Unexpected Shutdown, BSOD, but it's Black not Blue

Indian · 26 Dec 2010

Uploading 2 mini dump files in one zip file

I also have a large Memory Dump to upload to 3rd Party

Indian · 26 Dec 2010

2 mini dump files in thjis zip file

CarlTR6 · 26 Dec 2010

Your earliest dump directly blames cmdguard.sys, COMODO Firewall Pro Sandbox Driver. I suspect you have some conflicts going on with Avira Comodo and Acronis. Uninstall Comodo completely. I believe there is a removal tool at the Comodo website. Down load and use it. Make sure Windows Firewall is turned on. Comodo is known to cause BSOD's on some Win 7 systems; however, it generally runs pretty well with Win 7. Once you get your system stable, you can try Comodo again.

Your latest dump directly blames tdrpm251.sys, Acronis True Image 2010 driver. Uninstall Acronis. I have seen Acronis cause BSOD's on a few Win 7 systems. You can try it again once your system is stable.

Your dump shows these outdated drivers loaded on your system. These can be causing the conflicts with Acronis and Comodo. I listed these in a previous post.

avgio.sys 2/22/2007 - Avira AntiVir. Avira AntiVir Personal - Free Antivirus. This is an XP/Vista driver. Uninstall Avira.
e1e6032.sys 3/24/2009 - Intel PRO/1000 Adapter NDIS 6 deserialized driver, http://downloadcenter.intel.com/Default.aspx. Update this driver.

ElbyCDFL.sys 12/14/2006 - ElbyCDIO Filter Driver. Cdrtools (Cdrecord) release information. This is an XP driver. Uninstall the Elby software if there is no update for the driver.

IntelS51.sys 5/1/2006 - Intel® 536EP Modem Driver, Intel V.92 Modem. http://downloadcenter.intel.com/Default.aspx.This is an XP driver. Update this driver.

pcouffin.sys 12/5/2006 - ow level access layer for CD devices (A part of many different CD/DVD burning programs). VSO Download DVD Burning Software, convert AVI to DVD, video converter, DVD copy to DVD slideshow photo
or
rename to pcouffin.BAK and see what CD/DVD program it breaks. This is an XP driver.

ssmdrv.sys 5/5/2009 - AVIRA SnapShot Driver. Avira AntiVir Personal - Free Antivirus. Uninstall Avira.

When you get your system stable, try adding Acronis back first if you choose to try it again. You can also try Macrium Reflect which has a free addition. I have not seen Macrium cause conflicts on Win 7. If all is running smoothly after a day or two, you can try adding Comodo back. Let you system run a day or two before you install anything else. I think that once you uninstall Avira and update or eliminate the out of date driver, you may be able to run Acronis and Comodo if you choose to do so. If you do not wish to stay with MSE, try Avast; it generally runs very well with Win 7.

Code:

Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82a4e000 PsLoadedModuleList = 0x82b96810
Debug session time: Sun Dec 26 08:40:21.391 2010 (GMT-5)
System Uptime: 0 days 0:18:23.011
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
1: kd> !Analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {8d303892, 8b07cac1, 74f8353e, 0}

*** WARNING: Unable to verify timestamp for tdrpm251.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpm251.sys
Probably caused by : hardware ( tdrpm251+9fce )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 8d303892, Actual security check cookie from the stack
Arg2: 8b07cac1, Expected security check cookie
Arg3: 74f8353e, Complement of the expected security check cookie
Arg4: 00000000, zero

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  GS_FALSE_POSITIVE_MISSING_GSFRAME

SECURITY_COOKIE:  Expected 8b07cac1 found 8d303892

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xF7

PROCESS_NAME:  System

CURRENT_IRQL:  0

EXCEPTION_RECORD:  8d3138d8 -- (.exr 0xffffffff8d3138d8)
ExceptionAddress: 8b0d1ffe (Ntfs!NtfsFsdClose+0x00000258)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00000000
Attempt to write to address 00000000

TRAP_FRAME:  8d31392c -- (.trap 0xffffffff8d31392c)
ErrCode = 00000002
eax=00000000 ebx=00000000 ecx=00080000 edx=00000000 esi=0636f0d1 edi=8d3139ab
eip=8b0d1ffe esp=8d3139a0 ebp=8d313a10 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
Ntfs!NtfsFsdClose+0x258:
8b0d1ffe 183b            sbb     byte ptr [ebx],bh          ds:0023:00000000=??
Resetting default scope

MISALIGNED_IP: 
Ntfs!NtfsFsdClose+258
8b0d1ffe 183b            sbb     byte ptr [ebx],bh

LAST_CONTROL_TRANSFER:  from 8b06d9d2 to 82b2ad10

STACK_TEXT:  
8d31337c 8b06d9d2 000000f7 8d303892 8b07cac1 nt!KeBugCheckEx+0x1e
8d31339c 8b05447f 00000000 00000000 00000000 Ntfs!__report_gsfailure+0x25
8d3133c4 82ab6822 8d3138d8 8d313a00 8d3134b0 Ntfs!_except_handler4+0x49
8d3133e8 82ab67f4 8d3138d8 8d313a00 8d3134b0 nt!ExecuteHandler2+0x26
8d3134a0 82b0b352 8d3138d8 8d3134b0 00010017 nt!ExecuteHandler+0x24
8d3138bc 82a92036 8d3138d8 00000000 8d31392c nt!KiDispatchException+0x17c
8d313924 82a91fea 8d313a10 8b0d1ffe badb0d00 nt!CommonDispatchException+0x4a
8d313a10 82a8a4bc 00000000 88227590 88227590 nt!Kei386EoiHelper+0x192
8d313a28 8adb920c 85fcdd68 88227590 00000000 nt!IofCallDriver+0x63
8d313a4c 8adb93cb 8d313a6c 85fcdd68 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
8d313a84 82a8a4bc 85fcdd68 88227590 8b6f4600 fltmgr!FltpDispatch+0xc5
8d313a9c 8b6fcfce 8b71db9c 85fcdd68 88227590 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8d313b30 8adb920c 86108698 88227590 00000000 tdrpm251+0x9fce
8d313b54 8adb93cb 8d313b74 86108698 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
8d313b8c 82a8a4bc 86108698 88227590 88227590 fltmgr!FltpDispatch+0xc5
8d313ba4 8adb93e8 86f1a538 85896840 88227590 nt!IofCallDriver+0x63
8d313bd0 82a8a4bc 86f1a538 88227590 8609f024 fltmgr!FltpDispatch+0xe2
8d313be8 82c8fe47 851a5298 85896828 00000000 nt!IofCallDriver+0x63
8d313c2c 82c6f788 85896840 85896840 85896828 nt!IopDeleteFile+0x10c
8d313c44 82ab6f60 00000000 85281008 860282a0 nt!ObpRemoveObjectRoutine+0x59
8d313c58 82ab6ed0 85896840 82a890a3 00000000 nt!ObfDereferenceObjectWithTag+0x88
8d313c60 82a890a3 00000000 85281008 85896840 nt!ObfDereferenceObject+0xd
8d313c78 82ae6eb3 00000001 00000000 86c44420 nt!CcDeleteSharedCacheMap+0x131
8d313ca8 82aeeee6 8d313cc4 c96a4a52 851a13d0 nt!CcWriteBehind+0x715
8d313d00 82abbf3b 851a13d0 00000000 851b3a70 nt!CcWorkerThread+0x164
8d313d50 82c5c6d3 00000000 c96a4ac2 00000000 nt!ExpWorkerThread+0x10d
8d313d90 82b0e0f9 82abbe2e 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tdrpm251+9fce
8b6fcfce ??              ???

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  tdrpm251+9fce

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  IP_MISALIGNED

BUCKET_ID:  IP_MISALIGNED

Followup: MachineOwner
---------

Debug session time: Sat Dec 25 17:46:00.313 2010 (GMT-5)
System Uptime: 0 days 0:25:31.391
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
1: kd> !Analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 1ed3001, 0, c0802000}

Unable to load image \SystemRoot\System32\DRIVERS\cmdguard.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for cmdguard.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdguard.sys
Probably caused by : cmdguard.sys ( cmdguard+11de9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 01ed3001
Arg3: 00000000
Arg4: c0802000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 82ac7826 to 82b2dd10

STACK_TEXT:  
8eeaf9cc 82ac7826 0000001a 00041284 01ed3001 nt!KeBugCheckEx+0x1e
8eeaf9f4 82ac7a78 c0c08b4c c000f698 84e922ec nt!MiLocateWsle+0xc1
8eeafa14 82b0a947 01ed3000 85a3d568 00001eb3 nt!MiTerminateWsle+0x1f
8eeafb1c 82b04e41 01ed0000 01eecfff ca81c10d nt!MiDeleteVirtualAddresses+0x234
8eeafbb4 82a9444a ffffffff 8eeafcd8 8eeafce4 nt!NtFreeVirtualMemory+0x60b
8eeafbb4 82a92401 ffffffff 8eeafcd8 8eeafce4 nt!KiFastCallEntry+0x12a
8eeafc3c 8224d4d8 ffffffff 8eeafcd8 8eeafce4 nt!ZwFreeVirtualMemory+0x11
8eeafcdc 8224e890 00000000 00000000 00000000 win32k!SURFACE::bDeleteSurface+0x291
8eeafcf0 8222e3a3 00000000 00000000 fe652a28 win32k!SURFREF::bDeleteSurface+0x14
8eeafd04 8222fb88 480510cd 000fed18 480510cd win32k!bDeleteSurface+0x20
8eeafd18 8ac11de9 480510cd 000fed18 8eeafd34 win32k!NtGdiDeleteObjectApp+0x7f
WARNING: Stack unwind information not available. Following frames may be wrong.
8eeafd28 82a9444a 480510cd 000fed2c 771264f4 cmdguard+0x11de9
8eeafd28 771264f4 480510cd 000fed2c 771264f4 nt!KiFastCallEntry+0x12a
000fed2c 00000000 00000000 00000000 00000000 0x771264f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cmdguard+11de9
8ac11de9 ??              ???

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  cmdguard+11de9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cmdguard

IMAGE_NAME:  cmdguard.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c8aab1c

FAILURE_BUCKET_ID:  0x1a_41284_cmdguard+11de9

BUCKET_ID:  0x1a_41284_cmdguard+11de9

Followup: MachineOwner
---------

1: kd> lmtsmn
start    end        module name
90000000 9002c000   1394ohci 1394ohci.sys Mon Jul 13 19:51:59 2009 (4A5BC89F)
8ae87000 8aecf000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8ebb7000 8ebdc3a0   afcdp    afcdp.sys    Fri Sep 11 12:19:52 2009 (4AAA78A8)
90497000 904f1000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
91027000 91039000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
8afdf000 8afe8000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
91616000 9162dc80   AnyDVD   AnyDVD.sys   Sat Dec 19 13:21:59 2009 (4B2D19C7)
ad075000 ad07e000   asyncmac asyncmac.sys Mon Jul 13 19:54:46 2009 (4A5BC946)
8afb3000 8afbc000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
8afbc000 8afdf000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
82040000 8208d000   ATMFD    ATMFD.DLL    Tue Oct 19 22:58:41 2010 (4CBE5AE1)
900da000 900db800   avgio    avgio.sys    Thu Feb 22 09:57:32 2007 (45DDAF5C)
8b7ea000 8b7ff000   avgntflt avgntflt.sys Fri May 07 08:28:31 2010 (4BE4076F)
900b7000 900da000   avipbb   avipbb.sys   Thu May 27 10:11:26 2010 (4BFE7D8E)
8b62c000 8b633000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
900a9000 900b7000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
8acc8000 8acd0000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
8eb0c000 8eb25000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
82020000 8203e000   cdd      cdd.dll      Mon Jul 13 21:04:18 2009 (4A5BD992)
8b400000 8b41f000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
8ad12000 8adbd000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
8b7c5000 8b7ea000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
8acd0000 8ad12000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8ac00000 8ac3d000   cmdguard cmdguard.sys Fri Sep 10 18:03:08 2010 (4C8AAB1C)
9048d000 90497000   cmdhlp   cmdhlp.sys   Fri Sep 10 18:02:21 2010 (4C8AAAED)
8b16f000 8b1cc000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8b1f0000 8b1fd000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
9119b000 911a8000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
9002d000 90091000   csc      csc.sys      Mon Jul 13 19:15:08 2009 (4A5BBFFC)
8ea3f000 8ea64000   DefragFS DefragFS.SYS Tue Dec 15 05:18:05 2009 (4B27625D)
90091000 900a9000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8b5ee000 8b5fa000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
8b7b4000 8b7c5000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
911b3000 911bc000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
911a8000 911b3000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
911bc000 911cd000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
911cd000 911d7000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
91b3d000 91bf4000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 20:48:33 2009 (4AC54DE1)
9010f000 90148000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:25:25 2009 (4A5BC265)
90148000 90180000   e1e6032  e1e6032.sys  Tue Mar 24 14:16:11 2009 (49C9236B)
9160f000 91615b00   ElbyCDFL ElbyCDFL.sys Thu Dec 14 16:22:33 2006 (4581C099)
905fa000 905fe900   ElbyCDIO ElbyCDIO.sys Thu Dec 17 17:25:11 2009 (4B2AAFC7)
913ea000 913f5000   fdc      fdc.sys      Mon Jul 13 19:45:45 2009 (4A5BC729)
8afe8000 8aff9000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
91145000 9114f000   flpydisk flpydisk.sys Mon Jul 13 19:45:45 2009 (4A5BC729)
8adbd000 8adf1000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
8b1da000 8b1e3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
8b782000 8b7b4000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
8b569000 8b59a000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
82a1a000 82a51000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
9116b000 9117e000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
9117e000 91184480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
91160000 9116b000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
8ea87000 8eb0c000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8b77a000 8b782000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
8b3e2000 8b3fa000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
91634000 91b3d000   igdkmd32 igdkmd32.sys Wed Sep 23 15:18:09 2009 (4ABA7471)
90549000 9055e000   inspect  inspect.sys  Fri Sep 10 18:02:55 2010 (4C8AAB0F)
8af81000 8af88000   intelide intelide.sys Mon Jul 13 19:11:19 2009 (4A5BBF17)
900fd000 9010f000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
9120a000 913d0a80   IntelS51 IntelS51.sys Mon May 01 11:59:23 2006 (4456305B)
8b1e3000 8b1f0000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
91014000 91020000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80b99000 80ba1000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
901cb000 901ff000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
8b15c000 8b16f000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
8b333000 8b358000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
8ea64000 8ea74000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
8b600000 8b61b000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
8ac3f000 8acb7000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
913d1000 913de000   modem    modem.sys    Mon Jul 13 19:55:24 2009 (4A5BC96C)
9113b000 91145000   MODEMCSA MODEMCSA.sys Mon Jul 13 19:55:25 2009 (4A5BC96D)
911d7000 911e2000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
910da000 910e7000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
91187000 91192000   mouhid   mouhid.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8af9d000 8afb3000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
8b200000 8b223000   MpFilter MpFilter.sys Sat Mar 20 00:03:26 2010 (4BA4490E)
8eb25000 8eb37000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
8eb37000 8eb5a000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
8eb5a000 8eb95000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
8eb95000 8ebb0000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
90452000 9045d000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
8aed8000 8aee0000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
8b131000 8b15c000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
90400000 9040a000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8b76a000 8b77a000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
8b23e000 8b2f5000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
91051000 9105c000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
9105c000 9107e000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
9114f000 91160000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
9055e000 9056c000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
904f1000 90523000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
8b2f5000 8b333000   NETIO    NETIO.SYS    Mon Jul 13 19:12:35 2009 (4A5BBF63)
9045d000 9046b000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
905f0000 905fa000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
82a51000 82e61000   nt       ntkrpamp.exe Fri Jun 18 23:55:24 2010 (4C1C3FAC)
8b002000 8b131000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
8b625000 8b62c000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
9052a000 90549000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
8b223000 8b23b000   parport  parport.sys  Mon Jul 13 19:45:34 2009 (4A5BC71E)
8af15000 8af26000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
8ebb0000 8ebb7000   parvdm   parvdm.sys   Mon Jul 13 19:45:29 2009 (4A5BC719)
8aee0000 8af0a000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
8af96000 8af9d000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
8af88000 8af96000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
910c4000 910cf900   pcouffin pcouffin.sys Tue Dec 05 09:39:53 2006 (457584B9)
8b1cc000 8b1da000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
ae03e000 ae0d5000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
91192000 9119a800   point32  point32.sys  Tue Jun 29 04:54:24 2010 (4C29B4C0)
8acb7000 8acc8000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
ae1ad000 ae1af280   psi_mf   psi_mf.sys   Wed Sep 01 03:53:16 2010 (4C7E066C)
91039000 91051000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
9107e000 91096000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
91096000 910ad000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
910ad000 910c4000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
905af000 905f0000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
910d0000 910da000   rdpbus   rdpbus.sys   Mon Jul 13 20:02:40 2009 (4A5BCB20)
9043a000 90442000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
90442000 9044a000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
9044a000 90452000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
8b73d000 8b76a000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
8ea74000 8ea87000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
ae0d5000 ae0df000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
913f5000 913ff000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
9056c000 90586000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
8b718000 8b73cc20   snapman  snapman.sys  Tue Sep 08 03:57:17 2009 (4AA60E5D)
8b710000 8b718000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
ae15c000 ae1ad000   srv      srv.sys      Thu Aug 26 23:31:26 2010 (4C77318E)
ae10d000 ae15c000   srv2     srv2.sys     Thu Aug 26 23:30:45 2010 (4C773165)
ae0ec000 ae10d000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
905a9000 905aea00   ssmdrv   ssmdrv.sys   Tue May 05 06:05:18 2009 (4A000F5E)
910e7000 910e8380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8b420000 8b569000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
ae0df000 ae0ec000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
90482000 9048d000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
8b635000 8b70fb00   tdrpm251 tdrpm251.sys Fri Jul 31 10:00:11 2009 (4A72F8EB)
9046b000 90482000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
90599000 905a9000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
8b358000 8b3e1880   timntr   timntr.sys   Mon Aug 17 03:16:54 2009 (4A8903E6)
913de000 913ea000   tpm      tpm.sys      Mon Jul 13 19:12:52 2009 (4A5BBF74)
823e0000 823e9000   TSDDD    TSDDD.dll    unavailable (00000000)
900dc000 900fd000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
910e9000 910f7000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
91000000 91013b00   usbaudio usbaudio.sys Mon Jul 13 19:51:23 2009 (4A5BC87B)
911e2000 911f9000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
91185000 91186700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
91600000 9160f000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
910f7000 9113b000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
90180000 901cb000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
91bf4000 91bff000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
8af0a000 8af15000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
8b5e2000 8b5ee000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
9040c000 9042d000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
8b59a000 8b5a2380   vmstorfl vmstorfl.sys Mon Jul 13 19:28:44 2009 (4A5BC32C)
8af26000 8af36000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8af36000 8af81000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
8b5a3000 8b5e2000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
90586000 90599000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
9042d000 9043a000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
8ae08000 8ae79000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
8ae79000 8ae87000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
90523000 9052a000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
82180000 823cb000   win32k   win32k.sys   Tue Oct 19 23:00:01 2010 (4CBE5B31)
8aecf000 8aed8000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
8ea25000 8ea3f000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)

Unloaded modules:
ad00b000 ad075000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8b7ea000 8b7f7000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8b600000 8b60b000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8b60b000 8b614000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8b614000 8b625000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000