Antivirus Software:
Code:
ccsvchst.exe c:\program files (x86)\norton 360\engine\5.2.0.13\ccsvchst.exe 1992 8 1024 10240 2/12/2012 7:52 PM 10.1.1.16 126.96 KB (130,008 bytes) 2/2/2012 8:29 PM
ccsvchst.exe c:\program files (x86)\norton 360\engine\5.2.0.13\ccsvchst.exe 3104 8 1024 10240 2/12/2012 7:52 PM 10.1.1.16 126.96 KB (130,008 bytes) 2/2/2012 8:29 PM
Possible out of date drivers:
Code:
wacommousefilter fffff880`04c0d000 fffff880`04c15000 Fri Feb 16 11:12:17 2007 (45d5f401) 00005ace wacommousefilter.sys
GEARAspiWDM fffff880`049c8000 fffff880`049d5000 Mon May 18 06:17:04 2009 (4a1151c0) 000159b4 GEARAspiWDM.sys
wacommousefilter.sys
GEARAspiWDM.sys
Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Kingston\BSODDmpFiles\midna34704\Windows_NT6_BSOD_jcgriff2\021212-50341-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c1d000 PsLoadedModuleList = 0xfffff800`02e62670
Debug session time: Sun Feb 12 19:50:25.022 2012 (UTC - 7:00)
System Uptime: 0 days 1:10:26.645
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000096, fffff80002ccab5a, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000096, The exception code that was not handled
Arg2: fffff80002ccab5a, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.
FAULTING_IP:
nt!KeStackAttachProcess+1ba
fffff800`02ccab5a 0f22d8 mov cr3,rax
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.
BUGCHECK_STR: 0x1E_c0000096
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002ce5588 to fffff80002c99c40
STACK_TEXT:
fffff880`0353efe8 fffff800`02ce5588 : 00000000`0000001e ffffffff`c0000096 fffff800`02ccab5a 00000000`00000000 : nt!KeBugCheckEx
fffff880`0353eff0 fffff800`02c992c2 : fffff880`0353f7c8 fffffa80`02401b60 fffff880`0353f870 fffffa80`08793f48 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0353f690 fffff800`02c97bca : fffff880`0353f8b0 fffff8a0`14747010 00000000`0000006b 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0353f870 fffff800`02ccab5a : 00000000`00000000 fffffa80`02401b60 fffffa80`02401b60 fffff800`02f6cdb3 : nt!KiGeneralProtectionFault+0x10a
fffff880`0353fa00 fffffa80`037249a0 : fffff880`0353fb80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x1ba
fffff880`0353fa80 fffff880`0353fb80 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`037249a0
fffff880`0353fa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`0353fb80
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+1ba
fffff800`02ccab5a 0f22d8 mov cr3,rax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KeStackAttachProcess+1ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
Followup: MachineOwner
---------
The .dmp file is rather inconclusive. Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash.
What steps have you used so far to try to resolve the issue? Have you tried contacting the manufacturer of your Pen software/device?