[list=1]
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-58562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a11000 PsLoadedModuleList = 0xfffff800`02c56670
Debug session time: Tue Jan 10 16:23:24.110 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:33.532
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8800139eb0f, fffff88006c47520, 0}
Probably caused by : msrpc.sys ( msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800139eb0f, Address of the instruction which caused the bugcheck
Arg3: fffff88006c47520, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff
fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx
CONTEXT: fffff88006c47520 -- (.cxr 0xfffff88006c47520)
rax=fffffa80075c2850 rbx=fffff8a00ddb1740 rcx=0000000000000012
rdx=0000000000000000 rsi=fffff880016428b6 rdi=0000000000000000
rip=fffff8800139eb0f rsp=fffff88006c47f00 rbp=ffbffa80076004c8
r8=0000000000000000 r9=0000000000000001 r10=fffffa8007763870
r11=fffff8800137f000 r12=0000000000000000 r13=fffffa80074c70cc
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+0xff:
fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx ss:0018:ffbffa80`076004c8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8800139a92c to fffff8800139eb0f
STACK_TEXT:
fffff880`06c47f00 fffff880`0139a92c : fffff880`06c40009 fffff880`0f200000 fffffa80`00000001 00000000`00000000 : msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+0xff
fffff880`06c47f90 fffff880`013a063e : fffff8a0`0ddb1740 00000000`00000000 fffff880`06c48190 00000000`00000000 : msrpc!NDR_POINTER_QUEUE::Dispatch+0x4c
fffff880`06c47fc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : msrpc!NdrpEnquePointerUnmarshall+0x12e
FOLLOWUP_IP:
msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff
fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: msrpc
IMAGE_NAME: msrpc.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79334
STACK_COMMAND: .cxr 0xfffff88006c47520 ; kb
FAILURE_BUCKET_ID: X64_0x3B_msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff
BUCKET_ID: X64_0x3B_msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-30859-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c54670
Debug session time: Tue Jan 10 16:36:13.046 2012 (UTC - 7:00)
System Uptime: 0 days 0:10:52.468
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image \SystemRoot\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMEFA64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEFA64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff880013bbc6d, fffff880031f6838, fffff880031f6090}
Unable to load image \SystemRoot\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMDS64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMDS64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMDS64.SYS
Probably caused by : SYMEFA64.SYS ( SYMEFA64+c4c6d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880013bbc6d, The address that the exception occurred at
Arg3: fffff880031f6838, Exception Record Address
Arg4: fffff880031f6090, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
SYMEFA64+c4c6d
fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h]
EXCEPTION_RECORD: fffff880031f6838 -- (.exr 0xfffff880031f6838)
ExceptionAddress: fffff880013bbc6d (SYMEFA64+0x00000000000c4c6d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880031f6090 -- (.cxr 0xfffff880031f6090)
rax=fffff8a000bb9bd0 rbx=0000000000000003 rcx=fffdf8a0103efc00
rdx=fffffa8008ac9bd0 rsi=fffff8a00f71f888 rdi=fffffa8008ac9b80
rip=fffff880013bbc6d rsp=fffff880031f6a70 rbp=0000000000000020
r8=0000000000000020 r9=0000000000000000 r10=0000000000000000
r11=fffff8a0075ea958 r12=0000000000000001 r13=fffffa800b7d1700
r14=0000000000000000 r15=0000000000000020
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287
SYMEFA64+0xc4c6d:
fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:fffdf8a0`103efc10=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbe100
ffffffffffffffff
FOLLOWUP_IP:
SYMEFA64+c4c6d
fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 0000000000000021 to fffff880013bbc6d
STACK_TEXT:
fffff880`031f6a70 00000000`00000021 : fffffa80`073af400 00000000`00000021 fffff880`011a8645 00010000`0001ab7e : SYMEFA64+0xc4c6d
fffff880`031f6a78 fffffa80`073af400 : 00000000`00000021 fffff880`011a8645 00010000`0001ab7e fffff880`011a1738 : 0x21
fffff880`031f6a80 00000000`00000021 : fffff880`011a8645 00010000`0001ab7e fffff880`011a1738 fffff8a0`0f71f888 : 0xfffffa80`073af400
fffff880`031f6a88 fffff880`011a8645 : 00010000`0001ab7e fffff880`011a1738 fffff8a0`0f71f888 fffff8a0`1108cbc8 : 0x21
fffff880`031f6a90 00010000`0001ab7e : fffff880`011a1738 fffff8a0`0f71f888 fffff8a0`1108cbc8 fffffa80`0b7d1602 : SYMDS64+0x62645
fffff880`031f6a98 fffff880`011a1738 : fffff8a0`0f71f888 fffff8a0`1108cbc8 fffffa80`0b7d1602 fffffa80`08ac9b80 : 0x10000`0001ab7e
fffff880`031f6aa0 fffff8a0`0f71f888 : fffff8a0`1108cbc8 fffffa80`0b7d1602 fffffa80`08ac9b80 fffffa80`0819d0b0 : SYMDS64+0x5b738
fffff880`031f6aa8 fffff8a0`1108cbc8 : fffffa80`0b7d1602 fffffa80`08ac9b80 fffffa80`0819d0b0 fffff880`013bc123 : 0xfffff8a0`0f71f888
fffff880`031f6ab0 fffffa80`0b7d1602 : fffffa80`08ac9b80 fffffa80`0819d0b0 fffff880`013bc123 fffff880`013a40f8 : 0xfffff8a0`1108cbc8
fffff880`031f6ab8 fffffa80`08ac9b80 : fffffa80`0819d0b0 fffff880`013bc123 fffff880`013a40f8 fffff8a0`0f71f888 : 0xfffffa80`0b7d1602
fffff880`031f6ac0 fffffa80`0819d0b0 : fffff880`013bc123 fffff880`013a40f8 fffff8a0`0f71f888 fffffa80`0819d0b0 : 0xfffffa80`08ac9b80
fffff880`031f6ac8 fffff880`013bc123 : fffff880`013a40f8 fffff8a0`0f71f888 fffffa80`0819d0b0 00000000`00000000 : 0xfffffa80`0819d0b0
fffff880`031f6ad0 fffff880`013a40f8 : fffff8a0`0f71f888 fffffa80`0819d0b0 00000000`00000000 fffff880`00000002 : SYMEFA64+0xc5123
fffff880`031f6ad8 fffff8a0`0f71f888 : fffffa80`0819d0b0 00000000`00000000 fffff880`00000002 fffff880`012f8e30 : SYMEFA64+0xad0f8
fffff880`031f6ae0 fffffa80`0819d0b0 : 00000000`00000000 fffff880`00000002 fffff880`012f8e30 00000000`00000000 : 0xfffff8a0`0f71f888
fffff880`031f6ae8 00000000`00000000 : fffff880`00000002 fffff880`012f8e30 00000000`00000000 00000000`00000000 : 0xfffffa80`0819d0b0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: SYMEFA64+c4c6d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SYMEFA64
IMAGE_NAME: SYMEFA64.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4e545217
STACK_COMMAND: .cxr 0xfffff880031f6090 ; kb
FAILURE_BUCKET_ID: X64_0x7E_SYMEFA64+c4c6d
BUCKET_ID: X64_0x7E_SYMEFA64+c4c6d
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-41312-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c54670
Debug session time: Tue Jan 10 17:06:29.199 2012 (UTC - 7:00)
System Uptime: 0 days 0:28:47.636
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002d58e6e, fffff88006de66e0, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1de )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002d58e6e, Address of the instruction which caused the bugcheck
Arg3: fffff88006de66e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!CmpKcbCacheLookup+1de
fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch]
CONTEXT: fffff88006de66e0 -- (.cxr 0xfffff88006de66e0)
rax=000000000000000a rbx=0000000000000000 rcx=00000000000004b9
rdx=0000000002012f4a rsi=fffff88006de72e8 rdi=00000000cb127fd7
rip=fffff80002d58e6e rsp=fffff88006de70c0 rbp=fffff8a004114010
r8=0000000000000009 r9=0000000000000000 r10=000000000000000b
r11=fffff88006de7270 r12=fffff8a013833de8 r13=ffeff8a013707390
r14=0000000000000005 r15=0000000000000005
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!CmpKcbCacheLookup+0x1de:
fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch] ds:002b:ffeff8a0`13707384=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: TrustedInstall
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002d58e6e
STACK_TEXT:
fffff880`06de70c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpKcbCacheLookup+0x1de
FOLLOWUP_IP:
nt!CmpKcbCacheLookup+1de
fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CmpKcbCacheLookup+1de
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88006de66e0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!CmpKcbCacheLookup+1de
BUCKET_ID: X64_0x3B_nt!CmpKcbCacheLookup+1de
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-24500-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02caa670
Debug session time: Tue Jan 10 17:24:36.820 2012 (UTC - 7:00)
System Uptime: 0 days 0:15:58.242
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880088b8598, fffff880088b7df0, fffff88001501c73}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880088b8598
Arg3: fffff880088b7df0
Arg4: fffff88001501c73
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880088b8598 -- (.exr 0xfffff880088b8598)
ExceptionAddress: fffff88001501c73 (Ntfs!NtfsFcbTableCompare+0x0000000000000003)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880088b7df0 -- (.cxr 0xfffff880088b7df0)
rax=000100000001b0c7 rbx=ffeff8a00ea0f300 rcx=fffffa80081ae640
rdx=fffff880088b88d0 rsi=fffff880088b88d0 rdi=fffffa80081ae640
rip=fffff88001501c73 rsp=fffff880088b87d8 rbp=fffff880088b88a0
r8=ffeff8a00ea0f320 r9=0000ffffffffffff r10=fffff880014ab180
r11=fffff880088b8918 r12=fffff880088b8974 r13=0000000000000000
r14=fffffa80081ae180 r15=fffffa80081ae180
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
Ntfs!NtfsFcbTableCompare+0x3:
fffff880`01501c73 498b08 mov rcx,qword ptr [r8] ds:002b:ffeff8a0`0ea0f320=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d14100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`01501c73 498b08 mov rcx,qword ptr [r8]
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`01501c73 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002b0bb7d to fffff88001501c73
STACK_TEXT:
fffff880`088b87d8 fffff800`02b0bb7d : 00000000`00000000 fffff800`02dde687 00000000`00000010 00000000`00010297 : Ntfs!NtfsFcbTableCompare+0x3
fffff880`088b87e0 fffff800`02b0bbf5 : fffff880`088b8950 fffffa80`071f9c10 fffffa80`077f6e11 fffff880`088b88d0 : nt!FindNodeOrParent+0x3d
fffff880`088b8810 fffff880`015001a9 : 00010000`0001b0c7 fffff980`01129800 00000000`00000000 fffff880`014fce55 : nt!RtlLookupElementGenericTableFullAvl+0x15
fffff880`088b8840 fffff880`014d1d8b : fffffa80`077f6e40 fffffa80`081ae180 fffffa80`077f6e40 00010000`0001b0c7 : Ntfs!NtfsCreateFcb+0x79
fffff880`088b8920 fffff880`014f6179 : fffff880`061e0460 fffffa80`071f9c10 fffffa80`077f6e40 00000000`00000000 : Ntfs!NtfsOpenFile+0x1cb
fffff880`088b8b10 fffff880`0145ea3d : fffffa80`077f6e40 fffffa80`071f9c10 fffff880`061e0460 fffffa80`0b34e600 : Ntfs!NtfsCommonCreate+0xc49
fffff880`088b8cf0 fffff800`02ad9757 : fffff880`061e03d0 00310031`00300032 0043000a`000d0031 00530055`005c003a : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`088b8d20 fffff800`02ad9711 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`061e02a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff880088b7df0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-25375-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a19000 PsLoadedModuleList = 0xfffff800`02c5e670
Debug session time: Wed Jan 11 02:52:32.084 2012 (UTC - 7:00)
System Uptime: 0 days 7:19:51.506
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff960000cdada, fffff8800640ec80, 0}
Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetrics+18a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960000cdada, Address of the instruction which caused the bugcheck
Arg3: fffff8800640ec80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!RFONTOBJ::bGetGlyphMetrics+18a
fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8]
CONTEXT: fffff8800640ec80 -- (.cxr 0xfffff8800640ec80)
rax=fffff900c1d91af8 rbx=fffff8800640f8e8 rcx=fffff900c1d91af8
rdx=fffdf900c1d97408 rsi=fffff900c1d91020 rdi=fffff8800640f710
rip=fffff960000cdada rsp=fffff8800640f660 rbp=0000000000000020
r8=fffff900c1d91010 r9=fffff900c1d917f0 r10=00000000000000a0
r11=0000000000000000 r12=fffff8800640fa72 r13=0000000000000088
r14=00000000000000b1 r15=fffff8800640fa50
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210282
win32k!RFONTOBJ::bGetGlyphMetrics+0x18a:
fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8] ds:002b:fffdf900`c1d97410=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: OUTLOOK.EXE
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff960000cdada
STACK_TEXT:
fffff880`0640f660 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetrics+0x18a
FOLLOWUP_IP:
win32k!RFONTOBJ::bGetGlyphMetrics+18a
fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!RFONTOBJ::bGetGlyphMetrics+18a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
STACK_COMMAND: .cxr 0xfffff8800640ec80 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!RFONTOBJ::bGetGlyphMetrics+18a
BUCKET_ID: X64_0x3B_win32k!RFONTOBJ::bGetGlyphMetrics+18a
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-25828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c52670
Debug session time: Wed Jan 11 08:09:45.326 2012 (UTC - 7:00)
System Uptime: 0 days 5:16:04.748
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002a91fa6, fffff880083defb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeRemoveQueueEx+336 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a91fa6, Address of the instruction which caused the bugcheck
Arg3: fffff880083defb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!KeRemoveQueueEx+336
fffff800`02a91fa6 49890424 mov qword ptr [r12],rax
CONTEXT: fffff880083defb0 -- (.cxr 0xfffff880083defb0)
rax=0000000000000102 rbx=0000002c27dee694 rcx=0000000000000000
rdx=00000000000007ff rsi=fffffa800b573b60 rdi=fffffa800a979840
rip=fffff80002a91fa6 rsp=fffff880083df990 rbp=0000000000000000
r8=fffffa800a979bb8 r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e6100 r12=fffdf880083dfb88 r13=fffff880083dfba0
r14=0000000000000001 r15=fffffa800b573c68
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!KeRemoveQueueEx+0x336:
fffff800`02a91fa6 49890424 mov qword ptr [r12],rax ds:002b:fffdf880`083dfb88=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002a91fa6
STACK_TEXT:
fffff880`083df990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeRemoveQueueEx+0x336
FOLLOWUP_IP:
nt!KeRemoveQueueEx+336
fffff800`02a91fa6 49890424 mov qword ptr [r12],rax
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeRemoveQueueEx+336
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff880083defb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!KeRemoveQueueEx+336
BUCKET_ID: X64_0x3B_nt!KeRemoveQueueEx+336
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-81890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c1f000 PsLoadedModuleList = 0xfffff800`02e64670
Debug session time: Wed Jan 11 15:43:54.886 2012 (UTC - 7:00)
System Uptime: 0 days 0:56:51.308
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002f278cd, fffff880096e19d0, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmListGetNextElement+1d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002f278cd, Address of the instruction which caused the bugcheck
Arg3: fffff880096e19d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!CmListGetNextElement+1d
fffff800`02f278cd 498b09 mov rcx,qword ptr [r9]
CONTEXT: fffff880096e19d0 -- (.cxr 0xfffff880096e19d0)
rax=fffdf8a011f24360 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff880096e2428 rsi=0000000000000001 rdi=fffff8a000024010
rip=fffff80002f278cd rsp=fffff880096e23b8 rbp=fffff8a00d4fae00
r8=0000000000000000 r9=fffdf8a011f24360 r10=fffff8a006129010
r11=fffff8a004832c40 r12=0000000000000000 r13=fffff8a00d4fae00
r14=fffff8a00d4fae10 r15=fffff880096e2460
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!CmListGetNextElement+0x1d:
fffff800`02f278cd 498b09 mov rcx,qword ptr [r9] ds:002b:fffdf8a0`11f24360=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: poqexec.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002f278cd
STACK_TEXT:
fffff880`096e23b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmListGetNextElement+0x1d
FOLLOWUP_IP:
nt!CmListGetNextElement+1d
fffff800`02f278cd 498b09 mov rcx,qword ptr [r9]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CmListGetNextElement+1d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff880096e19d0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!CmListGetNextElement+1d
BUCKET_ID: X64_0x3B_nt!CmListGetNextElement+1d
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011212-33656-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c4d000 PsLoadedModuleList = 0xfffff800`02e92670
Debug session time: Wed Jan 11 23:16:29.371 2012 (UTC - 7:00)
System Uptime: 0 days 7:31:03.792
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880095ff348, fffff880095feba0, fffff8800144ff14}
Probably caused by : Ntfs.sys ( Ntfs!NtfsUninitializeNtfsMcb+8c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880095ff348
Arg3: fffff880095feba0
Arg4: fffff8800144ff14
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880095ff348 -- (.exr 0xfffff880095ff348)
ExceptionAddress: fffff8800144ff14 (Ntfs!NtfsUninitializeNtfsMcb+0x000000000000008c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880095feba0 -- (.cxr 0xfffff880095feba0)
rax=0000000000000000 rbx=fffff8a000dc2270 rcx=fffff880014a3980
rdx=0000000000000001 rsi=0000000000000000 rdi=0008000000000000
rip=fffff8800144ff14 rsp=fffff880095ff580 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffff880014a3980
r11=0000000000000000 r12=0000000000000703 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsUninitializeNtfsMcb+0x8c:
fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8] ds:002b:00080000`00000008=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: ccSvcHst.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efc100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsUninitializeNtfsMcb+8c
fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8]
FAULTING_IP:
Ntfs!NtfsUninitializeNtfsMcb+8c
fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880014d2b2f to fffff8800144ff14
STACK_TEXT:
fffff880`095ff580 fffff880`014d2b2f : fffff880`095ff638 00000000`00000130 fffff8a0`00dc2010 00000000`00000000 : Ntfs!NtfsUninitializeNtfsMcb+0x8c
fffff880`095ff5b0 fffff880`014d7cc1 : 00000000`00000000 00000000`00000000 fffff880`095ffa00 00000000`00000001 : Ntfs!NtfsDeleteScb+0x8b
fffff880`095ff5f0 fffff880`0145085c : fffff8a0`00dc2040 fffff8a0`00dc2140 fffff880`095ffa00 fffff8a0`00dc2140 : Ntfs!NtfsRemoveScb+0x61
fffff880`095ff630 fffff880`0144fa3f : fffff8a0`00dc2010 fffff880`095ffa40 fffff880`095ff701 fffffa80`0b664b30 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`095ff660 fffff880`014d5770 : fffffa80`0b664b30 fffffa80`08193180 fffff8a0`13f29670 fffff8a0`15665f10 : Ntfs!NtfsTeardownFromLcb+0x2af
fffff880`095ff6f0 fffff880`014c374c : fffffa80`0b664b30 00000000`00000000 00000000`00000001 fffffa80`0b664b00 : Ntfs!NtfsTeardownStructures+0x200
fffff880`095ff770 fffff880`014cbfad : fffffa80`0b664b30 fffffa80`08193180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x530
fffff880`095ff8a0 fffff880`014cc6b4 : fffffa80`0b664b30 fffffa80`0be91010 fffffa80`0b0de910 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`095ff980 fffff880`01110bcf : fffffa80`0be913b0 fffffa80`0be91010 fffffa80`0b664b30 fffff880`095ff9a8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`095ff9f0 fffff880`0110f6df : fffffa80`0853bb60 00000000`00000001 fffffa80`0853bb00 fffffa80`0be91010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`095ffa80 fffff800`02fd221b : 00000000`00000002 fffffa80`0b0de910 00000000`00000001 fffffa80`0be91010 : fltmgr!FltpDispatch+0xcf
fffff880`095ffae0 fffff800`02f66b85 : fffffa80`0be91010 fffffa80`0b23bb60 fffffa80`0b0de910 fffff800`02e3fe80 : nt!IopSynchronousServiceTail+0xfb
fffff880`095ffb50 fffff800`02cc8ed3 : fffffa80`0b23bb60 00000000`7efa4000 fffffa80`0853bb60 fffffa80`0b0de910 : nt!NtFlushBuffersFile+0x171
fffff880`095ffbe0 00000000`77b617ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`059ee158 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b617ca
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsUninitializeNtfsMcb+8c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff880095feba0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsUninitializeNtfsMcb+8c
BUCKET_ID: X64_0x24_Ntfs!NtfsUninitializeNtfsMcb+8c
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011212-24750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
Debug session time: Thu Jan 12 07:03:18.600 2012 (UTC - 7:00)
System Uptime: 0 days 4:32:13.022
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {77ad138a, 0, ffff, fffff88005cd3c60}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 0000000077ad138a, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000ffff, Thread->KernelApcDisable
Arg4: fffff88005cd3c60, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
+6233303734383535
00000000`77ad138a ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cc51e9 to fffff80002cc5c40
STACK_TEXT:
fffff880`05cd3a28 fffff800`02cc51e9 : 00000000`00000001 00000000`77ad138a 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
fffff880`05cd3a30 fffff800`02cc5120 : fffffa80`0a2afb30 00000000`00000001 fffffa80`0a2ab060 fffff800`02fbd4f4 : nt!KiBugCheckDispatch+0x69
fffff880`05cd3b70 00000000`77ad138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`00cab3d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ad138a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`02cc5120 4883ec50 sub rsp,50h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245
BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011412-22546-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c01000 PsLoadedModuleList = 0xfffff800`02e46670
Debug session time: Fri Jan 13 22:00:36.686 2012 (UTC - 7:00)
System Uptime: 1 days 7:25:17.124
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff8800126c0fe, fffff880031cc898, fffff880031cc0f0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsMcbCleanupLruQueue+7e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800126c0fe, The address that the exception occurred at
Arg3: fffff880031cc898, Exception Record Address
Arg4: fffff880031cc0f0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
Ntfs!NtfsMcbCleanupLruQueue+7e
fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi]
EXCEPTION_RECORD: fffff880031cc898 -- (.exr 0xfffff880031cc898)
ExceptionAddress: fffff8800126c0fe (Ntfs!NtfsMcbCleanupLruQueue+0x000000000000007e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880031cc0f0 -- (.cxr 0xfffff880031cc0f0)
rax=fffff88001296ed0 rbx=fffff8800126c080 rcx=0000000000000000
rdx=0000000000003e57 rsi=fffdf8a012984990 rdi=fffff8a012984950
rip=fffff8800126c0fe rsp=fffff880031ccad0 rbp=fffff80002e1e260
r8=0000000000001f40 r9=0000000000000000 r10=fffff80002dfd300
r11=fffff8a012b5b9d0 r12=fffff8a012984950 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
Ntfs!NtfsMcbCleanupLruQueue+0x7e:
fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi] ds:002b:fffdf8a0`12984990=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb0100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsMcbCleanupLruQueue+7e
fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff80002c88001 to fffff8800126c0fe
STACK_TEXT:
fffff880`031ccad0 fffff800`02c88001 : fffffa80`06d29040 fffff880`031ccb00 00000000`00000000 00000000`00000000 : Ntfs!NtfsMcbCleanupLruQueue+0x7e
fffff880`031ccc70 fffff800`02f18fee : 00000000`00000000 fffffa80`06d29040 00000000`00000080 fffffa80`06d16040 : nt!ExpWorkerThread+0x111
fffff880`031ccd00 fffff800`02c6f5e6 : fffff880`009e6180 fffffa80`06d29040 fffff880`009f0f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031ccd40 00000000`00000000 : fffff880`031cd000 fffff880`031c7000 fffff880`031cc9a0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsMcbCleanupLruQueue+7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff880031cc0f0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_Ntfs!NtfsMcbCleanupLruQueue+7e
BUCKET_ID: X64_0x7E_Ntfs!NtfsMcbCleanupLruQueue+7e
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011412-22906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e47670
Debug session time: Sat Jan 14 06:18:33.955 2012 (UTC - 7:00)
System Uptime: 0 days 0:04:40.376
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {5002, fffff780c0000000, d94d, 40d94efffffffe}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2aa81 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005002, The subtype of the bugcheck.
Arg2: fffff780c0000000
Arg3: 000000000000d94d
Arg4: 0040d94efffffffe
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_5002
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SearchProtocol
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cea347 to fffff80002c7ec40
STACK_TEXT:
fffff880`0992c228 fffff800`02cea347 : 00000000`0000001a 00000000`00005002 fffff780`c0000000 00000000`0000d94d : nt!KeBugCheckEx
fffff880`0992c230 fffff800`02c94fa0 : fffff6fc`c00fc500 00000000`00000001 fffff880`00000010 fffffa80`0460b630 : nt! ?? ::FNODOBFM::`string'+0x2aa81
fffff880`0992c3a0 fffff800`02c6dc1e : fffff980`1f880000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCheckCachedPageStates+0x3c0
fffff880`0992c550 fffff800`02f68e10 : 00000000`00000000 00000000`00000000 fffffa80`07910f20 00000000`01225960 : nt!CcFetchDataForRead+0x10e
fffff880`0992c5b0 fffff880`0124e730 : fffff8a0`00000001 00000000`00000001 fffffa80`00040000 fffff880`012a1001 : nt!CcCopyRead+0x180
fffff880`0992c670 fffff880`0124eda3 : 00000000`00000000 fffff8a0`0bcf96f0 fffff880`0992c8a0 fffff880`0992c798 : Ntfs!NtfsCachedRead+0x180
fffff880`0992c6d0 fffff880`01250a68 : fffffa80`070f4c70 fffffa80`079d4a50 fffff880`0992c801 fffffa80`07d5e200 : Ntfs!NtfsCommonRead+0x583
fffff880`0992c870 fffff880`01165bcf : fffffa80`079d4df0 fffffa80`079d4a50 fffffa80`07d5e280 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0992c920 fffff880`011646df : fffffa80`0854e7a0 00000000`00000001 fffffa80`0854e700 fffffa80`079d4a50 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0992c9b0 fffff800`02f8721b : 00000000`00000000 fffffa80`07910f20 00000000`00000001 fffffa80`079d4a50 : fltmgr!FltpDispatch+0xcf
fffff880`0992ca10 fffff800`02f68b63 : fffffa80`07910f20 fffffa80`07910f20 fffffa80`07910f20 00000000`00000001 : nt!IopSynchronousServiceTail+0xfb
fffff880`0992ca80 fffff800`02c7ded3 : fffffa80`0a190820 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`0992cb70 00000000`7742137a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`011ae1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7742137a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+2aa81
fffff800`02cea347 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2aa81
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2aa81
BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2aa81
Followup: MachineOwner
---------
[/list]
