Code:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e11000 PsLoadedModuleList = 0xfffff800`0304ee50
Debug session time: Fri Nov 12 12:35:48.928 2010 (GMT-5)
System Uptime: 0 days 0:06:24.239
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffff900c1fa7000, 0, 1, fffff96000144c17}
Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+183 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff900c1fa7000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff96000144c17, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b90e0
fffff900c1fa7000
CURRENT_IRQL: 0
FAULTING_IP:
win32k!InternalRebuildHwndListForIMEClass+183
fffff960`00144c17 48832600 and qword ptr [rsi],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: AVGIDSMonitor.
TRAP_FRAME: fffff880096208f0 -- (.trap 0xfffff880096208f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c1fa7000 rbx=0000000000000000 rcx=fffff900c1fa8490
rdx=000000000000000e rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000144c17 rsp=fffff88009620a80 rbp=0000000000000000
r8=000000000000000e r9=000000000000007f r10=0000000000000080
r11=0000000000000018 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
win32k!InternalRebuildHwndListForIMEClass+0x183:
fffff960`00144c17 48832600 and qword ptr [rsi],0 ds:0020:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e80ca9 to fffff80002e81740
STACK_TEXT:
fffff880`096207a8 fffff800`02e80ca9 : 00000000`0000000a fffff900`c1fa7000 00000000`00000000 00000000`00000001 : nt!KeBugCheckEx
fffff880`096207b0 fffff800`02e7f920 : 00000000`00000001 fffff900`c1ecb020 fffff880`09620900 00000000`00000080 : nt!KiBugCheckDispatch+0x69
fffff880`096208f0 fffff960`00144c17 : fffff900`c1ecb000 00000000`00000000 fffff8a0`6c777355 fffff8a0`00000001 : nt!KiPageFault+0x260
fffff880`09620a80 fffff960`0015da46 : fffff900`c1ecb000 00000000`00000000 fffff900`c1ecb020 fffff900`c1ecb020 : win32k!InternalRebuildHwndListForIMEClass+0x183
fffff880`09620af0 fffff960`001447ed : 00000000`00000000 fffff880`09620ca0 00000000`00000000 00000000`00000000 : win32k!BuildHwndList+0xb2
fffff880`09620b20 fffff800`02e80993 : fffffa80`07f78060 00000000`00000000 00000000`002ee7d8 fffff880`09620bc8 : win32k!NtUserBuildHwndList+0x19d
fffff880`09620bb0 00000000`7576fd8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`002ee7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7576fd8a
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!InternalRebuildHwndListForIMEClass+183
fffff960`00144c17 48832600 and qword ptr [rsi],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!InternalRebuildHwndListForIMEClass+183
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dc13c
FAILURE_BUCKET_ID: X64_0xD1_win32k!InternalRebuildHwndListForIMEClass+183
BUCKET_ID: X64_0xD1_win32k!InternalRebuildHwndListForIMEClass+183
Followup: MachineOwner
---------
4: kd> lmtsmn
start end module name
fffff880`04226000 fffff880`04264000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00e8a000 fffff880`00ee1000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02d2d000 fffff880`02db7000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04200000 fffff880`04216000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`04086000 fffff880`0409b000 amdppm amdppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`0114d000 fffff880`01158000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`08154000 fffff880`0815c000 AsrIbDrv AsrIbDrv.sys Thu Jan 08 03:39:16 2009 (4965BBB4)
fffff880`081cd000 fffff880`081d8000 asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`00feb000 fffff880`00ff4000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e2a000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`05087000 fffff880`050a9000 AtiHdmi AtiHdmi.sys Tue Mar 09 05:08:38 2010 (4B961E26)
fffff880`0481f000 fffff880`04eea000 atikmdag atikmdag.sys Tue May 04 21:41:02 2010 (4BE0CCAE)
fffff880`042bb000 fffff880`042f6000 atikmpag atikmpag.sys Tue May 04 21:23:24 2010 (4BE0C88C)
fffff880`07104000 fffff880`07138000 AVGIDSDriver AVGIDSDriver.Sys Tue Aug 03 18:24:45 2010 (4C58972D)
fffff880`019c7000 fffff880`019d1000 AVGIDSEH AVGIDSEH.Sys Mon Sep 13 18:46:38 2010 (4C8EA9CE)
fffff880`03c9e000 fffff880`03caa000 AVGIDSFilter AVGIDSFilter.Sys Tue Aug 03 18:23:21 2010 (4C5896D9)
fffff880`04011000 fffff880`04060000 avgldx64 avgldx64.sys Mon Sep 06 20:49:29 2010 (4C858C19)
fffff880`0183d000 fffff880`0184c000 avgmfx64 avgmfx64.sys Mon Sep 06 20:49:14 2010 (4C858C0A)
fffff880`019bd000 fffff880`019c7000 avgrkx64 avgrkx64.sys Mon Sep 06 20:49:37 2010 (4C858C21)
fffff880`02c87000 fffff880`02ce8000 avgtdia avgtdia.sys Mon Sep 06 20:52:11 2010 (4C858CBB)
fffff880`01855000 fffff880`0185c000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`04000000 fffff880`04011000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`03d9f000 fffff880`03dbd000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00710000 fffff960`00737000 cdd cdd.dll Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`01813000 fffff880`0183d000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c9c000 fffff880`00d5c000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0198d000 fffff880`019bd000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c3e000 fffff880`00c9c000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0140a000 fffff880`0147d000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`043e3000 fffff880`043f3000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`03caa000 fffff880`03cb3000 cpuz133_x64 cpuz133_x64.sys Tue Mar 30 17:34:16 2010 (4BB26E58)
fffff880`06758000 fffff880`06766000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`04157000 fffff880`041da000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`041da000 fffff880`041f8000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`04148000 fffff880`04157000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01977000 fffff880`0198d000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`066ad000 fffff880`066cf000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`06772000 fffff880`0677b000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06766000 fffff880`06772000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0677b000 fffff880`0678e000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`0678e000 fffff880`0679a000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04eea000 fffff880`04fde000 dxgkrnl dxgkrnl.sys Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`042f6000 fffff880`0433c000 dxgmms1 dxgmms1.sys Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`011a4000 fffff880`011b8000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01158000 fffff880`011a4000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0148e000 fffff880`01498000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`0193d000 fffff880`01977000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`00e2a000 fffff880`00e74000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`04fde000 fffff880`04feb000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`033ed000 fffff800`03436000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`0433c000 fffff880`04360000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`06729000 fffff880`06742000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`069ef000 fffff880`069f7080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`069e1000 fffff880`069ef000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`03cd7000 fffff880`03d9f000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01934000 fffff880`0193d000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`043d4000 fffff880`043e3000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06800000 fffff880`0680e000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bb8000 fffff800`00bc2000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0519a000 fffff880`051dd000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013d5000 fffff880`013ef000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01200000 fffff880`0122b000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`066cf000 fffff880`066d4200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`06600000 fffff880`06615000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`067a8000 fffff880`067cb000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`08099000 fffff880`080a3000 LVPr2M64 LVPr2M64.sys Fri May 07 21:38:16 2010 (4BE4C088)
fffff880`00c1d000 fffff880`00c2a000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`0679a000 fffff880`067a8000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05189000 fffff880`05198000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`0674b000 fffff880`06758000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00fd1000 fffff880`00feb000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03dbd000 fffff880`03dd5000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`03c00000 fffff880`03c2d000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`03c2d000 fffff880`03c7b000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`03c7b000 fffff880`03c9e000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01067000 fffff880`01072000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00eea000 fffff880`00ef4000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01000000 fffff880`0105e000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`0413d000 fffff880`04148000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01922000 fffff880`01934000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`0108a000 fffff880`01116000 mv91xx mv91xx.sys Fri Dec 25 01:45:39 2009 (4B345F93)
fffff880`01145000 fffff880`0114d000 mvxxmm mvxxmm.sys Fri Dec 25 01:45:15 2009 (4B345F7B)
fffff880`01498000 fffff880`0158a000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04216000 fffff880`04222000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`050f9000 fffff880`05128000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05072000 fffff880`05087000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02de6000 fffff880`02df5000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02ce8000 fffff880`02d2d000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0158a000 fffff880`015ea000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01072000 fffff880`01083000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`04131000 fffff880`0413d000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02e11000 fffff800`033ed000 nt ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01232000 fffff880`013d5000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`06742000 fffff880`0674b000 NuidFltr NuidFltr.sys Fri May 08 04:53:31 2009 (4A03F30B)
fffff880`0184c000 fffff880`01855000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`05000000 fffff880`05018000 nusb3hub nusb3hub.sys Thu Jan 21 22:22:18 2010 (4B5919EA)
fffff880`0409b000 fffff880`040cb000 nusb3xhc nusb3xhc.sys Thu Jan 21 22:22:21 2010 (4B5919ED)
fffff880`02dc0000 fffff880`02de6000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00f34000 fffff880`00f49000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ef4000 fffff880`00f27000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fba000 fffff880`00fc1000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00fc1000 fffff880`00fd1000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0147d000 fffff880`0148e000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`07014000 fffff880`070ba000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`050a9000 fffff880`050e6000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c2a000 fffff880`00c3e000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`02c60000 fffff880`02c84000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05128000 fffff880`05143000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`05143000 fffff880`05164000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`05164000 fffff880`0517e000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`040e0000 fffff880`04131000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`0517e000 fffff880`05189000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`019f4000 fffff880`019fd000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`080d4000 fffff880`08102000 rdpdr rdpdr.sys Mon Jul 13 20:18:02 2009 (4A5BCEBA)
fffff880`01400000 fffff880`01409000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0105e000 fffff880`01067000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`0811c000 fffff880`08154000 RDPWD RDPWD.SYS Mon Jul 13 20:16:47 2009 (4A5BCE6F)
fffff880`018e8000 fffff880`01922000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`06615000 fffff880`0662d000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04264000 fffff880`042bb000 Rt64win7 Rt64win7.sys Thu Mar 04 08:42:52 2010 (4B8FB8DC)
fffff880`02c56000 fffff880`02c60000 SASDIFSV64 SASDIFSV64.SYS Mon Feb 08 19:11:52 2010 (4B70A848)
fffff880`02c4c000 fffff880`02c56000 SASKUTIL64 SASKUTIL64.SYS Tue Feb 09 17:27:34 2010 (4B71E156)
fffff880`01116000 fffff880`01145000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`070ba000 fffff880`070c5000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04811000 fffff880`0481d000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02c00000 fffff880`02c1d000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`018e0000 fffff880`018e8000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0815c000 fffff880`081cd000 spsys spsys.sys Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`08003000 fffff880`08099000 srv srv.sys Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07138000 fffff880`0719f000 srv2 srv2.sys Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`070c5000 fffff880`070f2000 srvnet srvnet.sys Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`05198000 fffff880`05199480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01600000 fffff880`017fd000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`070f2000 fffff880`07104000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`011d6000 fffff880`011e3000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`08102000 fffff880`0810d000 tdtcp tdtcp.sys Mon Jul 13 20:16:32 2009 (4A5BCE60)
fffff880`011b8000 fffff880`011d6000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02c38000 fffff880`02c4c000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00580000 fffff960`0058a000 TSDDD TSDDD.dll unavailable (00000000)
fffff880`0810d000 fffff880`0811c000 tssecsrv tssecsrv.sys Mon Jul 13 20:16:41 2009 (4A5BCE69)
fffff880`04060000 fffff880`04086000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`066d5000 fffff880`06729000 udfs udfs.sys Mon Jul 13 19:23:37 2009 (4A5BC1F9)
fffff880`051dd000 fffff880`051ef000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`069c4000 fffff880`069e1000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`040cb000 fffff880`040ccf00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04800000 fffff880`04811000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`040cd000 fffff880`040da000 usbfilter usbfilter.sys Wed Oct 07 03:44:08 2009 (4ACC46C8)
fffff880`05018000 fffff880`05072000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04feb000 fffff880`04ff6000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04360000 fffff880`043b6000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`00f27000 fffff880`00f34000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`0185c000 fffff880`0186a000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`06813000 fffff880`069c4000 viahduaa viahduaa.sys Tue Mar 02 06:30:18 2010 (4B8CF6CA)
fffff880`0186a000 fffff880`0188f000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`015ea000 fffff880`015fa000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00f49000 fffff880`00f5e000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f5e000 fffff880`00fba000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01894000 fffff880`018e0000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c1d000 fffff880`02c38000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`013ef000 fffff880`013ff000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00d5c000 fffff880`00e00000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00c00000 fffff880`00c0f000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02db7000 fffff880`02dc0000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000 win32k win32k.sys Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`04ff6000 fffff880`04fff000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00ee1000 fffff880`00eea000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`067cb000 fffff880`067ec000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1)
Unloaded modules:
fffff880`080a3000 fffff880`080d4000 AODDriver.sy
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`019d1000 fffff880`019df000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`019df000 fffff880`019eb000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`019eb000 fffff880`019f4000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`01800000 fffff880`01813000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`043b6000 fffff880`043d4000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
Debug session time: Thu Nov 11 01:18:26.042 2010 (GMT-5)
System Uptime: 0 days 10:19:41.977
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002e65349, fffff880031d1918, fffff880031d1180}
Probably caused by : memory_corruption ( nt!MiPrepareSegmentForDeletion+119 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e65349, The address that the exception occurred at
Arg3: fffff880031d1918, Exception Record Address
Arg4: fffff880031d1180, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiPrepareSegmentForDeletion+119
fffff800`02e65349 48396b50 cmp qword ptr [rbx+50h],rbp
EXCEPTION_RECORD: fffff880031d1918 -- (.exr 0xfffff880031d1918)
ExceptionAddress: fffff80002e65349 (nt!MiPrepareSegmentForDeletion+0x0000000000000119)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880031d1180 -- (.cxr 0xfffff880031d1180)
rax=0000000000000000 rbx=0400000000000000 rcx=0000000000001000
rdx=0000000000000200 rsi=0000000000000000 rdi=00000000000c0000
rip=fffff80002e65349 rsp=fffff880031d1b50 rbp=0000000000000000
r8=0000000000000000 r9=fffff88002f64180 r10=0000000000000000
r11=fffff880031d1b20 r12=0000000000000001 r13=fffffa800febb630
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiPrepareSegmentForDeletion+0x119:
fffff800`02e65349 48396b50 cmp qword ptr [rbx+50h],rbp ds:002b:04000000`00000050=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b20e0
ffffffffffffffff
FOLLOWUP_IP:
nt!MiPrepareSegmentForDeletion+119
fffff800`02e65349 48396b50 cmp qword ptr [rbx+50h],rbp
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff8000316b5df to fffff80002e65349
STACK_TEXT:
fffff880`031d1b50 fffff800`0316b5df : 00000000`00000000 00000000`00000000 00000000`0008c081 fffffa80`0feb0e50 : nt!MiPrepareSegmentForDeletion+0x119
fffff880`031d1bc0 fffff800`02fa208b : fffffa80`0febb638 00000000`00000001 00000000`00000000 00000000`00000631 : nt!MiSegmentDelete+0x4b
fffff880`031d1c00 fffff800`02fa26fd : 00000000`00000000 00000000`00000080 fffffa80`0568fb30 00000000`00000012 : nt!MiProcessDereferenceList+0x23b
fffff880`031d1cc0 fffff800`0311ec06 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d
fffff880`031d1d40 fffff800`02e58c26 : fffff880`02f64180 fffffa80`056a8510 fffff880`02f6f040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031d1d80 00000000`00000000 : fffff880`031d2000 fffff880`031cc000 fffff880`031d1800 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiPrepareSegmentForDeletion+119
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
STACK_COMMAND: .cxr 0xfffff880031d1180 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x7E_nt!MiPrepareSegmentForDeletion+119
BUCKET_ID: X64_0x7E_nt!MiPrepareSegmentForDeletion+119
Followup: MachineOwner
---------
Debug session time: Wed Nov 10 01:32:40.090 2010 (GMT-5)
System Uptime: 0 days 14:57:37.401
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, bfa0001, 6859, fffff70001080000}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000000bfa0001
Arg3: 0000000000006859
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cd33b3 to fffff80002c7e740
STACK_TEXT:
fffff880`096f5498 fffff800`02cd33b3 : 00000000`0000001a 00000000`00041284 00000000`0bfa0001 00000000`00006859 : nt!KeBugCheckEx
fffff880`096f54a0 fffff800`02cf1cc3 : fffffa80`0053e3e0 85900000`1bf6a867 00000000`0bf9f000 8f800000`28469867 : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`096f54e0 fffff800`02cb1df9 : fffffa80`00000000 00000000`0c623fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x3360b
fffff880`096f56a0 fffff800`02f971d0 : fffffa80`05e95470 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`096f57c0 fffff800`02f975db : fffff900`00000000 00000000`0b900000 fffffa80`00000001 fffff880`00000000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`096f5880 fffff800`02c7d993 : 00000000`00000000 fffffa80`0924eb60 fffffa80`09229060 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`096f58d0 fffff800`02c79f30 : fffff960`0018543a 00000000`00000001 fffff900`c0130010 fffff900`c1fe5010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`096f5a68 fffff960`0018543a : 00000000`00000001 fffff900`c0130010 fffff900`c1fe5010 00000000`00000000 : nt!KiServiceLinkage
fffff880`096f5a70 fffff960`001857b4 : ffffffff`00000000 fffff880`00000000 fffff900`c1fe5010 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`096f5bc0 fffff960`001466e5 : ffffffff`8505199f fffff900`c1fe5010 ffffffff`8505199f 00000000`0000199f : win32k!bDeleteSurface+0x34
fffff880`096f5bf0 fffff800`02c7d993 : fffffa80`0924eb60 fffff880`096f5ca0 00000000`0185000f 00000000`0028ece0 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`096f5c20 000007fe`fe21118a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0028eb68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe21118a
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+3a2
fffff960`0018543a e9d6010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`00185615)
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3a2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dc13c
FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2
BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2
Followup: MachineOwner
---------
Debug session time: Wed Nov 10 14:58:01.256 2010 (GMT-5)
System Uptime: 0 days 1:03:40.552
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+5ed6952f01afdd54
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: MagicDVDRipper
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff880030465d8 -- (.exr 0xfffff880030465d8)
ExceptionAddress: fffff80002e82e39 (nt!KiProcessExpiredTimerList+0x0000000000000129)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff88003046680 -- (.trap 0xfffff88003046680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009c613f8 rbx=0000000000000000 rcx=00fffa0009c613f8
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e82e39 rsp=fffff88003046810 rbp=fffffa80096fec68
r8=fffff880009b4301 r9=0000000000000002 r10=00000000000000a9
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiProcessExpiredTimerList+0x129:
fffff800`02e82e39 48894108 mov qword ptr [rcx+8],rax ds:00fffa00`09c61400=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e6f46e to fffff80002e77710
STACK_TEXT:
fffff880`030456c8 fffff800`02e6f46e : fffffa80`05a166c0 fffffa80`05a16590 fffff880`03045e40 fffff800`02ea4668 : nt!KeBugCheck
fffff880`030456d0 fffff800`02e9d40d : fffff800`03085b7c fffff800`02fbfe84 fffff800`02e07000 fffff880`030465d8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`03045700 fffff800`02ea4a90 : fffff800`02fc6a40 fffff880`03045778 fffff880`030465d8 fffff800`02e07000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`03045730 fffff800`02eb19ef : fffff880`030465d8 fffff880`03045e40 fffff880`00000000 fffffa80`09c613f0 : nt!RtlDispatchException+0x410
fffff880`03045e10 fffff800`02e76d82 : fffff880`030465d8 fffffa80`096fec68 fffff880`03046680 00000000`00000000 : nt!KiDispatchException+0x16f
fffff880`030464a0 fffff800`02e7568a : 00000000`00000004 00000000`0005d480 fffffa80`0005d480 fffff880`0184608f : nt!KiExceptionDispatch+0xc2
fffff880`03046680 fffff800`02e82e39 : fffffa80`096fec20 fffffa80`083bfc68 fffffa80`083bfc68 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a
fffff880`03046810 fffff800`02e834be : 00000008`e53a002f fffff880`03046e88 00000000`0003bca9 fffff880`009b5aa8 : nt!KiProcessExpiredTimerList+0x129
fffff880`03046e60 fffff800`02e82cb7 : fffff880`009b21c1 fffff880`0003bca9 fffffa80`06496050 00000000`000000a9 : nt!KiTimerExpiration+0x1be
fffff880`03046f00 fffff800`02e7d865 : 5b987fa6`bd220011 fffffa80`06ee0760 00000000`00000000 fffff880`05054588 : nt!KiRetireDpcList+0x277
fffff880`03046fb0 fffff800`02e7d67c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`08b6abe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`02e6f46e 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
I find the following slightly out of date driver loaded on your system. Oleder drivers can and do cause memory corruption and chrashes. See if you can update this driver.