BSOD - possibly ntoskrnl? - some advice please..

Goose0211 · 06 Dec 2010

Hi,

I have just started getting a 'selection' of BSOD, they come up pretty regularly but the machine can occasionally boot ok and occasionally into safe mode. If i get in ok it runs for a while and then seems to Blue screen when I run a program - can vary from IE to Chrome to another application- nothing specific.

i have looked at some of the minidump files and it looks like they are pointing at the ntoskrnl.exe but would like a bit of clarification on this, and some advice as to where to go next!

I have tried all I can think of - removing recently installed software, done a few hours of memtest - came back fine but need to be pointed in the right direction, before i potentially do a rebuild.....last resort!

I have attached a host of minidump files and would be gratefull if someone could have a look and help me out.

If you need any more info - let me know

Thanks

CarlTR6 · 06 Dec 2010

Hi, goose, and welcome to the forum. You do have a bunch of mini dumps. Please read this thread, follow the instructions and post back. We will be glad to help you.

https://www.sevenforums.com/crashes-d...tructions.html

Goose0211 · 06 Dec 2010

Thanks for the quick reply Carl, Ive attached the 2 requested files - hopefully they are as they should be!!

thanks again

CarlTR6 · 06 Dec 2010

Thanks, Goose. Everything came through just fine. I looked at your four most recent dumps. None of them point a specific cause and they all indicate memory corruption. You will have to troubleshoot. Please note the usual causes below.

Error code A (2X), IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility.

Error code D1, DRIVER_IRQL_NOT_LESS_OR_EQUAL. Usually caused by a device driver.

Error code 7F, UNEXPECTED_KERNEL_MODE_TRAP. Usual causes: Memory corruption, Hardware (memory in particular), Installing a faulty or mismatched hardware (especially memory) or a failure after installing it, 3rd party firewall, Device drivers, SCSI/network/BIOS updates needed, Improperly seated cards, Incompatible storage devices, Overclocking, Virus scanner, Backup tool, Bad motherboard, Missing Service Pack.

To begin your troubleshooting, I recommend that you uninstall Kaspersky using this removal tool: Tool. Kaspersky is a known cause of BSOD's on some Win 7 systems. You can tyr it again after you know your system is stable; but I do not recommend doing so. Download and install Microsoft Security Essentials in its place and make sure Windows Firewall is turned on.

I find outdated drivers loaded on your system. Out of date drivers can and do cause memory corruption and BSOD's. Update or eliminate the following drivers.

Acceler.sys Fri Jun 26 16:56:34 2009 - HP Mobile Data Protection System Accelerometer. HP® - Holiday Deals on Laptops, Desktops, Printers, Servers and more.

bcmwl664.sys Tue Jul 07 20:45:04 2009 - bcmwl664.sys - Broadcom 802.11g Network Adapter wireless driver. Broadcom.com - Downloads & Support.

CtClsFlt.sys Mon Jun 15 01:06:41 2009 - Creative Camera Class Upper Filter Driver. Creative Worldwide Support.

o2mdgx64.sys Thu May 21 08:22:50 2009 - O2-Card-Reader-Controller-Driver. OEM - none at O2Micro - Welcome. Try to update this driver through the Dell site.

SynTP.sys Fri Jun 26 14:35:47 2009 - Synaptic Touch Pad Driver. Drivers | Synaptics.

How to find drivers-

- I have listed links to most of the drivers in the code box above. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Uninstall Kaspersky, update or eliminate the above drivers, reboot, and let's see how your system runs. Update us and let us know. If you get another BSOD, upload it and we will go from there.

Code:

Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e3fe50
Debug session time: Sun Dec  5 17:36:33.726 2010 (GMT-5)
System Uptime: 0 days 0:00:51.303
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c92436}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c92436, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eaa0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c73
fffff800`02c92436 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88006d43da0 -- (.trap 0xfffff88006d43da0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88006d44428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c92436 rsp=fffff88006d43f30 rbp=fffff88006d44080
 r8=0000000000000000  r9=fffff88006d44030 r10=0000000000000002
r11=fffffa80057c7b20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc73:
fffff800`02c92436 488b09          mov     rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c71ca9 to fffff80002c72740

STACK_TEXT:  
fffff880`06d43c58 fffff800`02c71ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`06d43c60 fffff800`02c70920 : fffffa80`06b4fc00 fffffa80`06b3f810 fffffa80`06b23370 fffff880`00e47579 : nt!KiBugCheckDispatch+0x69
fffff880`06d43da0 fffff800`02c92436 : fffffa80`06b43600 fffff880`00000000 a6c00001`003e9901 00000000`00000000 : nt!KiPageFault+0x260
fffff880`06d43f30 fffff800`02c4f0c7 : 00000000`00000000 fffff800`02eac840 fffff880`06d44100 fffffa80`00000000 : nt!IopCompleteRequest+0xc73
fffff880`06d44000 fffff800`02c4f487 : 00000000`00000006 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`06d44080 fffff800`02c69471 : fffff800`02c4d95e fffff880`00001000 00000000`00000000 fffff880`01800000 : nt!KiApcInterrupt+0xd7
fffff880`06d44218 fffff800`02c4d95e : fffff880`00001000 00000000`00000000 fffff880`01800000 fffff880`06d442c0 : nt!memmove+0x41
fffff880`06d44220 fffff800`02c559fe : fffffa80`04671910 fffff8a0`02dfa000 fffffa80`03d58570 fffffa80`00000000 : nt!EtwpEventWriteFull+0x3be
fffff880`06d44490 fffff800`0301a2f6 : 00000000`0000003a 000007fe`fddb00f0 fffff880`06d44798 fffff880`06d44780 : nt!EtwWrite+0xae
fffff880`06d44500 fffff800`02ce12ea : fffffa80`06b49000 00000000`00000000 000007fe`fddb0000 fffff800`02f50000 : nt!EtwpPsProvTraceImage+0x1c5
fffff880`06d445e0 fffff800`02ecddc5 : fffffa80`055edc70 fffffa80`06b49000 fffff8a0`00002000 fffff880`06d44798 : nt! ?? ::FNODOBFM::`string'+0x29333
fffff880`06d44700 fffff800`02f2f43e : fffffa80`06b23370 00000000`00000000 fffffa80`06b43660 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0x210c6
fffff880`06d448a0 fffff800`02f57cd4 : 000007ff`fffd9000 fffff880`06d44c20 00000000`00000000 fffffa80`0613b8a0 : nt!PspExitProcess+0x4e
fffff880`06d44900 fffff800`02f30635 : 00000000`00000001 fffff800`02f71101 000007ff`fffd9000 00000000`00000000 : nt!PspExitThread+0x834
fffff880`06d449c0 fffff800`02c4f1db : fffffa80`0616d001 fffffa80`06458b10 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`06d449f0 fffff800`02c4f620 : 00000000`0036df90 fffff880`06d44a70 fffff800`02f3074c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`06d44a70 fffff800`02c71a37 : 00000000`00000378 00000000`022be7f0 00000000`00000000 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`06d44bb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02c70920 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Goose0211 · 06 Dec 2010

Thanks again for that, just for info I had MSE running on it and removed as part of a troubleshooting process - only put Kaspersky on after the first few BSOD's to try a different AV to see if it was virus related and it picked anything else up!

Really appreciate the help...... when you say memory corruption, do you mean physical chip problems or virtual memory corruption?

Thanks again, I'll await your next update.

CarlTR6 · 06 Dec 2010

Memory corruption means the system memory is corrupted. This can be caused by bad RAM, software or hardware conflicts, and device driver conflicts. My method of troubleshooting is to eliminate all known possible conflicts before testing the RAM. MSE will not cause a BSOD unless something else is interfering with it and this is rare.

Goose0211 · 06 Dec 2010

Have managed to locate most of the updates - am struggling with a couple though - mainly because Im not sure what they ere for - or do!!

Acceler.sys - links and google search take me to HP website and a Pro Liant server download?!? - I have a Dell studio 1747 laptop

CtClsFlt.sys - is this the Webcam? not sure what a Class upper filter driver is

You also mention eliminating the drivers, how would I do this if I dont know what they represent in device manager? Is there a better way to remove these drivers - if I dont need them - not sure??

Thanks again

Goose0211 · 06 Dec 2010

I 'think' i have updated the relevant updates, though not the 2 i was struggling with, however removing Kaspersky is proving to be a problem, the removal tool finds nothing - though its definitely there, and when I remove or try to from add/remove it just blue screens, ive attached the recent dumps if they help.

This is getting v frustrating now - as you may imagine, as can't get the machine up for long enough to do anything, and when I do it just blue screens.

Thanks

CarlTR6 · 07 Dec 2010

Download Revo Uninstaller (free) and use it to uninstall Kaspersky. Use it in the Safe Mode if you need to. Also, download and install Malwarebytes and run a scan. Let's make sure you don't have a nasty lurking about.

Acceler.sys belongs to a utility. I believe the driver has an update. You can disable a driver by renaming it. Create a restore point; using Windows Explorer, navigate to C:\Windows\System32\Drivers, locate the driver files, and rename them from .sys to .old or.bak. Reboot and the drivers will not load. This will break whatever software or hardware these drivers are associated with. Sometimes drivers are not located in the System32 folder; the are located in a sub folder in the Programs folder. If you can't find a driver in System32, do a search of C: drive for that driver.

To the best of my knowledge, CtClsFlt.sys is a Creative camera driver. It seems to me that I remember seeing an updated version of this driver. You can always rename it to see if doing so helps your system. It is a Vista driver and it make work with Win 7.

Have you checked for updated drivers for all your devices at the Dell support site? BTW, looking at the drivers unloaded during the crash shows o2mdgx64.sys. This driver is up to date; but it may be the driver which requires fixing. I believe this driver is a card reader controller driver. An unloaded driver means the driver was involved in the crash, but not necessarily the cause of the crash.

Your latest three dumps show the Kaspersky drivers still loaded. Work on getting Kaspersky off or your system. YOu may have to reinstall it and then run the removal tool or use Revo Uninstaller. We may be able to tell more once Kaspersky is gone.

Error code A (2X), IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility.

Error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.

Code:

Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03255000 PsLoadedModuleList = 0xfffff800`03489eb0
Debug session time: Mon Dec  6 15:43:28.354 2010 (GMT-5)
System Uptime: 0 days 0:00:49.930
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff800032de803}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032de803, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034f40e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`032de803 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88006910a70 -- (.trap 0xfffff88006910a70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88006911428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032de803 rsp=fffff88006910c00 rbp=fffff88006910d50
 r8=fffffa80067e3910  r9=fffff88006910d00 r10=0000000000000002
r11=fffffa8005bdaea0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`032de803 488b09          mov     rcx,qword ptr [rcx] ds:5060:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032baae9 to fffff800032bb580

STACK_TEXT:  
fffff880`06910928 fffff800`032baae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`06910930 fffff800`032b9760 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`064ce440 : nt!KiBugCheckDispatch+0x69
fffff880`06910a70 fffff800`032de803 : fffffa80`06555060 00000000`00000000 fffff880`06910e40 fffff800`035859c2 : nt!KiPageFault+0x260
fffff880`06910c00 fffff800`0329658f : 00000000`00000001 00000000`00000000 fffff880`06910e00 fffff800`00000000 : nt!IopCompleteRequest+0xae3
fffff880`06910cd0 fffff800`03296957 : 00000000`0000012a 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`06910d50 fffff800`032c94cc : fffff800`03436e80 fffff800`00000001 00000000`00000000 00000000`00000000 : nt!KiApcInterrupt+0xd7
fffff880`06910ee0 fffff800`032d3ef1 : 00000000`00000000 00000000`00000002 00000000`00000001 fffff800`034f6840 : nt!KeFlushMultipleRangeTb+0x1cc
fffff880`06910fb0 fffff800`032ec773 : 00000000`00000002 fffff880`06911100 fffff8a0`03cae000 ffffffff`ffffffff : nt!MiFlushTbAsNeeded+0x1d1
fffff880`069110c0 fffff800`033ee445 : 00000000`00002000 fffffa80`03c62000 00000000`00000001 fffff6fc`5001e570 : nt!MiAllocatePagedPoolPages+0x1433
fffff880`069111f0 fffff800`032cdfc0 : 00000000`00002000 fffffa80`03c62000 00000000`00000001 fffff800`033ee34f : nt!MiAllocatePoolPages+0x35
fffff880`06911330 00000000`00000200 : 00000001`00000080 fffff880`06911428 fffff880`06911428 00000000`00000000 : nt!ExpAllocateBigPool+0xb0
fffff880`06911420 00000001`00000080 : fffff880`06911428 fffff880`06911428 00000000`00000000 00000000`00000000 : 0x200
fffff880`06911428 fffff880`06911428 : fffff880`06911428 00000000`00000000 00000000`00000000 fffff800`032a0000 : 0x1`00000080
fffff880`06911430 fffff880`06911428 : 00000000`00000000 00000000`00000000 fffff800`032a0000 00000000`0017c868 : 0xfffff880`06911428
fffff880`06911438 00000000`00000000 : 00000000`00000000 fffff800`032a0000 00000000`0017c868 fffffa80`049b3000 : 0xfffff880`06911428


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`032b9760 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c42e3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

System Uptime: 0 days 0:54:29.524
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80003246a71, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!KiApcInterrupt+1f1 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003246a71, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiApcInterrupt+1f1
fffff800`03246a71 48cf            iretq

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034a40e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  regsvr32.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88007db14c8 -- (.exr 0xfffff88007db14c8)
ExceptionAddress: fffff80003246a71 (nt!KiApcInterrupt+0x00000000000001f1)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000008
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88007db1570 -- (.trap 0xfffff88007db1570)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000e rbx=0000000000000000 rcx=0000000000000188
rdx=000000000000018f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003246a71 rsp=fffff88007db1708 rbp=fffffa8004cd3618
 r8=00000000000000ba  r9=0000000000000090 r10=0000000000000090
r11=0000000000000200 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
nt!KiApcInterrupt+0x1f1:
fffff800`03246a71 48cf            iretq
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032ac789 to fffff8000326b580

STACK_TEXT:  
fffff880`07db0cf8 fffff800`032ac789 : 00000000`0000001e ffffffff`c0000005 fffff800`03246a71 00000000`00000000 : nt!KeBugCheckEx
fffff880`07db0d00 fffff800`0326abc2 : fffff880`07db14c8 00000000`00000190 fffff880`07db1570 00000000`000000b2 : nt!KiDispatchException+0x1b9
fffff880`07db1390 fffff800`032694ca : 00000000`00000000 fffffa80`04cd3650 fffffa80`04cd4970 00000000`000000b2 : nt!KiExceptionDispatch+0xc2
fffff880`07db1570 fffff800`03246a71 : fffffa80`04ccc186 00000000`00000000 00000000`00000200 00000001`07db1730 : nt!KiGeneralProtectionFault+0x10a
fffff880`07db1708 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiApcInterrupt+0x1f1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiApcInterrupt+1f1
fffff800`03246a71 48cf            iretq

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!KiApcInterrupt+1f1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c42e3

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiApcInterrupt+1f1

BUCKET_ID:  X64_0x1E_nt!KiApcInterrupt+1f1

Followup: MachineOwner
---------

5: kd> lmtsmn
start             end                 module name
fffff880`05752000 fffff880`05790000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`0480d000 fffff880`04819000   Acceler  Acceler.sys  Fri Jun 26 16:56:34 2009 (4A453602)
fffff880`00f4b000 fffff880`00fa2000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`046cc000 fffff880`04756000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`0483f000 fffff880`04855000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00ff5000 fffff880`01000000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04cbe000 fffff880`04ce0000   AnyDVD   AnyDVD.sys   Sat Dec 19 13:22:08 2009 (4B2D19D0)
fffff880`00e59000 fffff880`00e62000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e62000 fffff880`00e8c000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`04ceb000 fffff880`05395000   atikmdag atikmdag.sys Tue Apr 06 21:47:17 2010 (4BBBE425)
fffff880`048d3000 fffff880`04909000   atikmpag atikmpag.sys Tue Apr 06 21:23:30 2010 (4BBBDE92)
fffff880`00e1e000 fffff880`00e2a000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`07000000 fffff880`07009000   BCM42RLY BCM42RLY.sys Tue Jul 07 20:34:55 2009 (4A53E9AF)
fffff880`0a7b9000 fffff880`0a7c2000   bcmvwl64 bcmvwl64.sys Tue Dec 08 11:07:09 2009 (4B1E79AD)
fffff880`0a4b5000 fffff880`0a7a3000   bcmwl664 bcmwl664.sys Tue Dec 08 11:10:06 2009 (4B1E7A5E)
fffff880`030b0000 fffff880`030b7000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`046b1000 fffff880`046c2000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`04bac000 fffff880`04bca000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00710000 fffff960`00737000   cdd      cdd.dll      Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`0106a000 fffff880`01094000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cba000 fffff880`00d7a000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0103a000 fffff880`0106a000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c5c000 fffff880`00cba000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05457000 fffff880`0545b500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`0116e000 fffff880`011e1000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e15000 fffff880`00e1e000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`0482f000 fffff880`0483f000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06b33000 fffff880`06b41000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`06bc4000 fffff880`06bee2a0   CtClsFlt CtClsFlt.sys Mon Jun 15 01:06:41 2009 (4A35D6E1)
fffff880`031ad000 fffff880`031cb000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`046a2000 fffff880`046b1000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01dc3000 fffff880`01dd9000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05dac000 fffff880`05dce000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`06b4f000 fffff880`06b5b000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06b66000 fffff880`06b79000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`06b5b000 fffff880`06b66000   dump_msahci dump_msahci.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`06b27000 fffff880`06b33000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04909000 fffff880`049fd000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`05395000 fffff880`053db000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`04697000 fffff880`046a2000   ElbyCDIO ElbyCDIO.sys Thu Dec 17 17:25:16 2009 (4B2AAFCC)
fffff880`04a9e000 fffff880`04ad4000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`010f0000 fffff880`01104000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010a4000 fffff880`010f0000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0122b000 fffff880`01235000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`04c67000 fffff880`04c75000   ftusbrdload ftusbrdload.sys Tue Apr 13 10:40:06 2010 (4BC48246)
fffff880`01d89000 fffff880`01dc3000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`03131000 fffff880`0317b000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`04800000 fffff880`0480d000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`037d8000 fffff800`03821000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`053db000 fffff880`053ff000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05d13000 fffff880`05d6f000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`04bf3000 fffff880`04bfb080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04ae4000 fffff880`04bac000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01d80000 fffff880`01d89000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0545c000 fffff880`0547a000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04819000 fffff880`0482f000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`0547a000 fffff880`05489000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bc3000 fffff800`00bc6000   kdcom    kdcom.dll    Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`01621000 fffff880`01d80000   kl1      kl1.sys      Wed Jun 09 09:34:19 2010 (4C0F985B)
fffff880`031a6000 fffff880`031ad000   kl2      kl2.sys      Wed Jun 09 09:24:47 2010 (4C0F961F)
fffff880`03011000 fffff880`030a7000   klif     klif.sys     Fri Oct 01 03:28:56 2010 (4CA58DB8)
fffff880`0548b000 fffff880`05495000   klmouflt klmouflt.sys Mon Nov 02 11:26:06 2009 (4AEF081E)
fffff880`05c4f000 fffff880`05c92000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01200000 fffff880`0121a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`015c4000 fffff880`015ef000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`05dce000 fffff880`05dd3200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`06a44000 fffff880`06a59000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`06a00000 fffff880`06a23000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c04000 fffff880`00c48000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`06b41000 fffff880`06b4f000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`057ef000 fffff880`057fe000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00e3f000 fffff880`00e59000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04bca000 fffff880`04be2000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`04a00000 fffff880`04a2d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`04a2d000 fffff880`04a7b000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`04a7b000 fffff880`04a9e000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`00e8c000 fffff880`00e97000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03115000 fffff880`03120000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fab000 fffff880`00fb5000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01110000 fffff880`0116e000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`0468c000 fffff880`04697000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`0145c000 fffff880`0146e000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01472000 fffff880`01564000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04879000 fffff880`04885000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`05dd4000 fffff880`05de7000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04885000 fffff880`048b4000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05cfe000 fffff880`05d13000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`047e9000 fffff880`047f8000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`04756000 fffff880`0479b000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01564000 fffff880`015c4000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`03120000 fffff880`03131000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`04680000 fffff880`0468c000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03205000 fffff800`037d8000   nt       ntkrnlmp.exe Sat Jun 19 00:09:07 2010 (4C1C42E3)
fffff880`01255000 fffff880`013f8000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`030a7000 fffff880`030b0000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`06a59000 fffff880`06aac000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`0a482000 fffff880`0a492800   o2mdgx64 o2mdgx64.sys Thu Nov 12 03:07:00 2009 (4AFBC224)
fffff880`047a4000 fffff880`047ca000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e00000 fffff880`00e15000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00fb5000 fffff880`00fe8000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00dd6000 fffff880`00de6000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0121a000 fffff880`0122b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`07010000 fffff880`070b6000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05d6f000 fffff880`05dac000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c48000 fffff880`00c5c000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`01104000 fffff880`0110fe00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`04855000 fffff880`04879000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`048b4000 fffff880`048cf000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`05c03000 fffff880`05c24000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`05c24000 fffff880`05c3e000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`0462f000 fffff880`04680000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`030fa000 fffff880`03103000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03103000 fffff880`0310c000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0310c000 fffff880`03115000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01000000 fffff880`0103a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05de7000 fffff880`05dff000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05400000 fffff880`05457000   Rt64win7 Rt64win7.sys Thu Mar 04 08:42:52 2010 (4B8FB8DC)
fffff880`057c0000 fffff880`057ef000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`05790000 fffff880`057b0000   sdbus    sdbus.sys    Fri Oct 09 22:41:20 2009 (4ACFF450)
fffff880`070b6000 fffff880`070c1000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`01454000 fffff880`0145c000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`07167000 fffff880`071fd000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07100000 fffff880`07167000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`070c1000 fffff880`070ee000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`0144c000 fffff880`01454000   stdflt   stdflt.sys   Tue Aug 11 13:47:05 2009 (4A81AE99)
fffff880`06aac000 fffff880`06b27000   stwrt64  stwrt64.sys  Wed Jul 15 14:54:48 2009 (4A5E25F8)
fffff880`05c4d000 fffff880`05c4e480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`04c75000 fffff880`04cbe000   SynTP    SynTP.sys    Fri Jun 26 14:35:47 2009 (4A451503)
fffff880`04403000 fffff880`04600000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`070ee000 fffff880`07100000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`03199000 fffff880`031a6000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`0317b000 fffff880`03199000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`0461b000 fffff880`0462f000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005a0000 fffff960`005aa000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`031cb000 fffff880`031f1000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`05c92000 fffff880`05ca4000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`06b79000 fffff880`06b96000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`05489000 fffff880`0548af00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04c00000 fffff880`04c11000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05ca4000 fffff880`05cfe000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04c11000 fffff880`04c67000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`06b96000 fffff880`06bc3200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`05c3e000 fffff880`05c4d000   VClone   VClone.sys   Sun Aug 09 17:25:45 2009 (4A7F3ED9)
fffff880`00fe8000 fffff880`00ff5000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`030b7000 fffff880`030c5000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`030c5000 fffff880`030ea000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00e2a000 fffff880`00e3f000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d7a000 fffff880`00dd6000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01400000 fffff880`0144c000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`0a7a3000 fffff880`0a7b0000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`047ca000 fffff880`047e0000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`04600000 fffff880`0461b000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`030ea000 fffff880`030fa000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e98000 fffff880`00f3c000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f3c000 fffff880`00f4b000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0479b000 fffff880`047a4000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000f0000 fffff960`003ff000   win32k   win32k.sys   Tue Aug 31 22:58:05 2010 (4C7DC13D)
fffff880`046c2000 fffff880`046cb000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fa2000 fffff880`00fab000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`06a23000 fffff880`06a44000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`047e0000 fffff880`047e9000   klim6.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a400000 fffff880`0a471000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01dd9000 fffff880`01df2000   HIDCLASS.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04ad4000 fffff880`04ae2000   hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`06bef000 fffff880`06bfc000   mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a471000 fffff880`0a482000   o2mdgx64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04be2000 fffff880`04bf3000   o2mdgx64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a7b0000 fffff880`0a7b9000   bcmvwl64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a7d2000 fffff880`0a7df000   vwifibus.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a4e4000 fffff880`0a7d2000   bcmwl664.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a77e000 fffff880`0a78b000   vwifibus.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0a490000 fffff880`0a77e000   bcmwl664.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`05745000 fffff880`05752000   vwifibus.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0549d000 fffff880`05745000   bcmwl664.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04be2000 fffff880`04bf3000   o2mdgx64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`057b0000 fffff880`057c0000   o2mdgx64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`07cf7000 fffff880`07d68000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01dd9000 fffff880`01de7000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01de7000 fffff880`01df3000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01df3000 fffff880`01dfe000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01600000 fffff880`01613000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

A list of your loaded and unloaded drivers shows in the last dump file, error code 1E.

Goose0211 · 07 Dec 2010

I thought we were progressing - I removed Kaspersky - I hope! also renamed the 2 drivers CtClsFlt.sys and o2mdgx64.sys and rebooted and got another blue screen on boot - the earlier of the 2 in the attachment.

I then got into safemode and disabled all non microsoft services and managed to get it to boot happily twice and was able to use it for an hour or so with no issues - and thought I'll start by rebooting once more and then gradually re-enable the various services to try and narrow things down - but another blue screen - the second in the zip file! before I could start more troubleshooting.

Have updated all I can see from Dell and have done a malware scan - all seems good.

Thanks for the help so far - Im sure we'll get there....!