This ones a doozy guys

cybercore · 13 Jan 2011

@ Thank Ken. :)

@ Spot on, Carl.

@ Good luck Shawnio.

CarlTR6 · 13 Jan 2011

That's cool and please do. We will be here.

cybercore · 13 Jan 2011

Yup. Me too. :)

Shawnio · 13 Jan 2011

Ive had two more crashes, I think I removed the Eset (nod32) when I tried to install a fresh copy I got the first dump, then about an hour later while I was monitoring the cpu it BSOD on me again

heres what my resources were at when it happened and I have attached the dumps

the screenshot, is my systems memory supposed to be at 80% usage when im not doing anything?

Im experiencing frequent Driver_IRQL_Not_Less_Or_Greater BSOD's now

CarlTR6 · 13 Jan 2011

Each of the two dumps has a different bugcheck code and both blame Windows system files, which are highly unlikely to be the real cause. I see Eset loaded in the most recent of the two dumps. It is the same version as you had installed previously and this version is definitely known to cause problems on some Win 7 systems. The dumps do not point to a definite cause. This means you have to troubleshoot by the process of elimination. You need to eliminate all possible sources of conflict. Since your version of Eset is a known possible cause of BSOD's, you need to uninstall it. Once your system is stable, you can certainly try Eset again; but follow Cybercore's advice and install the latest version - not the version you now have. In the meantime, while you are troubleshooting, I suggest you install Microsoft Security Essentials.

AVG is gone; good job. I still see outdated drivers loaded on your system. Three of these drivers are dated 2007 are not going to work with Win 7. One of them was involved in both of the crashes. Update these drivers or uninstall the software or hardware they are associated with. Be sure to update the Realtek driver.

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC Realtek.

US122Wdmx64.sys Wed Aug 29 15:52:59 2007 - external audio device, Tascam us-122. Downloads | TASCAM.

US122x64.sys Wed Aug 29 15:52:36 2007 - external audio device, Tascam us-122. Downloads | TASCAM.

V0260Vid.sys Tue Jul 17 23:34:14 2007 - Creative Camera driver. Creative Worldwide Support.

cybercore · 14 Jan 2011

Shawnio said:

Ive had two more crashes, I think I removed the Eset (nod32) when I tried to install a fresh copy I got the first dump, then about an hour later while I was monitoring the cpu it BSOD on me again

heres what my resources were at when it happened and I have attached the dumps

the screenshot, is my systems memory supposed to be at 80% usage when im not doing anything?

Im experiencing frequent Driver_IRQL_Not_Less_Or_Greater BSOD's now

The nod drivers are all there, which means you didn't uninstall it:

Code:

 fffff880`02066000 fffff880`02138000   eamon    eamon.sys    Fri Sep 11  01:12:19 2009 (4AA9DC33)
fffff880`0190f000 fffff880`01932000   ehdrv     ehdrv.sys    Fri Sep 11 01:12:55 2009 (4AA9DC57)
fffff880`04671000  fffff880`04691000   epfwwfpr epfwwfpr.sys Fri Sep 11 01:07:43 2009  (4AA9DB1F)

First try Eset uninstaller file, then use Revo Uninstaller.

Reboot and install Eset 2010. Or you can replace NOD with MSE.

http://www.microsoft.com/security_essentials/

Update drivers as on page 1 of this thread.

Crash Dumps:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [F:\a\Minidump\D M P\DMP\011311-20732-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e40e50
Debug session time: Thu Jan 13 13:30:52.115 2011 (UTC - 5:00)
System Uptime: 0 days 3:58:13.175
Loading Kernel Symbols
.
 
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
 
..............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 1E, {ffffffffc0000005, fffff800030cf852, 0, 58}
 
Probably caused by : ntkrnlmp.exe ( nt!PfSnPrefetchSections+32 )
 
Followup: MachineOwner
---------
 
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030cf852, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000058, Parameter 1 of the exception
 
Debugging Details:
------------------
 
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
 
FAULTING_IP: 
nt!PfSnPrefetchSections+32
fffff800`030cf852 418b4758        mov     eax,dword ptr [r15+58h]
 
EXCEPTION_PARAMETER1:  0000000000000000
 
EXCEPTION_PARAMETER2:  0000000000000058
 
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eab0e0
 0000000000000058 
 
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
 
BUGCHECK_STR:  0x1E_c0000005
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
 
PROCESS_NAME:  PCPitstopSched
 
CURRENT_IRQL:  0
 
EXCEPTION_RECORD:  fffff880027133e8 -- (.exr 0xfffff880027133e8)
ExceptionAddress: fffff800030cf852 (nt!PfSnPrefetchSections+0x0000000000000032)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000058
Attempt to read from address 0000000000000058
 
TRAP_FRAME:  fffff88002713490 -- (.trap 0xfffff88002713490)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002713708 rbx=0000000000000000 rcx=fffff88002713740
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030cf852 rsp=fffff88002713620 rbp=fffff8a002e98000
 r8=0000000000000000  r9=0000000000000000 r10=fffff80002db3600
r11=0000000000000045 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!PfSnPrefetchSections+0x32:
fffff800`030cf852 418b4758        mov     eax,dword ptr [r15+58h] ds:00000000`00000058=????????
Resetting default scope
 
LAST_CONTROL_TRANSFER:  from fffff80002cada39 to fffff80002c73740
 
STACK_TEXT:  
fffff880`02712c18 fffff800`02cada39 : 00000000`0000001e ffffffff`c0000005 fffff800`030cf852 00000000`00000000 : nt!KeBugCheckEx
fffff880`02712c20 fffff800`02c72d82 : fffff880`027133e8 00000000`00000005 fffff880`02713490 00000000`00000005 : nt!KiDispatchException+0x1b9
fffff880`027132b0 fffff800`02c718fa : 00000000`00000000 00000000`00000005 fffff8a0`00268a00 fffff880`0110c4a5 : nt!KiExceptionDispatch+0xc2
fffff880`02713490 fffff800`030cf852 : 00000000`00000000 fffff880`02713740 fffff880`00000008 00000000`00004021 : nt!KiPageFault+0x23a
fffff880`02713620 fffff800`030cfe7d : fffff880`02713740 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PfSnPrefetchSections+0x32
fffff880`02713710 fffff800`030d02bf : 00000000`00d0c08f fffffa80`02a73490 fffff8a0`02e98000 00000000`00000000 : nt!PfSnPrefetchScenario+0x16d
fffff880`02713980 fffff800`02ec86df : 00000000`00000000 00000000`aaea77b6 fffffa80`02656e40 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`02713a50 fffff800`02f412fc : fffffa80`03f40b60 fffffa80`02656e40 00000000`14050800 00000000`7efde000 : nt! ?? ::NNGAKEGL::`string'+0x50100
fffff880`02713a80 fffff800`02c51d55 : fffff800`02dede80 00000000`00000000 fffff800`02f41200 fffffa80`03f40b60 : nt!PspUserThreadStartup+0xfc
fffff880`02713ae0 fffff800`02c51cd7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`02713c20 00000000`774e3260 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`0008fcf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774e3260
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
nt!PfSnPrefetchSections+32
fffff800`030cf852 418b4758        mov     eax,dword ptr [r15+58h]
 
SYMBOL_STACK_INDEX:  4
 
SYMBOL_NAME:  nt!PfSnPrefetchSections+32
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: nt
 
IMAGE_NAME:  ntkrnlmp.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
 
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!PfSnPrefetchSections+32
 
BUCKET_ID:  X64_0x1E_c0000005_nt!PfSnPrefetchSections+32
 
Followup: MachineOwner
---------
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [F:\a\Minidump\D M P\DMP\011311-26130-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c1f000 PsLoadedModuleList = 0xfffff800`02e5ce50
Debug session time: Thu Jan 13 14:59:04.652 2011 (UTC - 5:00)
System Uptime: 0 days 1:16:22.556
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck D1, {fffff880024fa3f8, 2, 0, fffff88000c1bc50}
 
Probably caused by : ataport.SYS ( ataport!IdeLogCrbActive+bc )
 
Followup: MachineOwner
---------
 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff880024fa3f8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88000c1bc50, address which referenced memory
 
Debugging Details:
------------------
 
 
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec70e0
 fffff880024fa3f8 
 
CURRENT_IRQL:  2
 
FAULTING_IP: 
ataport!IdeLogCrbActive+bc
fffff880`00c1bc50 f30f6f4148      movdqu  xmm0,xmmword ptr [rcx+48h]
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
 
BUGCHECK_STR:  0xD1
 
PROCESS_NAME:  System
 
TRAP_FRAME:  fffff80000b9c590 -- (.trap 0xfffff80000b9c590)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8002bf40e0 rbx=0000000000000000 rcx=fffff880024fa3b0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000c1bc50 rsp=fffff80000b9c720 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffffa800445dc20
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
ataport!IdeLogCrbActive+0xbc:
fffff880`00c1bc50 f30f6f4148      movdqu  xmm0,xmmword ptr [rcx+48h] ds:5050:fffff880`024fa3f8=????????????????????????????????
Resetting default scope
 
LAST_CONTROL_TRANSFER:  from fffff80002c8eca9 to fffff80002c8f740
 
STACK_TEXT:  
fffff800`00b9c448 fffff800`02c8eca9 : 00000000`0000000a fffff880`024fa3f8 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c450 fffff800`02c8d920 : fffffa80`01ff51a0 fffffa80`00c914a0 fffffa80`01ff5d20 fffff880`02c025c2 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c590 fffff880`00c1bc50 : 00000000`00000000 00000000`00000000 fffffa80`00c8f1b0 00000000`00000001 : nt!KiPageFault+0x260
fffff800`00b9c720 fffff880`00c25c71 : 00000000`00000000 fffffa80`015df1a0 fffffa80`0445db80 fffff800`c0000001 : ataport!IdeLogCrbActive+0xbc
fffff800`00b9c750 fffff800`031ff62f : 00000000`00000000 fffffa80`0445dc20 fffffa80`00c45ea0 00000008`00000000 : ataport!IdeStartIoCallBack+0xc9
fffff800`00b9c8c0 fffff880`00de80d3 : fffffa80`0445db80 fffff880`00de812c 00000000`00000000 fffff880`00c29719 : hal!HalBuildScatterGatherList+0x203
fffff800`00b9c930 fffff880`00c25b3b : fffffa80`0445db80 fffffa80`00c8f1b0 fffffa80`015df1a0 fffffa80`0445db80 : PCIIDEX!BmSetup+0x6b
fffff800`00b9c990 fffff880`00c247eb : fffffa80`015e0500 fffffa80`00c8f1b0 fffffa80`015e0500 fffffa80`015df1a0 : ataport!IdeDispatchChannelRequest+0xef
fffff800`00b9c9c0 fffff880`00c2431e : 00000000`00000001 fffffa80`0445db80 00000000`00000001 fffffa80`0445db80 : ataport!IdeStartChannelRequest+0x113
fffff800`00b9ca40 fffff880`00c26582 : fffffa80`0209ad00 00000000`00000000 fffffa80`00c8f1b0 fffffa80`00f1eb80 : ataport!IdeStartNextDeviceRequest+0x18e
fffff800`00b9cae0 fffff880`00c260ec : fffffa80`015df1a0 00000000`00000000 fffffa80`015df1a0 fffffa80`00f1eb80 : ataport!IdeProcessCompletedRequests+0x26a
fffff800`00b9cc10 fffff800`02c9abfc : fffff800`02e09e80 00000003`55a67e04 fffffa80`015df050 fffffa80`015df118 : ataport!IdePortCompletionDpc+0x1a8
fffff800`00b9ccd0 fffff800`02c97eea : fffff800`02e09e80 fffff800`02e17c40 00000000`00000000 fffff880`00c25f44 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
ataport!IdeLogCrbActive+bc
fffff880`00c1bc50 f30f6f4148      movdqu  xmm0,xmmword ptr [rcx+48h]
 
SYMBOL_STACK_INDEX:  3
 
SYMBOL_NAME:  ataport!IdeLogCrbActive+bc
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: ataport
 
IMAGE_NAME:  ataport.SYS
 
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc118
 
FAILURE_BUCKET_ID:  X64_0xD1_ataport!IdeLogCrbActive+bc
 
BUCKET_ID:  X64_0xD1_ataport!IdeLogCrbActive+bc
 
Followup: MachineOwner
---------

Drivers:

Code:

start             end                 module name
fffff880`00f47000 fffff880`00f9e000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`03abf000 fffff880`03b49000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02c56000 fffff880`02c6c000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00c44000 fffff880`00c4f000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00ff1000 fffff880`00ffa000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00c1a000 fffff880`00c44000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`01908000 fffff880`0190f000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02d78000 fffff880`02d89000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`04787000 fffff880`047a5000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00670000 fffff960`00697000   cdd      cdd.dll      unavailable (00000000)
fffff880`04fa6000 fffff880`04fc3000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`018d5000 fffff880`018ff000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d27000 fffff880`00de7000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0186f000 fffff880`0189f000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cc9000 fffff880`00d27000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`03dec000 fffff880`03dfc000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`04fc3000 fffff880`04fd1000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02cd7000 fffff880`02d5a000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02d5a000 fffff880`02d78000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03a68000 fffff880`03a77000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01859000 fffff880`0186f000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04f7e000 fffff880`04fa0000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`04fdd000 fffff880`04fe6000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04fd1000 fffff880`04fdd000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04fe6000 fffff880`04ff9000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`04c3f000 fffff880`04c4b000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`03c8e000 fffff880`03d82000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`03d82000 fffff880`03dc8000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`02066000 fffff880`02138000   eamon    eamon.sys    Fri Sep 11 01:12:19 2009 (4AA9DC33)
fffff880`0190f000 fffff880`01932000   ehdrv    ehdrv.sys    Fri Sep 11 01:12:55 2009 (4AA9DC57)
fffff880`04671000 fffff880`04691000   epfwwfpr epfwwfpr.sys Fri Sep 11 01:07:43 2009 (4AA9DB1F)
fffff880`01121000 fffff880`01135000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010d5000 fffff880`01121000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0122b000 fffff880`01235000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
fffff880`0181f000 fffff880`01859000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`03c7d000 fffff880`03c8a000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`031fb000 fffff800`03244000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`03dc8000 fffff880`03dec000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04c0e000 fffff880`04c27000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04c27000 fffff880`04c2f080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04c00000 fffff880`04c0e000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`046bf000 fffff880`04787000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`015f4000 fffff880`015fd000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03c50000 fffff880`03c6e000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0400f000 fffff880`045f32c0   igdkmd64 igdkmd64.sys Fri Sep 11 13:04:45 2009 (4AAA832D)
fffff880`00e86000 fffff880`00e8e000   intelide intelide.sys Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02daf000 fffff880`02dc5000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`03c6e000 fffff880`03c7d000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bc8000 fffff800`00bcb000   kdcom    kdcom.dll    Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`03eaa000 fffff880`03eed000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`01200000 fffff880`0121a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`04fa0000 fffff880`04fa5200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`02159000 fffff880`0216e000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03f6e000 fffff880`03f91000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c71000 fffff880`00cb5000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`04c50000 fffff880`04c5e000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`02cbf000 fffff880`02cce000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04c32000 fffff880`04c3f000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c00000 fffff880`00c1a000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`047a5000 fffff880`047bd000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`047bd000 fffff880`047ea000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`04600000 fffff880`0464e000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0464e000 fffff880`04671000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01990000 fffff880`0199b000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fa7000 fffff880`00fb1000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01135000 fffff880`01193000   msrpc    msrpc.sys    unavailable (00000000)
fffff880`03a5d000 fffff880`03a68000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`015e2000 fffff880`015f4000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014e8000 fffff880`015da000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`045f4000 fffff880`04600000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`02c90000 fffff880`02cbf000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03f59000 fffff880`03f6e000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`03bbd000 fffff880`03bcc000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03b49000 fffff880`03b8e000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0199b000 fffff880`019ac000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03a51000 fffff880`03a5d000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02c1f000 fffff800`031fb000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0124a000 fffff880`013ed000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`018ff000 fffff880`01908000   Null     Null.SYS     unavailable (00000000)
fffff880`03b97000 fffff880`03bbd000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e00000 fffff880`00e15000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00fb1000 fffff880`00fe4000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00de7000 fffff880`00df7000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0121a000 fffff880`0122b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`03e00000 fffff880`03ea6000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04f41000 fffff880`04f7e000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cb5000 fffff880`00cc9000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`02c6c000 fffff880`02c90000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`02dc5000 fffff880`02de0000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03a77000 fffff880`03a98000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`02de0000 fffff880`02dfa000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03a00000 fffff880`03a51000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04000000 fffff880`0400b000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`01975000 fffff880`0197e000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0197e000 fffff880`01987000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`01987000 fffff880`01990000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01193000 fffff880`011cd000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`0216e000 fffff880`02186000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03c00000 fffff880`03c32000   Rt64win7 Rt64win7.sys Thu Feb 26 04:04:13 2009 (49A65B0D)
fffff880`04ced000 fffff880`04f40700   RTKVHD64 RTKVHD64.sys Wed Jul 28 06:01:36 2010 (4C500000)
fffff880`04691000 fffff880`0469c000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`015da000 fffff880`015e2000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`038cb000 fffff880`0393c000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`03835000 fffff880`038cb000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`03f91000 fffff880`03ff8000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`02186000 fffff880`021b3000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`03dfc000 fffff880`03dfd480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0469c000 fffff880`046ae000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`019ca000 fffff880`019d7000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`019ac000 fffff880`019ca000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03be7000 fffff880`03bfb000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00540000 fffff960`0054a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02d89000 fffff880`02daf000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`03eed000 fffff880`03eff000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04cbe000 fffff880`04ccd600   US122Wdmx64 US122Wdmx64.sys Wed Aug 29 15:52:59 2007 (46D5CE9B)
fffff880`04c8d000 fffff880`04cbde80   US122x64 US122x64.sys Wed Aug 29 15:52:36 2007 (46D5CE84)
fffff880`04c30000 fffff880`04c31f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`03c3f000 fffff880`03c50000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`03eff000 fffff880`03f59000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`02c00000 fffff880`02c56000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`03c32000 fffff880`03c3f000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`04c5e000 fffff880`04c8c4e0   V0260Vid V0260Vid.sys Tue Jul 17 23:34:14 2007 (469D8A36)
fffff880`00fe4000 fffff880`00ff1000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01932000 fffff880`01940000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01940000 fffff880`01965000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`014d5000 fffff880`014e5000   vmstorfl vmstorfl.sys unavailable (00000000)
fffff880`00e15000 fffff880`00e2a000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e2a000 fffff880`00e86000   volmgrx  volmgrx.sys  unavailable (00000000)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`03bcc000 fffff880`03be7000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`01965000 fffff880`01975000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e94000 fffff880`00f38000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f38000 fffff880`00f47000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03b8e000 fffff880`03b97000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00020000 fffff960`00330000   win32k   win32k.sys   unavailable (00000000)
fffff880`00f9e000 fffff880`00fa7000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`02138000 fffff880`02159000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
 
Unloaded modules:
fffff880`04c4b000 fffff880`04c50000   US122DLx64.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00005000
fffff880`0189f000 fffff880`018ad000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`018ad000 fffff880`018b9000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`018b9000 fffff880`018c2000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`018c2000 fffff880`018d5000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000