Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\101110-20436-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e8ee50
Debug session time: Tue Oct 12 05:09:56.332 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:18.002
Loading Kernel Symbols
...............................................................
................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8800498e141, fffff88005cfda40, 0}
Probably caused by : atikmdag.sys ( atikmdag+38a141 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800498e141, Address of the instruction which caused the bugcheck
Arg3: fffff88005cfda40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
atikmdag+38a141
fffff880`0498e141 488b01 mov rax,qword ptr [rcx]
CONTEXT: fffff88005cfda40 -- (.cxr 0xfffff88005cfda40)
rax=fffffa8005d00a80 rbx=fffffa8005d00a80 rcx=0000000000000000
rdx=fffffa8005f593f8 rsi=fffffa8005f59020 rdi=fffffa8005f59418
rip=fffff8800498e141 rsp=fffff88005cfe410 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffffa8005d00a80
r11=fffff88005cfe300 r12=fffffa8005d00a80 r13=fffffa8003d462e0
r14=fffffa80055572c0 r15=fffffa8005cf4c40
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
atikmdag+0x38a141:
fffff880`0498e141 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8800498e141
STACK_TEXT:
fffff880`05cfe410 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x38a141
FOLLOWUP_IP:
atikmdag+38a141
fffff880`0498e141 488b01 mov rax,qword ptr [rcx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+38a141
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c75c7aa
STACK_COMMAND: .cxr 0xfffff88005cfda40 ; kb
FAILURE_BUCKET_ID: X64_0x3B_atikmdag+38a141
BUCKET_ID: X64_0x3B_atikmdag+38a141
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\100410-14289-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c56000 PsLoadedModuleList = 0xfffff800`02e93e50
Debug session time: Mon Oct 4 16:23:08.397 2010 (UTC - 5:00)
System Uptime: 4 days 19:10:34.303
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a40a3ee8a0, 0, fffff80002df9f8c, 5}
Could not read faulting driver name
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a40a3ee8a0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002df9f8c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efe0e0
fffff8a40a3ee8a0
FAULTING_IP:
nt!ExDeferredFreePool+100
fffff800`02df9f8c 4c8b02 mov r8,qword ptr [rdx]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff880080ef810 -- (.trap 0xfffff880080ef810)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a00ca2f2c0 rbx=0000000000000000 rcx=fffffa8003c5d3e0
rdx=fffff8a40a3ee8a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002df9f8c rsp=fffff880080ef9a0 rbp=0000000000000000
r8=fffff8a40a3ee8a0 r9=0000000000000000 r10=fffff8a00b0f5820
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExDeferredFreePool+0x100:
fffff800`02df9f8c 4c8b02 mov r8,qword ptr [rdx] ds:0001:fffff8a4`0a3ee8a0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d458c1 to fffff80002cc6740
STACK_TEXT:
fffff880`080ef6a8 fffff800`02d458c1 : 00000000`00000050 fffff8a4`0a3ee8a0 00000000`00000000 fffff880`080ef810 : nt!KeBugCheckEx
fffff880`080ef6b0 fffff800`02cc482e : 00000000`00000000 00000000`00000002 00000000`00000700 fffffa80`03c69f30 : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`080ef810 fffff800`02df9f8c : 00000000`00000194 00000000`000001a0 00000000`00000000 fffff800`02c8ffd1 : nt!KiPageFault+0x16e
fffff880`080ef9a0 fffff800`02dfb4c1 : 00000000`00000001 fffff8a0`0d2e05b0 fffff880`080efa40 fffff880`080efa40 : nt!ExDeferredFreePool+0x100
fffff880`080efa30 fffff800`02ccb8bc : fffff8a0`0d2e05e0 00000000`00000000 fffffa80`2079654b fffffa80`03d05f30 : nt!ExFreePoolWithTag+0x411
fffff880`080efae0 fffff800`02fdc514 : fffffa80`0663ab30 00000000`00000000 fffffa80`05fe6060 00000000`00000000 : nt!ObfDereferenceObject+0xdc
fffff880`080efb40 fffff800`02fdc414 : 00000000`000005c8 fffffa80`0663ab30 fffff8a0`03155100 00000000`000005c8 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`080efbd0 fffff800`02cc5993 : fffffa80`05fe6060 fffff880`080efca0 000007fe`fb6e4478 00000000`024be9e0 : nt!ObpCloseHandle+0x94
fffff880`080efc20 00000000`76d7fe4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`024be978 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d7fe4a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+100
fffff800`02df9f8c 4c8b02 mov r8,qword ptr [rdx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ExDeferredFreePool+100
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x50_nt!ExDeferredFreePool+100
BUCKET_ID: X64_0x50_nt!ExDeferredFreePool+100
Followup: Pool_corruption
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\101510-17206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02ea2e50
Debug session time: Sat Oct 16 02:08:18.771 2010 (UTC - 5:00)
System Uptime: 3 days 20:51:59.150
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a4037ccb9c, 0, fffff80002f7256b, 5}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpReportNotifyHelper+12b )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a4037ccb9c, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002f7256b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0d0e0
fffff8a4037ccb9c
FAULTING_IP:
nt!CmpReportNotifyHelper+12b
fffff800`02f7256b 418b4804 mov ecx,dword ptr [r8+4]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 1
TRAP_FRAME: fffff8800465b720 -- (.trap 0xfffff8800465b720)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000081010000 rbx=0000000000000000 rcx=fffff8a0029fe008
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f7256b rsp=fffff8800465b8b0 rbp=fffff8a002d80010
r8=fffff8a4037ccb98 r9=0000000000000001 r10=fffff880009e9b40
r11=fffff8800465b970 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!CmpReportNotifyHelper+0x12b:
fffff800`02f7256b 418b4804 mov ecx,dword ptr [r8+4] ds:07ff:fffff8a4`037ccb9c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d548c1 to fffff80002cd5740
STACK_TEXT:
fffff880`0465b5b8 fffff800`02d548c1 : 00000000`00000050 fffff8a4`037ccb9c 00000000`00000000 fffff880`0465b720 : nt!KeBugCheckEx
fffff880`0465b5c0 fffff800`02cd382e : 00000000`00000000 fffff8a0`1368f2b0 fffff8a0`085f6000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`0465b720 fffff800`02f7256b : fffff8a0`02d80010 fffff8a0`02d80010 fffff8a0`03727320 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0465b8b0 fffff800`02f5ea8e : fffff8a0`091645d0 fffff8a0`02d80010 00000000`00000000 00000000`00000000 : nt!CmpReportNotifyHelper+0x12b
fffff880`0465b940 fffff800`02f6e172 : fffff8a0`091645d0 00000000`00000000 00000000`00000000 00000000`c0000001 : nt!CmpReportNotify+0x92
fffff880`0465b9a0 fffff800`02f73f5e : fffff8a0`099060d0 00000000`00000000 fffff880`0465bb58 fffff8a0`0f0bbe80 : nt!CmpSecurityMethod+0x809
fffff880`0465baf0 fffff800`02f742ec : fffffa80`05450000 fffff800`00000004 00000000`00000001 fffffa80`05d7b001 : nt!ObSetSecurityObjectByPointer+0x5a
fffff880`0465bb50 fffff800`02cd4993 : 00000000`00001f24 fffffa80`05456b60 00000000`0575e801 fffffa80`063c8b10 : nt!NtSetSecurityObject+0x108
fffff880`0465bc20 00000000`7759141a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0575e698 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7759141a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!CmpReportNotifyHelper+12b
fffff800`02f7256b 418b4804 mov ecx,dword ptr [r8+4]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!CmpReportNotifyHelper+12b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x50_nt!CmpReportNotifyHelper+12b
BUCKET_ID: X64_0x50_nt!CmpReportNotifyHelper+12b
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\091310-24632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c60000 PsLoadedModuleList = 0xfffff800`02e9de50
Debug session time: Tue Sep 14 06:26:37.315 2010 (UTC - 5:00)
System Uptime: 0 days 0:06:10.985
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800660e718, fffff8800660df80, fffff880010d4c27}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+1fe )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800660e718
Arg3: fffff8800660df80
Arg4: fffff880010d4c27
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800660e718 -- (.exr 0xfffff8800660e718)
ExceptionAddress: fffff880010d4c27 (Ntfs!NtfsFindPrefixHashEntry+0x00000000000001fe)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000400000010
Attempt to read from address 0000000400000010
CONTEXT: fffff8800660df80 -- (.cxr 0xfffff8800660df80)
rax=fffff8a00878d000 rbx=0000000400000000 rcx=00000000000000a8
rdx=0000000000000002 rsi=fffff8a00027fbc0 rdi=fffffa8004c0d350
rip=fffff880010d4c27 rsp=fffff8800660e950 rbp=0000000000000001
r8=000000001aa25854 r9=0000000000000000 r10=0000000000000002
r11=fffff8800660e998 r12=fffff8800660ec60 r13=fffff88003a57b90
r14=0000000000000054 r15=0000000000000854
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsFindPrefixHashEntry+0x1fe:
fffff880`010d4c27 44394310 cmp dword ptr [rbx+10h],r8d ds:002b:00000004`00000010=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000400000010
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f080e0
0000000400000010
FOLLOWUP_IP:
Ntfs!NtfsFindPrefixHashEntry+1fe
fffff880`010d4c27 44394310 cmp dword ptr [rbx+10h],r8d
FAULTING_IP:
Ntfs!NtfsFindPrefixHashEntry+1fe
fffff880`010d4c27 44394310 cmp dword ptr [rbx+10h],r8d
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880010d5ce2 to fffff880010d4c27
STACK_TEXT:
fffff880`0660e950 fffff880`010d5ce2 : fffffa80`03e9a660 fffffa80`04c0d350 fffff8a0`0027fbc0 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x1fe
fffff880`0660ea80 fffff880`010d028d : fffffa80`03e9a660 fffffa80`03edf010 fffff880`0660ec60 fffff880`0660eca8 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0660eb50 fffff880`01039c0d : fffffa80`03e9a660 fffffa80`03edf010 fffff880`03a57b90 fffffa80`06682800 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`0660ed30 fffff800`02cc8487 : fffff880`03a57b00 00000000`0011a420 00000000`775d4270 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0660ed60 fffff800`02cc8441 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`03a579d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFindPrefixHashEntry+1fe
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800660df80 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFindPrefixHashEntry+1fe
BUCKET_ID: X64_0x24_Ntfs!NtfsFindPrefixHashEntry+1fe
Followup: MachineOwner
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\083110-12277-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c5a000 PsLoadedModuleList = 0xfffff800`02e97e50
Debug session time: Wed Sep 1 03:08:16.531 2010 (UTC - 5:00)
System Uptime: 16 days 19:21:07.186
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa840519e548, 1, fffff880010208ae, 5}
Could not read faulting driver name
Probably caused by : fileinfo.sys ( fileinfo!FIPfFileOpenRemove+5e )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa840519e548, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880010208ae, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f020e0
fffffa840519e548
FAULTING_IP:
fileinfo!FIPfFileOpenRemove+5e
fffff880`010208ae 48894108 mov qword ptr [rcx+8],rax
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800796c4e0 -- (.trap 0xfffff8800796c4e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800519e540 rbx=0000000000000000 rcx=fffffa840519e540
rdx=0000000000000010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880010208ae rsp=fffff8800796c670 rbp=fffffa8005b49670
r8=fffff8a00175ffd8 r9=0000000000000150 r10=fffff80002c5a000
r11=fffff8800796c660 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
fileinfo!FIPfFileOpenRemove+0x5e:
fffff880`010208ae 48894108 mov qword ptr [rcx+8],rax ds:7b60:fffffa84`0519e548=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d49801 to fffff80002cca600
STACK_TEXT:
fffff880`0796c378 fffff800`02d49801 : 00000000`00000050 fffffa84`0519e548 00000000`00000001 fffff880`0796c4e0 : nt!KeBugCheckEx
fffff880`0796c380 fffff800`02cc86ee : 00000000`00000001 fffff8a0`11737180 fffff880`0796c800 fffff8a0`0e905890 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`0796c4e0 fffff880`010208ae : fffff8a0`0175ffb0 fffff880`00000000 fffff8a0`0175ffb0 fffffa80`0519e538 : nt!KiPageFault+0x16e
fffff880`0796c670 fffff880`0101f6b4 : fffff8a0`0175ffb0 00000000`00000000 fffff880`0796c700 00000000`00000000 : fileinfo!FIPfFileOpenRemove+0x5e
fffff880`0796c6b0 fffff800`0303b7c5 : fffffa80`04599650 fffff8a0`0e8ff000 00000000`00000009 fffff8a0`10405f00 : fileinfo!FIPfInterfaceClose+0x90
fffff880`0796c6e0 fffff800`030e6899 : fffff8a0`0e9056d0 fffff8a0`0e8ff000 00000000`4c526650 00000000`00000001 : nt!PfpOpenHandleClose+0x55
fffff880`0796c730 fffff800`03128c8d : 00000000`00000000 00000000`0000002d fffffa80`04913010 00000000`00000060 : nt!PfpReadSupportCleanup+0x49
fffff880`0796c760 fffff800`0313084c : fffff8a0`000001fa fffff8a0`00000000 fffff8a0`00000001 00000000`0000002d : nt!PfpPrefetchFiles+0x37d
fffff880`0796c810 fffff800`03131327 : 00000000`00000000 fffff880`0796cca0 fffff880`0796ca08 fffff8a0`0111c670 : nt!PfpPrefetchRequestPerform+0x3cc
fffff880`0796c960 fffff800`0313d8fe : fffff880`0796ca08 fffff880`0796ca01 fffffa80`05e6ce00 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`0796c9d0 fffff800`0314202e : 00000000`00000000 00000000`00ebf750 00000000`0000004f 00000000`08058001 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`0796cab0 fffff800`02cc9853 : fffffa80`03f17b60 00000000`00000000 00000000`07ee3801 00000000`07ee38b0 : nt!NtSetSystemInformation+0xb91
fffff880`0796cc20 00000000`771115aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00ebf728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771115aa
STACK_COMMAND: kb
FOLLOWUP_IP:
fileinfo!FIPfFileOpenRemove+5e
fffff880`010208ae 48894108 mov qword ptr [rcx+8],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: fileinfo!FIPfFileOpenRemove+5e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481
FAILURE_BUCKET_ID: X64_0x50_fileinfo!FIPfFileOpenRemove+5e
BUCKET_ID: X64_0x50_fileinfo!FIPfFileOpenRemove+5e
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\101610-14820-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02ea2e50
Debug session time: Sat Oct 16 22:31:30.441 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:18.111
Loading Kernel Symbols
...............................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff880049d1041, fffff88006611a50, 0}
Probably caused by : atikmdag.sys ( atikmdag+379041 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880049d1041, Address of the instruction which caused the bugcheck
Arg3: fffff88006611a50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
atikmdag+379041
fffff880`049d1041 488b01 mov rax,qword ptr [rcx]
CONTEXT: fffff88006611a50 -- (.cxr 0xfffff88006611a50)
rax=fffffa8005de3a80 rbx=fffffa8005de3a80 rcx=0000000000000000
rdx=fffffa8005fc9408 rsi=fffffa8005fc9020 rdi=fffffa8005fc9428
rip=fffff880049d1041 rsp=fffff88006612420 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffffa8005de3a80
r11=fffff88006612300 r12=0000000000000000 r13=fffffa8003d462e0
r14=fffffa8005461740 r15=fffffa8005dd8c40
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010282
atikmdag+0x379041:
fffff880`049d1041 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880049d1041
STACK_TEXT:
fffff880`06612420 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x379041
FOLLOWUP_IP:
atikmdag+379041
fffff880`049d1041 488b01 mov rax,qword ptr [rcx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+379041
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c58c4bc
STACK_COMMAND: .cxr 0xfffff88006611a50 ; kb
FAILURE_BUCKET_ID: X64_0x3B_atikmdag+379041
BUCKET_ID: X64_0x3B_atikmdag+379041
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\101610-15303-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Sat Oct 16 02:24:28.396 2010 (UTC - 5:00)
System Uptime: 0 days 0:15:35.066
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa8000836b80, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000836b80
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: CCC.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cf9f9e to fffff80002c86740
STACK_TEXT:
fffff880`0750d648 fffff800`02cf9f9e : 00000000`0000001a 00000000`00041790 fffffa80`00836b80 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0750d650 fffff800`02cc80da : 00000000`00000000 00000000`1e58ffff fffffa80`00000000 fffffa80`06bfb060 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`0750d810 fffff800`02c85993 : ffffffff`ffffffff fffff880`0750dad0 fffff880`0750dad8 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0750d900 fffff800`02c81f30 : fffff800`02f16a9f fffffa80`06bfb060 fffffa80`03fad060 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0750da98 fffff800`02f16a9f : fffffa80`06bfb060 fffffa80`03fad060 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`0750daa0 fffff800`02f6bc4e : 00000000`1e490000 00000000`00000000 00000000`00000000 fffffa80`0539c960 : nt!RtlFreeUserStack+0x27
fffff880`0750dad0 fffff800`02f6f72d : fffff880`00000000 00000000`1e58fa00 000007ff`fff0a000 00000000`00000000 : nt!PspExitThread+0x7ae
fffff880`0750db90 fffff800`02f6f969 : fffffa80`03fad060 00000000`00000000 fffffa80`03fad060 fffff880`0750dc00 : nt!PspTerminateThreadByPointer+0x4d
fffff880`0750dbe0 fffff800`02c85993 : fffffa80`03fad060 fffff880`0750dca0 00000000`00000000 fffffa80`065cf070 : nt!NtTerminateThread+0x45
fffff880`0750dc20 00000000`7782028a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1e58fa68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7782028a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02cf9f9e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33906
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
Followup: MachineOwner
---------
1: kd> lmtn
start end module name
fffff800`00bc0000 fffff800`00bca000 kdcom kdcom.dll Tue Jul 14 04:31:07 2009 (4A5BDFDB)
fffff800`02c16000 fffff800`031f2000 nt ntkrnlmp.exe Sat Jun 19 07:16:41 2010 (4C1C44A9)
fffff800`031f2000 fffff800`0323b000 hal hal.dll Tue Jul 14 04:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00c2a000 ataport ataport.SYS Tue Jul 14 02:19:52 2009 (4A5BC118)
fffff880`00c2a000 fffff880`00c35000 amdxata amdxata.sys Tue May 19 20:56:59 2009 (4A12F2EB)
fffff880`00c35000 fffff880`00c65000 CLASSPNP CLASSPNP.SYS Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00c71000 fffff880`00c80000 netbios netbios.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`00c80000 fffff880`00c8d000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Tue Jul 14 04:29:09 2009 (4A5BDF65)
fffff880`00c8d000 fffff880`00ca1000 PSHED PSHED.dll Tue Jul 14 04:32:23 2009 (4A5BE027)
fffff880`00ca1000 fffff880`00cff000 CLFS CLFS.SYS Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00cff000 fffff880`00dbf000 CI CI.dll Tue Jul 14 04:32:13 2009 (4A5BE01D)
fffff880`00dbf000 fffff880`00dd9000 mountmgr mountmgr.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00dd9000 fffff880`00de2000 atapi atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e0d000 vdrvroot vdrvroot.sys Tue Jul 14 03:01:31 2009 (4A5BCADB)
fffff880`00e0d000 fffff880`00e22000 partmgr partmgr.sys Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00e22000 fffff880`00e37000 volmgr volmgr.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00e37000 fffff880`00e93000 volmgrx volmgrx.sys Tue Jul 14 02:20:33 2009 (4A5BC141)
fffff880`00e93000 fffff880`00e9a000 pciide pciide.sys Tue Jul 14 02:19:49 2009 (4A5BC115)
fffff880`00e9a000 fffff880`00eaa000 PCIIDEX PCIIDEX.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`00eab000 fffff880`00f4f000 Wdf01000 Wdf01000.sys Tue Jul 14 02:22:07 2009 (4A5BC19F)
fffff880`00f4f000 fffff880`00f5e000 WDFLDR WDFLDR.SYS Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00f5e000 fffff880`00fb5000 ACPI ACPI.sys Tue Jul 14 02:19:34 2009 (4A5BC106)
fffff880`00fb5000 fffff880`00fbe000 WMILIB WMILIB.SYS Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00fbe000 fffff880`00fc8000 msisadrv msisadrv.sys Tue Jul 14 02:19:26 2009 (4A5BC0FE)
fffff880`00fc8000 fffff880`00ffb000 pci pci.sys Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`01000000 fffff880`0104c000 volsnap volsnap.sys Tue Jul 14 02:20:08 2009 (4A5BC128)
fffff880`0104c000 fffff880`01086000 rdyboost rdyboost.sys Tue Jul 14 02:34:34 2009 (4A5BC48A)
fffff880`01091000 fffff880`010dd000 fltmgr fltmgr.sys Tue Jul 14 02:19:59 2009 (4A5BC11F)
fffff880`010dd000 fffff880`010f1000 fileinfo fileinfo.sys Tue Jul 14 02:34:25 2009 (4A5BC481)
fffff880`010f1000 fffff880`0114f000 msrpc msrpc.sys Tue Jul 14 02:21:32 2009 (4A5BC17C)
fffff880`0114f000 fffff880`011c2000 cng cng.sys Tue Jul 14 02:49:40 2009 (4A5BC814)
fffff880`011c2000 fffff880`011fc000 fvevol fvevol.sys Sat Sep 26 05:34:26 2009 (4ABD7DB2)
fffff880`01200000 fffff880`0121a000 ksecdd ksecdd.sys Tue Jul 14 02:20:54 2009 (4A5BC156)
fffff880`0121a000 fffff880`0122b000 pcw pcw.sys Tue Jul 14 02:19:27 2009 (4A5BC0FF)
fffff880`0122b000 fffff880`01235000 Fs_Rec Fs_Rec.sys Tue Jul 14 02:19:45 2009 (4A5BC111)
fffff880`01235000 fffff880`0124b000 disk disk.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`0124d000 fffff880`013f0000 Ntfs Ntfs.sys Tue Jul 14 02:20:47 2009 (4A5BC14F)
fffff880`01400000 fffff880`01409000 hwpolicy hwpolicy.sys Tue Jul 14 02:19:22 2009 (4A5BC0FA)
fffff880`0140a000 fffff880`014fc000 ndis ndis.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`014fc000 fffff880`0155c000 NETIO NETIO.SYS Tue Jul 14 02:21:46 2009 (4A5BC18A)
fffff880`0155c000 fffff880`01587000 ksecpkg ksecpkg.sys Fri Dec 11 08:03:32 2009 (4B21E0B4)
fffff880`01587000 fffff880`015d1000 fwpkclnt fwpkclnt.sys Tue Jul 14 02:21:08 2009 (4A5BC164)
fffff880`015d1000 fffff880`015e1000 vmstorfl vmstorfl.sys Tue Jul 14 02:42:54 2009 (4A5BC67E)
fffff880`015e1000 fffff880`015e9000 spldr spldr.sys Mon May 11 19:56:27 2009 (4A0858BB)
fffff880`015e9000 fffff880`015fb000 mup mup.sys Tue Jul 14 02:23:45 2009 (4A5BC201)
fffff880`01600000 fffff880`017fd000 tcpip tcpip.sys Mon Jun 14 06:39:04 2010 (4C15A458)
fffff880`02400000 fffff880`0240e000 monitor monitor.sys Tue Jul 14 02:38:52 2009 (4A5BC58C)
fffff880`0240e000 fffff880`02423000 lltdio lltdio.sys Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`02428000 fffff880`025f0000 athurx athurx.sys Tue Jan 05 05:23:16 2010 (4B42B0A4)
fffff880`025f0000 fffff880`025fd000 vwifibus vwifibus.sys Tue Jul 14 03:07:21 2009 (4A5BCC39)
fffff880`02a00000 fffff880`02a8a000 afd afd.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`02a8a000 fffff880`02acf000 netbt netbt.sys Tue Jul 14 02:21:28 2009 (4A5BC178)
fffff880`02ad2000 fffff880`02afc000 cdrom cdrom.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`02afc000 fffff880`02b05000 Null Null.SYS Tue Jul 14 02:19:37 2009 (4A5BC109)
fffff880`02b05000 fffff880`02b0c000 Beep Beep.SYS Tue Jul 14 03:00:13 2009 (4A5BCA8D)
fffff880`02b0c000 fffff880`02b1a000 vga vga.sys Tue Jul 14 02:38:47 2009 (4A5BC587)
fffff880`02b1a000 fffff880`02b3f000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:38:51 2009 (4A5BC58B)
fffff880`02b3f000 fffff880`02b4f000 watchdog watchdog.sys Tue Jul 14 02:37:35 2009 (4A5BC53F)
fffff880`02b4f000 fffff880`02b58000 RDPCDD RDPCDD.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`02b58000 fffff880`02b61000 rdpencdd rdpencdd.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`02b61000 fffff880`02b6a000 rdprefmp rdprefmp.sys Tue Jul 14 03:16:35 2009 (4A5BCE63)
fffff880`02b6a000 fffff880`02b75000 Msfs Msfs.SYS Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`02b75000 fffff880`02b86000 Npfs Npfs.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`02b86000 fffff880`02ba4000 tdx tdx.sys Tue Jul 14 02:21:15 2009 (4A5BC16B)
fffff880`02ba4000 fffff880`02bb1000 TDI TDI.SYS Tue Jul 14 02:21:18 2009 (4A5BC16E)
fffff880`02bb1000 fffff880`02bba000 wfplwf wfplwf.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02bba000 fffff880`02be0000 pacer pacer.sys Tue Jul 14 03:09:41 2009 (4A5BCCC5)
fffff880`02be0000 fffff880`02bf6000 vwififlt vwififlt.sys Tue Jul 14 03:07:22 2009 (4A5BCC3A)
fffff880`03400000 fffff880`0341e000 dfsc dfsc.sys Tue Jul 14 02:23:44 2009 (4A5BC200)
fffff880`0341e000 fffff880`0342f000 blbdrive blbdrive.sys Tue Jul 14 02:35:59 2009 (4A5BC4DF)
fffff880`0342f000 fffff880`03455000 tunnel tunnel.sys Tue Jul 14 03:09:37 2009 (4A5BCCC1)
fffff880`03455000 fffff880`0346a000 amdppm amdppm.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
fffff880`0346a000 fffff880`03473000 wmiacpi wmiacpi.sys Tue Jul 14 02:31:02 2009 (4A5BC3B6)
fffff880`03499000 fffff880`034b6000 serial serial.sys Tue Jul 14 03:00:40 2009 (4A5BCAA8)
fffff880`034b6000 fffff880`034d1000 wanarp wanarp.sys Tue Jul 14 03:10:21 2009 (4A5BCCED)
fffff880`034d1000 fffff880`034e5000 termdd termdd.sys Tue Jul 14 03:16:36 2009 (4A5BCE64)
fffff880`034e5000 fffff880`034ff000 SCDEmu SCDEmu.SYS Mon Nov 09 05:27:29 2009 (4AF78C21)
fffff880`034ff000 fffff880`03550000 rdbss rdbss.sys Tue Jul 14 02:24:09 2009 (4A5BC219)
fffff880`03550000 fffff880`0355c000 nsiproxy nsiproxy.sys Tue Jul 14 02:21:02 2009 (4A5BC15E)
fffff880`0355c000 fffff880`03567000 mssmbios mssmbios.sys Tue Jul 14 02:31:10 2009 (4A5BC3BE)
fffff880`03567000 fffff880`03576000 discache discache.sys Tue Jul 14 02:37:18 2009 (4A5BC52E)
fffff880`03576000 fffff880`035f9000 csc csc.sys Tue Jul 14 02:24:26 2009 (4A5BC22A)
fffff880`03c00000 fffff880`03c3e000 1394ohci 1394ohci.sys Tue Jul 14 03:07:12 2009 (4A5BCC30)
fffff880`03c3e000 fffff880`03c4b000 fdc fdc.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`03c4b000 fffff880`03c57000 serenum serenum.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`03c57000 fffff880`03c67000 CompositeBus CompositeBus.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`03c67000 fffff880`03c7d000 AgileVpn AgileVpn.sys Tue Jul 14 03:10:24 2009 (4A5BCCF0)
fffff880`03c7d000 fffff880`03ca1000 rasl2tp rasl2tp.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`03ca1000 fffff880`03cad000 ndistapi ndistapi.sys Tue Jul 14 03:10:00 2009 (4A5BCCD8)
fffff880`03cd1000 fffff880`03d07000 atikmpag atikmpag.sys Wed Apr 07 04:23:30 2010 (4BBBDE92)
fffff880`03d07000 fffff880`03d2b000 HDAudBus HDAudBus.sys Tue Jul 14 03:06:13 2009 (4A5BCBF5)
fffff880`03d2b000 fffff880`03d82000 Rt64win7 Rt64win7.sys Thu Mar 04 15:42:52 2010 (4B8FB8DC)
fffff880`03d82000 fffff880`03dd8000 USBPORT USBPORT.SYS Tue Jul 14 03:06:31 2009 (4A5BCC07)
fffff880`03dd8000 fffff880`03de9000 usbehci usbehci.sys Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`04000000 fffff880`0405a000 usbhub usbhub.sys Tue Jul 14 03:07:09 2009 (4A5BCC2D)
fffff880`0405a000 fffff880`04065000 flpydisk flpydisk.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`04065000 fffff880`0407a000 NDProxy NDProxy.SYS Tue Jul 14 03:10:05 2009 (4A5BCCDD)
fffff880`0407a000 fffff880`0409c000 AtiHdmi AtiHdmi.sys Tue Mar 09 12:08:38 2010 (4B961E26)
fffff880`040d2000 fffff880`04101000 ndiswan ndiswan.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04101000 fffff880`0411c000 raspppoe raspppoe.sys Tue Jul 14 03:10:17 2009 (4A5BCCE9)
fffff880`0411c000 fffff880`0413d000 raspptp raspptp.sys Tue Jul 14 03:10:18 2009 (4A5BCCEA)
fffff880`0413d000 fffff880`04157000 rassstp rassstp.sys Tue Jul 14 03:10:25 2009 (4A5BCCF1)
fffff880`04157000 fffff880`04162000 rdpbus rdpbus.sys Tue Jul 14 03:17:46 2009 (4A5BCEAA)
fffff880`04162000 fffff880`04171000 kbdclass kbdclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`04171000 fffff880`04180000 mouclass mouclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`04180000 fffff880`04181480 swenum swenum.sys Tue Jul 14 03:00:18 2009 (4A5BCA92)
fffff880`04182000 fffff880`041c5000 ks ks.sys Tue Jul 14 03:00:31 2009 (4A5BCA9F)
fffff880`041c5000 fffff880`041d7000 umbus umbus.sys Tue Jul 14 03:06:56 2009 (4A5BCC20)
fffff880`04600000 fffff880`04646000 dxgmms1 dxgmms1.sys Tue Jul 14 02:38:32 2009 (4A5BC578)
fffff880`04646000 fffff880`04653000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 15:17:04 2009 (4A1151C0)
fffff880`04653000 fffff880`0465e000 usbohci usbohci.sys Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`04660000 fffff880`04d0a000 atikmdag atikmdag.sys Wed Apr 07 04:47:17 2010 (4BBBE425)
fffff880`04d0a000 fffff880`04dfe000 dxgkrnl dxgkrnl.sys Fri Oct 02 04:00:14 2009 (4AC5509E)
fffff880`05200000 fffff880`052c8000 HTTP HTTP.sys Tue Jul 14 02:22:16 2009 (4A5BC1A8)
fffff880`052c9000 fffff880`0531c000 nwifi nwifi.sys Tue Jul 14 03:07:23 2009 (4A5BCC3B)
fffff880`0531c000 fffff880`0532f000 ndisuio ndisuio.sys Tue Jul 14 03:09:25 2009 (4A5BCCB5)
fffff880`0532f000 fffff880`05347000 rspndr rspndr.sys Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`05347000 fffff880`05365000 bowser bowser.sys Tue Jul 14 02:23:50 2009 (4A5BC206)
fffff880`05365000 fffff880`0537d000 mpsdrv mpsdrv.sys Tue Jul 14 03:08:25 2009 (4A5BCC79)
fffff880`0537d000 fffff880`053aa000 mrxsmb mrxsmb.sys Sat Feb 27 09:52:19 2010 (4B88CF33)
fffff880`053aa000 fffff880`053f8000 mrxsmb10 mrxsmb10.sys Sat Feb 27 09:52:28 2010 (4B88CF3C)
fffff880`06400000 fffff880`0640e000 hidusb hidusb.sys Tue Jul 14 03:06:22 2009 (4A5BCBFE)
fffff880`0640e000 fffff880`06427000 HIDCLASS HIDCLASS.SYS Tue Jul 14 03:06:21 2009 (4A5BCBFD)
fffff880`06427000 fffff880`0642f080 HIDPARSE HIDPARSE.SYS Tue Jul 14 03:06:17 2009 (4A5BCBF9)
fffff880`06430000 fffff880`0643e000 kbdhid kbdhid.sys Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`0643e000 fffff880`0644b000 mouhid mouhid.sys Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`0644b000 fffff880`0646e000 luafv luafv.sys Tue Jul 14 02:26:13 2009 (4A5BC295)
fffff880`0646e000 fffff880`0648f000 WudfPf WudfPf.sys Tue Jul 14 03:05:37 2009 (4A5BCBD1)
fffff880`0648f000 fffff880`064b2000 mrxsmb20 mrxsmb20.sys Sat Feb 27 09:52:26 2010 (4B88CF3A)
fffff880`064db000 fffff880`06518000 portcls portcls.sys Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`06518000 fffff880`0653a000 drmk drmk.sys Tue Jul 14 04:01:25 2009 (4A5BD8E5)
fffff880`0653a000 fffff880`0653f200 ksthunk ksthunk.sys Tue Jul 14 03:00:19 2009 (4A5BCA93)
fffff880`06540000 fffff880`0659c000 HdAudio HdAudio.sys Tue Jul 14 03:06:59 2009 (4A5BCC23)
fffff880`0659c000 fffff880`065aa000 crashdmp crashdmp.sys Tue Jul 14 03:01:01 2009 (4A5BCABD)
fffff880`065aa000 fffff880`065b6000 dump_dumpata dump_dumpata.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`065b6000 fffff880`065bf000 dump_atapi dump_atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`065bf000 fffff880`065d2000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
fffff880`065d2000 fffff880`065de000 Dxapi Dxapi.sys Tue Jul 14 02:38:28 2009 (4A5BC574)
fffff880`065de000 fffff880`065fb000 usbccgp usbccgp.sys Tue Jul 14 03:06:45 2009 (4A5BCC15)
fffff880`065fb000 fffff880`065fcf00 USBD USBD.SYS Tue Jul 14 03:06:23 2009 (4A5BCBFF)
fffff880`07000000 fffff880`07068000 srv2 srv2.sys Tue Jun 22 06:20:47 2010 (4C202C0F)
fffff880`070dc000 fffff880`07182000 peauth peauth.sys Tue Jul 14 04:01:19 2009 (4A5BD8DF)
fffff880`07182000 fffff880`0718d000 secdrv secdrv.SYS Wed Sep 13 16:18:38 2006 (4508052E)
fffff880`0718d000 fffff880`071ba000 srvnet srvnet.sys Tue Jun 22 06:20:32 2010 (4C202C00)
fffff880`071ba000 fffff880`071cc000 tcpipreg tcpipreg.sys Tue Jul 14 03:09:49 2009 (4A5BCCCD)
fffff880`07235000 fffff880`072cb000 srv srv.sys Tue Jun 22 06:21:11 2010 (4C202C27)
fffff880`0733c000 fffff880`07347000 asyncmac asyncmac.sys Tue Jul 14 03:10:13 2009 (4A5BCCE5)
fffff960`000c0000 fffff960`003cf000 win32k win32k.sys Sat Jun 19 07:31:59 2010 (4C1C483F)
fffff960`00430000 fffff960`0043a000 TSDDD TSDDD.dll unavailable (00000000)
fffff960`00740000 fffff960`00767000 cdd cdd.dll Wed May 19 22:48:26 2010 (4BF4408A)
Unloaded modules:
fffff880`072cb000 fffff880`0733c000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00071000
fffff880`013f0000 fffff880`013fe000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`00c65000 fffff880`00c71000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`01086000 fffff880`0108f000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
fffff880`00de2000 fffff880`00df5000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000