Hi guys,
I suffered some BSOD issues, and used driver-verifier to check out what was causing it. I got a similar bsod each time, have the dump attached. I know a driver is not behaving, but which one? Hidclass is not a driver itself is it?
Any help would be appreciated.
I'm running win 7 64 bit.
Bob
Hi, Bob and welcome to the forum. I will take a look at the dumps; but please follow the instructions in this tutorial: https://www.sevenforums.com/crashes-d...tructions.html. This will give us additional information to work with.
Your Driver Verifier enabled dump blames HIDCLASS.SYS, which is a Windows system driver and very unlikely to be the real cause. This dump does not give us much information. I suggest that you turn Verifier off for the time being. More than likely something is conflicting with HIDCLASS.SYS.
Here are a couple of things to try.
1. Disable the sandbox portion of Comodo. Normally Comodo runs well with Win 7; but right now you need to eliminate possibilities.
2. The dump shows a driver for your U46 XL USB recording interface, U46DRV.sys, as an unloaded module. This means this driver was unloaded from memory during the crash. This may or may not be significant. But since your USB subsystem was involved in the crash, I recommend that you uninstall your U64XL and see if your system runs more stable. I am not able to determine the date of the driver without additional information. However, this device is supposed to be Win 7 compatible.
As an alternative to both of the above, you can wait and see if you have another crash with Verifier turned off. If you do, upload the dumps and we will go from there. This is the best I can do without more information.
Code:Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e40e50 Debug session time: Tue Feb 22 13:49:12.662 2011 (GMT-5) System Uptime: 0 days 0:01:39.191 Loading Kernel Symbols ............................................................... ................................................................ .......................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C9, {23b, fffff88005002818, fffff98003e8ee50, 0} Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpMajorHandler+0 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9) The IO manager has caught a misbehaving driver. Arguments: Arg1: 000000000000023b, The caller has changed the status field of an IRP it does not understand. Arg2: fffff88005002818, The address in the driver's code where the error was detected. Arg3: fffff98003e8ee50, IRP address. Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0xc9_23b DRIVER_VERIFIER_IO_VIOLATION_TYPE: 23b FAULTING_IP: HIDCLASS!HidpMajorHandler+0 fffff880`05002818 48895c2410 mov qword ptr [rsp+10h],rbx FOLLOWUP_IP: HIDCLASS!HidpMajorHandler+0 fffff880`05002818 48895c2410 mov qword ptr [rsp+10h],rbx IRP_ADDRESS: fffff98003e8ee50 DEVICE_OBJECT: fffffa8003901060 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: System CURRENT_IRQL: 2 LOCK_ADDRESS: fffff80002e77400 -- (!locks fffff80002e77400) Resource @ nt!PiEngineLock (0xfffff80002e77400) Available WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted. WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted. 1 total locks PNP_TRIAGE: Lock address : 0xfffff80002e77400 Thread Count : 0 Thread address: 0x0000000000000000 Thread wait : 0x0 LAST_CONTROL_TRANSFER: from fffff800030fe3dc to fffff80002c73740 STACK_TEXT: fffff880`02fba148 fffff800`030fe3dc : 00000000`000000c9 00000000`0000023b fffff880`05002818 fffff980`03e8ee50 : nt!KeBugCheckEx fffff880`02fba150 fffff800`0310847a : fffff800`030fc9f0 fffff880`05002818 fffff980`03e8ee50 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c fffff880`02fba190 fffff800`03109483 : 00000000`0000023b 00000000`c0000010 fffff980`03e8ee50 00000000`ffffffff : nt!ViErrorFinishReport+0xda fffff880`02fba1e0 fffff800`03109b42 : fffff980`03e8ef68 fffff880`05002818 00000000`00000000 fffff800`02e00440 : nt!VfErrorReport1+0x63 fffff880`02fba280 fffff800`030fe071 : fffffa80`04aef150 00000000`00000001 00000000`00000000 fffff980`03e8ef68 : nt!ViGenericVerifyIrpStackUpward+0x62 fffff880`02fba2b0 fffff800`0310ab2d : fffffa80`0494cd40 fffffa80`04aef010 fffff980`03e8ee50 fffff980`03e8ee50 : nt!VfMajorVerifyIrpStackUpward+0x91 fffff880`02fba2f0 fffff800`0311c50d : fffff980`03e8ef68 fffff880`02fba4d0 00000000`c0000010 fffff980`03e8ef68 : nt!IovpCompleteRequest2+0xad fffff880`02fba360 fffff800`02c75d26 : fffff980`03e8ef6b fffff800`00000000 00000000`000000ff fffff880`00000005 : nt!IovpLocalCompletionRoutine+0x9d fffff880`02fba3c0 fffff800`0311419f : fffff980`03e8ee50 fffff880`0500c300 fffffa80`03901100 00000000`00000000 : nt!IopfCompleteRequest+0x3a6 fffff880`02fba4a0 fffff800`02c59e22 : fffff880`00000013 fffff880`02fba5c8 fffff980`03e8ef68 fffffa80`039011b0 : nt!IovCompleteRequest+0x19f fffff880`02fba570 fffff880`05002b17 : 00000000`00000000 fffffa80`039011b0 00000000`00000001 00000000`00000017 : nt!IopInvalidDeviceRequest+0x16 fffff880`02fba5a0 fffff880`05002903 : 00000000`00000000 fffffa80`039011b0 fffff980`03e8ee50 fffff880`02fba650 : HIDCLASS!HidpIrpMajorDefault+0x8b fffff880`02fba5e0 fffff800`0311ac16 : fffff980`00000002 fffff980`03e8ee50 00000000`00000002 00000000`00000000 : HIDCLASS!HidpMajorHandler+0xeb fffff880`02fba650 fffff800`03119d58 : fffff980`03e8ee50 fffffa80`03901060 00000000`00000000 fffffa80`04b00630 : nt!IovCallDriver+0x566 fffff880`02fba6b0 fffff800`03119e42 : fffffa80`03898080 fffffa80`019bd430 fffffa80`03898080 00000000`00000017 : nt!VfIrpSendSynchronousIrp+0xe8 fffff880`02fba720 fffff800`03106faf : fffffa80`03898970 00000000`000007ff fffff800`02db25b8 fffff800`0300b7c9 : nt!VfWmiTestStartedPdoStack+0x72 fffff880`02fba7c0 fffff800`02d27522 : fffffa80`03898970 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VfMajorTestStartedPdoStack+0x5f fffff880`02fba7f0 fffff800`0305f04c : fffffa80`03898970 fffffa80`019bd430 00000000`00000001 00000000`00000000 : nt!PpvUtilTestStartedPdoStack+0x12 fffff880`02fba820 fffff800`03060c44 : fffffa80`03898970 fffffa80`03898970 fffffa80`019bd430 00000000`00000001 : nt!PipProcessStartPhase3+0x55c fffff880`02fba910 fffff800`03061208 : fffff800`02e74d80 00000000`00000000 00000000`00000010 fffff800`03061170 : nt!PipProcessDevNodeTree+0x264 fffff880`02fbab80 fffff800`02d753c7 : 00000001`00000003 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PiProcessReenumeration+0x98 fffff880`02fbabd0 fffff800`02c80961 : fffff800`02d750a0 fffff800`03089401 fffff800`02e18500 fffffa80`0194c680 : nt!PnpDeviceActionWorker+0x327 fffff880`02fbac70 fffff800`02f167c6 : a0d0a0a8`a080a058 fffffa80`0194c680 00000000`00000080 fffffa80`01932840 : nt!ExpWorkerThread+0x111 fffff880`02fbad00 fffff800`02c51c26 : fffff880`009e6180 fffffa80`0194c680 fffff880`009f0f40 a7b0a788`a760a738 : nt!PspSystemThreadStartup+0x5a fffff880`02fbad40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: .bugcheck ; kb SYMBOL_NAME: HIDCLASS!HidpMajorHandler+0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: HIDCLASS IMAGE_NAME: HIDCLASS.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcbfd FAILURE_BUCKET_ID: X64_0xc9_23b_VRF_HIDCLASS!HidpMajorHandler+0 BUCKET_ID: X64_0xc9_23b_VRF_HIDCLASS!HidpMajorHandler+0 Followup: MachineOwner ---------
Last edited by CarlTR6; 22 Feb 2011 at 15:39.
Hi,
and thanks for the help so far. I looked at the instructions and have now attached a zip with all the info. However, I tried running perfmon /report and it gave me an error: cannot find location specified. I also ran sfc /scannow and it didn't indicate any problems.
Any ideas?
rgds,
Bob
btw the dumps from today and yesterday were with verifier turned off.
Bumping this... anyone got an idea? Or am I stuck with installing all over?
Hi, Bob, thanks for uploading the files. I am sorry I missed it earlier. I looked at your five most recent dumps. Four of the dumps blame Windows system files and drivers and one blames symsnap.sys, a StorageCraft Volume Snap-Shot Development Edition driver. All of the dumps show memory corruption.
1. I recommend that you make sure your Win 7 is updated through Windows Update. Install SP1: http://windows.microsoft.com/en-US/w...ice-pack-1-sp1Bugcheck 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.
Bugcheck A, (4X)IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility.
2. Update this driver through the link providedReboot and see how your system does. If you get another BSOD, upload the dumps and follow steps 3 & 4 below.Rt64win7.sys 22-5-2009 - Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC. Realtek.
3. Since one of your dumps directly blames the StorageCraft Volume driver, rather uninstalling it, I suggest that you try renaming symsnap.sys to symsnap.old. Create a restore point. Using Windows Explorer, navigate to C:\Windows\System32\Drivers, locate symsnap.sys and rename it. Reboot and symsnap will not load. This will break StorageCraft Volume; but it is easily reversible.
4. I also recommend that your run Memtest86 to test your RAM. Follow the instructions in this tutorial: RAM - Test with Memtest86+. Let Memtest run for at least seven passes. This may take 6-8 hours. If you see any errors, you can stop the test. Post back with your results.
Code:Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03a17000 PsLoadedModuleList = 0xfffff800`03c54e50 Debug session time: Thu Feb 24 06:30:20.136 2011 (GMT-5) System Uptime: 0 days 0:00:56.666 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {1fffff840, 2, 1, fffff80003a8bcd8} Unable to load image \SystemRoot\system32\DRIVERS\symsnap.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for symsnap.sys *** ERROR: Module load completed but symbols could not be loaded for symsnap.sys Probably caused by : symsnap.sys ( symsnap+eab6 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 00000001fffff840, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80003a8bcd8, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cbf0e0 00000001fffff840 CURRENT_IRQL: 2 FAULTING_IP: nt!KiTryUnwaitThread+28 fffff800`03a8bcd8 f0480fba6b4000 lock bts qword ptr [rbx+40h],0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: AtBroker.exe TRAP_FRAME: fffff88005bf2a70 -- (.trap 0xfffff88005bf2a70) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff88005bf33d8 rbx=0000000000000000 rcx=fffff880009e6180 rdx=fffffa8000000204 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80003a8bcd8 rsp=fffff88005bf2c00 rbp=fffff88005bf2db0 r8=0000000000000100 r9=0000000000000000 r10=0000000000000002 r11=fffffa80056bc170 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!KiTryUnwaitThread+0x28: fffff800`03a8bcd8 f0480fba6b4000 lock bts qword ptr [rbx+40h],0 ds:00000000`00000040=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003a86ca9 to fffff80003a87740 STACK_TEXT: fffff880`05bf2928 fffff800`03a86ca9 : 00000000`0000000a 00000001`fffff840 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`05bf2930 fffff800`03a85920 : fffff880`05bf2c30 00000001`fffff800 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69 fffff880`05bf2a70 fffff800`03a8bcd8 : fffffa80`05852070 fffff8a0`00000000 00000000`00010000 fffff8a0`02ce0000 : nt!KiPageFault+0x260 fffff880`05bf2c00 fffff800`03b02f74 : fffffa80`057cf9e0 fffff880`05bf2db0 00000000`00000000 00000000`00000000 : nt!KiTryUnwaitThread+0x28 fffff880`05bf2c60 fffff800`03a640b7 : fffffffd`00000000 fffffa80`0583bc30 fffffa80`0583bc00 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x3ca30 fffff880`05bf2d30 fffff800`03a64477 : fffffa80`044480f8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7 fffff880`05bf2db0 fffff800`03a7de6b : 00000000`00000000 fffff800`03c13b40 00000000`00000000 fffff6fc`50016748 : nt!KiApcInterrupt+0xd7 fffff880`05bf2f40 fffff880`012ba948 : fffffa80`0586dad8 fffff8a0`0461d780 fffff880`05bf3340 fffff800`03cc1840 : nt!ExAcquireResourceSharedLite+0x8b fffff880`05bf2fb0 fffff880`012bb906 : fffff880`05bf3130 fffffa80`0586d6f0 fffff880`00001fc4 fffffa80`00001fc4 : Ntfs!NtfsCommonQueryInformation+0x158 fffff880`05bf3090 fffff880`012bbea4 : fffff880`05bf3130 fffffa80`0586d6f0 fffffa80`0586db20 00000000`00000000 : Ntfs!NtfsFsdDispatchSwitch+0x106 fffff880`05bf3110 fffff880`0107723f : fffff880`05bf33b0 fffff880`01076be9 fffff880`05bf3300 fffffa80`00000005 : Ntfs!NtfsFsdDispatchWait+0x14 fffff880`05bf3300 fffff880`010756df : fffffa80`04a027a0 fffffa80`04a048b0 fffffa80`04a02700 fffffa80`00000200 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`05bf3390 fffff880`010e2ab6 : fffffa80`0586d6f0 00000000`00000000 00000000`00000009 fffffa80`0586d6f0 : fltmgr!FltpDispatch+0xcf fffff880`05bf33f0 fffffa80`0586d6f0 : 00000000`00000000 00000000`00000009 fffffa80`0586d6f0 fffffa80`04a04760 : symsnap+0xeab6 fffff880`05bf33f8 00000000`00000000 : 00000000`00000009 fffffa80`0586d6f0 fffffa80`04a04760 fffffa80`0586d6f0 : 0xfffffa80`0586d6f0 STACK_COMMAND: kb FOLLOWUP_IP: symsnap+eab6 fffff880`010e2ab6 ?? ??? SYMBOL_STACK_INDEX: d SYMBOL_NAME: symsnap+eab6 FOLLOWUP_NAME: MachineOwner MODULE_NAME: symsnap IMAGE_NAME: symsnap.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ab000d3 FAILURE_BUCKET_ID: X64_0xA_symsnap+eab6 BUCKET_ID: X64_0xA_symsnap+eab6 Followup: MachineOwner --------- Debug session time: Thu Feb 24 05:52:24.889 2011 (GMT-5) System Uptime: 0 days 0:02:51.419 Loading Kernel Symbols ............................................................... ................................................................ ............................ Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff80003a8b8fb, 0, ffffffffffffffff} Probably caused by : ntkrnlmp.exe ( nt!KiDispatchException+1b9 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80003a8b8fb, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: ffffffffffffffff, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!memset+6b fffff800`03a8b8fb c20000 ret 0 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003cc10e0 ffffffffffffffff CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x1E PROCESS_NAME: PING.EXE CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff88005ecb1a8 -- (.exr 0xfffff88005ecb1a8) ExceptionAddress: fffff80003a8b8fb (nt!memset+0x000000000000006b) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff TRAP_FRAME: fffff88005ecb250 -- (.trap 0xfffff88005ecb250) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8003d07b80 rbx=0000000000000000 rcx=fffffa8003d07ff8 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80003a8b8fb rsp=fffff88005ecb3e8 rbp=0000000000000400 r8=0000000000000000 r9=0000000000000000 r10=fffff80003c18888 r11=fffffa8003d9c000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!memset+0x6b: fffff800`03a8b8fb c20000 ret 0 Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003ac3a39 to fffff80003a89740 STACK_TEXT: fffff880`05eca9d8 fffff800`03ac3a39 : 00000000`0000001e ffffffff`c0000005 fffff800`03a8b8fb 00000000`00000000 : nt!KeBugCheckEx fffff880`05eca9e0 fffff800`03a88d82 : fffff880`05ecb1a8 fffffa80`03d07b80 fffff880`05ecb250 00000000`0000000d : nt!KiDispatchException+0x1b9 fffff880`05ecb070 fffff800`03a8768a : fffff880`05ecb590 00000000`00000000 00000000`000001c8 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`05ecb250 fffff800`03a8b8fb : 0050a000`0000ff00 00000000`00000000 00000000`00000000 fffffa80`048b76a0 : nt!KiGeneralProtectionFault+0x10a fffff880`05ecb3e8 0050a000`0000ff00 : 00000000`00000000 00000000`00000000 fffffa80`048b76a0 00000000`000007ff : nt!memset+0x6b fffff880`05ecb3f0 00000000`00000000 : 00000000`00000000 fffffa80`048b76a0 00000000`000007ff fffff8a0`0000ccb8 : 0x50a000`0000ff00 STACK_COMMAND: kb FOLLOWUP_IP: nt!KiDispatchException+1b9 fffff800`03ac3a39 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!KiDispatchException+1b9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd FAILURE_BUCKET_ID: X64_0x1E_nt!KiDispatchException+1b9 BUCKET_ID: X64_0x1E_nt!KiDispatchException+1b9 Followup: MachineOwner --------- 1: kd> lmtsmn start end module name fffff880`00f4d000 fffff880`00fa4000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106) fffff880`02c30000 fffff880`02cba000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`03ca2000 fffff880`03cb8000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0) fffff880`00dd0000 fffff880`00ddb000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB) fffff880`045e8000 fffff880`045f0000 ASACPI ASACPI.sys Wed May 13 21:25:17 2009 (4A0B72FD) fffff880`00e8d000 fffff880`00e96000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00da6000 fffff880`00dd0000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118) fffff880`04b3d000 fffff880`04b5f000 AtiHdmi AtiHdmi.sys Tue Mar 09 05:08:38 2010 (4B961E26) fffff880`03cbc000 fffff880`04366000 atikmdag atikmdag.sys Tue Apr 06 21:47:17 2010 (4BBBE425) fffff880`03a6b000 fffff880`03aa1000 atikmpag atikmpag.sys Tue Apr 06 21:23:30 2010 (4BBBDE92) fffff880`019eb000 fffff880`019f2000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D) fffff880`03a1e000 fffff880`03a2f000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF) fffff880`06124000 fffff880`06142000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206) fffff960`00750000 fffff960`00777000 cdd cdd.dll unavailable (00000000) fffff880`01976000 fffff880`019a0000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`00cbc000 fffff880`00d7c000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D) fffff880`01907000 fffff880`01937000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00c5e000 fffff880`00cbc000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`0196d000 fffff880`01976000 cmderd cmderd.sys Fri Sep 10 18:07:24 2010 (4C8AAC1C) fffff880`019a0000 fffff880`019e2000 cmdguard cmdguard.sys Fri Sep 10 18:07:10 2010 (4C8AAC0E) fffff880`01897000 fffff880`018a2000 cmdhlp cmdhlp.sys Fri Sep 10 18:06:39 2010 (4C8AABEF) fffff880`01000000 fffff880`01073000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814) fffff880`043c9000 fffff880`043d9000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`06000000 fffff880`06009000 cpuz133_x64 cpuz133_x64.sys Tue Mar 30 17:34:16 2010 (4BB26E58) fffff880`053ab000 fffff880`053b9000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD) fffff880`03b64000 fffff880`03be7000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A) fffff880`03a00000 fffff880`03a1e000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200) fffff880`03b55000 fffff880`03b64000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E) fffff880`018f1000 fffff880`01907000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`03c3d000 fffff880`03c5f000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5) fffff880`053c5000 fffff880`053ce000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`053b9000 fffff880`053c5000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`053ce000 fffff880`053e1000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F) fffff880`04b86000 fffff880`04b92000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff880`044d6000 fffff880`045ca000 dxgkrnl dxgkrnl.sys Tue Jan 25 23:22:56 2011 (4D3FA1A0) fffff880`04400000 fffff880`04446000 dxgmms1 dxgmms1.sys Tue Jan 25 23:22:12 2011 (4D3FA174) fffff880`07342000 fffff880`07378000 fastfat fastfat.SYS Mon Jul 13 19:23:28 2009 (4A5BC1F0) fffff880`045db000 fffff880`045e8000 fdc fdc.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`01121000 fffff880`01135000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481) fffff880`04b1d000 fffff880`04b28000 flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6) fffff880`010d5000 fffff880`01121000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F) fffff880`013f3000 fffff880`013fd000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111) fffff880`018b7000 fffff880`018f1000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2) fffff880`01400000 fffff880`0144a000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164) fffff880`043bc000 fffff880`043c9000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0) fffff880`043d9000 fffff880`043ec000 GenericMount GenericMount.sys Fri Aug 28 18:59:50 2009 (4A986166) fffff800`03ff6000 fffff800`0403f000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08) fffff880`04446000 fffff880`0446a000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5) fffff880`04b5f000 fffff880`04b78000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD) fffff880`0520e000 fffff880`05216080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9) fffff880`05200000 fffff880`0520e000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE) fffff880`0605c000 fffff880`06124000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8) fffff880`01474000 fffff880`0147d000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA) fffff880`02d2e000 fffff880`02d46000 inspect inspect.sys Fri Sep 10 18:07:36 2010 (4C8AAC28) fffff880`03a55000 fffff880`03a6b000 intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD) fffff880`03be7000 fffff880`03bf6000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`04b78000 fffff880`04b86000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff800`00b98000 fffff800`00b9b000 kdcom kdcom.dll Thu Feb 17 06:33:32 2011 (4D5D078C) fffff880`03c5f000 fffff880`03ca2000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9) fffff880`013c8000 fffff880`013e2000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156) fffff880`015d0000 fffff880`015fb000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4) fffff880`044cd000 fffff880`044d2200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93) fffff880`04a21000 fffff880`04a36000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`04bd8000 fffff880`04bfb000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295) fffff880`04b92000 fffff880`04ba2000 LUsbFilt LUsbFilt.Sys Thu Mar 18 04:51:28 2010 (4BA1E990) fffff880`00c06000 fffff880`00c4a000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66) fffff880`04bca000 fffff880`04bd8000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C) fffff880`02c00000 fffff880`02c0f000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`04ba2000 fffff880`04baf000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff880`00d8c000 fffff880`00da6000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`06142000 fffff880`0615a000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79) fffff880`0615a000 fffff880`06187000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33) fffff880`06187000 fffff880`061d5000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C) fffff880`061d5000 fffff880`061f8000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A) fffff880`01850000 fffff880`0185b000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00fad000 fffff880`00fb7000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE) fffff880`01163000 fffff880`011c1000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C) fffff880`03b4a000 fffff880`03b55000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE) fffff880`01462000 fffff880`01474000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201) fffff880`0147e000 fffff880`01570000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`0438a000 fffff880`04396000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8) fffff880`03aa1000 fffff880`03ad0000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04b28000 fffff880`04b3d000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD) fffff880`02d46000 fffff880`02d55000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff880`02cba000 fffff880`02cff000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178) fffff880`01570000 fffff880`015d0000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A) fffff880`0185b000 fffff880`0186c000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`03b3e000 fffff880`03b4a000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E) fffff800`03a19000 fffff800`03ff6000 nt ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD) fffff880`01225000 fffff880`013c8000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F) fffff880`019e2000 fffff880`019eb000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109) fffff880`02d08000 fffff880`02d2e000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5) fffff880`00e00000 fffff880`00e15000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00fb7000 fffff880`00fea000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`00e86000 fffff880`00e8d000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115) fffff880`00d7c000 fffff880`00d8c000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`013e2000 fffff880`013f3000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF) fffff880`066d6000 fffff880`0677c000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF) fffff880`03c00000 fffff880`03c3d000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03) fffff880`00c4a000 fffff880`00c5e000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027) fffff880`04366000 fffff880`0438a000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04396000 fffff880`043b1000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9) fffff880`02dd2000 fffff880`02df3000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA) fffff880`03ad0000 fffff880`03aea000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1) fffff880`03aed000 fffff880`03b3e000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219) fffff880`043b1000 fffff880`043bc000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA) fffff880`01835000 fffff880`0183e000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`0183e000 fffff880`01847000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`01847000 fffff880`01850000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63) fffff880`011c1000 fffff880`011fb000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A) fffff880`04a36000 fffff880`04a4e000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`02db8000 fffff880`02dd2000 SCDEmu SCDEmu.SYS Sun Nov 08 22:27:29 2009 (4AF78C21) fffff880`0677c000 fffff880`06787000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E) fffff880`045f0000 fffff880`045fc000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`02d55000 fffff880`02d72000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8) fffff880`0145a000 fffff880`01462000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB) fffff880`072a9000 fffff880`0733f000 srv srv.sys Thu Aug 26 23:38:00 2010 (4C773318) fffff880`06600000 fffff880`06667000 srv2 srv2.sys Thu Aug 26 23:37:46 2010 (4C77330A) fffff880`06787000 fffff880`067b4000 srvnet srvnet.sys Thu Aug 26 23:37:24 2010 (4C7732F4) fffff880`044d3000 fffff880`044d4480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92) fffff880`01135000 fffff880`01163000 symsnap symsnap.sys Tue Sep 15 17:02:11 2009 (4AB000D3) fffff880`01602000 fffff880`017ff000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458) fffff880`067b4000 fffff880`067c6000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD) fffff880`0188a000 fffff880`01897000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E) fffff880`0186c000 fffff880`0188a000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B) fffff880`02da4000 fffff880`02db8000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64) fffff960`00490000 fffff960`0049a000 TSDDD TSDDD.dll Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`03a2f000 fffff880`03a55000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1) fffff880`02d8d000 fffff880`02d9f000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20) fffff880`04baf000 fffff880`04bc9c00 usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`053e1000 fffff880`053fe000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15) fffff880`053fe000 fffff880`053fff00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF) fffff880`045ca000 fffff880`045db000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`04ac3000 fffff880`04b1d000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D) fffff880`04477000 fffff880`044cd000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`0446a000 fffff880`04477000 usbuhci usbuhci.sys Mon Jul 13 20:06:27 2009 (4A5BCC03) fffff880`00fea000 fffff880`00ff7000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB) fffff880`019f2000 fffff880`01a00000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`05220000 fffff880`053ab000 viahduaa viahduaa.sys Thu May 07 23:24:59 2009 (4A03A60B) fffff880`01800000 fffff880`01825000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B) fffff880`0144a000 fffff880`0145a000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E) fffff880`00e15000 fffff880`00e2a000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`00e2a000 fffff880`00e86000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141) fffff880`01073000 fffff880`010bf000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128) fffff880`043ec000 fffff880`043fd380 vrtaucbl vrtaucbl.sys Mon Feb 15 12:06:55 2010 (4B797F2F) fffff880`02d72000 fffff880`02d8d000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED) fffff880`01825000 fffff880`01835000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F) fffff880`00e9a000 fffff880`00f3e000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F) fffff880`00f3e000 fffff880`00f4d000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`02cff000 fffff880`02d08000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff960`00090000 fffff960`003a0000 win32k win32k.sys Tue Jan 04 22:59:44 2011 (4D23ECB0) fffff880`03bf6000 fffff880`03bfad00 WmBEnum WmBEnum.sys Tue Apr 27 16:10:19 2010 (4BD744AB) fffff880`00fa4000 fffff880`00fad000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`0733f000 fffff880`07341500 WmVirHid WmVirHid.sys Tue Apr 27 16:08:53 2010 (4BD74455) fffff880`02c0f000 fffff880`02c20480 WmXlCore WmXlCore.sys Tue Apr 27 16:09:26 2010 (4BD74476) fffff880`04a00000 fffff880`04a21000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1) Unloaded modules: fffff880`07378000 fffff880`07382000 LNonPnP.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01937000 fffff880`01945000 crashdmp.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01945000 fffff880`01951000 dump_ataport Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`01951000 fffff880`0195a000 dump_atapi.s Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`0195a000 fffff880`0196d000 dump_dumpfve Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`04366000 fffff880`043bc000 Rt64win7.sys Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`02da2000 fffff880`02da4000 USBD.SYS Timestamp: unavailable (00000000) Checksum: 00000000 fffff880`02d8d000 fffff880`02da2000 U46DRV.sys Timestamp: unavailable (00000000) Checksum: 00000000
Quote