BSOD nightmare

schouwla · 22 Feb 2011

My system gives me the BSOD after I used for round 10 minutes, but seems to work stable in safe mode.
How do I diagnostics the crash files, I can't find a workable download link to Windows 7 - Microsoft Diagnostics and Recovery Toolset.

I ran about 10 minutes memory test but could not find any problem (will do the fill run tonight).

I did find some malware and removed it.. hopefully all of it!

I ran a check disk on my c drive.
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
139008 file records processed. File verification completed.
1120 large file records processed. 0 bad file records processed. 2 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
188940 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
139008 file SDs/SIDs processed. Cleaning up 391 unused index entries from index $SII of file 0x9.
Cleaning up 391 unused index entries from index $SDH of file 0x9.
Cleaning up 391 unused security descriptors.
Security descriptor verification completed.
24967 data files processed. CHKDSK is verifying Usn Journal...
34788480 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
138992 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
27361934 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

156286975 KB total disk space.
46517700 KB in 75916 files.
77412 KB in 24968 indexes.
0 KB in bad sectors.
244123 KB in use by the system.
65536 KB occupied by the log file.
109447740 KB available on disk.

4096 bytes in each allocation unit.
39071743 total allocation units on disk.
27361935 allocation units available on disk.

Internal Info:
00 1f 02 00 1f 8a 01 00 ff f4 02 00 00 00 00 00 ................
eb 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

CarlTR6 · 22 Feb 2011

Hi schouwla, and welcome to the forum. Please read this tutorial, follow the instructions and post back. We will be glad to help you.

https://www.sevenforums.com/crashes-d...tructions.html

Your Check Disk results look good and you have 0 bad sectors.

It takes special software to analyze and read a dump file. And then it takes a lot of experience to understand what you are reading. Most of us here use WinDbg. Another is BlueScreenView.

Make sure your computer is set up for small memory dumps, NOT memory dumps. The last part of the first post in this tutorial shows you how to set your computer for small memory dumps: https://www.sevenforums.com/tutorials...en-forums.html

schouwla · 23 Feb 2011

I ran you excellent tool (BSOD Dump & System File Collection app), there should be a mini dump there from a recent crash 5 minutes ago. Please find the report attached.

I will try to run perfmon /report now, but are not sure the system is stable that long.

schouwla · 23 Feb 2011

I have attached the perfmon /report report.

Forgot to mention some information about my system.

Is Windows 7 x64, original installed from the retail version.. . .
The hardware is one year old and I installed the OS fresh 2 days ago again from scratch.

CarlTR6 · 23 Feb 2011

Thanks for the files. In your perfmon report I see the following error and this is your video display driver.

A device has a configuration problem that prevents it from working properly.details:The device, amdkmdag, is reporting "tv_ConfigMgrErr24". This device will not be available until the issue is resolved. The Plug and Play ID for this device is ROOT\LEGACY_AMDKMDAG\0000.resolution:1. Verify the correct driver is installed.
2. Try updating the drivers using Windows Update.
3. Check with the manufacturer for an updated driver.
4. Attempt to uninstall and then reinstall the device using Device Manager.

Your JCGriff upload appears to be infected with the Alureon virus. It triggered my antivirus program and I cannot download the files.

I suggest that you run an antivirus scan. What AV program are you using? Also download, install, update and run Malwarebytes (free). I am going to ask a moderator to check your upload in case I am getting a false alert.

schouwla · 23 Feb 2011

I am very sorry that there was a virus on my system.
I reinstalled everything again.

CarlTR6 · 23 Feb 2011

It was a false alarm from Avast. There is no virus in your upload. I looked at your three most recent dumps. All three blame Widows System files, which are highly unlikely to be the real causes, and all three indicate memory corruption.

You have an almost guaranteed BSOD maker loaded on your system. ASACPI.sys Sun Mar 27 22:30:36 2005

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

Also update this driver theough the link provided. There is an updated driver availalble.

yk62x64.sys Mon Feb 23 10:02:27 2009 - Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller. Marvell: Support

Follow these two suggestions, reboot and let's see how your system runs.

Code:

Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c4ce50
Debug session time: Wed Feb 23 01:16:16.374 2011 (GMT-5)
System Uptime: 0 days 0:03:45.498
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {bb0, 2, 0, fffff80002a9f2b3}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000bb0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a9f2b3, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb70e0
 0000000000000bb0 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02a9f2b3 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  conhost.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff880076a2210 -- (.trap 0xfffff880076a2210)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880076a2718 rbx=0000000000000000 rcx=0000000000000bb0
rdx=0000000000000bb0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a9f2b3 rsp=fffff880076a23a0 rbp=fffff880076a24f0
 r8=fffffa800b24b7e0  r9=fffff880076a24a0 r10=0000000000000002
r11=fffffa800a52eda0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!IopCompleteRequest+0xae3:
fffff800`02a9f2b3 488b09          mov     rcx,qword ptr [rcx] ds:0400:00000000`00000bb0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a7eca9 to fffff80002a7f740

STACK_TEXT:  
fffff880`076a20c8 fffff800`02a7eca9 : 00000000`0000000a 00000000`00000bb0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`076a20d0 fffff800`02a7d920 : fffffa80`0a541b30 fffffa80`0cb8cee0 00000000`00000100 fffffa80`0a263790 : nt!KiBugCheckDispatch+0x69
fffff880`076a2210 fffff800`02a9f2b3 : 00000000`00000001 00000000`00000001 00000000`00000000 fffff800`02a74dff : nt!KiPageFault+0x260
fffff880`076a23a0 fffff800`02a5c0b7 : 00000000`00000001 00000000`00000000 00000000`00000700 00000000`00000000 : nt!IopCompleteRequest+0xae3
fffff880`076a2470 fffff800`02a5c477 : fffffa80`0a2636d0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`076a24f0 fffff800`02e18e16 : 00000000`0000007f 00000000`000000f0 fffff900`c1b66530 fffff960`001979e7 : nt!KiApcInterrupt+0xd7
fffff880`076a2680 fffff800`02cda268 : fffffa80`00000000 00000000`00000200 00000001`00000080 fffff880`076a2718 : nt!MmEnumerateAndReferenceImages+0x46
fffff880`076a2700 fffff800`02d3b53e : fffffa80`0a541b30 00000000`00000000 fffffa80`0a2636d0 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0x20d99
fffff880`076a28a0 fffff800`02d629c4 : 000007ff`fffd8000 fffff880`076a2c20 00000000`00000000 fffffa80`09daad40 : nt!PspExitProcess+0x4e
fffff880`076a2900 fffff800`02d3c735 : 00000000`00000000 fffffa80`0a263601 000007ff`fffd8000 fffffa80`0a254060 : nt!PspExitThread+0x834
fffff880`076a29c0 fffff800`02a5c1cb : 00000000`00000000 00000000`00000000 fffffa80`0ca09ce0 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`076a29f0 fffff800`02a5c610 : 00000000`002017a0 fffff880`076a2a70 fffff800`02d3c84c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`076a2a70 fffff800`02a7ea37 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`076a2bb0 00000000`7768f71a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`01c8f4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7768f71a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02a7d920 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Debug session time: Tue Feb 22 19:09:07.740 2011 (GMT-5)
System Uptime: 0 days 0:04:13.864
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002ad2a5a, 0, ffffffffffffffff}

Probably caused by : win32k.sys ( win32k!UserDeleteW32Process+a4 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ad2a5a, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiPageFault+39a
fffff800`02ad2a5a 48cf            iretq

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0c0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  unlodctr.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88007753168 -- (.exr 0xfffff88007753168)
ExceptionAddress: fffff80002ad2a5a (nt!KiPageFault+0x000000000000039a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880077533a8 -- (.trap 0xfffff880077533a8)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a00000f1f0 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa800a4e5000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000401802 rsp=000000002796440c rbp=0000000000000000
 r8=0000000020206f49  r9=0000000000000002 r10=0000002e00000100
r11=fffff8a00a43c03e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=2         ov dn ei pl zr na pe cy
8070:fffff880`00401802 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b0ea39 to fffff80002ad4740

STACK_TEXT:  
fffff880`07752998 fffff800`02b0ea39 : 00000000`0000001e ffffffff`c0000005 fffff800`02ad2a5a 00000000`00000000 : nt!KeBugCheckEx
fffff880`077529a0 fffff800`02ad3d82 : fffff880`07753168 fffffa80`0acc4c80 fffff880`07753210 00000000`00000001 : nt!KiDispatchException+0x1b9
fffff880`07753030 fffff800`02ad268a : fffff8a0`0a43c010 00000000`00000011 00000000`00000000 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffff880`07753210 fffff800`02ad2a5a : fffff800`02db85f1 00000000`00000200 00000000`00010292 fffff880`077533d0 : nt!KiGeneralProtectionFault+0x10a
fffff880`077533a8 fffff960`0014d414 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x39a
00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!UserDeleteW32Process+0xa4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!UserDeleteW32Process+a4
fffff960`0014d414 488b5c2430      mov     rbx,qword ptr [rsp+30h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!UserDeleteW32Process+a4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d23ecb0

FAILURE_BUCKET_ID:  X64_0x1E_win32k!UserDeleteW32Process+a4

BUCKET_ID:  X64_0x1E_win32k!UserDeleteW32Process+a4

Followup: MachineOwner
---------

2: kd> lmtsmn
start             end                 module name
fffff880`04555000 fffff880`04593000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f88000 fffff880`00fdf000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0400e000 fffff880`04098000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`045c1000 fffff880`045d7000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00dd5000 fffff880`00de0000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`045a0000 fffff880`045a8000   ASACPI   ASACPI.sys   Sun Mar 27 22:30:36 2005 (42476C4C)
fffff880`00c8d000 fffff880`00c96000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00dab000 fffff880`00dd5000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`043a9000 fffff880`043f4000   atikmpag atikmpag.sys Tue Oct 26 22:14:23 2010 (4CC78AFF)
fffff880`01974000 fffff880`0197b000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`0435c000 fffff880`0436d000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`03d51000 fffff880`03d6f000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff880`01910000 fffff880`0193a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00e15000 fffff880`00ed5000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`018aa000 fffff880`018da000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d05000 fffff880`00d63000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01114000 fffff880`01187000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`045b1000 fffff880`045c1000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`04a71000 fffff880`04a7f000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`042bb000 fffff880`0433e000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`0433e000 fffff880`0435c000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`041b2000 fffff880`041c1000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01894000 fffff880`018aa000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04a3d000 fffff880`04a5f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`04a8b000 fffff880`04a94000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04a7f000 fffff880`04a8b000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04a94000 fffff880`04aa7000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`04a65000 fffff880`04a71000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff960`00520000 fffff960`0053e000   dxg      dxg.sys      Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0619f000 fffff880`061d5000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`04593000 fffff880`045a0000   fdc      fdc.sys      Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`010a2000 fffff880`010b6000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`04b7d000 fffff880`04b88000   flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`01056000 fffff880`010a2000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff960`00820000 fffff960`00829000   framebuf framebuf.dll unavailable (00000000)
fffff880`01211000 fffff880`0121b000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`0185a000 fffff880`01894000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`015a6000 fffff880`015f0000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`02a1b000 fffff800`02a64000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`04200000 fffff880`04224000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04b9d000 fffff880`04bf9000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`06133000 fffff880`0614c000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`0614c000 fffff880`06154080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`06125000 fffff880`06133000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`03c89000 fffff880`03d51000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0141a000 fffff880`01423000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`04393000 fffff880`043a9000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`0449c000 fffff880`044ab000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06155000 fffff880`06163000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bb9000 fffff800`00bbc000   kdcom    kdcom.dll    Thu Feb 17 06:33:32 2011 (4D5D078C)
fffff880`04ace000 fffff880`04b11000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013dc000 fffff880`013f6000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`0157b000 fffff880`015a6000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`04a5f000 fffff880`04a64200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`044dd000 fffff880`044f2000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04aa7000 fffff880`04aca000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`06170000 fffff880`0617a000   LVPr2M64 LVPr2M64.sys Fri May 07 21:38:16 2010 (4BE4C088)
fffff880`05a04000 fffff880`05dfaa80   lvuvc64  lvuvc64.sys  Tue Nov 09 21:37:14 2010 (4CDA055A)
fffff880`00cad000 fffff880`00cf1000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`044ab000 fffff880`044ba000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06163000 fffff880`06170000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c73000 fffff880`00c8d000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0193a000 fffff880`0196b000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`0617a000 fffff880`0618a000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`03d6f000 fffff880`03d87000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`03d87000 fffff880`03db4000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`03c00000 fffff880`03c4e000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`03c4e000 fffff880`03c71000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`019d9000 fffff880`019e4000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fe8000 fffff880`00ff2000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`010b6000 fffff880`01114000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`041a7000 fffff880`041b2000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01408000 fffff880`0141a000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01429000 fffff880`0151b000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04400000 fffff880`0440c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0440c000 fffff880`0443b000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04b88000 fffff880`04b9d000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`0410c000 fffff880`0411b000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`04098000 fffff880`040dd000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0151b000 fffff880`0157b000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`0618a000 fffff880`0619f000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`019e4000 fffff880`019f5000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0419b000 fffff880`041a7000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a64000 fffff800`03041000   nt       ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD)
fffff880`01239000 fffff880`013dc000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0196b000 fffff880`01974000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`040e6000 fffff880`0410c000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e00000 fffff880`00e15000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d63000 fffff880`00d96000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00c5c000 fffff880`00c63000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00c63000 fffff880`00c73000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01200000 fffff880`01211000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`05ea8000 fffff880`05f4e000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04a00000 fffff880`04a3d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cf1000 fffff880`00d05000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`045d7000 fffff880`045fb000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0443b000 fffff880`04456000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04456000 fffff880`04477000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`04477000 fffff880`04491000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`0414a000 fffff880`0419b000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04491000 fffff880`0449c000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`019be000 fffff880`019c7000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019c7000 fffff880`019d0000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019d0000 fffff880`019d9000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01000000 fffff880`0103a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`041dc000 fffff880`041f4000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05f4e000 fffff880`05f59000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`01400000 fffff880`01408000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`05e00000 fffff880`05e71000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`0608f000 fffff880`06125000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`05f98000 fffff880`05fff000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`05f59000 fffff880`05f86000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`044ba000 fffff880`044bb480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`05f86000 fffff880`05f98000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`0181e000 fffff880`0182b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`01800000 fffff880`0181e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`04136000 fffff880`0414a000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00760000 fffff960`0076a000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0436d000 fffff880`04393000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04b11000 fffff880`04b23000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`041c1000 fffff880`041dbc00   usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04298000 fffff880`042b5000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04aca000 fffff880`04acbf00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04287000 fffff880`04298000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04b23000 fffff880`04b7d000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04231000 fffff880`04287000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04224000 fffff880`04231000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00ff2000 fffff880`00fff000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`0197b000 fffff880`01989000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01989000 fffff880`019ae000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`015f0000 fffff880`01600000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00d96000 fffff880`00dab000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01187000 fffff880`011d3000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`0411b000 fffff880`04136000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`019ae000 fffff880`019be000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ed5000 fffff880`00f79000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f79000 fffff880`00f88000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`040dd000 fffff880`040e6000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00060000 fffff960`00370000   win32k   win32k.sys   Tue Jan 04 22:59:44 2011 (4D23ECB0)
fffff880`045a8000 fffff880`045b1000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fdf000 fffff880`00fe8000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`044bc000 fffff880`044dd000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`044f2000 fffff880`04555000   yk62x64  yk62x64.sys  Mon Feb 23 10:02:27 2009 (49A2BA83)

Unloaded modules:
fffff880`018da000 fffff880`018e8000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`018e8000 fffff880`018f4000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`018f4000 fffff880`018fd000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`018fd000 fffff880`01910000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000