New
#11
These were caused by HIDCLASS.sys (an OS file)
What USB devices are attached? How many?
Code:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2 05-21-2011\052111-29452-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols *http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631 Machine Name: Kernel base = 0xfffff800`03065000 PsLoadedModuleList = 0xfffff800`032aa650 Debug session time: Sat May 21 12:51:04.292 2011 (GMT-4) System Uptime: 0 days 2:34:16.353 Loading Kernel Symbols ............................................................... ................................................................ ............................................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {ffffffffffffffb2, 0, fffff800030f1439, 0} Could not read faulting driver name Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpIdleTimeWorker+63 ) Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffffffffffffb2, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff800030f1439, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003314100 ffffffffffffffb2 FAULTING_IP: nt!IoReuseIrp+19 fffff800`030f1439 0fb75902 movzx ebx,word ptr [rcx+2] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 0 TRAP_FRAME: fffff88003585a70 -- (.trap 0xfffff88003585a70) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff88003585c28 rbx=0000000000000000 rcx=ffffffffffffffb0 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800030f1439 rsp=fffff88003585c00 rbp=fffffa80083e8c80 r8=0000000000000000 r9=0000000000000000 r10=0000000000000024 r11=fffffa8008685d20 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc nt!IoReuseIrp+0x19: fffff800`030f1439 0fb75902 movzx ebx,word ptr [rcx+2] ds:0ce0:ffffffff`ffffffb2=???? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003090a0c to fffff800030e4d00 STACK_TEXT: fffff880`03585908 fffff800`03090a0c : 00000000`00000050 ffffffff`ffffffb2 00000000`00000000 fffff880`03585a70 : nt!KeBugCheckEx fffff880`03585910 fffff800`030e2e2e : 00000000`00000000 ffffffff`ffffffb2 00000000`00000000 fffffa80`083e8b30 : nt! ?? ::FNODOBFM::`string'+0x4621f fffff880`03585a70 fffff800`030f1439 : 00000000`00000019 fffff880`03585c58 00000000`00000008 00000000`00000000 : nt!KiPageFault+0x16e fffff880`03585c00 fffff880`0711aadf : fffffa80`083e8b30 fffffa80`083e8c80 ffffffff`ffffffb0 00000000`00000000 : nt!IoReuseIrp+0x19 fffff880`03585c30 fffff800`033db0c3 : fffffa80`083e8b30 fffff800`032822b8 fffffa80`03d0a040 fffffa80`03d0a040 : HIDCLASS!HidpIdleTimeWorker+0x63 fffff880`03585c80 fffff800`030ef021 : fffff800`03282200 fffff800`033db001 fffffa80`03d0a000 fffffa80`03d0a040 : nt!IopProcessWorkItem+0x23 fffff880`03585cb0 fffff800`0338132e : 14c315d9`f55343b2 fffffa80`03d0a040 00000000`00000080 fffffa80`03c72890 : nt!ExpWorkerThread+0x111 fffff880`03585d40 fffff800`030d6666 : fffff880`03367180 fffffa80`03d0a040 fffff880`033720c0 a990a090`ecb8ecb8 : nt!PspSystemThreadStartup+0x5a fffff880`03585d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: HIDCLASS!HidpIdleTimeWorker+63 fffff880`0711aadf 4885f6 test rsi,rsi SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: HIDCLASS!HidpIdleTimeWorker+63 FOLLOWUP_NAME: MachineOwner MODULE_NAME: HIDCLASS IMAGE_NAME: HIDCLASS.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7a665 FAILURE_BUCKET_ID: X64_0x50_HIDCLASS!HidpIdleTimeWorker+63 BUCKET_ID: X64_0x50_HIDCLASS!HidpIdleTimeWorker+63 Followup: MachineOwner --------- 5: kd> lmvm HIDCLASS start end module name fffff880`07110000 fffff880`07129000 HIDCLASS (pdb symbols) c:\symbols\hidclass.pdb\14772983A8A24C2BB1C94B949D26033A1\hidclass.pdb Loaded symbol image file: HIDCLASS.SYS Mapped memory image file: C:\Symbols\HIDCLASS.SYS\4CE7A66519000\HIDCLASS.SYS Image path: \SystemRoot\system32\drivers\HIDCLASS.SYS Image name: HIDCLASS.SYS Timestamp: Sat Nov 20 05:43:49 2010 (4CE7A665) CheckSum: 00015D32 ImageSize: 00019000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: hidclass.sys OriginalFilename: hidclass.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Hid Class Library LegalCopyright: © Microsoft Corporation. All rights reserved.