New
#1
BSOD driver maybe
hi,
relatively new system, new hw. bsods performed randomly, bcodes: 105, 50, A, c1, 3b,...
win7 64bit up to date,
thanks
hi,
relatively new system, new hw. bsods performed randomly, bcodes: 105, 50, A, c1, 3b,...
win7 64bit up to date,
thanks
Hi, teakiie, and welcome to the forum. I looked at your four most recent dumps. They all have different error codes and they all point to memory corruption.
I recommend that while you are troubleshooting, that you uninstall Comodo. I would download Revo Unistaller and use it to remove Comodo. Though Comodo generally runs well with Win 7, it is known to cause BSOD's on some Win 7 systems. Download and install Microsoft Security Essential and make sure Windows Firewall is turned on. After you get your system stable, you can try Comodo again.
You have an almost guaranteed BSOD maker on your system, Daemon Tools. It uses a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads. Select uninstall; do NOT select reinstall.
Here is a free alternative CD virtualization program that does not use the sptd.sys driver.
Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview
Uninstall Daemon Tools and Comodo, reboot and run your system. Let's see how it does. Update us and let us know. If you get another BSOD, upload it and we will test your RAM.
Code:Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`03016000 PsLoadedModuleList = 0xfffff800`03253e50 Debug session time: Fri Dec 3 17:31:05.575 2010 (GMT-5) System Uptime: 0 days 0:00:35.292 Loading Kernel Symbols ............................................................... ................................................................ ............................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {c8e00014b01, 2, 1, fffff800030ad99e} Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 00000c8e00014b01, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff800030ad99e, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032be0e0 00000c8e00014b01 CURRENT_IRQL: 2 FAULTING_IP: nt!IopInterlockedDecrementUlong+6e fffff800`030ad99e 41ff8424004b0000 inc dword ptr [r12+4B00h] CUSTOMER_CRASH_COUNT: 2 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0xA PROCESS_NAME: svchost.exe TRAP_FRAME: fffff88007bad860 -- (.trap 0xfffff88007bad860) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000002 rbx=0000000000000000 rcx=fffff80003201580 rdx=fffffa800574a89c rsi=0000000000000000 rdi=0000000000000000 rip=fffff800030ad99e rsp=fffff88007bad9f0 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=fffff8000352ba68 r11=fffffa8006fea1c8 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!IopInterlockedDecrementUlong+0x6e: fffff800`030ad99e 41ff8424004b0000 inc dword ptr [r12+4B00h] ds:ec10:00000000`00004b00=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003085ca9 to fffff80003086740 STACK_TEXT: fffff880`07bad718 fffff800`03085ca9 : 00000000`0000000a 00000c8e`00014b01 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`07bad720 fffff800`03084920 : 00000000`00000080 fffffa80`0574a89c fffffa80`068bdb0b 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`07bad860 fffff800`030ad99e : fffff800`0000000d fffff980`0f4fec10 fffffa80`068bdb30 fffffa80`0724f910 : nt!KiPageFault+0x260 fffff880`07bad9f0 fffff800`0339c759 : fffff800`03200e80 fffffa80`0574a880 fffffa80`068bdb30 fffffa80`05754a90 : nt!IopInterlockedDecrementUlong+0x6e fffff880`07bada50 fffff800`0308b8b4 : fffffa80`0724f940 fffffa80`068bdb30 fffffa80`04626360 00000000`01dad2e0 : nt!IopDeleteFile+0xe9 fffff880`07badae0 fffff800`0339c514 : fffffa80`068bdb30 00000000`00000000 fffffa80`06ae23a0 00000000`00000000 : nt!ObfDereferenceObject+0xd4 fffff880`07badb40 fffff800`0339c414 : 00000000`000005d0 fffffa80`068bdb30 fffff8a0`019852b0 00000000`000005d0 : nt!ObpCloseHandleTableEntry+0xc4 fffff880`07badbd0 fffff800`03085993 : fffffa80`06ae23a0 fffff880`07badca0 00000000`00000000 00000000`00000000 : nt!ObpCloseHandle+0x94 fffff880`07badc20 00000000`77b4fe4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`01dad578 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b4fe4a STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800030ad97f - nt!IopInterlockedDecrementUlong+4f [ 20:60 ] 1 error : !nt (fffff800030ad97f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- Debug session time: Fri Dec 3 06:13:15.783 2010 (GMT-5) System Uptime: 0 days 0:00:20.125 Loading Kernel Symbols ............................................................... ................................................................ ........ Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff88003593b68, 0, fffff8000303cd99, 0} Could not read faulting driver name *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff88003593b68, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff8000303cd99, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c20e0 fffff88003593b68 FAULTING_IP: nt!CcPerformReadAhead+625 fffff800`0303cd99 488b842498004000 mov rax,qword ptr [rsp+400098h] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 0 TRAP_FRAME: fffff88003193940 -- (.trap 0xfffff88003193940) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa80039fa040 rbx=0000000000000000 rcx=fffff8a0021ff140 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000303cd99 rsp=fffff88003193ad0 rbp=fffff8000322f5a0 r8=fffffa800667b970 r9=0000000000800000 r10=000000000000000f r11=014000011379e921 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!CcPerformReadAhead+0x625: fffff800`0303cd99 488b842498004000 mov rax,qword ptr [rsp+400098h] ss:0018:fffff880`03593b68=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000310af14 to fffff8000308a740 STACK_TEXT: fffff880`031937d8 fffff800`0310af14 : 00000000`00000050 fffff880`03593b68 00000000`00000000 fffff880`03193940 : nt!KeBugCheckEx fffff880`031937e0 fffff800`0308882e : 00000000`00000000 fffff880`02fd57f0 00000001`08e98900 00000001`08b99921 : nt! ?? ::FNODOBFM::`string'+0x42837 fffff880`03193940 fffff800`0303cd99 : 00000000`00000000 00000000`00040000 00000000`00011000 fffff800`0322f501 : nt!KiPageFault+0x16e fffff880`03193ad0 fffff800`0307e576 : fffffa80`0667bcb0 fffff880`00000000 00000000`00000005 fffff800`00000001 : nt!CcPerformReadAhead+0x625 fffff880`03193c00 fffff800`03097961 : fffffa80`039ff510 fffff800`0307e358 fffff800`03291150 fffffa80`00000002 : nt!CcWorkerThread+0x21e fffff880`03193cb0 fffff800`0332ec06 : 00000000`00000000 fffffa80`039fa040 00000000`00000080 fffffa80`0398cb30 : nt!ExpWorkerThread+0x111 fffff880`03193d40 fffff800`03068c26 : fffff880`02f64180 fffffa80`039fa040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`03193d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff8000303cd9f - nt!CcPerformReadAhead+62b [ 00:40 ] 1 error : !nt (fffff8000303cd9f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- Debug session time: Fri Dec 3 18:15:05.469 2010 (GMT-5) System Uptime: 0 days 0:00:29.969 Loading Kernel Symbols ............................................................... ......................................................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff800025b833f, 1, 7ffff8b} Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800025b833f, The address that the exception occurred at Arg3: 0000000000000001, Parameter 0 of the exception Arg4: 0000000007ffff8b, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt! ?? ::NNGAKEGL::`string'+15f1c fffff800`025b833f 08458b or byte ptr [rbp-75h],al EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 0000000007ffff8b WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800024bc0e0 0000000007ffff8b CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x1E PROCESS_NAME: ctfmon.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff880094dd688 -- (.exr 0xfffff880094dd688) ExceptionAddress: fffff800025b833f (nt! ?? ::NNGAKEGL::`string'+0x0000000000015f1c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000008 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 0000000007ffff8b Attempt to write to address 0000000007ffff8b TRAP_FRAME: fffff880094dd730 -- (.trap 0xfffff880094dd730) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000040 rbx=0000000000000000 rcx=fffffa80054b69f0 rdx=fffff8a004756be8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800025b833f rsp=fffff880094dd8c8 rbp=0000000008000000 r8=fffff8a004756c68 r9=0000000000000000 r10=fffff80002413888 r11=fffff880094dd8a0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt! ?? ::NNGAKEGL::`string'+0x15f1c: fffff800`025b833f 08458b or byte ptr [rbp-75h],al ss:0018:00000000`07ffff8b=?? Resetting default scope MISALIGNED_IP: nt! ?? ::NNGAKEGL::`string'+15f1c fffff800`025b833f 08458b or byte ptr [rbp-75h],al LAST_CONTROL_TRANSFER: from fffff800022bea39 to fffff80002284740 STACK_TEXT: fffff880`094dceb8 fffff800`022bea39 : 00000000`0000001e ffffffff`c0000005 fffff800`025b833f 00000000`00000001 : nt!KeBugCheckEx fffff880`094dcec0 fffff800`02283d82 : fffff880`094dd688 00000000`00000000 fffff880`094dd730 00000000`00000000 : nt!KiDispatchException+0x1b9 fffff880`094dd550 fffff800`022828fa : 00000000`00000001 00000000`00000000 fffff8a0`01603a00 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`094dd730 fffff800`025b833f : 00000000`000007ff fffff8a0`04756ba0 00000000`00000010 00000000`00000000 : nt!KiPageFault+0x23a fffff880`094dd8c8 00000000`00000004 : 00000000`00000000 00000000`00000004 fffffa80`054b69f0 fffff8a0`00000001 : nt! ?? ::NNGAKEGL::`string'+0x15f1c fffff880`094dd928 00000000`00000000 : 00000000`00000004 fffffa80`054b69f0 fffff8a0`00000001 00000000`00000001 : 0x4 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800025b819f - nt! ?? ::NNGAKEGL::`string'+15d7f [ 00:01 ] 1 error : !nt (fffff800025b819f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- Debug session time: Fri Dec 3 18:13:54.285 2010 (GMT-5) System Uptime: 0 days 0:02:00.612 Loading Kernel Symbols ............................................................... ................................................................ ............................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 109, {a3a039d896339668, b3b7465ee8b068ce, fffff800031a8e10, 1} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_STRUCTURE_CORRUPTION (109) This bugcheck is generated when the kernel detects that critical kernel code or data have been corrupted. There are generally three causes for a corruption: 1) A driver has inadvertently or deliberately modified critical kernel code or data. See Patching Policy for x64-Based Systems: Information for Driver Developers 2) A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was booted. Normal breakpoints, "bp", can only be set if the debugger is attached at boot time. Hardware breakpoints, "ba", can be set at any time. 3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data. Arguments: Arg1: a3a039d896339668, Reserved Arg2: b3b7465ee8b068ce, Reserved Arg3: fffff800031a8e10, Failure type dependent information Arg4: 0000000000000001, Type of corrupted region, can be 0 : A generic data region 1 : Modification of a function or .pdata 2 : A processor IDT 3 : A processor GDT 4 : Type 1 process list corruption 5 : Type 2 process list corruption 6 : Debug routine modification 7 : Critical MSR modification Debugging Details: ------------------ BUGCHECK_STR: 0x109 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800030ce740 STACK_TEXT: fffff880`031af5d8 00000000`00000000 : 00000000`00000109 a3a039d8`96339668 b3b7465e`e8b068ce fffff800`031a8e10 : nt!KeBugCheckEx STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800031a8f9f - nt!PnpRemoveDeviceActionRequests+18f [ 90:d0 ] 1 error : !nt (fffff800031a8f9f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- 2: kd> lmtsmn start end module name fffff880`04313000 fffff880`04351000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30) fffff880`00f21000 fffff880`00f78000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106) fffff880`03f75000 fffff880`03fff000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`0437a000 fffff880`04390000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0) fffff880`02c26000 fffff880`02c3b000 amdppm amdppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD) fffff880`00e4d000 fffff880`00e58000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB) fffff880`00e1a000 fffff880`00e23000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00e23000 fffff880`00e4d000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118) fffff880`0480a000 fffff880`04fff000 atikmdag atikmdag.sys Tue Oct 26 22:29:53 2010 (4CC78EA1) fffff880`04078000 fffff880`040c3000 atikmpag atikmpag.sys Tue Oct 26 22:14:23 2010 (4CC78AFF) fffff880`03ebe000 fffff880`03ec5000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D) fffff880`02dee000 fffff880`02dff000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF) fffff880`02794000 fffff880`027b2000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206) fffff960`00620000 fffff960`00647000 cdd cdd.dll unavailable (00000000) fffff880`00dbe000 fffff880`00de8000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`00cb2000 fffff880`00d72000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D) fffff880`013a3000 fffff880`013d3000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00c54000 fffff880`00cb2000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`013e6000 fffff880`013ef000 cmderd cmderd.sys Fri Sep 10 18:07:24 2010 (4C8AAC1C) fffff880`03e73000 fffff880`03eb5000 cmdguard cmdguard.sys Fri Sep 10 18:07:10 2010 (4C8AAC0E) fffff880`03f6a000 fffff880`03f75000 cmdhlp cmdhlp.sys Fri Sep 10 18:06:39 2010 (4C8AABEF) fffff880`014b2000 fffff880`01525000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814) fffff880`0436a000 fffff880`0437a000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`051d7000 fffff880`051e5000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD) fffff880`02d4d000 fffff880`02dd0000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A) fffff880`02dd0000 fffff880`02dee000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200) fffff880`02d3e000 fffff880`02d4d000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E) fffff880`01400000 fffff880`01416000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`05154000 fffff880`05176000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5) fffff880`051f1000 fffff880`051fa000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`051e5000 fffff880`051f1000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`05000000 fffff880`05013000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F) fffff880`051b0000 fffff880`051bc000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff880`040c3000 fffff880`041b7000 dxgkrnl dxgkrnl.sys Thu Oct 01 21:00:14 2009 (4AC5509E) fffff880`041b7000 fffff880`041fd000 dxgmms1 dxgmms1.sys Mon Jul 13 19:38:32 2009 (4A5BC578) fffff880`02d33000 fffff880`02d3e000 ElbyCDIO ElbyCDIO.sys Thu Dec 17 17:25:16 2009 (4B2AAFCC) fffff880`02696000 fffff880`026cc000 fastfat fastfat.SYS Mon Jul 13 19:23:28 2009 (4A5BC1F0) fffff880`04351000 fffff880`0435e000 fdc fdc.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`00e58000 fffff880`00e6c000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481) fffff880`050c5000 fffff880`050d0000 flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`00d72000 fffff880`00dbe000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F) fffff880`01536000 fffff880`01540000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111) fffff880`015c6000 fffff880`01600000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2) fffff880`01600000 fffff880`0164a000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164) fffff880`04294000 fffff880`042a1000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0) fffff800`03015000 fffff800`0305e000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08) fffff880`04000000 fffff880`04024000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5) fffff880`0517c000 fffff880`05195000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD) fffff880`06c00000 fffff880`06c08080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9) fffff880`06df2000 fffff880`06e00000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE) fffff880`026cc000 fffff880`02794000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8) fffff880`01674000 fffff880`0167d000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA) fffff880`03e4e000 fffff880`03e66000 inspect inspect.sys Fri Sep 10 18:07:36 2010 (4C8AAC28) fffff880`043ef000 fffff880`043fe000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`05195000 fffff880`051a3000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff800`00bb3000 fffff800`00bbd000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB) fffff880`05016000 fffff880`05059000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9) fffff880`01498000 fffff880`014b2000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156) fffff880`017d1000 fffff880`017fc000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4) fffff880`05176000 fffff880`0517b200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93) fffff880`02669000 fffff880`0267e000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`01416000 fffff880`01439000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295) fffff880`00c33000 fffff880`00c40000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65) fffff880`02c53000 fffff880`02c61000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C) fffff880`0405f000 fffff880`0406e000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`051a3000 fffff880`051b0000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff880`00e00000 fffff880`00e1a000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`027b2000 fffff880`027ca000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79) fffff880`027ca000 fffff880`027f7000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33) fffff880`07c62000 fffff880`07cb0000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C) fffff880`07cb0000 fffff880`07cd3000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A) fffff880`03f23000 fffff880`03f2e000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`011b5000 fffff880`011bf000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE) fffff880`0143a000 fffff880`01498000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C) fffff880`02d28000 fffff880`02d33000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE) fffff880`01662000 fffff880`01674000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201) fffff880`0167f000 fffff880`01771000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`043b4000 fffff880`043c0000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8) fffff880`043c0000 fffff880`043ef000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`050d0000 fffff880`050e5000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD) fffff880`013ef000 fffff880`013fe000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff880`03e00000 fffff880`03e45000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178) fffff880`01771000 fffff880`017d1000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A) fffff880`03f2e000 fffff880`03f3f000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`02d1c000 fffff880`02d28000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E) fffff800`0305e000 fffff800`0363a000 nt ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9) fffff880`01200000 fffff880`013a3000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F) fffff880`03eb5000 fffff880`03ebe000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109) fffff880`00c00000 fffff880`00c26000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5) fffff880`01000000 fffff880`01015000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`011cc000 fffff880`011ff000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`01015000 fffff880`0101c000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115) fffff880`00fe9000 fffff880`00ff9000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`01525000 fffff880`01536000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF) fffff880`07cd3000 fffff880`07d79000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF) fffff880`05117000 fffff880`05154000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03) fffff880`00c40000 fffff880`00c54000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027) fffff880`04390000 fffff880`043b4000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04200000 fffff880`0421b000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9) fffff880`04024000 fffff880`04045000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA) fffff880`04045000 fffff880`0405f000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1) fffff880`02ccb000 fffff880`02d1c000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219) fffff880`0421b000 fffff880`04226000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA) fffff880`03f08000 fffff880`03f11000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`08187000 fffff880`081b5000 rdpdr rdpdr.sys Mon Jul 13 20:18:02 2009 (4A5BCEBA) fffff880`03f11000 fffff880`03f1a000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`03f1a000 fffff880`03f23000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63) fffff880`08000000 fffff880`08038000 RDPWD RDPWD.SYS Mon Jul 13 20:16:47 2009 (4A5BCE6F) fffff880`0158c000 fffff880`015c6000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A) fffff880`0267e000 fffff880`02696000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`0422f000 fffff880`04294000 Rt64win7 Rt64win7.sys Mon Oct 25 05:33:07 2010 (4CC54ED3) fffff880`050e5000 fffff880`05116300 RtHDMIVX RtHDMIVX.sys Thu Jul 16 23:52:36 2009 (4A5FF584) fffff880`06c0f000 fffff880`06df1900 RTKVHD64 RTKVHD64.sys Tue Aug 18 05:29:10 2009 (4A8A7466) fffff880`01186000 fffff880`011b5000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0) fffff880`07d79000 fffff880`07d84000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E) fffff880`0435e000 fffff880`0436a000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`02c7f000 fffff880`02c9c000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8) fffff880`0165a000 fffff880`01662000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB) fffff880`01020000 fffff880`0117d000 sptd sptd.sys Tue Aug 24 02:13:12 2010 (4C7362F8) fffff880`080c0000 fffff880`08156000 srv srv.sys Thu Aug 26 23:38:00 2010 (4C773318) fffff880`08059000 fffff880`080c0000 srv2 srv2.sys Thu Aug 26 23:37:46 2010 (4C77330A) fffff880`07d84000 fffff880`07db1000 srvnet srvnet.sys Thu Aug 26 23:37:24 2010 (4C7732F4) fffff880`043fe000 fffff880`043ff480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92) fffff880`01801000 fffff880`019fe000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458) fffff880`07db1000 fffff880`07dc3000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD) fffff880`03f5d000 fffff880`03f6a000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E) fffff880`081b5000 fffff880`081c0000 tdtcp tdtcp.sys Mon Jul 13 20:16:32 2009 (4A5BCE60) fffff880`03f3f000 fffff880`03f5d000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B) fffff880`02cb7000 fffff880`02ccb000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64) fffff960`005a0000 fffff960`005aa000 TSDDD TSDDD.dll unavailable (00000000) fffff880`081c0000 fffff880`081cf000 tssecsrv tssecsrv.sys Mon Jul 13 20:16:41 2009 (4A5BCE69) fffff880`02c00000 fffff880`02c26000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1) fffff880`05059000 fffff880`0506b000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20) fffff880`06c09000 fffff880`06c0af00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF) fffff880`04302000 fffff880`04313000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`0506b000 fffff880`050c5000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D) fffff880`042a1000 fffff880`042ac000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`042ac000 fffff880`04302000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`051bc000 fffff880`051d7000 USBSTOR USBSTOR.SYS Mon Jul 13 20:06:34 2009 (4A5BCC0A) fffff880`02c44000 fffff880`02c53000 VClone VClone.sys Sun Aug 09 17:25:45 2009 (4A7F3ED9) fffff880`011bf000 fffff880`011cc000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB) fffff880`03ec5000 fffff880`03ed3000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`03ed3000 fffff880`03ef8000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B) fffff880`0164a000 fffff880`0165a000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E) fffff880`00f78000 fffff880`00f8d000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`00f8d000 fffff880`00fe9000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141) fffff880`01540000 fffff880`0158c000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128) fffff880`02c9c000 fffff880`02cb7000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED) fffff880`03ef8000 fffff880`03f08000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F) fffff880`00e6e000 fffff880`00f12000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F) fffff880`00f12000 fffff880`00f21000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`03e45000 fffff880`03e4e000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff960`000e0000 fffff960`003ef000 win32k win32k.sys unavailable (00000000) fffff880`02c3b000 fffff880`02c44000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6) fffff880`0117d000 fffff880`01186000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`02648000 fffff880`02669000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1) fffff880`08156000 fffff880`08187000 WUDFRd WUDFRd.sys Mon Jul 13 20:06:06 2009 (4A5BCBEE) Unloaded modules: fffff880`01416000 fffff880`01424000 crashdmp.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01424000 fffff880`01430000 dump_ataport Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01430000 fffff880`01439000 dump_atapi.s Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`013d3000 fffff880`013e6000 dump_dumpfve Timestamp: unavailable (00000000) Checksum: 00000000
Hi Carl,
ok, I've uninstalled COMODO and Daemon Tools. It worked well but still not perfect. System still crashing aprox. in every 2 hours but it's much better than before (random crashes in very short period of time). So any suggession? memtest86? :S
last 7 dump attached
thanks,
teakiie
I still see two Comodo drivers and sptd.sys loaded on your system in your latest three dumps. Did you use Revo Uninstaller to remove Comodo? If not, please do so. And did you run DuplexSecure - Downloads to remove sptd.sys? Be sure you select remove and not reinstall when using DuplexSecure. The Comodo driver I see has a reputation for triggering BSOD's: cmdguard.sys.
After you get rid of these two drivers, reboot and run your system. If you get another BSOD, upload it to us and run Memtest following the instructions in this tutorial: RAM - Test with Memtest86+. Please post your results.
Error code 109, CRITICAL_STRUCTURE_CORRUPTION. Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular).
Error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.Code:Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`0329be50 Debug session time: Fri Dec 3 18:13:54.285 2010 (GMT-5) System Uptime: 0 days 0:02:00.612 Loading Kernel Symbols ............................................................... ................................................................ ............................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 109, {a3a039d896339668, b3b7465ee8b068ce, fffff800031a8e10, 1} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_STRUCTURE_CORRUPTION (109) This bugcheck is generated when the kernel detects that critical kernel code or data have been corrupted. There are generally three causes for a corruption: 1) A driver has inadvertently or deliberately modified critical kernel code or data. See Patching Policy for x64-Based Systems: Information for Driver Developers 2) A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was booted. Normal breakpoints, "bp", can only be set if the debugger is attached at boot time. Hardware breakpoints, "ba", can be set at any time. 3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data. Arguments: Arg1: a3a039d896339668, Reserved Arg2: b3b7465ee8b068ce, Reserved Arg3: fffff800031a8e10, Failure type dependent information Arg4: 0000000000000001, Type of corrupted region, can be 0 : A generic data region 1 : Modification of a function or .pdata 2 : A processor IDT 3 : A processor GDT 4 : Type 1 process list corruption 5 : Type 2 process list corruption 6 : Debug routine modification 7 : Critical MSR modification Debugging Details: ------------------ BUGCHECK_STR: 0x109 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800030ce740 STACK_TEXT: fffff880`031af5d8 00000000`00000000 : 00000000`00000109 a3a039d8`96339668 b3b7465e`e8b068ce fffff800`031a8e10 : nt!KeBugCheckEx STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800031a8f9f - nt!PnpRemoveDeviceActionRequests+18f [ 90:d0 ] 1 error : !nt (fffff800031a8f9f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- 2: kd> lmtsmn start end module name fffff880`04313000 fffff880`04351000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30) fffff880`00f21000 fffff880`00f78000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106) fffff880`03f75000 fffff880`03fff000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`0437a000 fffff880`04390000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0) fffff880`02c26000 fffff880`02c3b000 amdppm amdppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD) fffff880`00e4d000 fffff880`00e58000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB) fffff880`00e1a000 fffff880`00e23000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00e23000 fffff880`00e4d000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118) fffff880`0480a000 fffff880`04fff000 atikmdag atikmdag.sys Tue Oct 26 22:29:53 2010 (4CC78EA1) fffff880`04078000 fffff880`040c3000 atikmpag atikmpag.sys Tue Oct 26 22:14:23 2010 (4CC78AFF) fffff880`03ebe000 fffff880`03ec5000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D) fffff880`02dee000 fffff880`02dff000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF) fffff880`02794000 fffff880`027b2000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206) fffff960`00620000 fffff960`00647000 cdd cdd.dll unavailable (00000000) fffff880`00dbe000 fffff880`00de8000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`00cb2000 fffff880`00d72000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D) fffff880`013a3000 fffff880`013d3000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00c54000 fffff880`00cb2000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`013e6000 fffff880`013ef000 cmderd cmderd.sys Fri Sep 10 18:07:24 2010 (4C8AAC1C) fffff880`03e73000 fffff880`03eb5000 cmdguard cmdguard.sys Fri Sep 10 18:07:10 2010 (4C8AAC0E) fffff880`03f6a000 fffff880`03f75000 cmdhlp cmdhlp.sys Fri Sep 10 18:06:39 2010 (4C8AABEF) fffff880`014b2000 fffff880`01525000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814) fffff880`0436a000 fffff880`0437a000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`051d7000 fffff880`051e5000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD) fffff880`02d4d000 fffff880`02dd0000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A) fffff880`02dd0000 fffff880`02dee000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200) fffff880`02d3e000 fffff880`02d4d000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E) fffff880`01400000 fffff880`01416000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`05154000 fffff880`05176000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5) fffff880`051f1000 fffff880`051fa000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`051e5000 fffff880`051f1000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`05000000 fffff880`05013000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F) fffff880`051b0000 fffff880`051bc000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff880`040c3000 fffff880`041b7000 dxgkrnl dxgkrnl.sys Thu Oct 01 21:00:14 2009 (4AC5509E) fffff880`041b7000 fffff880`041fd000 dxgmms1 dxgmms1.sys Mon Jul 13 19:38:32 2009 (4A5BC578) fffff880`02d33000 fffff880`02d3e000 ElbyCDIO ElbyCDIO.sys Thu Dec 17 17:25:16 2009 (4B2AAFCC) fffff880`02696000 fffff880`026cc000 fastfat fastfat.SYS Mon Jul 13 19:23:28 2009 (4A5BC1F0) fffff880`04351000 fffff880`0435e000 fdc fdc.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`00e58000 fffff880`00e6c000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481) fffff880`050c5000 fffff880`050d0000 flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`00d72000 fffff880`00dbe000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F) fffff880`01536000 fffff880`01540000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111) fffff880`015c6000 fffff880`01600000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2) fffff880`01600000 fffff880`0164a000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164) fffff880`04294000 fffff880`042a1000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0) fffff800`03015000 fffff800`0305e000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08) fffff880`04000000 fffff880`04024000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5) fffff880`0517c000 fffff880`05195000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD) fffff880`06c00000 fffff880`06c08080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9) fffff880`06df2000 fffff880`06e00000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE) fffff880`026cc000 fffff880`02794000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8) fffff880`01674000 fffff880`0167d000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA) fffff880`03e4e000 fffff880`03e66000 inspect inspect.sys Fri Sep 10 18:07:36 2010 (4C8AAC28) fffff880`043ef000 fffff880`043fe000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`05195000 fffff880`051a3000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff800`00bb3000 fffff800`00bbd000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB) fffff880`05016000 fffff880`05059000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9) fffff880`01498000 fffff880`014b2000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156) fffff880`017d1000 fffff880`017fc000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4) fffff880`05176000 fffff880`0517b200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93) fffff880`02669000 fffff880`0267e000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`01416000 fffff880`01439000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295) fffff880`00c33000 fffff880`00c40000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65) fffff880`02c53000 fffff880`02c61000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C) fffff880`0405f000 fffff880`0406e000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`051a3000 fffff880`051b0000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff880`00e00000 fffff880`00e1a000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`027b2000 fffff880`027ca000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79) fffff880`027ca000 fffff880`027f7000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33) fffff880`07c62000 fffff880`07cb0000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C) fffff880`07cb0000 fffff880`07cd3000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A) fffff880`03f23000 fffff880`03f2e000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`011b5000 fffff880`011bf000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE) fffff880`0143a000 fffff880`01498000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C) fffff880`02d28000 fffff880`02d33000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE) fffff880`01662000 fffff880`01674000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201) fffff880`0167f000 fffff880`01771000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`043b4000 fffff880`043c0000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8) fffff880`043c0000 fffff880`043ef000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`050d0000 fffff880`050e5000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD) fffff880`013ef000 fffff880`013fe000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff880`03e00000 fffff880`03e45000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178) fffff880`01771000 fffff880`017d1000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A) fffff880`03f2e000 fffff880`03f3f000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`02d1c000 fffff880`02d28000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E) fffff800`0305e000 fffff800`0363a000 nt ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9) fffff880`01200000 fffff880`013a3000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F) fffff880`03eb5000 fffff880`03ebe000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109) fffff880`00c00000 fffff880`00c26000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5) fffff880`01000000 fffff880`01015000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`011cc000 fffff880`011ff000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`01015000 fffff880`0101c000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115) fffff880`00fe9000 fffff880`00ff9000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`01525000 fffff880`01536000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF) fffff880`07cd3000 fffff880`07d79000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF) fffff880`05117000 fffff880`05154000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03) fffff880`00c40000 fffff880`00c54000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027) fffff880`04390000 fffff880`043b4000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04200000 fffff880`0421b000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9) fffff880`04024000 fffff880`04045000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA) fffff880`04045000 fffff880`0405f000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1) fffff880`02ccb000 fffff880`02d1c000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219) fffff880`0421b000 fffff880`04226000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA) fffff880`03f08000 fffff880`03f11000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`08187000 fffff880`081b5000 rdpdr rdpdr.sys Mon Jul 13 20:18:02 2009 (4A5BCEBA) fffff880`03f11000 fffff880`03f1a000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`03f1a000 fffff880`03f23000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63) fffff880`08000000 fffff880`08038000 RDPWD RDPWD.SYS Mon Jul 13 20:16:47 2009 (4A5BCE6F) fffff880`0158c000 fffff880`015c6000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A) fffff880`0267e000 fffff880`02696000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`0422f000 fffff880`04294000 Rt64win7 Rt64win7.sys Mon Oct 25 05:33:07 2010 (4CC54ED3) fffff880`050e5000 fffff880`05116300 RtHDMIVX RtHDMIVX.sys Thu Jul 16 23:52:36 2009 (4A5FF584) fffff880`06c0f000 fffff880`06df1900 RTKVHD64 RTKVHD64.sys Tue Aug 18 05:29:10 2009 (4A8A7466) fffff880`01186000 fffff880`011b5000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0) fffff880`07d79000 fffff880`07d84000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E) fffff880`0435e000 fffff880`0436a000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`02c7f000 fffff880`02c9c000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8) fffff880`0165a000 fffff880`01662000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB) fffff880`01020000 fffff880`0117d000 sptd sptd.sys Tue Aug 24 02:13:12 2010 (4C7362F8) fffff880`080c0000 fffff880`08156000 srv srv.sys Thu Aug 26 23:38:00 2010 (4C773318) fffff880`08059000 fffff880`080c0000 srv2 srv2.sys Thu Aug 26 23:37:46 2010 (4C77330A) fffff880`07d84000 fffff880`07db1000 srvnet srvnet.sys Thu Aug 26 23:37:24 2010 (4C7732F4) fffff880`043fe000 fffff880`043ff480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92) fffff880`01801000 fffff880`019fe000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458) fffff880`07db1000 fffff880`07dc3000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD) fffff880`03f5d000 fffff880`03f6a000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E) fffff880`081b5000 fffff880`081c0000 tdtcp tdtcp.sys Mon Jul 13 20:16:32 2009 (4A5BCE60) fffff880`03f3f000 fffff880`03f5d000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B) fffff880`02cb7000 fffff880`02ccb000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64) fffff960`005a0000 fffff960`005aa000 TSDDD TSDDD.dll unavailable (00000000) fffff880`081c0000 fffff880`081cf000 tssecsrv tssecsrv.sys Mon Jul 13 20:16:41 2009 (4A5BCE69) fffff880`02c00000 fffff880`02c26000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1) fffff880`05059000 fffff880`0506b000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20) fffff880`06c09000 fffff880`06c0af00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF) fffff880`04302000 fffff880`04313000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`0506b000 fffff880`050c5000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D) fffff880`042a1000 fffff880`042ac000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`042ac000 fffff880`04302000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`051bc000 fffff880`051d7000 USBSTOR USBSTOR.SYS Mon Jul 13 20:06:34 2009 (4A5BCC0A) fffff880`02c44000 fffff880`02c53000 VClone VClone.sys Sun Aug 09 17:25:45 2009 (4A7F3ED9) fffff880`011bf000 fffff880`011cc000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB) fffff880`03ec5000 fffff880`03ed3000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`03ed3000 fffff880`03ef8000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B) fffff880`0164a000 fffff880`0165a000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E) fffff880`00f78000 fffff880`00f8d000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`00f8d000 fffff880`00fe9000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141) fffff880`01540000 fffff880`0158c000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128) fffff880`02c9c000 fffff880`02cb7000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED) fffff880`03ef8000 fffff880`03f08000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F) fffff880`00e6e000 fffff880`00f12000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F) fffff880`00f12000 fffff880`00f21000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`03e45000 fffff880`03e4e000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff960`000e0000 fffff960`003ef000 win32k win32k.sys unavailable (00000000) fffff880`02c3b000 fffff880`02c44000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6) fffff880`0117d000 fffff880`01186000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`02648000 fffff880`02669000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1) fffff880`08156000 fffff880`08187000 WUDFRd WUDFRd.sys Mon Jul 13 20:06:06 2009 (4A5BCBEE) Unloaded modules: fffff880`01416000 fffff880`01424000 crashdmp.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01424000 fffff880`01430000 dump_ataport Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01430000 fffff880`01439000 dump_atapi.s Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`013d3000 fffff880`013e6000 dump_dumpfve Timestamp: unavailable (00000000) Checksum: 00000000 Debug session time: Fri Dec 3 18:15:05.469 2010 (GMT-5) System Uptime: 0 days 0:00:29.969 Loading Kernel Symbols ............................................................... ......................................................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff800025b833f, 1, 7ffff8b} Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800025b833f, The address that the exception occurred at Arg3: 0000000000000001, Parameter 0 of the exception Arg4: 0000000007ffff8b, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt! ?? ::NNGAKEGL::`string'+15f1c fffff800`025b833f 08458b or byte ptr [rbp-75h],al EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 0000000007ffff8b WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800024bc0e0 0000000007ffff8b CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x1E PROCESS_NAME: ctfmon.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff880094dd688 -- (.exr 0xfffff880094dd688) ExceptionAddress: fffff800025b833f (nt! ?? ::NNGAKEGL::`string'+0x0000000000015f1c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000008 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 0000000007ffff8b Attempt to write to address 0000000007ffff8b TRAP_FRAME: fffff880094dd730 -- (.trap 0xfffff880094dd730) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000040 rbx=0000000000000000 rcx=fffffa80054b69f0 rdx=fffff8a004756be8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800025b833f rsp=fffff880094dd8c8 rbp=0000000008000000 r8=fffff8a004756c68 r9=0000000000000000 r10=fffff80002413888 r11=fffff880094dd8a0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt! ?? ::NNGAKEGL::`string'+0x15f1c: fffff800`025b833f 08458b or byte ptr [rbp-75h],al ss:0018:00000000`07ffff8b=?? Resetting default scope MISALIGNED_IP: nt! ?? ::NNGAKEGL::`string'+15f1c fffff800`025b833f 08458b or byte ptr [rbp-75h],al LAST_CONTROL_TRANSFER: from fffff800022bea39 to fffff80002284740 STACK_TEXT: fffff880`094dceb8 fffff800`022bea39 : 00000000`0000001e ffffffff`c0000005 fffff800`025b833f 00000000`00000001 : nt!KeBugCheckEx fffff880`094dcec0 fffff800`02283d82 : fffff880`094dd688 00000000`00000000 fffff880`094dd730 00000000`00000000 : nt!KiDispatchException+0x1b9 fffff880`094dd550 fffff800`022828fa : 00000000`00000001 00000000`00000000 fffff8a0`01603a00 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`094dd730 fffff800`025b833f : 00000000`000007ff fffff8a0`04756ba0 00000000`00000010 00000000`00000000 : nt!KiPageFault+0x23a fffff880`094dd8c8 00000000`00000004 : 00000000`00000000 00000000`00000004 fffffa80`054b69f0 fffff8a0`00000001 : nt! ?? ::NNGAKEGL::`string'+0x15f1c fffff880`094dd928 00000000`00000000 : 00000000`00000004 fffffa80`054b69f0 fffff8a0`00000001 00000000`00000001 : 0x4 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800025b819f - nt! ?? ::NNGAKEGL::`string'+15d7f [ 00:01 ] 1 error : !nt (fffff800025b819f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
hmmm strange. I used revo as you suggested for the uninstall and removed sptd.sys with duplexSecure, i've selected uninstall. If I run duplex secure it writes that No SPTD version was detected and uninstall is not even an option now. is there some other way to remove these sys files? or what should i do?
Do a search of your C: drive for sptd.sys. If it shows up, delete every instance of it. This may require taking ownership of the file. Next, go to the Comodo website and download their uninstall tool. Run that uninstall tool. If that does not work, navigate to C:\Windows\System32\Drivers and look for cmderd.sys, cmdguard.sys, and cmdhlp.sys. Rename these drivers from .sys to .bak.
Now I've found sptd in device manager by showing hidden items, and uninstalled it.
but comodo have no .sys files like that, I've searched the system32 folder for clues, but nothing. I searched regedit for comodo stuffs. I've found under HKEY_LOCAL_MACHINE->System->ControlSet001>enum->root THIS 3 keys: LEGACY_CMDERD, LEGACY_CMDGUARD, LEGACY_CMDHELP, plus LEGACY_inspect which is also a comodo firewall driver. actually it's exsists under ControlSet002 and currentControlSet too. but I can't delete under enum and as I read it's not really possible.
sptd uninstall didn't change a lot, still crashes.
do you have any suggession?
no results for the search
dumps attached
It looks like you have successfully gotten rid of sptd and the Comodo drivers. Good job. Your latest three dumps all indicate memory corruption.
It is time to test hardware. Please test your RAM with Memtest following the instructions in this tutorial: RAM - Test with Memtest86+. Run memtest for at least seven passes; this will take six to eight hours. Errors, if any, will show on your screen in red. If you see errors, you can stop the test. Post your results.Code:Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`0305d000 PsLoadedModuleList = 0xfffff800`0329ae50 Debug session time: Sun Dec 5 15:38:07.982 2010 (GMT-5) System Uptime: 0 days 0:00:22.325 Loading Kernel Symbols ............................................................... ................................................................ ........... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff800033a3a87, fffff88003be2f90, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff800033a3a87, Address of the exception record for the exception that caused the bugcheck Arg3: fffff88003be2f90, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!SepAccessCheckAndAuditAlarm+96e fffff800`033a3a87 cf iretd CONTEXT: fffff88003be2f90 -- (.cxr 0xfffff88003be2f90) rax=fffffa8005c4eb20 rbx=00000000002e9301 rcx=fffff88003be3960 rdx=fffff8a0023cf150 rsi=0000000000000001 rdi=0000000000000000 rip=fffff800033a3a87 rsp=fffff88003be3960 rbp=fffff88003be3ca0 r8=0000000000000000 r9=fffff8a0023cf150 r10=fffff8a0023cf150 r11=00000000000006bf r12=fffff88003be3a14 r13=fffff88003be3a01 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 nt!SepAccessCheckAndAuditAlarm+0x96e: fffff800`033a3a87 cf iretd Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: services.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800033a3a87 STACK_TEXT: fffff880`03be3960 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SepAccessCheckAndAuditAlarm+0x96e CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800033a3a7f - nt!SepAccessCheckAndAuditAlarm+966 [ 8c:cc ] 1 error : !nt (fffff800033a3a7f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff88003be2f90 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- Debug session time: Sun Dec 5 15:39:24.780 2010 (GMT-5) System Uptime: 0 days 0:00:39.655 Loading Kernel Symbols ............................................................... ..................................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff8800a165c38, 1, fffff800025bb11d, 2} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff8800a165c38, memory referenced. Arg2: 0000000000000001, value 0 = read operation, 1 = write operation. Arg3: fffff800025bb11d, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800025000e0 fffff8800a165c38 FAULTING_IP: nt!RtlLookupAtomInAtomTable+bd fffff800`025bb11d 6641890424 mov word ptr [r12],ax MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: HelpPane.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff88009d657e0 -- (.trap 0xfffff88009d657e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=000000000000c001 rbx=0000000000000000 rcx=fffff8a000a00440 rdx=fffff8a000a00410 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800025bb11d rsp=fffff88009d65970 rbp=fffff88009d65ca0 r8=fffff8a000a03000 r9=0000000000000004 r10=0000000000000780 r11=fffff8a000a00020 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc nt!RtlLookupAtomInAtomTable+0xbd: fffff800`025bb11d 6641890424 mov word ptr [r12],ax ds:0004:00000000`00000000=???? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800023478f2 to fffff800022c8740 STACK_TEXT: fffff880`09d65678 fffff800`023478f2 : 00000000`00000050 fffff880`0a165c38 00000000`00000001 fffff880`09d657e0 : nt!KeBugCheckEx fffff880`09d65680 fffff800`022c682e : 00000000`00000001 ffffffff`ffffffff fffff700`01080400 000007fe`fe79b000 : nt! ?? ::FNODOBFM::`string'+0x40ec0 fffff880`09d657e0 fffff800`025bb11d : 00000000`00000004 ffffffff`ffffffff fffff8a0`00a00020 00000000`00000000 : nt!KiPageFault+0x16e fffff880`09d65970 fffff800`025bb88c : fffff8a0`00a00020 00000000`00000007 00000000`001bf600 00000000`001bf600 : nt!RtlLookupAtomInAtomTable+0xbd fffff880`09d659c0 fffff800`022c7993 : fffffa80`05a2d760 00000000`001bf598 00000000`ffffff01 fffffa80`05a227c0 : nt!NtFindAtom+0xe7 fffff880`09d65c20 00000000`76dcfe9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`001bf558 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dcfe9a STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800025bb87f - nt!NtFindAtom+da [ 00:40 ] 1 error : !nt (fffff800025bb87f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- Debug session time: Sun Dec 5 15:48:55.870 2010 (GMT-5) System Uptime: 0 days 0:08:53.370 Loading Kernel Symbols ............................................................... ..................................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffffa80147cae78, 0, fffff800024bc3a8, 2} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffa80147cae78, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff800024bc3a8, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800024b80e0 fffffa80147cae78 FAULTING_IP: nt!LZNT1FindMatchStandard+58 fffff800`024bc3a8 488b741028 mov rsi,qword ptr [rax+rdx+28h] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: rstrui.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff88009520570 -- (.trap 0xfffff88009520570) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000010009e50 rbx=0000000000000000 rcx=00000000010009e7 rdx=fffffa80047c1000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800024bc3a8 rsp=fffff88009520708 rbp=fffffa80047c1000 r8=fffff9802a640000 r9=0000000000001002 r10=0000000000000000 r11=fffffa80047b1000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz ac po nc nt!LZNT1FindMatchStandard+0x58: fffff800`024bc3a8 488b741028 mov rsi,qword ptr [rax+rdx+28h] ds:00a0:fffffa80`147cae78=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800022ff8f2 to fffff80002280740 STACK_TEXT: fffff880`09520408 fffff800`022ff8f2 : 00000000`00000050 fffffa80`147cae78 00000000`00000000 fffff880`09520570 : nt!KeBugCheckEx fffff880`09520410 fffff800`0227e82e : 00000000`00000000 fffff980`2a641000 00000000`00000000 fffffa80`04775f68 : nt! ?? ::FNODOBFM::`string'+0x40ec0 fffff880`09520570 fffff800`024bc3a8 : fffffa80`047b1004 fffffa80`047c1000 fffff980`2a640000 fffff800`024bc93c : nt!KiPageFault+0x16e fffff880`09520708 fffff800`024bc5a9 : fffff880`09520890 fffffa80`03b514f0 fffff980`2a640000 fffffa80`047b1003 : nt!LZNT1FindMatchStandard+0x58 fffff880`09520740 fffff800`024bca6d : fffff800`024bc350 fffff880`00dad900 fffffa80`047b1fff fffffa80`047b1000 : nt!LZNT1CompressChunk+0xf2 fffff880`095207c0 fffff800`024bcb48 : fffff8a0`0ac877a0 00000000`00000000 00000000`00010000 fffff880`09520e40 : nt!RtlCompressBufferLZNT1+0x7d fffff880`09520830 fffff880`0125c780 : 00000000`00000000 fffff880`0126b8cc 00000000`00000000 00000000`00000000 : nt!RtlCompressBuffer+0x64 fffff880`09520880 fffff880`0125bdf2 : fffff880`09520e40 fffff8a0`0ac877a0 00000000`00000000 fffff880`09520e40 : Ntfs!NtfsPrepareCompressedWriteBuffer+0x100 fffff880`09520930 fffff880`01262209 : fffff880`09520b28 fffffa80`03b7ec10 fffff880`09520b00 00000000`00000000 : Ntfs!NtfsPrepareComplexBuffers+0x1d2 fffff880`09520a00 fffff880`0125ffdc : fffffa80`03b7ec10 fffffa80`048cccf0 fffff880`09520b20 00000000`00000000 : Ntfs!NtfsPrepareBuffers+0x179 fffff880`09520a80 fffff880`01266a12 : fffff880`09520e40 fffffa80`03b7ec10 fffffa80`04b91180 fffff8a0`0ac877a0 : Ntfs!NtfsNonCachedIo+0x1bc fffff880`09520c50 fffff880`0126b413 : fffff880`09520e40 fffffa80`03b7ec10 fffff880`09521000 fffff880`09521801 : Ntfs!NtfsCommonWrite+0x872 fffff880`09520e10 fffff880`0106723f : fffffa80`03b7efb0 fffffa80`03b7ec10 fffffa80`05d35010 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3 fffff880`09521090 fffff880`010656df : fffffa80`048c8de0 fffffa80`03b514f0 fffffa80`048c8d00 fffffa80`03b7ec10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`09521120 fffff800`0226f2ff : fffffa80`03b7ec10 fffff880`09521638 fffffa80`054da1c0 fffff800`025729a4 : fltmgr!FltpDispatch+0xcf fffff880`09521180 fffff800`0226e987 : 00000000`00000000 fffff880`09521638 fffffa80`012198f0 00000000`00000000 : nt!IoSynchronousPageWrite+0x24f fffff880`09521200 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiFlushSectionInternal+0xa58 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800024bc39f - nt!LZNT1FindMatchStandard+4f [ 00:01 ] 1 error : !nt (fffff800024bc39f) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- 3: kd> lmtsmn start end module name fffff880`04d1d000 fffff880`04d5b000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30) fffff880`00ebd000 fffff880`00f14000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106) fffff880`0194e000 fffff880`019d8000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`04d94000 fffff880`04daa000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0) fffff880`00dd0000 fffff880`00ddb000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB) fffff880`00ff4000 fffff880`00ffd000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00da6000 fffff880`00dd0000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118) fffff880`018b4000 fffff880`018bb000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D) fffff880`04d68000 fffff880`04d79000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF) fffff880`0747a000 fffff880`07498000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206) fffff880`04a57000 fffff880`04a81000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`00cbc000 fffff880`00d7c000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D) fffff880`01845000 fffff880`01875000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00c5e000 fffff880`00cbc000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`01122000 fffff880`01195000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814) fffff880`04d79000 fffff880`04d89000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`075c2000 fffff880`075d0000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD) fffff880`04ae6000 fffff880`04b69000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A) fffff880`04b69000 fffff880`04b87000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200) fffff880`01235000 fffff880`0124b000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`075dc000 fffff880`075e5000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`075d0000 fffff880`075dc000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`075e5000 fffff880`075f8000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F) fffff880`07400000 fffff880`0740c000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff960`005c0000 fffff960`005de000 dxg dxg.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff880`04d5b000 fffff880`04d68000 fdc fdc.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`010b0000 fffff880`010c4000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481) fffff880`075a2000 fffff880`075ad000 flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`01064000 fffff880`010b0000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F) fffff960`00960000 fffff960`00969000 framebuf framebuf.dll Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`0122b000 fffff880`01235000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111) fffff880`00c00000 fffff880`00c3a000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2) fffff880`01400000 fffff880`0144a000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164) fffff880`04bda000 fffff880`04be7000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0) fffff800`027ec000 fffff800`02835000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08) fffff880`04bb6000 fffff880`04bda000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5) fffff880`0741a000 fffff880`07433000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD) fffff880`07433000 fffff880`0743b080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9) fffff880`0740c000 fffff880`0741a000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE) fffff880`015f1000 fffff880`015fa000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA) fffff880`04ca4000 fffff880`04cb3000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`0744b000 fffff880`07459000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff800`00baa000 fffff800`00bb4000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB) fffff880`074f3000 fffff880`07536000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9) fffff880`01200000 fffff880`0121a000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156) fffff880`015c6000 fffff880`015f1000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4) fffff880`00c3d000 fffff880`00c4a000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65) fffff880`04dda000 fffff880`04de9000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`0743e000 fffff880`0744b000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff880`00d8c000 fffff880`00da6000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`07498000 fffff880`074b0000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79) fffff880`01875000 fffff880`018a2000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33) fffff880`098d0000 fffff880`0991e000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C) fffff880`0991e000 fffff880`09941000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A) fffff880`01907000 fffff880`01912000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00f1d000 fffff880`00f27000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE) fffff880`010c4000 fffff880`01122000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C) fffff880`04d89000 fffff880`04d94000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE) fffff880`01462000 fffff880`01474000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201) fffff880`01474000 fffff880`01566000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`04dce000 fffff880`04dda000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8) fffff880`04c00000 fffff880`04c2f000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`075ad000 fffff880`075c2000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD) fffff880`019e1000 fffff880`019f0000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff880`01800000 fffff880`01845000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178) fffff880`01566000 fffff880`015c6000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A) fffff880`01912000 fffff880`01923000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`04ada000 fffff880`04ae6000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E) fffff800`02210000 fffff800`027ec000 nt ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9) fffff880`01254000 fffff880`013f7000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F) fffff880`018ab000 fffff880`018b4000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109) fffff880`0103a000 fffff880`01060000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5) fffff880`00f67000 fffff880`00f7c000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00f34000 fffff880`00f67000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`00fed000 fffff880`00ff4000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115) fffff880`00d7c000 fffff880`00d8c000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`0121a000 fffff880`0122b000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF) fffff880`00c4a000 fffff880`00c5e000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027) fffff880`04daa000 fffff880`04dce000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04c2f000 fffff880`04c4a000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9) fffff880`04c4a000 fffff880`04c6b000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA) fffff880`04c6b000 fffff880`04c85000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1) fffff880`04a89000 fffff880`04ada000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219) fffff880`04c85000 fffff880`04c90000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA) fffff880`018fe000 fffff880`01907000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`01000000 fffff880`0103a000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A) fffff880`04a00000 fffff880`04a57000 Rt64win7 Rt64win7.sys Mon Mar 22 05:57:14 2010 (4BA73EFA) fffff880`074c2000 fffff880`074f1000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0) fffff880`074f1000 fffff880`074f2480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92) fffff880`01600000 fffff880`017fd000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458) fffff880`01941000 fffff880`0194e000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E) fffff880`01923000 fffff880`01941000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B) fffff880`04c90000 fffff880`04ca4000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64) fffff960`00680000 fffff960`0068a000 TSDDD TSDDD.dll unavailable (00000000) fffff880`04b87000 fffff880`04bad000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1) fffff880`07536000 fffff880`07548000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20) fffff880`0743c000 fffff880`0743df00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF) fffff880`04d0c000 fffff880`04d1d000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`07548000 fffff880`075a2000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D) fffff880`04be7000 fffff880`04bf2000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`04cb6000 fffff880`04d0c000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`04de9000 fffff880`04df8000 VClone VClone.sys Sun Aug 09 17:25:45 2009 (4A7F3ED9) fffff880`00f27000 fffff880`00f34000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB) fffff880`018bb000 fffff880`018c9000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`018c9000 fffff880`018ee000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B) fffff880`0144a000 fffff880`0145a000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E) fffff880`00f7c000 fffff880`00f91000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`00f91000 fffff880`00fed000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141) fffff880`01195000 fffff880`011e1000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128) fffff880`018ee000 fffff880`018fe000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F) fffff880`00e0a000 fffff880`00eae000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F) fffff880`00eae000 fffff880`00ebd000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`019d8000 fffff880`019e1000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff960`00090000 fffff960`0039f000 win32k win32k.sys Tue Aug 31 22:58:04 2010 (4C7DC13C) fffff880`04bad000 fffff880`04bb6000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6) fffff880`00f14000 fffff880`00f1d000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`07459000 fffff880`0747a000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1) Unloaded modules: fffff880`01875000 fffff880`01883000 crashdmp.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01883000 fffff880`0188f000 dump_ataport Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`0188f000 fffff880`01898000 dump_atapi.s Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01898000 fffff880`018ab000 dump_dumpfve Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`0145a000 fffff880`01462000 spldr.sys Timestamp: unavailable (00000000) Checksum: 00000000
If you get no errors with Memtest, enable driver verifier following these instructions: Driver Verifier - Enable and Disable. Only enbale Driver Verifier if you have no RAM errors. If Driver Verifier finds a faulty driver, it will trigger a BSOD. Upload any and all Driver Verifier enables dumps.