Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121311-12807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a0a000 PsLoadedModuleList = 0xfffff800`01c4f670
Debug session time: Mon Dec 12 16:31:05.795 2011 (UTC - 7:00)
System Uptime: 0 days 1:25:04.575
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {7, 95571, 1, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3824b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 0000000000095571, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80001af8140 to fffff80001a86c40
STACK_TEXT:
fffff880`0ab3c908 fffff800`01af8140 : 00000000`0000004e 00000000`00000007 00000000`00095571 00000000`00000001 : nt!KeBugCheckEx
fffff880`0ab3c910 fffff800`01aae6cf : fffffa80`043fae90 fffff880`0ab3ca80 fffffa80`05561ec8 fffffa80`043fae00 : nt! ?? ::FNODOBFM::`string'+0x3824b
fffff880`0ab3c9f0 fffff800`01a9502a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff800`00000000 : nt!MiIssueHardFault+0x28b
fffff880`0ab3cac0 fffff800`01a84d6e : 00000000`00000000 00000000`00290ff8 00000000`00000001 00000000`752e2828 : nt!MmAccessFault+0x146a
fffff880`0ab3cc20 000007fe`ff3a117a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0296e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ff3a117a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+3824b
fffff800`01af8140 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+3824b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x4E_7_nt!_??_::FNODOBFM::_string_+3824b
BUCKET_ID: X64_0x4E_7_nt!_??_::FNODOBFM::_string_+3824b
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121311-12807-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a09000 PsLoadedModuleList = 0xfffff800`01c4e670
Debug session time: Mon Dec 12 18:04:22.069 2011 (UTC - 7:00)
System Uptime: 0 days 1:31:33.725
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80001a8fa8e, fffff8800c6e9100, 0}
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+c4 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001a8fa8e, Address of the instruction which caused the bugcheck
Arg3: fffff8800c6e9100, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObfDereferenceObject+6e
fffff800`01a8fa8e 6683b8c601000000 cmp word ptr [rax+1C6h],0
CONTEXT: fffff8800c6e9100 -- (.cxr 0xfffff8800c6e9100)
rax=0000000100001f80 rbx=0000000000000000 rcx=fffff8a00c92fe30
rdx=fffff8a00c92fe30 rsi=fffff8a00c92fe30 rdi=fffff8a00c92fe00
rip=fffff80001a8fa8e rsp=fffff8800c6e9ae0 rbp=fffffa80059acb30
r8=0000000000000000 r9=0000000000000001 r10=0000000000000214
r11=fffff8800c6e9ab0 r12=fffff8a00c92fe00 r13=fffffa80059acb30
r14=0000000002c4ee00 r15=fffff8a002806920
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ObfDereferenceObject+0x6e:
fffff800`01a8fa8e 6683b8c601000000 cmp word ptr [rax+1C6h],0 ds:002b:00000001`00002146=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80001d7cf44 to fffff80001a8fa8e
STACK_TEXT:
fffff880`0c6e9ae0 fffff800`01d7cf44 : fffffa80`059acb30 00000000`00000000 fffffa80`05abfb60 00000000`00000000 : nt!ObfDereferenceObject+0x6e
fffff880`0c6e9b40 fffff800`01d7d4f4 : 00000000`00000214 fffffa80`059acb30 fffff8a0`02806920 00000000`00000214 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`0c6e9bd0 fffff800`01a84ed3 : fffffa80`05abfb60 fffff880`0c6e9ca0 00000000`7efa4000 00000000`00000004 : nt!ObpCloseHandle+0x94
fffff880`0c6e9c20 00000000`77bd140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c4e4f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bd140a
FOLLOWUP_IP:
nt!ObpCloseHandleTableEntry+c4
fffff800`01d7cf44 33c0 xor eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObpCloseHandleTableEntry+c4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff8800c6e9100 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ObpCloseHandleTableEntry+c4
BUCKET_ID: X64_0x3B_nt!ObpCloseHandleTableEntry+c4
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121511-42666-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a17000 PsLoadedModuleList = 0xfffff800`01c5c670
Debug session time: Wed Dec 14 23:37:27.836 2011 (UTC - 7:00)
System Uptime: 0 days 17:53:28.601
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {80000003, fffff88001139730, fffff8800b1bedc0, 0}
Probably caused by : fileinfo.sys ( fileinfo!FltGetStreamContext+6 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff88001139730, Address of the instruction which caused the bugcheck
Arg3: fffff8800b1bedc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
FAULTING_IP:
fileinfo!FltGetStreamContext+6
fffff880`01139730 cc int 3
CONTEXT: fffff8800b1bedc0 -- (.cxr 0xfffff8800b1bedc0)
rax=0000000000000000 rbx=fffffa8006302f20 rcx=fffffa80041f5bb0
rdx=fffffa8006302f20 rsi=fffffa8007c7e1e0 rdi=0000000000000000
rip=fffff88001139730 rsp=fffff8800b1bf7a8 rbp=fffff8800b1bf850
r8=fffff8800b1bf838 r9=0000000000000000 r10=fffffffffffffe36
r11=fffff8800b1bf8c8 r12=0000000000000000 r13=fffffa8007c7e1e0
r14=fffff8800b1bf8d8 r15=fffff8800b1bfa40
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
fileinfo!FltGetStreamContext+0x6:
fffff880`01139730 cc int 3
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: msiexec.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88001139730
STACK_TEXT:
fffff880`0b1bf7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fileinfo!FltGetStreamContext+0x6
FOLLOWUP_IP:
fileinfo!FltGetStreamContext+6
fffff880`01139730 cc int 3
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fileinfo!FltGetStreamContext+6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481
STACK_COMMAND: .cxr 0xfffff8800b1bedc0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_fileinfo!FltGetStreamContext+6
BUCKET_ID: X64_0x3B_fileinfo!FltGetStreamContext+6
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121511-13197-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a0b000 PsLoadedModuleList = 0xfffff800`01c50670
Debug session time: Thu Dec 15 12:00:53.237 2011 (UTC - 7:00)
System Uptime: 0 days 9:46:06.018
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 6f8, 691fb75c}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: 00000000691fb75c
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80001a871e9 to fffff80001a87c40
STACK_TEXT:
fffff800`03449d28 fffff800`01a871e9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff800`03449d30 fffff800`01a856b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`03449e70 00000000`691fb75c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
00000000`0040ca18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x691fb75c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDoubleFaultAbort+b2
fffff800`01a856b2 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDoubleFaultAbort+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121711-14305-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a0f000 PsLoadedModuleList = 0xfffff800`01c54670
Debug session time: Sat Dec 17 02:15:18.784 2011 (UTC - 7:00)
System Uptime: 1 days 12:35:17.565
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {403, fffff68000010cc0, 1e00000cb546025, fffff68000059400}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+330bc )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000010cc0
Arg3: 01e00000cb546025
Arg4: fffff68000059400
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_403
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MCULauncher.ex
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80001a333f6 to fffff80001a8bc40
STACK_TEXT:
fffff880`0d848678 fffff800`01a333f6 : 00000000`0000001a 00000000`00000403 fffff680`00010cc0 01e00000`cb546025 : nt!KeBugCheckEx
fffff880`0d848680 fffff800`01abdbb7 : 00000000`00000000 fffff680`00010da8 fffffa80`05e2e060 fffff800`01abfca4 : nt! ?? ::FNODOBFM::`string'+0x330bc
fffff880`0d848830 fffff800`01abf569 : 00000000`00000000 00000000`021b6fff fffffa80`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0d8489f0 fffff800`01da3221 : fffffa80`0546aa90 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0d848b10 fffff800`01da3623 : 00000000`00000000 00000000`02180000 fffffa80`00000001 fffffa80`0603fa20 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0d848bd0 fffff800`01a8aed3 : ffffffff`ffffffff 00000000`0008e320 fffffa80`05e2e060 00000000`00008000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0d848c20 00000000`774915ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774915ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+330bc
fffff800`01a333f6 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+330bc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_403_nt!_??_::FNODOBFM::_string_+330bc
BUCKET_ID: X64_0x1a_403_nt!_??_::FNODOBFM::_string_+330bc
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121711-11809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a4d000 PsLoadedModuleList = 0xfffff800`01c92670
Debug session time: Sat Dec 17 06:54:53.582 2011 (UTC - 7:00)
System Uptime: 0 days 4:38:45.222
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80001ac1b65, 0, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80001ac1b65, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`01ac1b65 498b08 mov rcx,qword ptr [r8]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001cfc100
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: ZoomBrowser.ex
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80001b15588 to fffff80001ac9c40
STACK_TEXT:
fffff880`0a97d098 fffff800`01b15588 : 00000000`0000001e ffffffff`c0000005 fffff800`01ac1b65 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a97d0a0 fffff800`01ac92c2 : fffff880`0a97d878 00000000`00000000 fffff880`0a97d920 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0a97d740 fffff800`01ac7bca : fffffa80`01081ad0 fffff800`01aeffc0 00000000`00000000 fffff6fb`82200708 : nt!KiExceptionDispatch+0xc2
fffff880`0a97d920 fffff800`01ac1b65 : 00000000`00000000 fffff800`01ad759c 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`0a97dab0 fffff800`01ad759c : 00000000`00000000 00000000`00000000 fffff700`01080000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0a97dac0 fffff800`01ac7d6e : 00000000`00000001 00000000`3836f000 00000000`00000001 00000000`07e1f560 : nt!MmAccessFault+0x9dc
fffff880`0a97dc20 00000000`04a1af9d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`07e1f458 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x4a1af9d
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`01ac1b65 498b08 mov rcx,qword ptr [r8]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x1E_c0000005_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121811-12698-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a5b000 PsLoadedModuleList = 0xfffff800`01ca0670
Debug session time: Sun Dec 18 07:01:48.798 2011 (UTC - 7:00)
System Uptime: 0 days 16:21:49.348
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, ac0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46485 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000ac0
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41287
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: ZoomBrowser.ex
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c7e8920 -- (.trap 0xfffff8800c7e8920)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000425ca0005 rbx=0000000000000000 rcx=fffffa80039016e0
rdx=0000000000000ac1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001acfb65 rsp=fffff8800c7e8ab0 rbp=fffff8800c7e8b40
r8=0000000000000ac0 r9=0000000000000000 r10=fffffa80039016e0
r11=fffff8800c7e8c20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!ExpInterlockedPopEntrySListFault16:
fffff800`01acfb65 498b08 mov rcx,qword ptr [r8] ds:8010:00000000`00000ac0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001a6ad7e to fffff80001ad7c40
STACK_TEXT:
fffff880`0c7e87b8 fffff800`01a6ad7e : 00000000`0000001a 00000000`00041287 00000000`00000ac0 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c7e87c0 fffff800`01ad5d6e : 00000000`00000000 00000000`00000ac0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x46485
fffff880`0c7e8920 fffff800`01acfb65 : 00000000`00000000 fffff800`01ae559c 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0c7e8ab0 fffff800`01ae559c : 00000000`00000000 00000000`00000000 fffff700`01080000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0c7e8ac0 fffff800`01ad5d6e : 00000000`00000001 00000000`0a7bb000 00000000`00000001 00000000`07e1f580 : nt!MmAccessFault+0x9dc
fffff880`0c7e8c20 00000000`04b4af9d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`07e1f478 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x4b4af9d
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46485
fffff800`01a6ad7e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46485
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\121911-11871-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a50000 PsLoadedModuleList = 0xfffff800`01c95670
Debug session time: Mon Dec 19 00:00:42.009 2011 (UTC - 7:00)
System Uptime: 0 days 0:12:06.790
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, 80, 0, 0}
Probably caused by : win32k.sys ( win32k!memcpy+bd )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000080
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41287
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c37ca40 -- (.trap 0xfffff8800c37ca40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffb0b5b2ffa9adac rbx=0000000000000000 rcx=0000000002765020
rdx=fffff900bf9e8764 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000c4ccd rsp=fffff8800c37cbd8 rbp=fffff8800c37ccb0
r8=00000000000001fc r9=000000000000000a r10=ffbec3c2ffb8bdbb
r11=0000000002764f60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
win32k!memcpy+0xbd:
fffff960`000c4ccd 488941e0 mov qword ptr [rcx-20h],rax ds:2418:00000000`02765000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001a5fd7e to fffff80001accc40
STACK_TEXT:
fffff880`0c37c5d8 fffff800`01a5fd7e : 00000000`0000001a 00000000`00041287 00000000`00000080 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c37c5e0 fffff800`01acad6e : 00000000`00000000 00000000`00000080 fffffa80`059b7f00 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x46485
fffff880`0c37c740 fffff800`01ac4b65 : 00000000`00000000 fffff800`01ada59c 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0c37c8d0 fffff800`01ada59c : 00000000`00000000 00000000`00000000 fffff700`01080000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
fffff880`0c37c8e0 fffff800`01acad6e : 00000000`00000001 00000000`02765000 00000000`00000000 fffff900`c214d6c4 : nt!MmAccessFault+0x9dc
fffff880`0c37ca40 fffff960`000c4ccd : fffff960`0008c6c9 fffff880`015d2128 00000000`00000000 00000000`0000099c : nt!KiPageFault+0x16e
fffff880`0c37cbd8 fffff960`0008c6c9 : fffff880`015d2128 00000000`00000000 00000000`0000099c fffff880`015db6e4 : win32k!memcpy+0xbd
fffff880`0c37cbe0 fffff960`000867f8 : 00000000`00000001 fffff880`0c37d2f8 00000000`00000000 fffff880`0c37d044 : win32k!vSrcCopyS32D32Identity+0x71
fffff880`0c37cc10 fffff960`001f9683 : fffff900`c1ef0cd8 fffff900`c2143018 fffff880`0c37d040 fffff900`c1ef53d0 : win32k!EngCopyBits+0x908
fffff880`0c37cf20 fffff960`001e9a64 : fffff900`c00bf010 00000000`00000001 00000000`00000001 fffff900`c0088740 : win32k!BLTRECORD::bBitBlt+0x697
fffff880`0c37d110 fffff960`001fc668 : fffffa80`058a7b30 fffffa80`058a7e00 00000000`00000000 fffff960`000c6ffb : win32k!GreStretchBltInternal+0xa14
fffff880`0c37d3b0 fffff800`01acbed3 : ffffffff`b2050c5f 00000000`0185000f fffff900`c3076390 00000000`52050c86 : win32k!NtGdiStretchBlt+0x68
fffff880`0c37d430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!memcpy+bd
fffff960`000c4ccd 488941e0 mov qword ptr [rcx-20h],rax
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32k!memcpy+bd
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
FAILURE_BUCKET_ID: X64_0x1a_41287_win32k!memcpy+bd
BUCKET_ID: X64_0x1a_41287_win32k!memcpy+bd
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\122211-11965-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a68000 PsLoadedModuleList = 0xfffff800`01cad670
Debug session time: Wed Dec 21 16:11:47.117 2011 (UTC - 7:00)
System Uptime: 1 days 0:04:45.773
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck FE, {8, 6, a, fffffa8004ca4000}
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbport!_DEVICE_EXTENSION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
Probably caused by : usbhub.sys ( usbhub!UsbhHubProcessChangeWorker+ec )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 0000000000000008, USBBUGCODE_RESERVED_USBHUB
Arg2: 0000000000000006, USBHUB_TRAP_FATAL_TIMEOUT
Arg3: 000000000000000a, TimeoutCode
Arg4: fffffa8004ca4000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbport!_DEVICE_EXTENSION ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbhub!_DEVICE_EXTENSION_HUB ***
*** ***
*************************************************************************
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xFE
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff880062e6a60 to fffff80001ae4c40
STACK_TEXT:
fffff880`0acc2c18 fffff880`062e6a60 : 00000000`000000fe 00000000`00000008 00000000`00000006 00000000`0000000a : nt!KeBugCheckEx
fffff880`0acc2c20 fffff800`01ddb9e3 : fffffa80`049f3050 00000000`00000001 ffffffff`dc3a58a0 fffff800`01c852b8 : usbhub!UsbhHubProcessChangeWorker+0xec
fffff880`0acc2c80 fffff800`01aef001 : fffff800`01c85200 fffff800`01ddb901 fffffa80`062e1700 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`0acc2cb0 fffff800`01d7ffee : 00000030`485fcd81 fffffa80`062e17b0 00000000`00000080 fffffa80`03a32890 : nt!ExpWorkerThread+0x111
fffff880`0acc2d40 fffff800`01ad65e6 : fffff800`01c5ae80 fffffa80`062e17b0 fffffa80`03a3eb60 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0acc2d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
usbhub!UsbhHubProcessChangeWorker+ec
fffff880`062e6a60 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: usbhub!UsbhHubProcessChangeWorker+ec
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbhub
IMAGE_NAME: usbhub.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d8c0c15
FAILURE_BUCKET_ID: X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec
BUCKET_ID: X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\122211-12729-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a14000 PsLoadedModuleList = 0xfffff800`01c59670
Debug session time: Thu Dec 22 10:07:29.010 2011 (UTC - 7:00)
System Uptime: 0 days 17:53:35.790
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, 11c0a38c0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46485 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 000000011c0a38c0
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41287
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88009bef1a0 -- (.trap 0xfffff88009bef1a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000047b840004 rbx=0000000000000000 rcx=fffffa80039014e0
rdx=000000011c0a38c1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001a88b65 rsp=fffff88009bef330 rbp=fffff88009bef3c0
r8=000000011c0a38c0 r9=0000000000000000 r10=fffffa80039014e0
r11=fffff88009bef4a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!ExpInterlockedPopEntrySListFault16:
fffff800`01a88b65 498b08 mov rcx,qword ptr [r8] ds:dae0:00000001`1c0a38c0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001a23d7e to fffff80001a90c40
STACK_TEXT:
fffff880`09bef038 fffff800`01a23d7e : 00000000`0000001a 00000000`00041287 00000001`1c0a38c0 00000000`00000000 : nt!KeBugCheckEx
fffff880`09bef040 fffff800`01a8ed6e : 00000000`00000000 00000001`1c0a38c0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x46485
fffff880`09bef1a0 fffff800`01a88b65 : 00000000`00000000 fffff800`01a9e59c 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`09bef330 fffff800`01a9e59c : 00000000`00000000 00000000`00000000 fffff700`01080000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
fffff880`09bef340 fffff800`01a8ed6e : 00000000`00000001 00000000`027be000 00000000`0286c901 00000000`02460000 : nt!MmAccessFault+0x9dc
fffff880`09bef4a0 00000000`00ae3802 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`02d3b94c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xae3802
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46485
fffff800`01a23d7e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46485
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46485
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\122411-19515-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a61000 PsLoadedModuleList = 0xfffff800`01ca6670
Debug session time: Sat Dec 24 13:00:44.250 2011 (UTC - 7:00)
System Uptime: 0 days 10:52:19.031
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 6f8, fffff88000e4ea26}
Probably caused by : partmgr.sys ( partmgr!PmWmiCounterIoComplete+26 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff88000e4ea26
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80001add1e9 to fffff80001addc40
STACK_TEXT:
fffff880`009b7c68 fffff800`01add1e9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`009b7c70 fffff800`01adb6b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009b7db0 fffff880`00e4ea26 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
00000000`00000020 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : partmgr!PmWmiCounterIoComplete+0x26
STACK_COMMAND: kb
FOLLOWUP_IP:
partmgr!PmWmiCounterIoComplete+26
fffff880`00e4ea26 ff157c280000 call qword ptr [partmgr!_imp_KeQueryPerformanceCounter (fffff880`00e512a8)]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: partmgr!PmWmiCounterIoComplete+26
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: partmgr
IMAGE_NAME: partmgr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce792c0
FAILURE_BUCKET_ID: X64_0x7f_8_partmgr!PmWmiCounterIoComplete+26
BUCKET_ID: X64_0x7f_8_partmgr!PmWmiCounterIoComplete+26
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\122711-12792-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a49000 PsLoadedModuleList = 0xfffff800`01c8e670
Debug session time: Mon Dec 26 18:24:28.037 2011 (UTC - 7:00)
System Uptime: 0 days 14:57:28.818
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800bde7878, fffff8800bde70d0, fffff880012ec038}
Probably caused by : Ntfs.sys ( Ntfs!TxfOpenFileProcessing+158 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800bde7878
Arg3: fffff8800bde70d0
Arg4: fffff880012ec038
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800bde7878 -- (.exr 0xfffff8800bde7878)
ExceptionAddress: fffff880012ec038 (Ntfs!TxfOpenFileProcessing+0x0000000000000158)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000002a20
Attempt to read from address 0000000000002a20
CONTEXT: fffff8800bde70d0 -- (.cxr 0xfffff8800bde70d0)
rax=fffff8a00abbec48 rbx=0000000000002a20 rcx=0000000000000004
rdx=0000000000000000 rsi=fffff8a00abbec70 rdi=0000000000000000
rip=fffff880012ec038 rsp=fffff8800bde7ab0 rbp=0000000000000000
r8=fffff8a00abbec70 r9=fffff8a00abbeed8 r10=fffff8a000267000
r11=0000000000000000 r12=fffff8a00abbeb40 r13=0000000000000000
r14=fffffa8005d486c0 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!TxfOpenFileProcessing+0x158:
fffff880`012ec038 803b00 cmp byte ptr [rbx],0 ds:002b:00000000`00002a20=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: rundll32.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000002a20
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001cf8100
0000000000002a20
FOLLOWUP_IP:
Ntfs!TxfOpenFileProcessing+158
fffff880`012ec038 803b00 cmp byte ptr [rbx],0
FAULTING_IP:
Ntfs!TxfOpenFileProcessing+158
fffff880`012ec038 803b00 cmp byte ptr [rbx],0
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012e8167 to fffff880012ec038
STACK_TEXT:
fffff880`0bde7ab0 fffff880`012e8167 : fffff980`19200200 fffff8a0`0abbeb40 fffff980`19200398 fffff8a0`0abbeed8 : Ntfs!TxfOpenFileProcessing+0x158
fffff880`0bde7bd0 fffff880`012d6fe5 : fffffa80`05d486c0 fffffa80`059b4ae0 fffffa80`040cb180 fffff8a0`0abbeed8 : Ntfs!NtfsOpenAttribute+0x127
fffff880`0bde7ce0 fffff880`012d2e3b : fffff880`0bde84a0 fffffa80`05d486c0 fffff8a0`0abbeed8 fffff8a0`0000003a : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0bde7da0 fffff880`012d609f : fffffa80`05d486c0 fffffa80`059b47d0 fffff8a0`0abbeed8 fffff880`0000003a : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0bde7f30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!TxfOpenFileProcessing+158
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800bde70d0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!TxfOpenFileProcessing+158
BUCKET_ID: X64_0x24_Ntfs!TxfOpenFileProcessing+158
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\YamYam\120102\Windows_NT6_BSOD_jcgriff2_120102\123111-11840-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01a07000 PsLoadedModuleList = 0xfffff800`01c4c670
Debug session time: Sat Dec 31 14:54:00.841 2011 (UTC - 7:00)
System Uptime: 1 days 9:01:37.621
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffffffffffff8, 2, 0, fffff80001a8fad1}
Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+171 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffffffffff8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001a8fad1, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001cb6100
fffffffffffffff8
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiInsertTimerTable+171
fffff800`01a8fad1 4c3b7df8 cmp r15,qword ptr [rbp-8]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: TOTALCMD.EXE
TRAP_FRAME: fffff8800c36af50 -- (.trap 0xfffff8800c36af50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000009858 rbx=0000000000000000 rcx=00000114d488f57f
rdx=fffffa80054519f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001a8fad1 rsp=fffff8800c36b0e0 rbp=0000000000000000
r8=ffffffffffffffff r9=00000000000000dc r10=fffff80001bf9e80
r11=fffffa8003ef6c00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!KiInsertTimerTable+0x171:
fffff800`01a8fad1 4c3b7df8 cmp r15,qword ptr [rbp-8] ss:0018:ffffffff`fffffff8=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001a831e9 to fffff80001a83c40
STACK_TEXT:
fffff880`0c36ae08 fffff800`01a831e9 : 00000000`0000000a ffffffff`fffffff8 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c36ae10 fffff800`01a81e60 : 00000000`00000000 00000000`00000000 00000000`00001f80 fffffa80`03ef6c20 : nt!KiBugCheckDispatch+0x69
fffff880`0c36af50 fffff800`01a8fad1 : 00000000`00000000 00000000`00000000 00000008`00000001 fffff880`009b1180 : nt!KiPageFault+0x260
fffff880`0c36b0e0 fffff800`01a89092 : fffffa80`03ef6b60 fffffa80`03ef6b60 fffff880`00000000 fffff800`00000000 : nt!KiInsertTimerTable+0x171
fffff880`0c36b140 fffff800`01a8844a : 00000000`00000000 00000000`00000000 00000000`000000dc 00000000`00000000 : nt!KiCommitThreadWait+0x332
fffff880`0c36b1d0 fffff800`01d7a77f : fffff880`00000003 fffff880`0c36b520 00000000`00000001 fffffa80`00000006 : nt!KeWaitForMultipleObjects+0x272
fffff880`0c36b490 fffff800`01da74cd : fffff880`009b1101 fffff800`01a868a4 000111f5`00000001 00000000`00000000 : nt!ObpWaitForMultipleObjects+0x294
fffff880`0c36b960 fffff800`01a82ed3 : fffff880`0c36bca0 fffff800`01a8d85a 00000000`0000002a 00000000`74982450 : nt!NtWaitForMultipleObjects32+0xec
fffff880`0c36bbb0 00000000`74982e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0329f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74982e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiInsertTimerTable+171
fffff800`01a8fad1 4c3b7df8 cmp r15,qword ptr [rbp-8]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiInsertTimerTable+171
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xA_nt!KiInsertTimerTable+171
BUCKET_ID: X64_0xA_nt!KiInsertTimerTable+171
Followup: MachineOwner
---------
I know you already ran Memtest and found no errors, but Memtest sometimes misses memory problems associated with Windows. Please also run the extended version of