
Crash Dumps:
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-28423-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x83047000 PsLoadedModuleList = 0x8318f810
Debug session time: Sat Dec 18 08:34:11.803 2010 (UTC - 5:00)
System Uptime: 0 days 0:03:04.473
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c000001d, 822b9653, 90563788, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: 822b9653, The address that the exception occurred at
Arg3: 90563788, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {
FAULTING_IP:
win32k!SFMLOGICALSURFACE::GetRedirectionInfo+97
822b9653 c6 ???
TRAP_FRAME: 90563788 -- (.trap 0xffffffff90563788)
ErrCode = 00000000
eax=ec050bd6 ebx=fdb52488 ecx=00000000 edx=90563884 esi=00000000 edi=90563828
eip=822b9653 esp=905637fc ebp=90563800 iopl=0 ov up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a02
win32k!SFMLOGICALSURFACE::GetRedirectionInfo+0x97:
822b9653 c6 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 822df389 to 822b9653
FAILED_INSTRUCTION_ADDRESS:
win32k!SFMLOGICALSURFACE::GetRedirectionInfo+97
822b9653 c6 ???
STACK_TEXT:
90563800 822df389 90563884 90563898 90563890 win32k!SFMLOGICALSURFACE::GetRedirectionInfo+0x97
905638c8 82370d79 ffb8a008 00000000 b40f0b9a win32k!GreUpdateSprite+0x470
9056394c 82269d61 ffb7a6b8 00000767 0000017e win32k!EngpMovePointer+0x2b1
90563974 8226d61c ffb8a008 00000767 0000017e win32k!vMovePointer+0x81
905639b4 8233d827 00b46008 00000767 0000017e win32k!GreMovePointer+0x20f
905639f4 8230cabc 00000767 0000017e 00000000 win32k!xxxMoveEventAbsolute+0x17f
90563a2c 8230c93d 00000000 882d8640 90563a84 win32k!ProcessMouseInput+0x16f
90563a3c 830ef027 ffa45d28 ffa45d50 00000000 win32k!InputApc+0x4e
90563a84 830b5b0d 00000000 00000000 00000000 nt!KiDeliverApc+0x17f
90563ac8 830b4423 887c7d18 88811618 88811714 nt!KiSwapThread+0x24e
90563af0 830b06ef 88811618 888116d8 00000000 nt!KiCommitThreadWait+0x1df
90563c68 822bdc1c 00000002 882a85f0 00000001 nt!KeWaitForMultipleObjects+0x535
90563cc0 82228fff 00000001 882a85f0 82232838 win32k!xxxMsgWaitForMultipleObjects+0xe9
90563d04 82228590 882a85f0 00000001 8243eaa0 win32k!xxxDesktopThread+0x1b6
90563d18 822ec440 00000004 025ffedc 90563d34 win32k!xxxCreateSystemThreads+0x54
90563d28 8308a44a 00000004 025fff1c 777964f4 win32k!NtUserCallNoParam+0x1b
90563d28 777964f4 00000004 025fff1c 777964f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
025fff1c 00000000 00000000 00000000 00000000 0x777964f4
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !win32k
234 errors : !win32k (822b9040-822b9ff8)
822b9040 *00 83 7d e0 0c 75 55 c7 *00 fc 02 00 00 00 8b 4d ..}..uU........M
822b9050 *00 a1 b0 fb 43 82 3b c8 *00 04 8b 00 eb 02 8b 01 ....C.;.........
822b9060 *00 45 bc 89 55 fc eb 36 *00 c0 40 c3 8b 65 e8 eb .E..U..6..@..e..
822b9070 *00 8b 45 ec 8b 00 ff 30 *00 f8 ca 14 00 c3 eb ec ..E....0........
...
822b90c0 *00 08 01 00 00 50 89 88 *00 00 00 00 e8 1b 1a 02 .....P..........
822b90d0 00 33 c0 40 5d c2 08 00 *00 90 90 90 90 8b ff 55 .3.@]..........U
822b90e0 *00 ec ff 75 08 ff 35 58 *00 43 82 e8 bb ff ff ff ...u..5X.C......
822b90f0 *00 c2 04 00 90 90 90 90 *00 8b 51 0c 8b 41 08 56 ..........Q..A.V
...
822b9140 *00 bc 00 00 00 ff 00 83 *00 01 75 22 33 c0 3b 05 ..........u"3.;.
822b9150 *00 d8 43 82 1b c0 83 e0 *00 50 6a 00 6a f8 ff b7 ..C......Pj.j...
822b9160 *00 00 00 00 68 03 80 00 00 e8 4e 5d 04 00 5f 5e ....h.....N].._^
822b9170 *00 90 90 90 90 90 8b ff *00 8b ec 83 ec 2c 56 8b .............,V.
...
822b91c0 *00 1b c0 25 ff ff c0 7f *00 01 00 3f 80 5e c9 c2 ...%.......?.^..
822b91d0 *00 00 90 90 90 90 90 8b *00 55 8b ec a1 04 f4 43 .........U.....C
822b91e0 *00 56 ff 30 e8 77 3d 03 00 a1 04 f4 43 82 8b 70 .V.0.w=.....C..p
822b91f0 *00 eb 2e 8b 46 20 a9 00 *00 40 04 75 22 83 7e 08 ....F ...@.u".~.
...
822b9240 *00 56 57 8b f1 56 33 db *00 b7 30 02 00 8b 55 0c .VW..V3...0...U.
822b9250 *00 46 14 8d 8a b0 00 00 00 8b 79 04 89 08 89 78 .F........y....x
822b9260 *00 89 07 89 41 04 ff 82 *00 00 00 00 83 4e 54 0c ....A........NT.
822b9270 *00 46 54 39 5e 10 74 24 *00 06 6a 01 50 ff 75 08 .FT9^.t$..j.P.u.
...
822b92c0 *00 c7 0f 86 86 00 00 00 *00 d2 d1 fe ff 89 45 08 ..............E.
822b92d0 *00 c0 74 19 6a 05 6a 00 *00 76 68 50 e8 db ea ff ..t.j.j..vhP....
822b92e0 *00 85 c0 75 0b ff 75 08 *00 e8 02 04 00 89 7d 08 ...u..u.......}.
822b92f0 *00 7d 0c 00 74 5b 57 ff *00 d4 f3 43 82 56 e8 70 .}..t[W....C.V.p
...
822b9340 *00 ff 76 68 e8 8c 02 04 00 89 7e 68 eb 03 89 45 ..vh......~h...E
822b9350 *00 8b 45 08 5f 5e 5d c2 *00 00 90 90 90 90 90 8b ..E._^].........
822b9360 *00 55 8b ec 56 8b 75 08 *00 68 08 01 00 00 56 e8 .U..V.u..h....V.
822b9370 *00 93 02 00 a1 58 ea 43 *00 8b 80 bc 00 00 00 3b .....X.C.......;
...
822b93c0 *00 85 00 00 00 56 e8 29 *00 02 00 5f 5e 5d c2 08 .....V.)..._^]..
822b93d0 00 90 90 90 90 90 8b ff *00 8b ec 83 ec 14 56 8b ..............V.
822b93e0 *00 10 8d 46 ff 57 83 f8 *00 77 0d 8b 0d fc d1 43 ...F.W...w.....C
822b93f0 *00 8b b4 81 d0 09 00 00 *00 45 0c 8b 08 8b 50 04 .........E....P.
...
822b9440 *00 33 f6 56 ff 75 08 e8 *00 a6 03 00 85 c0 0f 84 .3.V.u..........
822b9450 *00 00 00 00 ff 75 08 8d *00 08 e8 be 4c 03 00 8b .....u......L...
822b9460 *00 08 85 c0 0f 84 a2 00 00 00 f7 40 48 00 08 00 ...........@H...
822b9470 00 0f 84 8b 00 00 00 83 *00 10 50 8d 4d f8 e8 e5 ..........P.M...
...
822b94c0 *00 b0 48 01 00 00 8b 4d *00 81 c1 94 00 00 00 e8 ..H....M........
822b94d0 *00 5a 02 00 85 f6 74 1c *00 4d 08 6a 00 8d 45 08 .Z....t..M.j..E.
822b94e0 *00 e8 a5 38 02 00 8b 4d *00 6a 00 8d 45 08 50 e8 ...8...M.j..E.P.
822b94f0 *00 3f 02 00 33 f6 8d 4d *00 46 e8 3d 3e 02 00 8b .?..3..M.F.=>...
...
822b9540 *00 8b 40 18 51 52 56 50 *00 75 18 8d 45 f4 ff 75 ..@.QRVP.u..E..u
822b9550 *00 ff 75 10 ff 75 0c 50 *00 cd 7d 02 00 8d 4d f4 ..u..u.P..}...M.
822b9560 *00 f0 e8 cf 7c 02 00 eb *00 6a 06 e8 a3 59 ff ff ....|....j...Y..
822b9570 *00 c6 5e c9 c2 14 00 90 *00 90 90 90 8b ff 55 8b ..^...........U.
...
822b95c0 *00 8b 41 2c 56 33 f6 3b *00 74 6c 50 e8 9b 2e 02 ..A,V3.;.tlP....
822b95d0 00 8b 48 20 8b 55 0c 89 *00 8b 48 24 8b 55 10 89 ..H .U....H$.U..
822b95e0 *00 33 c9 41 84 48 4c 74 *00 8b 4d 08 c7 01 02 00 .3.A.HLt..M.....
822b95f0 00 00 8b 4d 14 3b ce 74 *00 8b 90 30 01 00 00 89 ...M.;.t...0....
...
822b9640 *00 8b 45 10 89 30 8b 45 *00 3b c6 74 02 89 30 8b ..E..0.E.;.t..0.
822b9650 *00 18 3b c6 74 05 89 70 *00 89 30 5e 5d c2 14 00 ..;.t..p..0^]...
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE
BUCKET_ID: MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-22339-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x8304d000 PsLoadedModuleList = 0x83195810
Debug session time: Sat Dec 18 09:19:38.280 2010 (UTC - 5:00)
System Uptime: 0 days 0:10:39.560
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00003452, The subtype of the bugcheck.
Arg2: 6d44b000
Arg3: c0808c80
Arg4: bf512024
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_3452
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 830f20a8 to 830ed5bc
STACK_TEXT:
a26e3c14 830f20a8 8ea8f120 8ea8f120 00000000 nt!MiDeleteAddressesInWorkingSet+0x389
a26e3c40 83295dae 91be75a2 8a7ca6b0 c0000005 nt!MmCleanProcessAddressSpace+0x8c
a26e3cb4 832ca1e1 00000000 9fa257c8 00000001 nt!PspExitThread+0x683
a26e3ccc 830f5133 9fa257c8 a26e3cf8 a26e3d04 nt!PsExitSpecialApc+0x22
a26e3d1c 83090504 00000001 00000000 a26e3d34 nt!KiDeliverApc+0x28b
a26e3d1c 773e6400 00000001 00000000 a26e3d34 nt!KiServiceExit+0x64
WARNING: Frame IP not in any known module. Following frames may be wrong.
075ffa20 00000000 00000000 00000000 00000000 0x773e6400
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDeleteAddressesInWorkingSet+389
830ed5bc cc int 3
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+389
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c3fac
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x1a_3452_VRF_nt!MiDeleteAddressesInWorkingSet+389
BUCKET_ID: 0x1a_3452_VRF_nt!MiDeleteAddressesInWorkingSet+389
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-21964-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x83051000 PsLoadedModuleList = 0x83199810
Debug session time: Sat Dec 18 09:26:30.890 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:31.575
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8deff95f, 9d8ab704, 0}
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
*** WARNING: Unable to verify timestamp for dxgkrnl.sys
*** ERROR: Module load completed but symbols could not be loaded for dxgkrnl.sys
Probably caused by : atikmdag.sys ( atikmdag+2c295f )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8deff95f, The address that the exception occurred at
Arg3: 9d8ab704, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
atikmdag+2c295f
8deff95f 8b4508 mov eax,dword ptr [ebp+8]
TRAP_FRAME: 9d8ab704 -- (.trap 0xffffffff9d8ab704)
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=9ddbef68 edx=00000001 esi=9d8ab87c edi=9dc34d80
eip=8deff95f esp=9d8ab778 ebp=9d8ab778 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
atikmdag+0x2c295f:
8deff95f 8b4508 mov eax,dword ptr [ebp+8] ss:0010:9d8ab780=00000015
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x8E
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8deef129 to 8deff95f
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
9d8ab778 8deef129 00000015 9d8ab7a8 8defac64 atikmdag+0x2c295f
9d8ab784 8defac64 00000000 9d8ab87c 8c308fc8 atikmdag+0x2b2129
9d8ab7a8 8dc4af3e 9d8ab87c 9d8ab7d4 8d154b6d atikmdag+0x2bdc64
9d8ab7b4 8d154b6d 8c308fc8 9d8ab87c 81fef000 atikmdag+0xdf3e
9d8ab7d4 8e2f296a 8c308fc8 9d8ab87c 9d8ab8a0 atikmpag+0x4b6d
9d8ab7fc 8e2ef11b 9d8ab87c 867d6e30 9c5bfa38 dxgkrnl+0x2296a
9d8aba04 8e2ee505 9fc08bf8 9d8abcdc 9d8abcb8 dxgkrnl+0x1f11b
9d8abd18 98c5023e 00000010 867d6e30 9d8abd34 dxgkrnl+0x1e505
9d8abd28 8309444a 01d6ee18 01d6f0a8 772164f4 win32k!NtGdiDdDDIPresent+0x19
9d8abd28 772164f4 01d6ee18 01d6f0a8 772164f4 nt!KiFastCallEntry+0x12a
01d6f0a8 00000000 00000000 00000000 00000000 0x772164f4
STACK_COMMAND: kb
FOLLOWUP_IP:
atikmdag+2c295f
8deff95f 8b4508 mov eax,dword ptr [ebp+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+2c295f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc78dcd
FAILURE_BUCKET_ID: 0x8E_VRF_atikmdag+2c295f
BUCKET_ID: 0x8E_VRF_atikmdag+2c295f
Followup: MachineOwner
---------
Drivers:
Code:
start end module name
8d3c5000 8d3f1000 1394ohci 1394ohci.sys Mon Jul 13 19:51:59 2009 (4A5BC89F)
85281000 852c9000 ACPI ACPI.sys Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8d2b9000 8d313000 afd afd.sys Mon Jul 13 19:12:34 2009 (4A5BBF62)
8d225000 8d237000 AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
853ea000 853f3000 amdxata amdxata.sys Tue May 19 13:57:35 2009 (4A12F30F)
92a57000 92a59b00 aswFsBlk aswFsBlk.SYS Tue Sep 07 10:47:05 2010 (4C865069)
92a20000 92a57000 aswMonFlt aswMonFlt.sys Tue Sep 07 10:47:28 2010 (4C865080)
8d313000 8d317100 aswRdr aswRdr.SYS Tue Sep 07 10:47:44 2010 (4C865090)
8d0f6000 8d11cc80 aswSP aswSP.SYS Tue Sep 07 10:52:01 2010 (4C865191)
8d318000 8d321c00 aswTdi aswTdi.SYS Tue Sep 07 10:52:23 2010 (4C8651A7)
853a6000 853af000 atapi atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
853af000 853d2000 ataport ataport.SYS Mon Jul 13 19:11:18 2009 (4A5BBF16)
92f45000 92f62000 AtihdW73 AtihdW73.sys Fri Sep 24 01:43:53 2010 (4C9C3A99)
8dc3d000 8e2d0000 atikmdag atikmdag.sys Tue Oct 26 22:26:21 2010 (4CC78DCD)
8d150000 8d18d000 atikmpag atikmpag.sys Tue Oct 26 22:14:03 2010 (4CC78AEB)
857ee000 857f5000 Beep Beep.SYS Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8d0e8000 8d0f6000 blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
836a5000 836ad000 BOOTVID BOOTVID.dll Mon Jul 13 21:04:34 2009 (4A5BD9A2)
92b02000 92b1b000 bowser bowser.sys Mon Jul 13 19:14:21 2009 (4A5BBFCD)
823e9000 823f6000 BthEnum BthEnum.sys Mon Jul 13 19:51:35 2009 (4A5BC887)
82000000 8201b000 bthpan bthpan.sys Mon Jul 13 19:51:43 2009 (4A5BC88F)
8237a000 823de000 bthport bthport.sys Mon Jul 13 19:51:30 2009 (4A5BC882)
82368000 8237a000 BTHUSB BTHUSB.sys Mon Jul 13 19:51:36 2009 (4A5BC888)
98a20000 98a3e000 cdd cdd.dll Mon Jul 13 21:04:18 2009 (4A5BD992)
82314000 8232a000 cdfs cdfs.sys Mon Jul 13 19:11:14 2009 (4A5BBF12)
85600000 8561f000 cdrom cdrom.sys Mon Jul 13 19:11:24 2009 (4A5BBF1C)
836ef000 8379a000 CI CI.dll Mon Jul 13 21:09:28 2009 (4A5BDAC8)
85790000 857b5000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
836ad000 836ef000 CLFS CLFS.SYS Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8557d000 855da000 cng cng.sys Mon Jul 13 19:32:55 2009 (4A5BC427)
8d218000 8d225000 CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
82336000 82343000 crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8d06c000 8d0d0000 csc csc.sys Mon Jul 13 19:15:08 2009 (4A5BBFFC)
8d0d0000 8d0e8000 dfsc dfsc.sys Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8d060000 8d06c000 discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
8577f000 85790000 disk disk.sys Mon Jul 13 19:11:28 2009 (4A5BBF20)
92f91000 92faa000 drmk drmk.sys Mon Jul 13 20:36:05 2009 (4A5BD2F5)
8234e000 82357000 dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
82343000 8234e000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
82357000 82368000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
8230a000 82314000 Dxapi Dxapi.sys Mon Jul 13 19:25:25 2009 (4A5BC265)
8e2d0000 8e387000 dxgkrnl dxgkrnl.sys Thu Oct 01 20:48:33 2009 (4AC54DE1)
8e387000 8e3c0000 dxgmms1 dxgmms1.sys Mon Jul 13 19:25:25 2009 (4A5BC265)
8dc25000 8dc30000 fdc fdc.sys Mon Jul 13 19:45:45 2009 (4A5BC729)
83600000 83611000 fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
92f2a000 92f34000 flpydisk flpydisk.sys Mon Jul 13 19:45:45 2009 (4A5BC729)
837c0000 837f4000 fltmgr fltmgr.sys Mon Jul 13 19:11:13 2009 (4A5BBF11)
855e8000 855f1000 Fs_Rec Fs_Rec.sys unavailable (00000000)
8574d000 8577f000 fvevol fvevol.sys Fri Sep 25 22:24:21 2009 (4ABD7B55)
8594a000 8597b000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
8301a000 83051000 hal halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
8e3c0000 8e3df000 HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
82265000 82278000 HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
82278000 8227e480 HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
8225a000 82265000 hidusb hidusb.sys Mon Jul 13 19:51:04 2009 (4A5BC868)
92a7d000 92b02000 HTTP HTTP.sys Mon Jul 13 19:12:53 2009 (4A5BBF75)
859f8000 85a00000 hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
8d200000 8d218000 i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
8d13e000 8d150000 intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
853d2000 853ea000 jraid jraid.sys Mon Nov 03 21:20:23 2008 (490FB167)
8d1f0000 8d1fd000 kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
8232a000 82336000 kbdhid kbdhid.sys Mon Jul 13 19:45:09 2009 (4A5BC705)
80ba7000 80baf000 kdcom kdcom.dll Mon Jul 13 21:08:58 2009 (4A5BDAAA)
92ea4000 92ed8000 ks ks.sys Wed Mar 03 22:57:52 2010 (4B8F2FC0)
8556a000 8557d000 ksecdd ksecdd.sys Mon Jul 13 19:11:56 2009 (4A5BBF3C)
85718000 8573d000 ksecpkg ksecpkg.sys Thu Dec 10 23:04:22 2009 (4B21C4C6)
92a5a000 92a6a000 lltdio lltdio.sys Mon Jul 13 19:53:18 2009 (4A5BC8EE)
92fce000 92fe9000 luafv luafv.sys Mon Jul 13 19:15:44 2009 (4A5BC020)
8361c000 83694000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
823de000 823e9000 monitor monitor.sys Mon Jul 13 19:25:58 2009 (4A5BC286)
92e95000 92ea2000 mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
822bd000 822c8000 mouhid mouhid.sys Mon Jul 13 19:45:08 2009 (4A5BC704)
85390000 853a6000 mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
92b1b000 92b2d000 mpsdrv mpsdrv.sys Mon Jul 13 19:52:52 2009 (4A5BC8D4)
92b2d000 92b50000 mrxsmb mrxsmb.sys Sat Feb 27 02:32:02 2010 (4B88CA72)
92b50000 92b8b000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
92b8b000 92ba6000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
8d27e000 8d289000 Msfs Msfs.SYS unavailable (00000000)
852d2000 852da000 msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
8553f000 8556a000 msrpc msrpc.sys Mon Jul 13 19:11:59 2009 (4A5BBF3F)
8d056000 8d060000 mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8573d000 8574d000 mup mup.sys Mon Jul 13 19:14:14 2009 (4A5BBFC6)
85623000 856da000 ndis ndis.sys Mon Jul 13 19:12:24 2009 (4A5BBF58)
92e18000 92e23000 ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
92e23000 92e45000 ndiswan ndiswan.sys Mon Jul 13 19:54:34 2009 (4A5BC93A)
92f34000 92f45000 NDProxy NDProxy.SYS Mon Jul 13 19:54:27 2009 (4A5BC933)
8d37a000 8d388000 netbios netbios.sys Mon Jul 13 19:53:54 2009 (4A5BC912)
8d322000 8d354000 netbt netbt.sys Mon Jul 13 19:12:18 2009 (4A5BBF52)
856da000 85718000 NETIO NETIO.SYS Mon Jul 13 19:12:35 2009 (4A5BBF63)
8d289000 8d297000 Npfs Npfs.SYS Mon Jul 13 19:11:31 2009 (4A5BBF23)
8d04c000 8d056000 nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
83051000 83461000 nt ntkrpamp.exe Fri Jun 18 23:55:24 2010 (4C1C3FAC)
85410000 8553f000 Ntfs Ntfs.sys Mon Jul 13 19:12:05 2009 (4A5BBF45)
857e7000 857ee000 Null Null.SYS unavailable (00000000)
822c8000 822d2000 nx6000 nx6000.sys Wed Jan 27 18:36:05 2010 (4B60CDE5)
8d35b000 8d37a000 pacer pacer.sys Mon Jul 13 19:53:58 2009 (4A5BC916)
8d1d8000 8d1f0000 parport parport.sys Mon Jul 13 19:45:34 2009 (4A5BC71E)
8530f000 85320000 partmgr partmgr.sys Mon Jul 13 19:11:35 2009 (4A5BBF27)
92ba6000 92bad000 parvdm parvdm.sys Mon Jul 13 19:45:29 2009 (4A5BC719)
852da000 85304000 pci pci.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
8537b000 85382000 pciide pciide.sys Mon Jul 13 19:11:19 2009 (4A5BBF17)
85382000 85390000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:11:15 2009 (4A5BBF13)
855da000 855e8000 pcw pcw.sys Mon Jul 13 19:11:10 2009 (4A5BBF0E)
9ec22000 9ecb9000 peauth peauth.sys Mon Jul 13 20:35:44 2009 (4A5BD2E0)
92f62000 92f91000 portcls portcls.sys Mon Jul 13 19:51:00 2009 (4A5BC864)
83694000 836a5000 PSHED PSHED.dll Mon Jul 13 21:09:36 2009 (4A5BDAD0)
92e00000 92e18000 rasl2tp rasl2tp.sys Mon Jul 13 19:54:33 2009 (4A5BC939)
92e45000 92e5d000 raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
92e5d000 92e74000 raspptp raspptp.sys Mon Jul 13 19:54:47 2009 (4A5BC947)
92e74000 92e8b000 rassstp rassstp.sys Mon Jul 13 19:54:57 2009 (4A5BC951)
8d00b000 8d04c000 rdbss rdbss.sys Mon Jul 13 19:14:26 2009 (4A5BBFD2)
92e8b000 92e95000 rdpbus rdpbus.sys Mon Jul 13 20:02:40 2009 (4A5BCB20)
8d266000 8d26e000 RDPCDD RDPCDD.sys Mon Jul 13 20:01:40 2009 (4A5BCAE4)
9ed91000 9edb6000 rdpdr rdpdr.sys Mon Jul 13 20:02:56 2009 (4A5BCB30)
8d26e000 8d276000 rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
8d276000 8d27e000 rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
9edcd000 9edfe000 RDPWD RDPWD.SYS Mon Jul 13 20:01:50 2009 (4A5BCAEE)
859cb000 859f8000 rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
92faa000 92fce000 rfcomm rfcomm.sys Mon Jul 13 19:51:41 2009 (4A5BC88D)
92a6a000 92a7d000 rspndr rspndr.sys Mon Jul 13 19:53:20 2009 (4A5BC8F0)
8dc00000 8dc25000 Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
8201e000 822527c0 RTKVHDA RTKVHDA.sys Tue Jan 20 01:10:46 2009 (49756AE6)
82298000 822bd000 SaiK0CC3 SaiK0CC3.sys Wed Apr 21 12:34:42 2010 (4BCF2922)
82253000 8225a000 SaiU0CC3 SaiU0CC3.sys Wed Apr 21 12:34:40 2010 (4BCF2920)
8379a000 837c0000 SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
9ecb9000 9ecc3000 secdrv secdrv.SYS Wed Sep 13 09:18:32 2006 (45080528)
8dc30000 8dc3a000 serenum serenum.sys Mon Jul 13 19:45:27 2009 (4A5BC717)
8d388000 8d3a2000 serial serial.sys Mon Jul 13 19:45:33 2009 (4A5BC71D)
859c3000 859cb000 spldr spldr.sys Mon May 11 12:13:47 2009 (4A084EBB)
9ed40000 9ed91000 srv srv.sys Thu Aug 26 23:31:26 2010 (4C77318E)
9ecf1000 9ed40000 srv2 srv2.sys Thu Aug 26 23:30:45 2010 (4C773165)
9ecc3000 9ece4000 srvnet srvnet.sys Thu Aug 26 23:30:39 2010 (4C77315F)
92ea2000 92ea3380 swenum swenum.sys Mon Jul 13 19:45:08 2009 (4A5BC704)
85801000 8594a000 tcpip tcpip.sys Sun Jun 13 23:36:59 2010 (4C15A3DB)
9ece4000 9ecf1000 tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
8d2ae000 8d2b9000 TDI TDI.SYS Mon Jul 13 19:12:12 2009 (4A5BBF4C)
9edb6000 9edc0000 tdtcp tdtcp.sys Mon Jul 13 20:01:37 2009 (4A5BCAE1)
8d297000 8d2ae000 tdx tdx.sys Mon Jul 13 19:12:10 2009 (4A5BBF4A)
8d3b5000 8d3c5000 termdd termdd.sys Mon Jul 13 20:01:35 2009 (4A5BCADF)
98df0000 98df9000 TSDDD TSDDD.dll unavailable (00000000)
9edc0000 9edcd000 tssecsrv tssecsrv.sys Mon Jul 13 20:01:50 2009 (4A5BCAEE)
8d11d000 8d13e000 tunnel tunnel.sys Mon Jul 13 19:54:03 2009 (4A5BC91B)
92ed8000 92ee6000 umbus umbus.sys Mon Jul 13 19:51:38 2009 (4A5BC88A)
822f6000 82309b00 usbaudio usbaudio.sys Mon Jul 13 19:51:23 2009 (4A5BC87B)
82281000 82298000 usbccgp usbccgp.sys Mon Jul 13 19:51:31 2009 (4A5BC883)
8227f000 82280700 USBD USBD.SYS Mon Jul 13 19:51:05 2009 (4A5BC869)
8e3ea000 8e3f9000 usbehci usbehci.sys Mon Jul 13 19:51:14 2009 (4A5BC872)
92ee6000 92f2a000 usbhub usbhub.sys Mon Jul 13 19:52:06 2009 (4A5BC8A6)
8d18d000 8d1d8000 USBPORT USBPORT.SYS Mon Jul 13 19:51:13 2009 (4A5BC871)
8e3df000 8e3ea000 usbuhci usbuhci.sys Mon Jul 13 19:51:10 2009 (4A5BC86E)
822d2000 822f5b80 usbvideo usbvideo.sys Wed Mar 03 23:04:40 2010 (4B8F3158)
85304000 8530f000 vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
855f1000 855fd000 vga vga.sys Mon Jul 13 19:25:50 2009 (4A5BC27E)
8d238000 8d259000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
8597b000 85984000 vmstorfl vmstorfl.sys unavailable (00000000)
85320000 85330000 volmgr volmgr.sys Mon Jul 13 19:11:25 2009 (4A5BBF1D)
85330000 8537b000 volmgrx volmgrx.sys unavailable (00000000)
85984000 859c3000 volsnap volsnap.sys Mon Jul 13 19:11:34 2009 (4A5BBF26)
8d3a2000 8d3b5000 wanarp wanarp.sys Mon Jul 13 19:55:02 2009 (4A5BC956)
8d259000 8d266000 watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
85202000 85273000 Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
85273000 85281000 WDFLDR WDFLDR.SYS Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8d354000 8d35b000 wfplwf wfplwf.sys Mon Jul 13 19:53:51 2009 (4A5BC90F)
98b90000 98ddb000 win32k win32k.sys Tue Oct 19 23:00:01 2010 (4CBE5B31)
852c9000 852d2000 WMILIB WMILIB.SYS Mon Jul 13 19:11:22 2009 (4A5BBF1A)
Unloaded modules:
857b5000 857c2000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
857c2000 857cd000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000B000
857cd000 857d6000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
857d6000 857e7000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00011000