Code:
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Kerdex\Windows_NT6_BSOD_jcgriff2\011912-31293-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`03417000 PsLoadedModuleList = 0xfffff800`0365c650
Debug session time: Thu Jan 19 19:06:19.316 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:34.362
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {3951, 2, 0, fffff800035c2dd3}
Unable to load image \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Unable to load image \SystemRoot\system32\DRIVERS\HssDrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for HssDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for HssDrv.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3aca )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000003951, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800035c2dd3, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`035c2dd3 418b45f0 mov eax,dword ptr [r13-10h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
TRAP_FRAME: fffff8800331b580 -- (.trap 0xfffff8800331b580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000003961
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035c2dd3 rsp=fffff8800331b710 rbp=fffffa800c094e70
r8=0000000000000000 r9=0000000000000000 r10=fffffa800c097020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`035c2dd3 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800034962a9 to fffff80003496d00
STACK_TEXT:
fffff880`0331b438 fffff800`034962a9 : 00000000`0000000a 00000000`00003951 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0331b440 fffff800`03494f20 : fffff880`0331b7a0 00000000`00000000 00000000`00400120 fffffa80`0c091020 : nt!KiBugCheckDispatch+0x69
fffff880`0331b580 fffff800`035c2dd3 : 00000000`00000000 fffff880`05c3938c 00000000`0000085f 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0331b710 fffff880`01827195 : fffffa80`0c0970b0 fffff880`101b875c 00000000`00000000 00000000`00003961 : nt!ExFreePoolWithTag+0x43
fffff880`0331b7c0 fffff880`05c6eaca : fffffa80`0c094e70 fffffa80`0c094e70 fffffa80`0c0970b0 fffffa80`0c0918d0 : ndis!NdisFreeMemory+0x15
fffff880`0331b7f0 fffffa80`0c094e70 : fffffa80`0c094e70 fffffa80`0c0970b0 fffffa80`0c0918d0 fffff880`01882110 : VBoxNetFlt+0x3aca
fffff880`0331b7f8 fffffa80`0c094e70 : fffffa80`0c0970b0 fffffa80`0c0918d0 fffff880`01882110 fffffa80`0c0918d0 : 0xfffffa80`0c094e70
fffff880`0331b800 fffffa80`0c0970b0 : fffffa80`0c0918d0 fffff880`01882110 fffffa80`0c0918d0 fffffa80`0a7cd1a0 : 0xfffffa80`0c094e70
fffff880`0331b808 fffffa80`0c0918d0 : fffff880`01882110 fffffa80`0c0918d0 fffffa80`0a7cd1a0 fffff880`018e2a22 : 0xfffffa80`0c0970b0
fffff880`0331b810 fffff880`01882110 : fffffa80`0c0918d0 fffffa80`0a7cd1a0 fffff880`018e2a22 00000000`00000000 : 0xfffffa80`0c0918d0
fffff880`0331b818 fffffa80`0c0918d0 : fffffa80`0a7cd1a0 fffff880`018e2a22 00000000`00000000 fffffa80`0c094e70 : ndis!WPP_GLOBAL_Control
fffff880`0331b820 fffffa80`0a7cd1a0 : fffff880`018e2a22 00000000`00000000 fffffa80`0c094e70 fffffa80`0c0918d0 : 0xfffffa80`0c0918d0
fffff880`0331b828 fffff880`018e2a22 : 00000000`00000000 fffffa80`0c094e70 fffffa80`0c0918d0 fffffa80`0c094e70 : 0xfffffa80`0a7cd1a0
fffff880`0331b830 fffff880`018df388 : fffffa80`0b7dd7a0 fffffa80`0a7cd1a0 00000000`00000000 fffffa80`0c089bd0 : ndis!ndisMSendPacketCompleteToOpen+0x102
fffff880`0331b880 fffff880`05d231d3 : 00000000`00000000 fffffa80`0c089bd0 00000000`00000000 fffffa80`0a3241a0 : ndis! ?? ::FJGMBFAB::`string'+0xb10
fffff880`0331b8d0 00000000`00000000 : fffffa80`0c089bd0 00000000`00000000 fffffa80`0a3241a0 fffffa80`0cd4b300 : HssDrv+0x21d3
STACK_COMMAND: kb
FOLLOWUP_IP:
VBoxNetFlt+3aca
fffff880`05c6eaca ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: VBoxNetFlt+3aca
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: VBoxNetFlt
IMAGE_NAME: VBoxNetFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4eef3187
FAILURE_BUCKET_ID: X64_0xC5_2_VBoxNetFlt+3aca
BUCKET_ID: X64_0xC5_2_VBoxNetFlt+3aca
Followup: MachineOwner
---------