Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\102510-43430-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e16000 PsLoadedModuleList = 0x82f5e810
Debug session time: Mon Oct 25 22:25:32.935 2010 (UTC - 5:00)
System Uptime: 1 days 3:22:49.762
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
.....................
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 8fcb3000, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 82ed9cb2, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.
Debugging Details:
------------------
Unable to load image \??\C:\Program Files\Rappelz\GameGuard\dump_wmimmc.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dump_wmimmc.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_wmimmc.sys
READ_ADDRESS: GetPointerFromAddress: unable to read from 82f7e718
Unable to read MiSystemVaType memory at 82f5e160
8fcb3000
FAULTING_IP:
nt!_output_l+50e
82ed9cb2 663918 cmp word ptr [eax],bx
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xCD
PROCESS_NAME: LManager.exe
CURRENT_IRQL: 0
TRAP_FRAME: 97bbf0d0 -- (.trap 0xffffffff97bbf0d0)
ErrCode = 00000000
eax=8fcb3000 ebx=00000000 ecx=7fffffee edx=8fcb2fe0 esi=97bbf473 edi=00000007
eip=82ed9cb2 esp=97bbf144 ebp=97bbf3a0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!_output_l+0x50e:
82ed9cb2 663918 cmp word ptr [eax],bx ds:0023:8fcb3000=????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82e5c638 to 82e9b903
STACK_TEXT:
97bbf0b8 82e5c638 00000000 8fcb3000 00000000 nt!MmAccessFault+0x106
97bbf0b8 82ed9cb2 00000000 8fcb3000 00000000 nt!KiTrap0E+0xdc
97bbf3a0 82eda611 97bbf3c4 97bbf473 00000000 nt!_output_l+0x50e
97bbf3e4 82eda11a 97bbf828 00000400 97bbf41c nt!_vsnprintf_l+0x72
97bbf400 9058ddb9 97bbf828 00000400 97bbf41c nt!_vsnprintf+0x18
WARNING: Stack unwind information not available. Following frames may be wrong.
97bbfc28 905a0d59 000000a0 90588dc0 9369f19c dump_wmimmc+0x6db9
97bbfc88 9058b5be 00000114 000b2054 00000114 dump_wmimmc+0x19d59
97bbfccc 9058b6d6 751fa08f 00000114 000b2054 dump_wmimmc+0x45be
97bbfd34 770664f4 badb0d00 0012fbd4 00000000 dump_wmimmc+0x46d6
97bbfd38 badb0d00 0012fbd4 00000000 00000000 0x770664f4
97bbfd3c 0012fbd4 00000000 00000000 00000000 0xbadb0d00
97bbfd40 00000000 00000000 00000000 00000000 0x12fbd4
STACK_COMMAND: kb
FOLLOWUP_IP:
dump_wmimmc+6db9
9058ddb9 ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: dump_wmimmc+6db9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dump_wmimmc
IMAGE_NAME: dump_wmimmc.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c162f49
FAILURE_BUCKET_ID: 0xCD_VRF_dump_wmimmc+6db9
BUCKET_ID: 0xCD_VRF_dump_wmimmc+6db9
Followup: MachineOwner
Loaded symbol image file: dump_wmimmc.sys
Image path: \??\C:\Program Files\Rappelz\GameGuard\dump_wmimmc.sys
Image name: dump_wmimmc.sys
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\092310-48937-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e4e000 PsLoadedModuleList = 0x82f96810
Debug session time: Thu Sep 23 18:05:27.102 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:20.803
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
......
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffd5d78d, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 830e101d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 82fb6718
Unable to read MiSystemVaType memory at 82f96160
ffd5d78d
FAULTING_IP:
nt!NtQueryInformationJobObject+10
830e101d f6 ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
TRAP_FRAME: 9fdd5c9c -- (.trap 0xffffffff9fdd5c9c)
ErrCode = 00000000
eax=000000e8 ebx=830e100d ecx=8a4bf318 edx=830e100d esi=02c0ecdc edi=00000000
eip=830e101d esp=9fdd5d10 ebp=9fdd5d34 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!NtQueryInformationJobObject+0x10:
830e101d f6 ???
Resetting default scope
MISALIGNED_IP:
nt!NtQueryInformationJobObject+10
830e101d f6 ???
LAST_CONTROL_TRANSFER: from 82e94638 to 82ed3903
STACK_TEXT:
9fdd5c84 82e94638 00000000 ffd5d78d 00000000 nt!MmAccessFault+0x106
9fdd5c84 830e101d 00000000 ffd5d78d 00000000 nt!KiTrap0E+0xdc
9fdd5d34 76e764f4 badb0d00 02c0ecc8 00000000 nt!NtQueryInformationJobObject+0x10
WARNING: Frame IP not in any known module. Following frames may be wrong.
9fdd5d38 badb0d00 02c0ecc8 00000000 00000000 0x76e764f4
9fdd5d3c 02c0ecc8 00000000 00000000 00000000 0xbadb0d00
9fdd5d40 00000000 00000000 00000000 00000000 0x2c0ecc8
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtQueryInformationJobObject+10
830e101d f6 ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!NtQueryInformationJobObject+10
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\093010-36816-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e55000 PsLoadedModuleList = 0x82f9d810
Debug session time: Thu Sep 30 05:17:48.548 2010 (UTC - 5:00)
System Uptime: 0 days 8:32:34.390
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {368fc777, 2, 0, 82eda89d}
*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
*** WARNING: Unable to verify timestamp for aswRdr.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswRdr.SYS
*** WARNING: Unable to verify timestamp for mdvrmng.sys
*** ERROR: Module load completed but symbols could not be loaded for mdvrmng.sys
Probably caused by : pacer.sys ( pacer!PcFilterSendNetBufferLists+256 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 368fc777, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82eda89d, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 82fbd718
Unable to read MiSystemVaType memory at 82f9d160
368fc777
CURRENT_IRQL: 2
FAULTING_IP:
nt!MmAccessFault+a0
82eda89d 8b06 mov eax,dword ptr [esi]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: msnmsgr.exe
TRAP_FRAME: a397f110 -- (.trap 0xffffffffa397f110)
ErrCode = 00000000
eax=db3ab0c7 ebx=00000000 ecx=a397f1e0 edx=00004700 esi=8823d224 edi=886ef0e0
eip=8ba7fc96 esp=a397f184 ebp=a397f198 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
ndis!ndisMAllocSGList+0x10:
8ba7fc96 8b4d08 mov ecx,dword ptr [ebp+8] ss:0010:a397f1a0=886ef0e0
Resetting default scope
LAST_CONTROL_TRANSFER: from 82eda89d to 82e9b82b
STACK_TEXT:
a397f01c 82eda89d badb0d00 00000080 00000000 nt!KiTrap0E+0x2cf
a397f0f8 82e9b638 00000000 8b565308 00000000 nt!MmAccessFault+0xa0
a397f0f8 8ba7fc96 00000000 8b565308 00000000 nt!KiTrap0E+0xdc
a397f198 8ba87464 886ef0e0 8823d224 85efae00 ndis!ndisMAllocSGList+0x10
a397f1c0 8ba8730a a397f1e0 a397f1e0 00000000 ndis!ndisMSendPacketsXToMiniport+0xc1
a397f228 8ba1f59d 886ef0e0 85efae48 00000000 ndis!ndisMSendNetBufferListsToPackets+0x84
a397f248 8ba1f623 85efae48 85efae48 00000000 ndis!ndisFilterSendNetBufferLists+0x87
a397f260 90de5c20 88938858 85efae48 00000000 ndis!NdisFSendNetBufferLists+0x38
a397f2dc 8ba1f474 85d04730 01efae48 00000000 pacer!PcFilterSendNetBufferLists+0x256
a397f308 8ba83d8c 886ef0e0 85efae48 00000000 ndis!ndisSendNBLToFilter+0xf2
a397f338 90c1bbf8 88940a60 85efae48 00000000 ndis!NdisSendNetBufferLists+0x162
a397f394 8bca1861 02ca4bd8 00000000 88260002 wanarp!WanIpSendPackets+0x1f4
a397f3e8 8bca1573 8bd21d98 00000000 00000000 tcpip!IppFragmentPackets+0x2e2
a397f420 8bca9313 8bd21d98 8826baac 8826bb48 tcpip!IppDispatchSendPacketHelper+0x266
a397f4c0 8bcaf3ae 0026baac a397f5a0 85a5a130 tcpip!IppPacketizeDatagrams+0x8d6
a397f540 8bcaf635 00000000 00000007 8bd21d98 tcpip!IppSendDatagramsCommon+0x652
a397f560 8bc8f3a8 88260788 a397f578 a397f6e0 tcpip!IpNlpSendDatagrams+0x4b
a397f5ec 8bc8f339 88260788 a397f6e0 858829a0 tcpip!IppSlowSendDatagram+0x31
a397f64c 8bc926c4 88260788 00000001 a397f6e0 tcpip!IpNlpFastSendDatagram+0xefd
a397f79c 8bc96555 859aedf8 00000000 00000001 tcpip!TcpTcbSend+0x78b
a397f7bc 8bc943e9 859aedf8 85c20020 00000000 tcpip!TcpEnqueueTcbSendOlmNotifySendComplete+0x157
a397f81c 8bc968e6 859aedf8 a397f91c 00000000 tcpip!TcpEnqueueTcbSend+0x3ca
a397f838 82ee4faa a397f8c8 856ef5d6 00000000 tcpip!TcpTlConnectionSendCalloutRoutine+0x17
a397f8a0 8bc95aab 8bc968cf a397f8c8 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
a397f8d8 90daed27 859aed01 a397f900 85a1a150 tcpip!TcpTlConnectionSend+0x73
a397f93c 90db42e3 00e11008 85a1a150 85a1a1e4 tdx!TdxSendConnection+0x1d7
a397f958 82e914bc 8836add8 85a1a150 88420768 tdx!TdxTdiDispatchInternalDeviceControl+0x115
a397f970 90dcf23b 334ad9d6 00000000 85a1a208 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
a397f9a8 90dca977 88420738 85a1a150 8836add8 aswTdi+0x523b
a397f9f0 82e914bc 8836add8 85a1a150 88442a78 aswTdi+0x977
a397fa08 90dd44d8 884429c0 a397fa2c 82e914bc nt!IofCallDriver+0x63
a397fa14 82e914bc 884429c0 85a1a150 8a3d7608 aswRdr+0x4d8
a397fa2c 8b41be15 85b893a0 8a3d7608 a397fab8 nt!IofCallDriver+0x63
a397fa48 82e914bc 00000001 00000000 85a1a820 mdvrmng+0x1e15
a397fa60 8b7bfa0e 28ed4a96 a397fb20 00000001 nt!IofCallDriver+0x63
a397fab0 8b7ac542 00000000 8b7ac542 85df9630 afd!AfdFastConnectionSend+0x2a6
a397fc28 830af985 89a97a01 00000001 0050f83c afd!AfdFastIoDeviceControl+0x53d
a397fcd0 830b253a 8841ae10 000008b0 00000000 nt!IopXxxControlFile+0x2d0
a397fd04 82e9844a 00000db8 000008b0 00000000 nt!NtDeviceIoControlFile+0x2a
a397fd04 773964f4 00000db8 000008b0 00000000 nt!KiFastCallEntry+0x12a
0050f890 00000000 00000000 00000000 00000000 0x773964f4
STACK_COMMAND: kb
FOLLOWUP_IP:
pacer!PcFilterSendNetBufferLists+256
90de5c20 5b pop ebx
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: pacer!PcFilterSendNetBufferLists+256
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: pacer
IMAGE_NAME: pacer.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc916
FAILURE_BUCKET_ID: 0xA_pacer!PcFilterSendNetBufferLists+256
BUCKET_ID: 0xA_pacer!PcFilterSendNetBufferLists+256
Followup: MachineOwner
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\101510-40575-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e03000 PsLoadedModuleList = 0x82f4b810
Debug session time: Fri Oct 15 03:19:03.390 2010 (UTC - 5:00)
System Uptime: 0 days 0:42:27.231
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, 801de000, 0, 0}
Probably caused by : hardware ( nt!KiTrap0E+c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 801de000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SFrame.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
nt!KiTrap0E+c
82e49568 a0bb300000 mov al,byte ptr ds:[000030BBh]
LAST_CONTROL_TRANSFER: from 00000000 to 82e49568
STACK_TEXT:
084dfee8 00000000 00000000 00000000 00000000 nt!KiTrap0E+0xc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+c
82e49568 a0bb300000 mov al,byte ptr ds:[000030BBh]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap0E+c
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\102410-40232-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e46000 PsLoadedModuleList = 0x82f8e810
Debug session time: Sun Oct 24 07:31:03.596 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:53.422
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {ddacb008, 2, 0, 82f6605b}
Probably caused by : fileinfo.sys ( fileinfo!FIStreamQueryWorker+76 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: ddacb008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 82f6605b, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+4ab
82f6605b 3932 cmp dword ptr [edx],esi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
TRAP_FRAME: 8873d724 -- (.trap 0xffffffff8873d724)
ErrCode = 00000000
eax=82f7bb70 ebx=82f7b8c0 ecx=9dacb008 edx=ddacb008 esi=82f7bb70 edi=82f7b8c4
eip=82f6605b esp=8873d798 ebp=8873d7e4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExAllocatePoolWithTag+0x4ab:
82f6605b 3932 cmp dword ptr [edx],esi ds:0023:ddacb008=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82f6605b to 82e8c82b
STACK_TEXT:
8873d724 82f6605b badb0d00 ddacb008 00000003 nt!KiTrap0E+0x2cf
8873d7e4 8306a080 00000000 000000b0 e56c6946 nt!ExAllocatePoolWithTag+0x4ab
8873d810 83069eea 946f8300 8873d838 00000080 nt!ObpAllocateObject+0xe2
8873d844 8308aed5 00000000 857e0938 8873d880 nt!ObCreateObject+0x128
8873d89c 8308629a 8873d96c 8c7c0b78 8c716a38 nt!IopAllocRealFileObject+0x50
8873d990 8306726b 8c716a38 877e0938 946f8308 nt!IopParseDevice+0xac4
8873da0c 8308d2d9 00000000 8873da60 00000240 nt!ObpLookupObjectName+0x4fa
8873da68 8308562b 8873db90 857e0938 00010000 nt!ObOpenObjectByName+0x165
8873dae4 830bce29 8cfa97d4 00100001 8873db90 nt!IopCreateFile+0x673
8873db40 85d3cde3 8cfa97d4 00100001 8873db90 nt!IoCreateFileEx+0x9e
8873dbd0 85d3e033 00000000 00000000 8cfa9758 fltmgr!FltpNormalizeNameFromCache+0xe5
8873dbfc 85d3edf4 01fa9758 00000000 8cfa9758 fltmgr!FltpExpandShortNames+0x2b5
8873dc18 85d3f505 8cfa0000 00000000 918ed574 fltmgr!FltpGetNormalizedFileNameWorker+0xae
8873dc30 85d3c765 8cfa9758 00000000 8cfa9758 fltmgr!FltpGetNormalizedFileName+0x19
8873dc48 85d26b21 8cfa9758 9db180f0 00000000 fltmgr!FltpCreateFileNameInformation+0x81
8873dc78 85d3ccd9 9d3ebfd4 00000001 00000000 fltmgr!FltpGetFileNameInformation+0x321
8873dc8c 85d594e0 9db180f0 8cf34008 8cfa9758 fltmgr!FltGetFileNameInformationUnsafe+0x59
8873dccc 85d433c8 8af175f8 8cf34008 00000899 fileinfo!FIStreamQueryWorker+0x76
8873dd00 82eb3f3b 00000000 00000000 857de4c0 fltmgr!FltpProcessGenericWorkItem+0x38
8873dd50 830546d3 00000001 a0a7514e 00000000 nt!ExpWorkerThread+0x10d
8873dd90 82f060f9 82eb3e2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
fileinfo!FIStreamQueryWorker+76
85d594e0 85c0 test eax,eax
SYMBOL_STACK_INDEX: 11
SYMBOL_NAME: fileinfo!FIStreamQueryWorker+76
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc18f
FAILURE_BUCKET_ID: 0xC5_2_VRF_fileinfo!FIStreamQueryWorker+76
BUCKET_ID: 0xC5_2_VRF_fileinfo!FIStreamQueryWorker+76
Followup: MachineOwner
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\102410-36613-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e3b000 PsLoadedModuleList = 0x82f83810
Debug session time: Sun Oct 24 03:27:28.264 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:31.106
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {75, 2, 1, 91fbe58f}
Unable to load image \SystemRoot\system32\DRIVERS\netw5v32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for netw5v32.sys
*** ERROR: Module load completed but symbols could not be loaded for netw5v32.sys
Probably caused by : netw5v32.sys ( netw5v32+1bb58f )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000075, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 91fbe58f, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82fa3718
Unable to read MiSystemVaType memory at 82f83160
00000075
CURRENT_IRQL: 2
FAULTING_IP:
netw5v32+1bb58f
91fbe58f 0000 add byte ptr [eax],al
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: 8d9381f4 -- (.trap 0xffffffff8d9381f4)
ErrCode = 00000002
eax=00000075 ebx=00000000 ecx=887ad000 edx=881bbca0 esi=887ad000 edi=887ad05c
eip=91fbe58f esp=8d938268 ebp=8d93827c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210282
netw5v32+0x1bb58f:
91fbe58f 0000 add byte ptr [eax],al ds:0023:00000075=??
Resetting default scope
LOCK_ADDRESS: 82fa0f60 -- (!locks 82fa0f60)
Resource @ nt!PiEngineLock (0x82fa0f60) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0x82fa0f60
Thread Count : 0
Thread address: 0x00000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from 91fbe58f to 82e8182b
STACK_TEXT:
8d9381f4 91fbe58f badb0d00 881bbca0 00000000 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
8d93827c 91fb761c 887ad000 00000000 920b5830 netw5v32+0x1bb58f
8d9384a4 91e13690 887ad000 887f97b0 887fbfe0 netw5v32+0x1b461c
8d9384d4 91e14525 887f97b0 00000000 887f97b0 netw5v32+0x10690
8d9384ec 91e11379 887f97b0 887fbfe0 882d8c10 netw5v32+0x11525
8d938508 91f94c4d 881bb5d0 00000004 00000001 netw5v32+0xe379
8d9385b8 91e04bdb 882d8c10 882d8008 8b8175c0 netw5v32+0x191c4d
8d9385e8 920922c3 00000000 881b9f84 00000003 netw5v32+0x1bdb
8d938618 8b885368 880d30e0 92437f50 8d938670 netw5v32+0x28f2c3
8d9388e4 8b884aea 87f5b920 880d30e0 87f5b788 ndis!ndisMInitializeAdapter+0x76b
8d93891c 8b884963 87f5b920 880d3028 87e1d860 ndis!ndisInitializeAdapter+0x10a
8d938944 8b881247 880d3028 8817af94 8817afb8 ndis!ndisPnPStartDevice+0x130
8d938988 82e774bc 880d3028 8817af00 8d938a10 ndis!ndisPnPDispatch+0x62f
8d9389a0 82fe3d78 00000000 85ed6568 87d66008 nt!IofCallDriver+0x63
8d9389bc 82e4f479 8d9389ec 82e4eb67 87d66008 nt!PnpAsynchronousCall+0x92
8d938a20 82fe9bf4 82e4eb67 87d66008 85eba6f0 nt!PnpStartDevice+0xe1
8d938a7c 82fe9abd 87d66008 0000003d 00000000 nt!PnpStartDeviceNode+0x12c
8d938a98 82fe28b9 00000000 00000001 00000000 nt!PipProcessStartPhase1+0x62
8d938c94 82fc6a42 855fb008 87f539c0 8d938cc8 nt!PipProcessDevNodeTree+0x188
8d938cd4 82e4ef9c 87f539c0 82f9ee80 855cba70 nt!PiProcessStartSystemDevices+0x6d
8d938d00 82ea8f3b 00000000 00000000 855cba70 nt!PnpDeviceActionWorker+0x241
8d938d50 830496d3 00000001 ab681a7a 00000000 nt!ExpWorkerThread+0x10d
8d938d90 82efb0f9 82ea8e2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
netw5v32+1bb58f
91fbe58f 0000 add byte ptr [eax],al
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: netw5v32+1bb58f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: netw5v32
IMAGE_NAME: netw5v32.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c0406d7
FAILURE_BUCKET_ID: 0xD1_netw5v32+1bb58f
BUCKET_ID: 0xD1_netw5v32+1bb58f
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\092110-43586-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e03000 PsLoadedModuleList = 0x82f4b810
Debug session time: Tue Sep 21 19:49:16.405 2010 (UTC - 5:00)
System Uptime: 0 days 8:12:42.246
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
....................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {d, 0, 0, 0}
Probably caused by : hardware ( nt!KiSystemFatalException+f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 1b
EXCEPTION_RECORD: aa1f1ce0 -- (.exr 0xffffffffaa1f1ce0)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 00000000
Attempt to execute non-executable address 00000000
TRAP_FRAME: aa1f1d34 -- (.trap 0xffffffffaa1f1d34)
ErrCode = 00000014
eax=02455400 ebx=00a2eea0 ecx=00a2eea0 edx=00000002 esi=00000000 edi=000001e0
eip=00000000 esp=024a070c ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
001b:00000000 ?? ???
Resetting default scope
MISALIGNED_IP:
nt!RtlpCopyExtendedContext+17
82ec08db 0085c00f8c9e add byte ptr [ebp-6173F040h],al
LAST_CONTROL_TRANSFER: from 82ebd477 to 82e49f6b
STACK_TEXT:
aa1f1284 82ebd477 badb0d00 00000001 001dcdc6 nt!KiSystemFatalException+0xf
aa1f12f4 82ec2df7 82e3cc74 aa1f1318 aa1f131c nt!RtlLookupFunctionTable+0x48
aa1f1320 82ebbff8 aa1f13b0 00000000 aa1f17d0 nt!RtlIsValidHandler+0x1b
aa1f13a0 82ec0352 aa1f17d0 aa1f13b0 00010017 nt!RtlDispatchException+0x76
aa1f17b4 82e47036 aa1f17d0 00000000 aa1f1824 nt!KiDispatchException+0x17c
aa1f181c 82e46fea aa1f18a4 82ec08db badb0d00 nt!CommonDispatchException+0x4a
aa1f18a4 82ec0510 00000001 024a06f4 aa1f1c68 nt!Kei386EoiHelper+0x192
aa1f18a8 00000000 024a06f4 aa1f1c68 0001003f nt!KiDispatchException+0x338
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemFatalException+f
82e49f6b c3 ret
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiSystemFatalException+f
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\102610-40965-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e39000 PsLoadedModuleList = 0x82f81810
Debug session time: Tue Oct 26 03:00:19.339 2010 (UTC - 5:00)
System Uptime: 0 days 0:25:41.165
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.....
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 8fb3b000, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 82efccb2, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.
Debugging Details:
------------------
Unable to load image \??\C:\Program Files\Rappelz\GameGuard\dump_wmimmc.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dump_wmimmc.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_wmimmc.sys
READ_ADDRESS: GetPointerFromAddress: unable to read from 82fa1718
Unable to read MiSystemVaType memory at 82f81160
8fb3b000
FAULTING_IP:
nt!_output_l+50e
82efccb2 663918 cmp word ptr [eax],bx
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xCD
PROCESS_NAME: LManager.exe
CURRENT_IRQL: 0
TRAP_FRAME: 8817a0d0 -- (.trap 0xffffffff8817a0d0)
ErrCode = 00000000
eax=8fb3b000 ebx=00000000 ecx=7fffffee edx=8fb3afe0 esi=8817a473 edi=00000007
eip=82efccb2 esp=8817a144 ebp=8817a3a0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!_output_l+0x50e:
82efccb2 663918 cmp word ptr [eax],bx ds:0023:8fb3b000=????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82e7f638 to 82ebe903
STACK_TEXT:
8817a0b8 82e7f638 00000000 8fb3b000 00000000 nt!MmAccessFault+0x106
8817a0b8 82efccb2 00000000 8fb3b000 00000000 nt!KiTrap0E+0xdc
8817a3a0 82efd611 8817a3c4 8817a473 00000000 nt!_output_l+0x50e
8817a3e4 82efd11a 8817a828 00000400 8817a41c nt!_vsnprintf_l+0x72
8817a400 9f87ddb9 8817a828 00000400 8817a41c nt!_vsnprintf+0x18
WARNING: Stack unwind information not available. Following frames may be wrong.
8817ac28 9f890d59 000000a0 9f878dc0 92b6719c dump_wmimmc+0x6db9
8817ac88 9f87b5be 00000114 000b2054 00000114 dump_wmimmc+0x19d59
8817accc 9f87b6d6 75aaa08f 00000114 000b2054 dump_wmimmc+0x45be
8817ad34 777c64f4 badb0d00 0012fbd4 00000000 dump_wmimmc+0x46d6
8817ad38 badb0d00 0012fbd4 00000000 00000000 0x777c64f4
8817ad3c 0012fbd4 00000000 00000000 00000000 0xbadb0d00
8817ad40 00000000 00000000 00000000 00000000 0x12fbd4
STACK_COMMAND: kb
FOLLOWUP_IP:
dump_wmimmc+6db9
9f87ddb9 ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: dump_wmimmc+6db9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dump_wmimmc
IMAGE_NAME: dump_wmimmc.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c162f49
FAILURE_BUCKET_ID: 0xCD_VRF_dump_wmimmc+6db9
BUCKET_ID: 0xCD_VRF_dump_wmimmc+6db9
Followup: MachineOwner
---------
9f877000 9f8cf100 dump_wmimmc T (no symbols)
Loaded symbol image file: dump_wmimmc.sys
Image path: \??\C:\Program Files\Rappelz\GameGuard\dump_wmimmc.sys
Image name: dump_wmimmc.sys
Timestamp: Mon Jun 14 16:31:53 2010 (4C162F49)
916a3000 916cf000 1394ohci 1394ohci.sys Tue Jul 14 02:51:59 2009 (4A5BC89F)
85a8b000 85ad3000 ACPI ACPI.sys Tue Jul 14 02:11:11 2009 (4A5BBF0F)
85d81000 85ddb000 afd afd.sys Tue Jul 14 02:12:34 2009 (4A5BBF62)
8ff81000 8ff93000 AgileVpn AgileVpn.sys Tue Jul 14 02:55:00 2009 (4A5BC954)
85d33000 85d3c000 amdxata amdxata.sys Tue May 19 20:57:35 2009 (4A12F30F)
9200c000 9200eb00 aswFsBlk aswFsBlk.SYS Tue Sep 07 17:47:05 2010 (4C865069)
85bc3000 85bfa000 aswMonFlt aswMonFlt.sys Tue Sep 07 17:47:28 2010 (4C865080)
8edd5000 8edd9100 aswRdr aswRdr.SYS Tue Sep 07 17:47:44 2010 (4C865090)
8f702000 8f728c80 aswSP aswSP.SYS Tue Sep 07 17:52:01 2010 (4C865191)
8edcb000 8edd4c00 aswTdi aswTdi.SYS Tue Sep 07 17:52:23 2010 (4C8651A7)
85cfd000 85d06000 atapi atapi.sys Tue Jul 14 02:11:15 2009 (4A5BBF13)
85d06000 85d29000 ataport ataport.SYS Tue Jul 14 02:11:18 2009 (4A5BBF16)
91667000 916a3000 b57nd60x b57nd60x.sys Sun Apr 26 14:15:34 2009 (49F44256)
85b32000 85b3d000 BATTC BATTC.SYS Tue Jul 14 02:19:15 2009 (4A5BC0F3)
8ed37000 8ed3e000 Beep Beep.SYS Tue Jul 14 02:45:00 2009 (4A5BC6FC)
8f6f4000 8f702000 blbdrive blbdrive.sys Tue Jul 14 02:23:04 2009 (4A5BC1D8)
858a9000 858b1000 BOOTVID BOOTVID.dll Tue Jul 14 04:04:34 2009 (4A5BD9A2)
9b123000 9b13c000 bowser bowser.sys Tue Jul 14 02:14:21 2009 (4A5BBFCD)
95d90000 95dae000 cdd cdd.dll Tue Jul 14 04:04:18 2009 (4A5BD992)
8ed11000 8ed30000 cdrom cdrom.sys Tue Jul 14 02:11:24 2009 (4A5BBF1C)
858f3000 8599e000 CI CI.dll Tue Jul 14 04:09:28 2009 (4A5BDAC8)
90ddc000 90dea000 circlass circlass.sys Tue Jul 14 02:51:17 2009 (4A5BC875)
865c7000 865ec000 CLASSPNP CLASSPNP.SYS Tue Jul 14 02:11:20 2009 (4A5BBF18)
858b1000 858f3000 CLFS CLFS.SYS Tue Jul 14 02:11:10 2009 (4A5BBF0E)
917de000 917e1700 CmBatt CmBatt.sys Tue Jul 14 02:19:18 2009 (4A5BC0F6)
85f95000 85ff2000 cng cng.sys Tue Jul 14 02:32:55 2009 (4A5BC427)
85b2a000 85b32000 compbatt compbatt.sys Tue Jul 14 02:19:18 2009 (4A5BC0F6)
917eb000 917f8000 CompositeBus CompositeBus.sys Tue Jul 14 02:45:26 2009 (4A5BC716)
925a3000 925b0000 crashdmp crashdmp.sys Tue Jul 14 02:45:50 2009 (4A5BC72E)
8f678000 8f6dc000 csc csc.sys Tue Jul 14 02:15:08 2009 (4A5BBFFC)
8f6dc000 8f6f4000 dfsc dfsc.sys Tue Jul 14 02:14:16 2009 (4A5BBFC8)
8f66c000 8f678000 discache discache.sys Tue Jul 14 02:24:04 2009 (4A5BC214)
865b6000 865c7000 disk disk.sys Tue Jul 14 02:11:28 2009 (4A5BBF20)
9178c000 91796000 DKbFltr DKbFltr.sys Thu Mar 26 05:10:12 2009 (49CAF214)
924fc000 92515000 drmk drmk.sys Tue Jul 14 03:36:05 2009 (4A5BD2F5)
925b0000 925c1000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:12:47 2009 (4A5BBF6F)
8ec21000 8ecfb000 dump_iaStor dump_iaStor.sys Fri Jun 05 04:42:33 2009 (4A287809)
9f877000 9f8cf100 dump_wmimmc dump_wmimmc.sys Mon Jun 14 16:31:53 2010 (4C162F49)
925c1000 925cb000 Dxapi Dxapi.sys Tue Jul 14 02:25:25 2009 (4A5BC265)
8fe0d000 8fec4000 dxgkrnl dxgkrnl.sys Fri Oct 02 03:48:33 2009 (4AC54DE1)
8fec4000 8fefd000 dxgmms1 dxgmms1.sys Tue Jul 14 02:25:25 2009 (4A5BC265)
9b000000 9b02a000 fastfat fastfat.SYS Tue Jul 14 02:14:01 2009 (4A5BBFB9)
85d70000 85d81000 fileinfo fileinfo.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
85d3c000 85d70000 fltmgr fltmgr.sys Tue Jul 14 02:11:13 2009 (4A5BBF11)
85e00000 85e09000 Fs_Rec Fs_Rec.sys Tue Jul 14 02:11:14 2009 (4A5BBF12)
86584000 865b6000 fvevol fvevol.sys Sat Sep 26 05:24:21 2009 (4ABD7B55)
86349000 8637a000 fwpkclnt fwpkclnt.sys Tue Jul 14 02:12:03 2009 (4A5BBF43)
82e02000 82e39000 hal halmacpi.dll Tue Jul 14 02:11:03 2009 (4A5BBF07)
8ff62000 8ff81000 HDAudBus HDAudBus.sys Tue Jul 14 02:50:55 2009 (4A5BC85F)
921e2000 921f5000 HIDCLASS HIDCLASS.SYS Tue Jul 14 02:51:01 2009 (4A5BC865)
921d3000 921e2000 hidir hidir.sys Tue Jul 14 02:51:04 2009 (4A5BC868)
921f5000 921fb480 HIDPARSE HIDPARSE.SYS Tue Jul 14 02:50:59 2009 (4A5BC863)
92598000 925a3000 hidusb hidusb.sys Tue Jul 14 02:51:04 2009 (4A5BC868)
9b09e000 9b123000 HTTP HTTP.sys Tue Jul 14 02:12:53 2009 (4A5BBF75)
8657c000 86584000 hwpolicy hwpolicy.sys Tue Jul 14 02:11:01 2009 (4A5BBF05)
91774000 9178c000 i8042prt i8042prt.sys Tue Jul 14 02:11:23 2009 (4A5BBF1B)
8599e000 859e9000 iaNvStor iaNvStor.sys Thu Jul 02 03:54:06 2009 (4A4C052E)
85c23000 85cfd000 iaStor iaStor.sys Fri Jun 05 04:42:33 2009 (4A287809)
85b98000 85b9f000 intelide intelide.sys Tue Jul 14 02:11:19 2009 (4A5BBF17)
8f74a000 8f75c000 intelppm intelppm.sys Tue Jul 14 02:11:03 2009 (4A5BBF07)
91796000 917a3000 kbdclass kbdclass.sys Tue Jul 14 02:11:15 2009 (4A5BBF13)
92000000 9200c000 kbdhid kbdhid.sys Tue Jul 14 02:45:09 2009 (4A5BC705)
80bcf000 80bd7000 kdcom kdcom.dll Tue Jul 14 04:08:58 2009 (4A5BDAAA)
8f75c000 8f790000 ks ks.sys Thu Mar 04 05:57:52 2010 (4B8F2FC0)
85f82000 85f95000 ksecdd ksecdd.sys Tue Jul 14 02:11:56 2009 (4A5BBF3C)
86123000 86148000 ksecpkg ksecpkg.sys Fri Dec 11 06:04:22 2009 (4B21C4C6)
8f7e5000 8f7f5000 lltdio lltdio.sys Tue Jul 14 02:53:18 2009 (4A5BC8EE)
925d6000 925f1000 luafv luafv.sys Tue Jul 14 02:15:44 2009 (4A5BC020)
9f86f000 9f872780 mbam mbam.sys Thu Apr 29 20:14:15 2010 (4BD9BE67)
85820000 85898000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 04:06:41 2009 (4A5BDA21)
9221a000 9222e000 mdvrmng mdvrmng.sys Mon May 28 17:37:13 2007 (465AE919)
921c6000 921d3000 modem modem.sys Tue Jul 14 02:55:24 2009 (4A5BC96C)
925cb000 925d6000 monitor monitor.sys Tue Jul 14 02:25:58 2009 (4A5BC286)
917d1000 917de000 mouclass mouclass.sys Tue Jul 14 02:11:15 2009 (4A5BBF13)
92552000 9255d000 mouhid mouhid.sys Tue Jul 14 02:45:08 2009 (4A5BC704)
85bad000 85bc3000 mountmgr mountmgr.sys Tue Jul 14 02:11:27 2009 (4A5BBF1F)
9b13c000 9b14e000 mpsdrv mpsdrv.sys Tue Jul 14 02:52:52 2009 (4A5BC8D4)
9b14e000 9b171000 mrxsmb mrxsmb.sys Sat Feb 27 09:32:02 2010 (4B88CA72)
9b171000 9b1ac000 mrxsmb10 mrxsmb10.sys Sat Feb 27 09:32:21 2010 (4B88CA85)
9b1ac000 9b1c7000 mrxsmb20 mrxsmb20.sys Sat Feb 27 09:32:11 2010 (4B88CA7B)
85d29000 85d33000 msahci msahci.sys Tue Jul 14 02:45:50 2009 (4A5BC72E)
8ed90000 8ed9b000 Msfs Msfs.SYS Tue Jul 14 02:11:26 2009 (4A5BBF1E)
85adc000 85ae4000 msisadrv msisadrv.sys Tue Jul 14 02:11:09 2009 (4A5BBF0D)
9f875000 9f876700 MSPCLOCK MSPCLOCK.sys Tue Jul 14 02:45:08 2009 (4A5BC704)
9f873000 9f874580 MSPQM MSPQM.sys Tue Jul 14 02:45:07 2009 (4A5BC703)
85f57000 85f82000 msrpc msrpc.sys Tue Jul 14 02:11:59 2009 (4A5BBF3F)
8f662000 8f66c000 mssmbios mssmbios.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
8656c000 8657c000 mup mup.sys Tue Jul 14 02:14:14 2009 (4A5BBFC6)
8602e000 860e5000 ndis ndis.sys Tue Jul 14 02:12:24 2009 (4A5BBF58)
8ffab000 8ffb6000 ndistapi ndistapi.sys Tue Jul 14 02:54:24 2009 (4A5BC930)
9b07b000 9b08b000 ndisuio ndisuio.sys Tue Jul 14 02:53:51 2009 (4A5BC90F)
8ffb6000 8ffd8000 ndiswan ndiswan.sys Tue Jul 14 02:54:34 2009 (4A5BC93A)
8f7d4000 8f7e5000 NDProxy NDProxy.SYS Tue Jul 14 02:54:27 2009 (4A5BC933)
8ec00000 8ec0e000 netbios netbios.sys Tue Jul 14 02:53:54 2009 (4A5BC912)
86400000 86432000 netbt netbt.sys Tue Jul 14 02:12:18 2009 (4A5BBF52)
860e5000 86123000 NETIO NETIO.SYS Tue Jul 14 02:12:35 2009 (4A5BBF63)
91008000 91667000 NETwLv32 NETwLv32.sys Mon Aug 16 17:26:04 2010 (4C694A7C)
8ed9b000 8eda9000 Npfs Npfs.SYS Tue Jul 14 02:11:31 2009 (4A5BBF23)
8f658000 8f662000 nsiproxy nsiproxy.sys Tue Jul 14 02:12:08 2009 (4A5BBF48)
82e39000 83249000 nt ntkrpamp.exe Sat Jun 19 06:55:24 2010 (4C1C3FAC)
85e28000 85f57000 Ntfs Ntfs.sys Tue Jul 14 02:12:05 2009 (4A5BBF45)
8ed30000 8ed37000 Null Null.SYS Tue Jul 14 02:11:12 2009 (4A5BBF10)
90dac000 90dad040 nvBridge nvBridge.kmd Sat Oct 16 20:04:23 2010 (4CB9DB17)
9040f000 90dab5a0 nvlddmkm nvlddmkm.sys Sat Oct 16 20:07:56 2010 (4CB9DBEC)
9b035000 9b07b000 nwifi nwifi.sys Tue Jul 14 02:51:59 2009 (4A5BC89F)
8ede1000 8ee00000 pacer pacer.sys Tue Jul 14 02:53:58 2009 (4A5BC916)
85b19000 85b2a000 partmgr partmgr.sys Tue Jul 14 02:11:35 2009 (4A5BBF27)
85ae4000 85b0e000 pci pci.sys Tue Jul 14 02:11:16 2009 (4A5BBF14)
85b9f000 85bad000 PCIIDEX PCIIDEX.SYS Tue Jul 14 02:11:15 2009 (4A5BBF13)
85ff2000 86000000 pcw pcw.sys Tue Jul 14 02:11:10 2009 (4A5BBF0E)
9f02f000 9f0c6000 peauth peauth.sys Tue Jul 14 03:35:44 2009 (4A5BD2E0)
924cd000 924fc000 portcls portcls.sys Tue Jul 14 02:51:00 2009 (4A5BC864)
85898000 858a9000 PSHED PSHED.dll Tue Jul 14 04:09:36 2009 (4A5BDAD0)
8ff93000 8ffab000 rasl2tp rasl2tp.sys Tue Jul 14 02:54:33 2009 (4A5BC939)
8ffd8000 8fff0000 raspppoe raspppoe.sys Tue Jul 14 02:54:53 2009 (4A5BC94D)
90dae000 90dc5000 raspptp raspptp.sys Tue Jul 14 02:54:47 2009 (4A5BC947)
90dc5000 90ddc000 rassstp rassstp.sys Tue Jul 14 02:54:57 2009 (4A5BC951)
8f617000 8f658000 rdbss rdbss.sys Tue Jul 14 02:14:26 2009 (4A5BBFD2)
8fff0000 8fffa000 rdpbus rdpbus.sys Tue Jul 14 03:02:40 2009 (4A5BCB20)
8ed78000 8ed80000 RDPCDD RDPCDD.sys Tue Jul 14 03:01:40 2009 (4A5BCAE4)
8ed80000 8ed88000 rdpencdd rdpencdd.sys Tue Jul 14 03:01:39 2009 (4A5BCAE3)
8ed88000 8ed90000 rdprefmp rdprefmp.sys Tue Jul 14 03:01:41 2009 (4A5BCAE5)
8653f000 8656c000 rdyboost rdyboost.sys Tue Jul 14 02:22:02 2009 (4A5BC19A)
916e8000 916f9000 rimmptsk rimmptsk.sys Thu Jun 25 10:58:09 2009 (4A432E11)
916f9000 9170d000 rimsptsk rimsptsk.sys Thu Jun 25 10:10:46 2009 (4A4322F6)
9170d000 9175f000 rixdptsk rixdptsk.sys Thu Jun 25 10:25:57 2009 (4A432685)
9b08b000 9b09e000 rspndr rspndr.sys Tue Jul 14 02:53:20 2009 (4A5BC8F0)
92232000 924cca40 RTKVHDA RTKVHDA.sys Thu Jul 23 12:55:58 2009 (4A6833AE)
863d2000 863dfa60 SCDEmu SCDEmu.SYS Mon Nov 09 05:21:19 2009 (4AF78AAF)
916cf000 916e8000 sdbus sdbus.sys Sat Oct 10 05:31:24 2009 (4ACFF1FC)
9f0c6000 9f0d0000 secdrv secdrv.SYS Wed Sep 13 16:18:32 2006 (45080528)
917f8000 917fdf00 seehcri seehcri.sys Wed Jan 09 10:41:37 2008 (478488C1)
8651a000 8653ec20 snapman snapman.sys Tue Sep 08 10:57:17 2009 (4AA60E5D)
86512000 8651a000 spldr spldr.sys Mon May 11 19:13:47 2009 (4A084EBB)
9f81e000 9f86f000 srv srv.sys Fri Aug 27 06:31:26 2010 (4C77318E)
9f168000 9f1b7000 srv2 srv2.sys Fri Aug 27 06:30:45 2010 (4C773165)
9f0d0000 9f0f1000 srvnet srvnet.sys Fri Aug 27 06:30:39 2010 (4C77315F)
917fe000 917ff380 swenum swenum.sys Tue Jul 14 02:45:08 2009 (4A5BC704)
917a3000 917cee00 SynTP SynTP.sys Wed May 09 22:16:25 2007 (46421E09)
86200000 86349000 tcpip tcpip.sys Mon Jun 14 06:36:59 2010 (4C15A3DB)
9f0f1000 9f0fe000 tcpipreg tcpipreg.sys Tue Jul 14 02:54:14 2009 (4A5BC926)
8edc0000 8edcb000 TDI TDI.SYS Tue Jul 14 02:12:12 2009 (4A5BBF4C)
86437000 86511b00 tdrpm251 tdrpm251.sys Fri Jul 31 17:00:11 2009 (4A72F8EB)
8eda9000 8edc0000 tdx tdx.sys Tue Jul 14 02:12:10 2009 (4A5BBF4A)
863c2000 863d2000 termdd termdd.sys Tue Jul 14 03:01:35 2009 (4A5BCADF)
86148000 861d1880 timntr timntr.sys Mon Aug 17 10:16:54 2009 (4A8903E6)
95d60000 95d69000 TSDDD TSDDD.dll unavailable (00000000)
8f729000 8f74a000 tunnel tunnel.sys Tue Jul 14 02:54:03 2009 (4A5BC91B)
90dea000 90df8000 umbus umbus.sys Tue Jul 14 02:51:38 2009 (4A5BC88A)
9255d000 92574000 usbccgp usbccgp.sys Tue Jul 14 02:51:31 2009 (4A5BC883)
917cf000 917d0700 USBD USBD.SYS Tue Jul 14 02:51:05 2009 (4A5BC869)
8ff53000 8ff62000 usbehci usbehci.sys Tue Jul 14 02:51:14 2009 (4A5BC872)
8f790000 8f7d4000 usbhub usbhub.sys Tue Jul 14 02:52:06 2009 (4A5BC8A6)
8ff08000 8ff53000 USBPORT USBPORT.SYS Tue Jul 14 02:51:13 2009 (4A5BC871)
8fefd000 8ff08000 usbuhci usbuhci.sys Tue Jul 14 02:51:10 2009 (4A5BC86E)
92574000 92597b80 usbvideo usbvideo.sys Thu Mar 04 06:04:40 2010 (4B8F3158)
85b0e000 85b19000 vdrvroot vdrvroot.sys Tue Jul 14 02:46:19 2009 (4A5BC74B)
8ed3e000 8ed4a000 vga vga.sys Tue Jul 14 02:25:50 2009 (4A5BC27E)
8ed4a000 8ed6b000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:25:49 2009 (4A5BC27D)
8637a000 86382380 vmstorfl vmstorfl.sys Tue Jul 14 02:28:44 2009 (4A5BC32C)
85b3d000 85b4d000 volmgr volmgr.sys Tue Jul 14 02:11:25 2009 (4A5BBF1D)
85b4d000 85b98000 volmgrx volmgrx.sys Tue Jul 14 02:11:41 2009 (4A5BBF2D)
86383000 863c2000 volsnap volsnap.sys Tue Jul 14 02:11:34 2009 (4A5BBF26)
92515000 92552000 VSTAZL3 VSTAZL3.SYS Thu Oct 16 03:30:03 2008 (48F68B0B)
92111000 921c6000 VSTCNXT3 VSTCNXT3.SYS Thu Oct 16 03:29:13 2008 (48F68AD9)
9200f000 92111000 VSTDPV3 VSTDPV3.SYS Thu Oct 16 03:32:04 2008 (48F68B84)
8ec0e000 8ec21000 wanarp wanarp.sys Tue Jul 14 02:55:02 2009 (4A5BC956)
8ed6b000 8ed78000 watchdog watchdog.sys Tue Jul 14 02:24:10 2009 (4A5BC21A)
85a0c000 85a7d000 Wdf01000 Wdf01000.sys Tue Jul 14 02:11:36 2009 (4A5BBF28)
85a7d000 85a8b000 WDFLDR WDFLDR.SYS Tue Jul 14 02:11:25 2009 (4A5BBF1D)
8edda000 8ede1000 wfplwf wfplwf.sys Tue Jul 14 02:53:51 2009 (4A5BC90F)
95b00000 95d4b000 win32k win32k.sys Wed Sep 01 05:34:29 2010 (4C7DBBB5)
9175f000 91774000 winbondcir winbondcir.sys Wed Mar 28 08:51:32 2007 (460A0264)
917e2000 917eb000 wmiacpi wmiacpi.sys Tue Jul 14 02:19:16 2009 (4A5BC0F4)
85ad3000 85adc000 WMILIB WMILIB.SYS Tue Jul 14 02:11:22 2009 (4A5BBF1A)
92200000 9221a000 WudfPf WudfPf.sys Tue Jul 14 02:50:13 2009 (4A5BC835)
Unloaded modules:
9f0fe000 9f168000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0006A000
9b1c7000 9b1df000 parport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00018000
865ec000 865f9000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
8ec26000 8ed00000 dump_iaStor.
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
8ed00000 8ed11000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00011000
Quote