Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122311-33977-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe70
Debug session time: Fri Dec 23 14:47:04.123 2011 (UTC - 7:00)
System Uptime: 0 days 1:06:24.465
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {91, 0, fffffa80145ef060, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4894 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa80145ef060
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_91
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff880073e1178 -- (.exr 0xfffff880073e1178)
ExceptionAddress: fffff880012c22df (Ntfs!NtfsAllocateClusters+0x000000000000016b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
TRAP_FRAME: fffff880073e1220 -- (.trap 0xfffff880073e1220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80145393e8
rdx=fffffa80145393e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012c22df rsp=fffff880073e13b0 rbp=fffff880093e1960
r8=fffffa801453a990 r9=0000000000000000 r10=074a5f2000008660
r11=000000000000013b r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
Ntfs!NtfsAllocateClusters+0x16b:
fffff880`012c22df 488b00 mov rax,qword ptr [rax] ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f2717a to fffff80002ed25c0
STACK_TEXT:
fffff880`073e0288 fffff800`02f2717a : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`145ef060 : nt!KeBugCheckEx
fffff880`073e0290 fffff800`02eff573 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4894
fffff880`073e02d0 fffff800`02f0c8cf : fffff880`073e1178 fffff880`073e0ee0 fffff880`073e1220 fffffa80`14539180 : nt!RtlDispatchException+0x33
fffff880`073e09b0 fffff800`02ed1c02 : fffff880`073e1178 fffff8a0`00206b70 fffff880`073e1220 fffffa80`140d32c0 : nt!KiDispatchException+0x16f
fffff880`073e1040 fffff800`02ed077a : 00000000`00000000 fffff8a0`00206b70 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`073e1220 fffff880`012c22df : fffff8a0`00206b70 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`073e13b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsAllocateClusters+0x16b
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4894
fffff800`02f2717a cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4894
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
FAILURE_BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894
BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35630-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e63000 PsLoadedModuleList = 0xfffff800`030a0e70
Debug session time: Fri Dec 23 22:10:51.367 2011 (UTC - 7:00)
System Uptime: 0 days 7:21:59.756
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800ce713e8, fffff8800ce70c50, fffff880012c82dd}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800ce713e8
Arg3: fffff8800ce70c50
Arg4: fffff880012c82dd
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800ce713e8 -- (.exr 0xfffff8800ce713e8)
ExceptionAddress: fffff880012c82dd (Ntfs!NtfsCommonCleanup+0x0000000000000bcd)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: fffff8800ce70c50 -- (.cxr 0xfffff8800ce70c50)
rax=000000001f59fbba rbx=fffff8a0089e1a90 rcx=0000000000004c58
rdx=fffffa8016497b60 rsi=fffff8a0089e1bc0 rdi=fffff8800ce71c10
rip=fffff880012c82dd rsp=fffff8800ce71620 rbp=fffffa80133fcb30
r8=0000000000000000 r9=0000000000000000 r10=01ccc1fa67c25224
r11=fffff8800ce71600 r12=0000000000000004 r13=0000000000000000
r14=0000000000000007 r15=fffff8a0089e1e10
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsCommonCleanup+0xbcd:
fffff880`012c82dd 82 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x24
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
LAST_CONTROL_TRANSFER: from fffff88001239829 to fffff880012c82dd
STACK_TEXT:
fffff880`0ce71620 fffff880`01239829 : 00000000`00000001 fffff800`030074d3 fffff880`0ce71b70 fffff880`0ce61000 : Ntfs!NtfsCommonCleanup+0xbcd
fffff880`0ce71a30 fffff800`02ee2cda : fffff880`0ce71b70 00000000`20206f49 00000000`00f800c4 fffff8a0`09fb7660 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`0ce71a60 fffff880`012393e2 : fffff880`01239810 fffff880`0ce71b70 fffff8a0`00001900 fffffa80`146ad600 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`0ce71b40 fffff880`012d8324 : fffff880`0ce71c10 fffff880`0ce71c10 fffff880`0ce71c10 fffffa80`167ebc10 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`0ce71bb0 fffff880`010b56af : fffff880`0ce71c10 fffffa80`167ebc10 fffffa80`1445ade0 00000000`00000000 : Ntfs!NtfsFsdCleanup+0x144
fffff880`0ce71e20 fffff800`031e688f : fffffa80`167ebc10 fffffa80`133fcb30 00000000`00000000 fffffa80`16026740 : fltmgr!FltpDispatch+0x9f
fffff880`0ce71e80 fffff800`031cc754 : 00000000`00000001 fffffa80`172d3b30 fffffa80`000004d8 fffffa80`00000000 : nt!IopCloseFile+0x11f
fffff880`0ce71f10 fffff800`031e6381 : fffffa80`172d3b30 fffffa80`00000001 fffff8a0`000019f0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`0ce71f90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCloseHandleTableEntry+0xb1
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
fffff880012c82d8 - Ntfs!NtfsCommonCleanup+bc8
[ 0f:0d ]
1 error : !Ntfs (fffff880012c82d8)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff8800ce70c50 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34273-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e19000 PsLoadedModuleList = 0xfffff800`03056e70
Debug session time: Fri Dec 23 22:19:49.249 2011 (UTC - 7:00)
System Uptime: 0 days 0:03:43.592
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002e3d7f5, fffff8800b2b50e0, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002e3d7f5, Address of the instruction which caused the bugcheck
Arg3: fffff8800b2b50e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!NtResetWriteWatch+1e5
fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h]
CONTEXT: fffff8800b2b50e0 -- (.cxr 0xfffff8800b2b50e0)
rax=e2900005ffe22825 rbx=0000000000000000 rcx=fffff68000014400
rdx=fffff6fb7dbed000 rsi=fffffa8016c96b60 rdi=0000000000000000
rip=fffff80002e3d7f5 rsp=fffff8800b2b5ab0 rbp=fffff68000014408
r8=0000000000000001 r9=0000000000000001 r10=0000000000000002
r11=fffffffffffb3410 r12=0000000002881000 r13=fffff6fb400000a0
r14=0000000000000000 r15=fffffa8016c53ec8
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!NtResetWriteWatch+0x1e5:
fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h] ss:0018:e28ff886`0b0d8315=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x3B
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e88813 to fffff80002e3d7f5
STACK_TEXT:
fffff880`0b2b5ab0 fffff800`02e88813 : ffffffff`ffffffff fffff680`00014400 fffffa80`16c96b60 fffffa80`16c53b30 : nt!NtResetWriteWatch+0x1e5
fffff880`0b2b5c20 00000000`77000b0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02d8efc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77000b0a
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002e3d7f8 - nt!NtResetWriteWatch+1e8
[ 24:04 ]
1 error : !nt (fffff80002e3d7f8)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff8800b2b50e0 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-22261-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`03099e70
Debug session time: Sat Dec 24 11:04:51.092 2011 (UTC - 7:00)
System Uptime: 0 days 2:07:50.450
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 4a7988, 3, 569c07}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000004a7988, page frame number
Arg3: 0000000000000003, current page state
Arg4: 0000000000569c07, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: AfterFX.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f5c13c to fffff80002ecc5c0
STACK_TEXT:
fffff880`0df1e058 fffff800`02f5c13c : 00000000`0000004e 00000000`00000099 00000000`004a7988 00000000`00000003 : nt!KeBugCheckEx
fffff880`0df1e060 fffff800`02e7c5df : fffffa80`095ed850 00000000`00000001 fffffa80`0df6c980 fffff683`ffc3eff8 : nt!MiBadShareCount+0x4c
fffff880`0df1e0a0 fffff800`02efd7b5 : fffffa80`16d5bb30 000007ff`87dff000 d3f00003`52f58c46 fffff8a0`0237acf0 : nt! ?? ::FNODOBFM::`string'+0x204a1
fffff880`0df1e1b0 fffff800`02f0dfba : 00000000`00000000 000007ff`89bf7fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x96c
fffff880`0df1e370 fffff800`02ecb813 : ffffffff`ffffffff 00000000`0082ad78 00000000`0082ad70 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0df1e460 00000000`778bf89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0082ad38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778bf89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f5c13c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35833-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e54000 PsLoadedModuleList = 0xfffff800`03091e70
Debug session time: Sat Dec 24 12:40:41.825 2011 (UTC - 7:00)
System Uptime: 0 days 1:33:56.230
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 534698, 0, 52f918}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000534698, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000052f918, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Setup.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f5413c to fffff80002ec45c0
STACK_TEXT:
fffff880`1447a778 fffff800`02f5413c : 00000000`0000004e 00000000`00000099 00000000`00534698 00000000`00000000 : nt!KeBugCheckEx
fffff880`1447a780 fffff800`02f36600 : 00000000`00000000 fffff680`00058e50 00000000`00000000 00000000`00000004 : nt!MiBadShareCount+0x4c
fffff880`1447a7c0 fffff800`02ef5251 : 00000000`00000000 fffff680`00058ff8 fffffa80`178a7060 fffff880`1447aca0 : nt! ?? ::FNODOBFM::`string'+0x31e8a
fffff880`1447a970 fffff800`02f05fba : 00000000`00000000 00000000`0b229fff fffffa80`00000000 fffffa80`178a7060 : nt!MiDeleteVirtualAddresses+0x408
fffff880`1447ab30 fffff800`02ec3813 : ffffffff`ffffffff 00000000`0013e030 00000000`0013e028 fffff900`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`1447ac20 00000000`77a0f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0013dff8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a0f89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f5413c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-73866-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03041e70
Debug session time: Sat Dec 24 13:03:58.868 2011 (UTC - 7:00)
System Uptime: 0 days 0:18:55.289
Loading Kernel Symbols
..............................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800fb423e8, fffff8800fb41c50, fffff800031551c6}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800fb423e8
Arg3: fffff8800fb41c50
Arg4: fffff800031551c6
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800fb423e8 -- (.exr 0xfffff8800fb423e8)
Cannot read Exception record @ fffff8800fb423e8
CONTEXT: fffff8800fb41c50 -- (.cxr 0xfffff8800fb41c50)
Unable to read context, Win32 error 0n30
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x24
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e820ca to fffff880041cf9c2
STACK_TEXT:
fffff800`043ecc98 fffff800`02e820ca : 00000000`00298420 fffffa80`1527f8c8 fffff800`02ffcc40 00000000`00000001 : 0xfffff880`041cf9c2
fffff800`043ecca0 fffff800`02e7cd5c : fffff800`02feee80 fffff800`00000000 00000000`00000000 fffff880`10bc44d0 : nt!PoIdle+0x53a
fffff800`043ecd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80003155118 - nt!IoCheckShareAccessEx+78
[ 00:02 ]
1 error : !nt (fffff80003155118)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff8800fb41c50 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-23134-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030a2e70
Debug session time: Sat Dec 24 13:18:15.595 2011 (UTC - 7:00)
System Uptime: 0 days 0:13:10.000
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 61bd07, 2, 61be07}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000061bd07, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000061be07, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: nvvsvc.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f6513c to fffff80002ed55c0
STACK_TEXT:
fffff880`0b4b7f28 fffff800`02f6513c : 00000000`0000004e 00000000`00000099 00000000`0061bd07 00000000`00000002 : nt!KeBugCheckEx
fffff880`0b4b7f30 fffff800`02f4794e : 00000000`00000000 fffff680`00000fd8 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0b4b7f70 fffff800`02ea9bb3 : fffffa80`1578f930 fffff700`00000574 0000007f`fffffff8 fffff8a0`00133178 : nt! ?? ::FNODOBFM::`string'+0x321f5
fffff880`0b4b8000 fffff800`02ea860e : fffffa80`1578f930 fffffa80`00000000 fffff8a0`0000020d fffff880`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0b4b88b0 fffff800`031b7a8b : fffff8a0`00d19610 fffff880`0b4b8c20 00000000`00000000 fffffa80`1522a060 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0b4b8900 fffff800`03190131 : 00000000`00000000 00000000`00000001 000007ff`fffd3000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`0b4b89c0 fffff800`02eb211b : fffffa80`1522b890 fffff880`0b4b8ca0 fffffa80`15b3c4e0 fffff800`031edb7e : nt!PsExitSpecialApc+0x1d
fffff880`0b4b89f0 fffff800`02eb2560 : 00000000`00000000 fffff880`0b4b8a70 fffff800`031901b8 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0b4b8a70 fffff800`02ed48b7 : 00000000`000004a0 00000000`0114f170 00000000`00000000 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`0b4b8bb0 00000000`76fafa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0114fe58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fafa4a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f6513c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34881-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e70
Debug session time: Sat Dec 24 14:22:42.598 2011 (UTC - 7:00)
System Uptime: 0 days 0:31:35.003
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c000001d, fffff880010287ed, fffff88009706720, 0}
Probably caused by : hardware ( fltmgr!FltpNormalizeNameFromCache+1d )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff880010287ed, Address of the instruction which caused the bugcheck
Arg3: fffff88009706720, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
fltmgr!FltpNormalizeNameFromCache+1d
fffff880`010287ed d9 ???
CONTEXT: fffff88009706720 -- (.cxr 0xfffff88009706720)
rax=0000000000000000 rbx=0000000000000040 rcx=fffffa8013c97bf0
rdx=0000000000000080 rsi=fffffa8013c97bf0 rdi=0000000000000040
rip=fffff880010287ed rsp=fffff880097070f0 rbp=0000000000000017
r8=000000000000002e r9=fffffa8016e925e0 r10=0000000000000051
r11=fffff88009707208 r12=0000000000000000 r13=fffffa8013886401
r14=fffffa8014764668 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
fltmgr!FltpNormalizeNameFromCache+0x1d:
fffff880`010287ed d9 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
fltmgr!FltpNormalizeNameFromCache+1d
fffff880`010287ed d9 ???
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880010287ed
STACK_TEXT:
fffff880`097070f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpNormalizeNameFromCache+0x1d
FOLLOWUP_IP:
fltmgr!FltpNormalizeNameFromCache+1d
fffff880`010287ed d9 ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fltmgr!FltpNormalizeNameFromCache+1d
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff88009706720 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-42229-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70
Debug session time: Sat Dec 24 17:32:50.778 2011 (UTC - 7:00)
System Uptime: 0 days 1:30:29.821
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 3b8202, 3, 575d1b}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000003b8202, page frame number
Arg3: 0000000000000003, current page state
Arg4: 0000000000575d1b, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: AfterFX.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f1e13c to fffff80002e8e5c0
STACK_TEXT:
fffff880`0ebb2778 fffff800`02f1e13c : 00000000`0000004e 00000000`00000099 00000000`003b8202 00000000`00000003 : nt!KeBugCheckEx
fffff880`0ebb2780 fffff800`02f00609 : 00000000`00000000 fffff683`fdae8de0 00000000`00000000 fffff700`0363cff8 : nt!MiBadShareCount+0x4c
fffff880`0ebb27c0 fffff800`02ebf251 : fffff700`01080000 fffff683`fdae8ff8 fffffa80`16be1ab0 fffffa80`16be1ab0 : nt! ?? ::FNODOBFM::`string'+0x31e93
fffff880`0ebb2970 fffff800`02ecffba : 00000000`00000000 000007fb`5d38bfff fffffa80`00000000 fffffa80`16be1ab0 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0ebb2b30 fffff800`02e8d813 : ffffffff`ffffffff 00000000`00828968 00000000`00828960 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0ebb2c20 00000000`770af89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00828928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770af89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f1e13c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-21418-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e51000 PsLoadedModuleList = 0xfffff800`0308ee70
Debug session time: Sat Dec 24 17:58:53.887 2011 (UTC - 7:00)
System Uptime: 0 days 0:24:26.292
Loading Kernel Symbols
..............................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 4eb143, 2, 4ed2c2}
Probably caused by : ntkrnlmp.exe ( nt!PoIdle+53a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000004eb143, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000004ed2c2, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002ecf0ca to fffff88003ce09c2
STACK_TEXT:
fffff800`00b9cc98 fffff800`02ecf0ca : 00000000`00298465 fffffa80`15428dd8 fffffa80`1554e480 fffffa80`13a04170 : 0xfffff880`03ce09c2
fffff800`00b9cca0 fffff800`02ec9d5c : fffff800`0303be80 fffff800`00000000 00000000`00000000 fffff880`0fe55480 : nt!PoIdle+0x53a
fffff800`00b9cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PoIdle+53a
fffff800`02ecf0ca 0fba25761518000f bt dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`03050648)],0Fh
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PoIdle+53a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
FAILURE_BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a
BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-25053-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`03092e70
Debug session time: Mon Dec 26 07:23:45.366 2011 (UTC - 7:00)
System Uptime: 0 days 0:02:00.709
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {15, 2, 1, fffff80002ecd7e0}
Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000015, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ecd7e0, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fd0e0
0000000000000015
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiSearchForNewThread+2d0
fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: BitCometServic
TRAP_FRAME: fffff8801349c780 -- (.trap 0xfffff8801349c780)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000006 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff88002f68700 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ecd7e0 rsp=fffff8801349c910 rbp=0000000000000100
r8=fffffa801722f820 r9=0000000000000008 r10=0000000000000000
r11=fffff88003115101 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiSearchForNewThread+0x2d0:
fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1 ds:0001:00000000`00000015=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ec4b29 to fffff80002ec55c0
STACK_TEXT:
fffff880`1349c638 fffff800`02ec4b29 : 00000000`0000000a 00000000`00000015 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`1349c640 fffff800`02ec37a0 : 00000000`00000002 fffffa80`1722f780 fffffa80`133ab100 fffff800`02fcef6e : nt!KiBugCheckDispatch+0x69
fffff880`1349c780 fffff800`02ecd7e0 : fffff880`1349cdb0 fffffa80`17029660 fffff800`03042968 00000000`00000000 : nt!KiPageFault+0x260
fffff880`1349c910 fffff800`02ecc68c : fffffa80`17029660 fffffa80`17029660 00000000`00000000 00000000`00000006 : nt!KiSearchForNewThread+0x2d0
fffff880`1349c980 fffff800`02eceb9f : fffffa80`1711c270 00000000`00000000 00000000`00000059 00000000`00000002 : nt!KiCommitThreadWait+0x17c
fffff880`1349ca10 fffff800`02e8e222 : fffffa80`15dd3100 00000000`0000001b 00000000`00010200 fffff880`03115100 : nt!KeWaitForSingleObject+0x19f
fffff880`1349cab0 fffff800`02ecd44c : ffffffff`ffb3b4c0 fffffa80`1503c820 fffffa80`15dd31a0 fffff900`c0904370 : nt!ExpWaitForResource+0xae
fffff880`1349cb20 fffff800`02ed1077 : 00000000`72173e30 fffffa80`17029660 00000000`00000000 fffff800`031bcf1c : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`1349cb90 fffff960`00171be9 : fffff880`1349cbf8 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 : nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x23
fffff880`1349cbc0 fffff880`1349cbf8 : 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 : win32k+0xd1be9
fffff880`1349cbc8 00000000`00000000 : fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 00000000`00000000 : 0xfffff880`1349cbf8
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002ecd7e0 - nt!KiSearchForNewThread+2d0
[ f0:d0 ]
1 error : !nt (fffff80002ecd7e0)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-44803-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70
Debug session time: Mon Dec 26 09:18:41.374 2011 (UTC - 7:00)
System Uptime: 0 days 0:17:05.401
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c000001d, fffff8000318325d, fffff8800baf3ef0, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff8000318325d, Address of the instruction which caused the bugcheck
Arg3: fffff8800baf3ef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
nt!ObpCreateHandle+fd
fffff800`0318325d 82 ???
CONTEXT: fffff8800baf3ef0 -- (.cxr 0xfffff8800baf3ef0)
rax=000000001f59f9ba rbx=fffffa80182503a0 rcx=0000000000000000
rdx=fffffa8019549560 rsi=0000000000000040 rdi=fffff8a000db7c50
rip=fffff8000318325d rsp=fffff8800baf48c0 rbp=fffff80002e1e000
r8=0000000000000000 r9=0000000000000001 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=fffff80003040300
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ObpCreateHandle+0xfd:
fffff800`0318325d 82 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x3B
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000318325d
STACK_TEXT:
fffff880`0baf48c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0xfd
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80003183258 - nt!ObpCreateHandle+f8
[ 0f:0d ]
1 error : !nt (fffff80003183258)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff8800baf3ef0 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-17955-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`0325ce70
Debug session time: Wed Dec 28 06:34:07.112 2011 (UTC - 7:00)
System Uptime: 0 days 0:06:08.454
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800c18c048, fffff8800c18b8b0, fffff8800121ebc3}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800c18c048
Arg3: fffff8800c18b8b0
Arg4: fffff8800121ebc3
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800c18c048 -- (.exr 0xfffff8800c18c048)
ExceptionAddress: fffff8800121ebc3 (Ntfs!NtfsCommonRead+0x00000000000000c3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000005
Attempt to read from address 0000000000000005
CONTEXT: fffff8800c18b8b0 -- (.cxr 0xfffff8800c18b8b0)
rax=0000000000000001 rbx=fffff8a00352a140 rcx=0000000000000001
rdx=0000000000000080 rsi=0000000000000000 rdi=0000000000000201
rip=fffff8800121ebc3 rsp=fffff8800c18c280 rbp=fffff8800c18c450
r8=fffffa80138b8c10 r9=0000000000000000 r10=fffffa80138b8fb0
r11=fffff8800c18c418 r12=0000000000000000 r13=fffff8a00352a140
r14=0000000000000000 r15=fffffa8013a5ca40
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsCommonRead+0xc3:
fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 ds:002b:00000000`00000005=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000005
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c70e0
0000000000000005
FOLLOWUP_IP:
Ntfs!NtfsCommonRead+c3
fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1
FAULTING_IP:
Ntfs!NtfsCommonRead+c3
fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: CODE_CORRUPTION
LAST_CONTROL_TRANSFER: from fffff88001221cf8 to fffff8800121ebc3
STACK_TEXT:
fffff880`0c18c280 fffff880`01221cf8 : fffffa80`13a5ca40 fffffa80`138b8c10 fffff880`0c18c450 fffffa80`13c31600 : Ntfs!NtfsCommonRead+0xc3
fffff880`0c18c420 fffff880`010c823f : fffffa80`138b8fb0 fffffa80`138b8c10 fffffa80`13c31650 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0c18c4d0 fffff880`010c66df : fffffa80`143fab60 fffffa80`138b8c10 fffffa80`143fab00 fffffa80`138b8c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0c18c560 fffff800`030810c2 : fffffa80`138b8c30 fffffa80`13839c00 00000000`00000403 fffff8a0`03db0f68 : fltmgr!FltpDispatch+0xcf
fffff880`0c18c5c0 fffff800`0332be37 : fffffa80`13acb300 fffffa80`13acb300 fffffa80`15174f51 00000000`00000001 : nt!IoPageRead+0x252
fffff880`0c18c650 fffff800`032ec1fb : 00000000`00000001 00000000`00000001 fffffa80`16e66430 00000000`00000007 : nt!MiPfExecuteReadList+0xff
fffff880`0c18c6b0 fffff800`034ed67d : 00000000`00000018 00000000`00000018 fffffa80`16e66430 fffff880`0c18c778 : nt!MmPrefetchPages+0xfb
fffff880`0c18c710 fffff800`034f569e : fffff8a0`00000000 fffff8a0`00000000 fffff8a0`0000012d fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x21d
fffff880`0c18c810 fffff800`034f6237 : 00000000`00000000 fffff880`0c18cca0 fffff880`0c18ca08 fffff8a0`00fbe060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`0c18c960 fffff800`0350280e : fffff880`0c18ca08 00000000`00000001 fffffa80`16ff63f0 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`0c18c9d0 fffff800`03506f3e : 00000000`00000000 00000000`0f2ff410 00000000`0000004f fffffa80`1543fb01 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`0c18cab0 fffff800`0308e813 : fffffa80`137e0b60 00000000`00000000 00000000`00000001 00000000`00000001 : nt!NtSetSystemInformation+0xb91
fffff880`0c18cc20 00000000`76e00daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0f2ff3e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e00daa
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
fffff8800121eb58 - Ntfs!NtfsCommonRead+58
[ 85:87 ]
1 error : !Ntfs (fffff8800121eb58)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff8800c18b8b0 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-36644-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03249e70
Debug session time: Wed Dec 28 12:17:19.795 2011 (UTC - 7:00)
System Uptime: 0 days 0:28:08.278
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff30027bb9440, 0, fffff80003093798, 7}
Could not read faulting driver name
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff30027bb9440, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003093798, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b40e0
fffff30027bb9440
FAULTING_IP:
nt!KeAcquireGuardedMutex+28
fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h]
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
PROCESS_NAME: mscorsvw.exe
CURRENT_IRQL: 0
DEVICE_OBJECT: fffffa8016512ff8
TRAP_FRAME: fffff88011564270 -- (.trap 0xfffff88011564270)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80146783e8
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003093798 rsp=fffff88011564400 rbp=fffffa8016655010
r8=fffffa8017881018 r9=fffff88011564438 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KeAcquireGuardedMutex+0x28:
fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h] ss:0018:fffff880`11564430=fffff8a0114a0750
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030fb729 to fffff8000307c5c0
STACK_TEXT:
fffff880`11564108 fffff800`030fb729 : 00000000`00000050 fffff300`27bb9440 00000000`00000000 fffff880`11564270 : nt!KeBugCheckEx
fffff880`11564110 fffff800`0307a6ae : 00000000`00000000 fffffa80`146783e8 fffff8a0`114a0700 fffffa80`16655010 : nt! ?? ::FNODOBFM::`string'+0x40ccb
fffff880`11564270 fffff800`03093798 : 00000000`00000000 00000000`00000000 fffffa80`14678180 fffffa80`16655010 : nt!KiPageFault+0x16e
fffff880`11564400 fffff880`012ea268 : fffff8a0`114a0750 00000000`00000000 00000000`0000119e 00000000`00001119 : nt!KeAcquireGuardedMutex+0x28
fffff880`11564430 fffff880`012e51d9 : fffffa80`16655010 fffffa80`14678180 fffff8a0`114a0620 00000000`00001119 : Ntfs!NtfsAllocateClusters+0xf4
fffff880`11564570 fffff880`01245750 : fffffa80`16655010 fffffa80`165821c0 00000000`00000001 00000000`00001119 : Ntfs!NtfsAddAllocation+0x299
fffff880`11564680 fffff880`01243791 : 00000000`00000000 fffff880`115648c0 00000000`00000000 00000000`00000000 : Ntfs!NtfsAddAllocationForNonResidentWrite+0xfc
fffff880`115646e0 fffff880`01246663 : fffffa80`16655010 fffffa80`16512c10 fffff880`11564801 fffff880`11564800 : Ntfs!NtfsCommonWrite+0x287b
fffff880`11564890 fffff880`0104923f : fffffa80`16512fb0 fffffa80`16512c10 fffffa80`1664a770 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`11564950 fffff880`010476df : fffffa80`144268e0 00000000`00000001 fffffa80`14426800 fffffa80`16512c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`115649e0 fffff800`0338fb29 : 00000000`00000001 fffffa80`165821c0 00000000`00000001 fffffa80`16512c10 : fltmgr!FltpDispatch+0xcf
fffff880`11564a40 fffff800`033908c3 : fffffa80`16512ff8 00000000`00000000 fffffa80`165821c0 fffff880`02f64180 : nt!IopSynchronousServiceTail+0xf9
fffff880`11564ab0 fffff800`0307b813 : 000007fe`f564a701 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`11564bb0 00000000`774af73a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`002cd538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774af73a
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80003093798 - nt!KeAcquireGuardedMutex+28
[ 48:4a ]
1 error : !nt (fffff80003093798)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010212-33368-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`03001000 PsLoadedModuleList = 0xfffff800`0323ee70
Debug session time: Mon Jan 2 20:58:57.295 2012 (UTC - 7:00)
System Uptime: 0 days 5:32:37.836
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {24, 6, 1, fffff8800ff32c16}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+cec16 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000024, memory referenced
Arg2: 0000000000000006, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800ff32c16, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a90e0
0000000000000024
CURRENT_IRQL: 6
FAULTING_IP:
nvlddmkm+cec16
fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff8800313d0e0 -- (.trap 0xfffff8800313d0e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8015304480 rbx=0000000000000000 rcx=fffff8800313d300
rdx=fffffdffecc80380 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800ff32c16 rsp=fffff8800313d270 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000002020000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nvlddmkm+0xcec16:
fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp ss:0018:fffff880`0313d2e0=0000000000000000
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003070b29 to fffff800030715c0
STACK_TEXT:
fffff880`0313cf98 fffff800`03070b29 : 00000000`0000000a 00000000`00000024 00000000`00000006 00000000`00000001 : nt!KeBugCheckEx
fffff880`0313cfa0 fffff800`0306f7a0 : fffffa80`1628b330 fffff880`0313d430 fffffa80`164bd000 fffff880`04528691 : nt!KiBugCheckDispatch+0x69
fffff880`0313d0e0 fffff880`0ff32c16 : fffff880`0313d430 fffff880`0313d430 00000000`00000000 fffffa80`15339000 : nt!KiPageFault+0x260
fffff880`0313d270 fffff880`0313d430 : fffff880`0313d430 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 : nvlddmkm+0xcec16
fffff880`0313d278 fffff880`0313d430 : 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 : 0xfffff880`0313d430
fffff880`0313d280 00000000`00000000 : fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 00000000`00000000 : 0xfffff880`0313d430
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+cec16
fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nvlddmkm+cec16
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ee42661
FAILURE_BUCKET_ID: X64_0xD1_nvlddmkm+cec16
BUCKET_ID: X64_0xD1_nvlddmkm+cec16
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-35271-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`03296e70
Debug session time: Tue Jan 3 13:47:56.728 2012 (UTC - 7:00)
System Uptime: 0 days 16:41:41.070
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff96002305470, 0, fffff96000135093, 2}
Could not read faulting driver name
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96002305470, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff96000135093, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033010e0
fffff96002305470
FAULTING_IP:
win32k!NtUserCallOneParam+23
fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800e2f3a60 -- (.trap 0xfffff8800e2f3a60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8015e77300
rdx=000000000000002e rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000135093 rsp=fffff8800e2f3bf0 rbp=fffff8800e2f3ca0
r8=0000000000000002 r9=0000000000000006 r10=fffff96000135070
r11=000000007ef23000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
win32k!NtUserCallOneParam+0x23:
fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470] ds:015c:fffff960`02305470=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800031487d2 to fffff800030c95c0
STACK_TEXT:
fffff880`0e2f38f8 fffff800`031487d2 : 00000000`00000050 fffff960`02305470 00000000`00000000 fffff880`0e2f3a60 : nt!KeBugCheckEx
fffff880`0e2f3900 fffff800`030c76ae : 00000000`00000000 00000000`00000407 fffffa80`16d64b00 fffff800`03243e80 : nt! ?? ::FNODOBFM::`string'+0x40d80
fffff880`0e2f3a60 fffff960`00135093 : fffffa80`16d64b60 fffff880`0e2f3ca0 00000000`00000100 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0e2f3bf0 fffff800`030c8813 : fffffa80`16d64b60 00000000`0aebc3a0 00000000`00000000 fffffa80`14578e10 : win32k!NtUserCallOneParam+0x23
fffff880`0e2f3c20 00000000`748cfdfa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`10a5e018 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748cfdfa
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
fffff96000135098 - win32k!NtUserCallOneParam+28
[ 00:02 ]
1 error : !win32k (fffff96000135098)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-37019-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`0324ae70
Debug session time: Tue Jan 3 19:57:21.653 2012 (UTC - 7:00)
System Uptime: 0 days 4:18:15.058
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 86682, 0, 86702}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000086682, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000086702, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Bridge.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000310d13c to fffff8000307d5c0
STACK_TEXT:
fffff880`0fcae778 fffff800`0310d13c : 00000000`0000004e 00000000`00000099 00000000`00086682 00000000`00000000 : nt!KeBugCheckEx
fffff880`0fcae780 fffff800`030ef600 : 00000000`00000000 fffff680`0013f1c8 00000000`00000000 fffff800`031f7e80 : nt!MiBadShareCount+0x4c
fffff880`0fcae7c0 fffff800`030ae251 : 00000000`00000000 fffff680`0013f2f0 fffffa80`14ca6b30 fffff900`c0218d80 : nt! ?? ::FNODOBFM::`string'+0x31e8a
fffff880`0fcae970 fffff800`030befba : 00000000`00000000 00000000`27e5efff fffffa80`00000000 fffffa80`14ca6b30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0fcaeb30 fffff800`0307c813 : ffffffff`ffffffff 00000000`07c3e810 00000000`07c3e808 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0fcaec20 00000000`7783f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07c3e7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7783f89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0310d13c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
The main things that stand out are: memory_corruption, hardware, a few memory_corruption related to NTFS (your hard drive) errors, and a couple display card related crashes. Do the following: