unexpected shutdown in my windows 7!

sadon said:

I am not going to go with Driver Verifier

I 3rd the motion to let Windows 7 do one of the things it does best - VERIFY DRIVERS.

Run the Driver Verifier. It simply "stress-tests" 3rd party (non-MS) drivers and if it finds one that could be a potential BSOD-causing candidate - it will flag it and BSOD your system.

Driver Verifier --> http://www.techsupportforum.com/2110308-post3.html

All you need to do is make sure you follow step #1 - create the restore point. If the D/V flags a driver, it will produce a memory dump containing additional info that will help identify the rogue driver(s). The assumption is made that the hardware platform is stable.

sadon said:

Let me update the drivers first by using driver detective and then will see if things will get stabled or not.

Honestly, a bad move. From the # of drivers you mentioned, it sounds like it picked up some Microsoft Windows 7 drivers as well; not sure.

sadon said:

I have run three programs to see if my win 7 drivers need to be updated or not.

Driver Detective ( which is the one i put my money on) detects that i have 33 out-of-date drivers. < SNIP > . . .the other two programs (Device doctor and Driver Agent) detect nothing out of date! (all were running at the same time)
i am not sure which one is actually out of date...

You just made my and the others point. Only Windows Updates or a Microsoft hotfix can update Windows 7 OS drivers - no patches allowed.

sadon said:

. . .
for my system, not sure whether this observation is good to proceed with fixing errors, however i have noticed something that might help. I have scheduled my RegCure ( which is a registery cleaner program) to clean the registery 3 am everyday. the system after the cleaning gets a little bit stable.

As was mentioned, registry cleaners are a waste of money and more often than not do more harm than any good whatsoever. There is noting in the registry to "clean".

Registry Cleaners -
--> http://www.techsupportforum.com/micr...ml#post1722857
--> http://www.techsupportforum.com/micr...y-cleaner.html

zigzag3143 said:

Sadon

If your drivers are the same as in your last DMP there are only four that could possibly be considered out of date. Thats the problem with the driver detective type programs. Their list of up to date drivers may be up to date or not. It also may be correct or not.

these are the drivers that might be considered old.

Code:

secdrv.SYS        fffff880`06352000    fffff880`0635d000    0x0000b000    0x4508052e    9/13/2006 8:18:38 AM                        
LHidFilt.Sys        fffff880`04e1c000    fffff880`04e2e000    0x00012000    0x45b69d19    1/23/2007 6:41:13 PM                        
LMouFilt.Sys        fffff880`03e4a000    fffff880`03e5c000    0x00012000    0x45b69d1c    1/23/2007 6:41:16 PM                        
spldr.sys        fffff880`0145a000    fffff880`01462000    0x00008000    0x4a0858bb    5/11/2009 11:56:27 AM                        
amdxata.sys        fffff880`01097000    fffff880`010a2000    0x0000b000    0x4a12f2eb    5/19/2009 12:56:59 PM                        
rtkio.sys        fffff880`07995000    fffff880`0799d000    0x00008000    0x4a3c7af9    6/20/2009 1:00:25 AM

Focus on the drivers in RED - they 1st 2 especially need to be updated.

I agree with Jack and zigzag3143 here - work within Windows 7, utilize its self-healing tools and follow the advice that you have received here.

Regards. . .

jcgriff2

.

Hi -

Thank you for your trust and understanding opposite the Driver Verifier as well as the info you posted and the dump attached.

Capt.Jack Sparrow said:

Also if your using any third party Antivirus / Firewall uninstall it and see whether it makes any difference.

Thank you, Jack... your 4-day old post held the key for the latest BSOD granted to us by the Driver Verifier - in less than 3 min 8 secs ! !

The dump was indeed a VERIFIER_ENABLED_VISTA_MINIDUMP (Yes, Windows 7 D/V induced dumps do say "Vista"!). The bugcheck -

0xc1 = a driver has written to an invalid area of the special pool.

The cuprit caught red-handed =klif.sys Wed Nov 11 08:32:16 2009 (4AFABCE0)

Kaspersky Internet Security. It must go. Un-install KIS using the KIS Removal Tool (KRT) -

KRT download --> Kaspersky Americas Support and Services United States

Download the KRT; save to desktop.

Boot into SAFEMODE - NO Networking. Tap the F8 key repeatedly during boot-up.

Then go to desktop, RIGHT-click on the KRT icon and select "Run as Administrator". When complete - re-boot.

Reset the Windows Firewall to its default settings -
START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on "Restore Defaults" | Click Apply, OK

I would recommend Microsoft Security Essentials, available FREE --> http://www.microsoft.com/Security_Essentials/

See if BSODs persist pot-KIS removal.

Regards. . .

jcgriff2

.

Windows 7 x64 - DRIVER_VERIFIER_ENABLED_DUMP - Bugcheck 0xc1

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\!_jcgriff2\022010-36831-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
 
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03054000 PsLoadedModuleList = 0xfffff800`03291e50
Debug session time: Sat Feb 20 13:23:41.204 2010 (GMT-5)
System Uptime: 0 days 0:03:08.266
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff98025680f20, fffff98025680eee, fd40e0, 32}
Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+1b17c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98025680f20, address trying to free
Arg2: fffff98025680eee, address where one bit is corrupted
Arg3: 0000000000fd40e0, (reserved)
Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error
Debugging Details:
------------------
 
BUGCHECK_STR:  0xC1_32
SPECIAL_POOL_CORRUPTION_TYPE:  32
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  avp.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff80003154593 to fffff800030c5f00
STACK_TEXT:  
fffff880`049aa718 fffff800`03154593 : 00000000`000000c1 fffff980`25680f20 fffff980`25680eee 00000000`00fd40e0 : nt!KeBugCheckEx
fffff880`049aa720 fffff800`031cb613 : fffff980`1f3c8f00 00000000`0206f12c fffff980`25680f20 fffff980`1f356680 : nt!MiCheckSpecialPoolSlop+0x83
fffff880`049aa760 fffff800`031f7356 : 00000000`000000e1 00000000`69664c4b ffffffff`ffffff50 fffff980`1f356680 : nt!MmFreeSpecialPool+0x1d3
fffff880`049aa890 fffff880`03c2717c : 00000000`0000000f 00000000`c0000225 00000000`00000014 fffff980`1f356680 : nt!ExFreePool+0x9f3
fffff880`049aa940 00000000`0000000f : 00000000`c0000225 00000000`00000014 fffff980`1f356680 00000000`00000000 : klif+0x1b17c
fffff880`049aa948 00000000`c0000225 : 00000000`00000014 fffff980`1f356680 00000000`00000000 fffff880`03c51b50 : 0xf
fffff880`049aa950 00000000`00000014 : fffff980`1f356680 00000000`00000000 fffff880`03c51b50 00000000`00000000 : 0xc0000225
fffff880`049aa958 fffff980`1f356680 : 00000000`00000000 fffff880`03c51b50 00000000`00000000 00000000`00010212 : 0x14
fffff880`049aa960 00000000`00000000 : fffff880`03c51b50 00000000`00000000 00000000`00010212 fffff980`1f356680 : 0xfffff980`1f356680
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
klif+1b17c
fffff880`03c2717c ??              ???
SYMBOL_STACK_INDEX:  4
SYMBOL_NAME:  klif+1b17c
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: klif
IMAGE_NAME:  klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4afabce0
FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_klif+1b17c
BUCKET_ID:  X64_0xC1_32_VRF_klif+1b17c
Followup: MachineOwner
---------
3: kd> lmvm klif
start             end                 module name
fffff880`03c0c000 fffff880`03c69000   klif     T (no symbols)           
Loaded symbol image file: klif.sys
Image path: \SystemRoot\system32\DRIVERS\klif.sys
Image name: klif.sys
Timestamp:        Wed Nov 11 08:32:16 2009 (4AFABCE0)
CheckSum:         00060F42
ImageSize:        0005D000
Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
3: kd> k
Child-SP          RetAddr           Call Site
fffff880`049aa718 fffff800`03154593 nt!KeBugCheckEx
fffff880`049aa720 fffff800`031cb613 nt!MiCheckSpecialPoolSlop+0x83
fffff880`049aa760 fffff800`031f7356 nt!MmFreeSpecialPool+0x1d3
fffff880`049aa890 fffff880`03c2717c nt!ExFreePool+0x9f3
fffff880`049aa940 00000000`0000000f klif+0x1b17c
fffff880`049aa948 00000000`c0000225 0xf
fffff880`049aa950 00000000`00000014 0xc0000225
fffff880`049aa958 fffff980`1f356680 0x14
fffff880`049aa960 00000000`00000000 0xfffff980`1f356680
3: kd> lmntsm
start             end                 module name
fffff880`05384000 fffff880`053c2000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f70000 fffff880`00fc7000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`03d1e000 fffff880`03da8000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`053c2000 fffff880`053d8000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`011ed000 fffff880`011f8000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`011ba000 fffff880`011c3000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011c3000 fffff880`011ed000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`05cbf000 fffff880`05ce1000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 20:03:36 2010 (4B6233E8)
fffff880`045c4000 fffff880`045f8000   atikmpag atikmpag.sys Tue Feb 02 22:23:59 2010 (4B68EC4F)
fffff880`04ce1000 fffff880`05345000   atipmdag atipmdag.sys Tue Feb 02 23:21:24 2010 (4B68F9C4)
fffff880`03c72000 fffff880`03c79000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`04545000 fffff880`04556000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05582000 fffff880`055a0000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`007d0000 fffff960`007f7000   cdd      cdd.dll      unavailable (00000000)
fffff880`01200000 fffff880`0122a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01416000 fffff880`01446000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d4a000 fffff880`00da8000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`014a4000 fffff880`01517000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`0568a000 fffff880`0569a000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05470000 fffff880`05478000   cpuz132_x64 cpuz132_x64.sys Thu Mar 26 19:17:23 2009 (49CC0D03)
fffff880`079f0000 fffff880`079fe000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`044a4000 fffff880`04527000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`04527000 fffff880`04545000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`0147c000 fffff880`0148b000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01400000 fffff880`01416000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05d1e000 fffff880`05d40000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05d52000 fffff880`05d5b000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05d46000 fffff880`05d52000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05d5b000 fffff880`05d6e000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05d9e000 fffff880`05daa000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`056a0000 fffff880`05794000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`05794000 fffff880`057da000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`05674000 fffff880`05681000   fdc      fdc.sys      Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`0104c000 fffff880`01060000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`05c9f000 fffff880`05caa000   flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`01000000 fffff880`0104c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01528000 fffff880`01532000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`015c6000 fffff880`01600000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`017a0000 fffff880`017ea000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`0300b000 fffff800`03054000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`057da000 fffff880`057fe000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05d7c000 fffff880`05d95000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05d95000 fffff880`05d9d080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`05d6e000 fffff880`05d7c000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`054ba000 fffff880`05582000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0161a000 fffff880`01623000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0457c000 fffff880`04592000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`01151000 fffff880`01171000   jraid    jraid.sys    Wed Oct 07 07:26:03 2009 (4ACC7ACB)
fffff880`04c9c000 fffff880`04cab000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05daa000 fffff880`05db8000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bd0000 fffff800`00bda000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03ed2000 fffff880`043fb000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffff880`015b8000 fffff880`015c6000   klbg     klbg.sys     Wed Oct 14 13:18:13 2009 (4AD607D5)
fffff880`03c0c000 fffff880`03c69000   klif     klif.sys     Wed Nov 11 08:32:16 2009 (4AFABCE0)
fffff880`05dc5000 fffff880`05dcf000   klmouflt klmouflt.sys Fri Oct 02 11:38:29 2009 (4AC61E75)
fffff880`04400000 fffff880`04443000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`013dd000 fffff880`013f7000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01775000 fffff880`017a0000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`05d40000 fffff880`05d45200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`05c00000 fffff880`05c15000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05ddd000 fffff880`05e00000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cf2000 fffff880`00d36000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`05dcf000 fffff880`05ddd000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04cab000 fffff880`04cba000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05db8000 fffff880`05dc5000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`011a0000 fffff880`011ba000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`055a0000 fffff880`055b8000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`055b8000 fffff880`055e5000   mrxsmb   mrxsmb.sys   Thu Jan 07 22:38:26 2010 (4B46A8B2)
fffff880`05400000 fffff880`0544d000   mrxsmb10 mrxsmb10.sys Thu Jan 07 22:38:32 2010 (4B46A8B8)
fffff880`0544d000 fffff880`05470000   mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`03cd7000 fffff880`03ce2000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd0000 fffff880`00fda000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01060000 fffff880`010be000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03c00000 fffff880`03c0b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01608000 fffff880`0161a000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01623000 fffff880`01715000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04c00000 fffff880`04c0c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`04c0c000 fffff880`04c3b000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05caa000 fffff880`05cbf000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`03e7e000 fffff880`03e8d000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03e00000 fffff880`03e45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01715000 fffff880`01775000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`03ce2000 fffff880`03cf3000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03ebc000 fffff880`03ec8000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03054000 fffff800`03631000   nt       ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`0123a000 fffff880`013dd000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`03c69000 fffff880`03c72000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04443000 fffff880`04459000   nusb3hub nusb3hub.sys Fri Sep 25 09:58:23 2009 (4ABCCC7F)
fffff880`04592000 fffff880`045c2000   nusb3xhc nusb3xhc.sys Fri Sep 25 09:58:31 2009 (4ABCCC87)
fffff880`03e4e000 fffff880`03e74000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`0113a000 fffff880`01141000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`01141000 fffff880`01151000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01517000 fffff880`01528000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`098e6000 fffff880`0998c000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05ce1000 fffff880`05d1e000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00d36000 fffff880`00d4a000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`053d8000 fffff880`053fc000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04c3b000 fffff880`04c56000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04c56000 fffff880`04c77000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`04c77000 fffff880`04c91000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03da8000 fffff880`03df9000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04c91000 fffff880`04c9c000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`03cbc000 fffff880`03cc5000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03cc5000 fffff880`03cce000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03cce000 fffff880`03cd7000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`0157e000 fffff880`015b8000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05c15000 fffff880`05c2d000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05345000 fffff880`05384000   Rt64win7 Rt64win7.sys Thu Aug 20 12:05:06 2009 (4A8D7432)
fffff880`0ab25000 fffff880`0ab2d000   rtkio    rtkio.sys    Sat Jun 20 02:00:25 2009 (4A3C7AF9)
fffff880`07805000 fffff880`079ef080   RTKVHD64 RTKVHD64.sys Wed Oct 21 10:27:48 2009 (4ADF1A64)
fffff880`01171000 fffff880`011a0000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0998c000 fffff880`09997000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`01600000 fffff880`01608000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0aa8d000 fffff880`0ab25000   srv      srv.sys      Tue Dec 08 03:32:55 2009 (4B1E0F37)
fffff880`09800000 fffff880`09869000   srv2     srv2.sys     Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`09997000 fffff880`099c4000   srvnet   srvnet.sys   Tue Dec 08 03:32:26 2009 (4B1E0F1A)
fffff880`0569a000 fffff880`0569b480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`099c4000 fffff880`099d6000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`03d11000 fffff880`03d1e000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`03cf3000 fffff880`03d11000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03ea8000 fffff880`03ebc000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005d0000 fffff960`005da000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04556000 fffff880`0457c000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04cba000 fffff880`04ccc000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`045c2000 fffff880`045c3f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`05663000 fffff880`05674000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05c45000 fffff880`05c9f000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`0560d000 fffff880`05663000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`05600000 fffff880`0560d000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`03c79000 fffff880`03c87000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`03c87000 fffff880`03cac000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`017ea000 fffff880`017fa000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e55000 fffff880`00e6a000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010de000 fffff880`0113a000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01532000 fffff880`0157e000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`03e8d000 fffff880`03ea8000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`03cac000 fffff880`03cbc000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ebd000 fffff880`00f61000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f61000 fffff880`00f70000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03e45000 fffff880`03e4e000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00000000 fffff960`0030f000   win32k   win32k.sys   Mon Jul 13 19:40:17 2009 (4A5BC5E1)
fffff880`05681000 fffff880`0568a000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fc7000 fffff880`00fd0000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
Unloaded modules:
fffff880`01446000 fffff880`01454000   crashdmp.sys
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01454000 fffff880`01460000   dump_ataport
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01460000 fffff880`01469000   dump_atapi.s
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01469000 fffff880`0147c000   dump_dumpfve
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`03e74000 fffff880`03e7e000   klim6.sys
Timestamp: unavailable (00000000)
Checksum:  00000000

jcgriff2 said:

sadon said:

I am not going to go with Driver Verifier

I 3rd the motion to let Windows 7 do one of the things it does best - VERIFY DRIVERS.

Run the Driver Verifier. It simply "stress-tests" 3rd party (non-MS) drivers and if it finds one that could be a potential BSOD-causing candidate - it will flag it and BSOD your system.

Driver Verifier --> Tech Support Forum - View Single Post - Windows Has Recovered From Unexpected Shutdown - Blue Screen of Death - BSOD

All you need to do is make sure you follow step #1 - create the restore point. If the D/V flags a driver, it will produce a memory dump containing additional info that will help identify the rogue driver(s). The assumption is made that the hardware platform is stable.

sadon said:

Let me update the drivers first by using driver detective and then will see if things will get stabled or not.

Honestly, a bad move. From the # of drivers you mentioned, it sounds like it picked up some Microsoft Windows 7 drivers as well; not sure.




You just made my and the others point. Only Windows Updates or a Microsoft hotfix can update Windows 7 OS drivers - no patches allowed.

sadon said:

. . .
for my system, not sure whether this observation is good to proceed with fixing errors, however i have noticed something that might help. I have scheduled my RegCure ( which is a registery cleaner program) to clean the registery 3 am everyday. the system after the cleaning gets a little bit stable.

As was mentioned, registry cleaners are a waste of money and more often than not do more harm than any good whatsoever. There is noting in the registry to "clean".

Registry Cleaners -
--> [SOLVED] Registry Editors - Tech Support Forum
--> [SOLVED] Max Registry Cleaner - Tech Support Forum

zigzag3143 said:

Sadon

If your drivers are the same as in your last DMP there are only four that could possibly be considered out of date. Thats the problem with the driver detective type programs. Their list of up to date drivers may be up to date or not. It also may be correct or not.

these are the drivers that might be considered old.

Code:

secdrv.SYS        fffff880`06352000    fffff880`0635d000    0x0000b000    0x4508052e    9/13/2006 8:18:38 AM                        
LHidFilt.Sys        fffff880`04e1c000    fffff880`04e2e000    0x00012000    0x45b69d19    1/23/2007 6:41:13 PM                        
LMouFilt.Sys        fffff880`03e4a000    fffff880`03e5c000    0x00012000    0x45b69d1c    1/23/2007 6:41:16 PM                        
spldr.sys        fffff880`0145a000    fffff880`01462000    0x00008000    0x4a0858bb    5/11/2009 11:56:27 AM                        
amdxata.sys        fffff880`01097000    fffff880`010a2000    0x0000b000    0x4a12f2eb    5/19/2009 12:56:59 PM                        
rtkio.sys        fffff880`07995000    fffff880`0799d000    0x00008000    0x4a3c7af9    6/20/2009 1:00:25 AM

Focus on the drivers in RED - they 1st 2 especially need to be updated.

I agree with Jack and zigzag3143 here - work within Windows 7, utilize its self-healing tools and follow the advice that you have received here.

Regards. . .

jcgriff2

.

I have managed to update the first two driveres (LHidFilt.Sys & LMouFilt.Sys) however, i have been trying to update the last two but couldn't. It says in the amdxata.sys properties (when you go to C drive and then Windows folder -> System32 -> drivers -> amdxata.sys) that this driver is an AMD driver! My CPU is core i7 and I am only using one producrt from AMD which is ATI Radeon HD 5850. And for this graphic card, i compeletly uninstalled the driver and then reinstalled it once again. I am not sure whether this will do the updating or not.


for rtkio.sys, it's not even in the folder drivers! (when you go to C drive and then Windows folder -> System32 -> drivers -> rtkio.sys)
Only Rt64win7.sys and RTKVHD64.sys are listed.

please, look guys to what i got from windbg when opening a dump file.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\sadon\Desktop\blue screens\022110-32354-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Windows\symbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`0325ce50
Debug session time: Sun Feb 21 04:34:44.253 2010 (GMT-8)
System Uptime: 0 days 0:21:43.314
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41287, 4004478a1ff8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt!KeInitializeProfile+38 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 00004004478a1ff8
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
 
BUGCHECK_STR:  0x1a_41287
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff8000303bb6e to fffff80003090f00
STACK_TEXT:  
fffff880`033e7538 fffff800`0303bb6e : 00000000`0000001a 00000000`00041287 00004004`478a1ff8 00000000`00000000 : nt!KeInitializeProfile+0x38
fffff880`033e7540 00000000`0000001a : 00000000`00041287 00004004`478a1ff8 00000000`00000000 00000000`00000000 : nt!ExpGetSystemProcessorInformation+0x25
fffff880`033e7548 00000000`00041287 : 00004004`478a1ff8 00000000`00000000 00000000`00000000 00000000`00000002 : 0x1a
fffff880`033e7550 00004004`478a1ff8 : 00000000`00000000 00000000`00000000 00000000`00000002 fffff880`03115180 : 0x41287
fffff880`033e7558 00000000`00000000 : 00000000`00000000 00000000`00000002 fffff880`03115180 fffff800`0309de18 : 0x4004`478a1ff8
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!KeInitializeProfile+38
fffff800`03090f00 48894c2408      mov     qword ptr [rsp+8],rcx
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!KeInitializeProfile+38
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600
FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!KeInitializeProfile+38
BUCKET_ID:  X64_0x1a_41287_nt!KeInitializeProfile+38
Followup: MachineOwner

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\sadon\Desktop\blue screens\022110-38766-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Windows\symbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0305b000 PsLoadedModuleList = 0xfffff800`03298e50
Debug session time: Sun Feb 21 05:25:37.181 2010 (GMT-8)
System Uptime: 0 days 0:49:24.243
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {ffffffffffffffff, 2, 1, fffff8000310dc22}
Probably caused by : memory_corruption ( nt!MmCreatePeb+227 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffffffffffffff, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000310dc22, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS:  ffffffffffffffff 
CURRENT_IRQL:  0
FAULTING_IP: 
nt!MmCreatePeb+227
fffff800`0310dc22 48890a          mov     qword ptr [rdx],rcx
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
LAST_CONTROL_TRANSFER:  from fffff800030cc469 to fffff800030ccf00
STACK_TEXT:  
fffff880`0c9bd238 fffff800`030cc469 : 00000000`0000000a ffffffff`ffffffff 00000000`00000002 00000000`00000001 : nt!KeInitializeProfile+0x38
fffff880`0c9bd240 00000000`0000000a : ffffffff`ffffffff 00000000`00000002 00000000`00000001 fffff800`0310dc22 : nt!SdbQueryDataExTagID+0x1e7
fffff880`0c9bd248 ffffffff`ffffffff : 00000000`00000002 00000000`00000001 fffff800`0310dc22 00000000`00000000 : 0xa
fffff880`0c9bd250 00000000`00000002 : 00000000`00000001 fffff800`0310dc22 00000000`00000000 00000000`00000000 : 0xffffffff`ffffffff
fffff880`0c9bd258 00000000`00000001 : fffff800`0310dc22 00000000`00000000 00000000`00000000 04000004`0031005b : 0x2
fffff880`0c9bd260 fffff800`0310dc22 : 00000000`00000000 00000000`00000000 04000004`0031005b 00000000`04000000 : 0x1
fffff880`0c9bd268 00000000`00000000 : 00000000`00000000 04000004`0031005b 00000000`04000000 00000000`04000000 : nt!MmCreatePeb+0x227

STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MmCreatePeb+227
fffff800`0310dc22 48890a          mov     qword ptr [rdx],rcx
SYMBOL_STACK_INDEX:  6
SYMBOL_NAME:  nt!MmCreatePeb+227
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  X64_0xA_nt!MmCreatePeb+227
BUCKET_ID:  X64_0xA_nt!MmCreatePeb+227
Followup: MachineOwner
---------

zigzag3143 said:

Code:

amdxata.sys        fffff880`01097000    fffff880`010a2000    0x0000b000    0x4a12f2eb    5/19/2009 12:56:59 PM                        
rtkio.sys        fffff880`07995000    fffff880`0799d000    0x00008000    0x4a3c7af9    6/20/2009 1:00:25 AM

sadon said:

I have managed to update the first two driveres (LHidFilt.Sys & LMouFilt.Sys) however, i have been trying to update the last two but couldn't. It says in the amdxata.sys properties (when you go to C drive and then Windows folder -> System32 -> drivers -> amdxata.sys) that this driver is an AMD driver! My CPU is core i7 and I am only using one producrt from AMD which is ATI Radeon HD 5850. And for this graphic card, i compeletly uninstalled the driver and then reinstalled it once again. I am not sure whether this will do the updating or not.


for rtkio.sys, it's not even in the folder drivers! (when you go to C drive and then Windows folder -> System32 -> drivers -> rtkio.sys)
Only Rt64win7.sys and RTKVHD64.sys are listed.

Hi -

The drivers noted by zigzag3143 were listed the dumps. Not all drivers reside in \windows\system32\drivers. Do some REGEDIT'ing and find rtkio.sys.
START | type regedit | go to the key -

Code:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services

Then look for rtkio. What is the description and location as listed within the REG key?

sadon said:

please, look guys to what i got from windbg when opening a dump file.

Symbol search path is: C:\Windows\symbols
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe

The errors surrounding the NT Kernel (inability to validate the timestamp on NT) in this case are due to incorrect symbols. Change the symbol path to include the MSDL SYM site -

Code:

 
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols

Use these commands at the kd> command line -

Code:

!analyze -v; kv; r; lmnt; lmntsm

I noted the time stamps on both BSODs; they obviously occurred after my last post and don't appear to be verifier-enabled.

Did those 2 BSODs occur post-KIS removal? Is KIS removed per instructions? If not, please do so.

If BSODs occur post KIS removal, please zip them up and attach to your next post.

Regards. . .

jcgriff2

.

jcgriff2 said:

zigzag3143 said:

Code:

amdxata.sys        fffff880`01097000    fffff880`010a2000    0x0000b000    0x4a12f2eb    5/19/2009 12:56:59 PM                        
rtkio.sys        fffff880`07995000    fffff880`0799d000    0x00008000    0x4a3c7af9    6/20/2009 1:00:25 AM

sadon said:

I have managed to update the first two driveres (LHidFilt.Sys & LMouFilt.Sys) however, i have been trying to update the last two but couldn't. It says in the amdxata.sys properties (when you go to C drive and then Windows folder -> System32 -> drivers -> amdxata.sys) that this driver is an AMD driver! My CPU is core i7 and I am only using one producrt from AMD which is ATI Radeon HD 5850. And for this graphic card, i compeletly uninstalled the driver and then reinstalled it once again. I am not sure whether this will do the updating or not.


for rtkio.sys, it's not even in the folder drivers! (when you go to C drive and then Windows folder -> System32 -> drivers -> rtkio.sys)
Only Rt64win7.sys and RTKVHD64.sys are listed.

Hi -

The drivers noted by zigzag3143 were listed the dumps. Not all drivers reside in \windows\system32\drivers. Do some REGEDIT'ing and find rtkio.sys.
START | type regedit | go to the key -

Code:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services

Then look for rtkio. What is the description and location as listed within the REG key?

sadon said:

please, look guys to what i got from windbg when opening a dump file.

Symbol search path is: C:\Windows\symbols
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe

The errors surrounding the NT Kernel (inability to validate the timestamp on NT) in this case are due to incorrect symbols. Change the symbol path to include the MSDL SYM site -

Code:

 
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols

Use these commands at the kd> command line -

Code:

!analyze -v; kv; r; lmnt; lmntsm

I noted the time stamps on both BSODs; they obviously occurred after my last post and don't appear to be verifier-enabled.

Did those 2 BSODs occur post-KIS removal? Is KIS removed per instructions? If not, please do so.

If BSODs occur post KIS removal, please zip them up and attach to your next post.

Regards. . .

jcgriff2

.

Thank you very very much jcgriff2 for helping me out.

Then look for rtkio. What is the description and location as listed within the REG key?

i got this one (please find the attached)







regarding, windbg
i did what you want me to do, and i got the following:

Code:

0: kd> !analyze -v; kv; r; lmnt; lmntsm
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031b2991, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800af357d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
nt!ExAllocatePoolWithTag+5c1
fffff800`031b2991 488910          mov     qword ptr [rax],rdx
CONTEXT:  fffff8800af357d0 -- (.cxr 0xfffff8800af357d0)
rax=ffe8fa80096cf010 rbx=fffff8a004acb000 rcx=fffffa80096cf010
rdx=fffff8a004acb170 rsi=0000000000001000 rdi=0000000000000001
rip=fffff800031b2991 rsp=fffff8800af361b0 rbp=fffffa80096ce3c0
 r8=0000000000000001  r9=fffffa80096cf170 r10=fffffa80096ce3c8
r11=0000000000000003 r12=0000000000000016 r13=0000000000000000
r14=fffffa8009c04060 r15=0000000062654c4b
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!ExAllocatePoolWithTag+0x5c1:
fffff800`031b2991 488910          mov     qword ptr [rax],rdx ds:002b:ffe8fa80`096cf010=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  svchost.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800031b2991
STACK_TEXT:  
fffff880`0af361b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolWithTag+0x5c1
 
FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+5c1
fffff800`031b2991 488910          mov     qword ptr [rax],rdx
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!ExAllocatePoolWithTag+5c1
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600
STACK_COMMAND:  .cxr 0xfffff8800af357d0 ; kb
FAILURE_BUCKET_ID:  X64_0x3B_nt!ExAllocatePoolWithTag+5c1
BUCKET_ID:  X64_0x3B_nt!ExAllocatePoolWithTag+5c1
Followup: MachineOwner
---------
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0af34f08 fffff800`0307f469 : 00000000`0000003b 00000000`c0000005 fffff800`031b2991 fffff880`0af357d0 : nt!KeBugCheckEx
fffff880`0af34f10 fffff800`0307edbc : fffff880`0af35f78 fffff880`0af357d0 00000000`00000000 fffff800`030ae450 : nt!KiBugCheckDispatch+0x69
fffff880`0af35050 fffff800`030a5bed : fffff800`032a1828 fffff800`031c6814 fffff800`0300e000 fffff880`0af35f78 : nt!KiSystemServiceHandler+0x7c
fffff880`0af35090 fffff800`030ad250 : fffff800`031ce1e8 fffff880`0af35108 fffff880`0af35f78 fffff800`0300e000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0af350c0 fffff800`030ba1b5 : fffff880`0af35f78 fffff880`0af357d0 fffff880`00000000 00000000`00000001 : nt!RtlDispatchException+0x410
fffff880`0af357a0 fffff800`0307f542 : fffff880`0af35f78 fffff8a0`04acb000 fffff880`0af36020 00000000`00001000 : nt!KiDispatchException+0x135
fffff880`0af35e40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
rax=fffff8800af35010 rbx=fffff800031ce1e8 rcx=000000000000003b
rdx=00000000c0000005 rsi=fffff8000300e000 rdi=0000000000000000
rip=fffff8000307ff00 rsp=fffff8800af34f08 rbp=0000000000000000
 r8=fffff800031b2991  r9=fffff8800af357d0 r10=0000000000000000
r11=fffff8800af35108 r12=fffff8000307f153 r13=fffff8000328c354
r14=fffff8000307ed40 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000282
nt!KeBugCheckEx:
fffff800`0307ff00 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0af34f10=000000000000003b
start             end                 module name
fffff800`00b99000 fffff800`00ba3000   kdcom    kdcom.dll    Mon Jul 13 18:31:07 2009 (4A5BDFDB)
fffff800`0300e000 fffff800`035eb000   nt       ntkrnlmp.exe Mon Jul 13 16:40:48 2009 (4A5BC600)
fffff800`035eb000 fffff800`03634000   hal      hal.dll      Mon Jul 13 18:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 16:20:33 2009 (4A5BC141)
fffff880`00c5c000 fffff880`00c7c000   jraid    jraid.sys    Wed Oct 07 04:26:03 2009 (4ACC7ACB)
fffff880`00c7c000 fffff880`00cab000   SCSIPORT SCSIPORT.SYS Mon Jul 13 17:01:04 2009 (4A5BCAC0)
fffff880`00cb5000 fffff880`00cf9000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 18:29:10 2009 (4A5BDF66)
fffff880`00cf9000 fffff880`00d0d000   PSHED    PSHED.dll    Mon Jul 13 18:32:23 2009 (4A5BE027)
fffff880`00d0d000 fffff880`00d6b000   CLFS     CLFS.SYS     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00d6b000 fffff880`00dc2000   ACPI     ACPI.sys     Mon Jul 13 16:19:34 2009 (4A5BC106)
fffff880`00dc2000 fffff880`00dd7000   volmgr   volmgr.sys   Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00dd7000 fffff880`00df1000   mountmgr mountmgr.sys Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00df1000 fffff880`00dff000   monitor  monitor.sys  Mon Jul 13 16:38:52 2009 (4A5BC58C)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 17:01:31 2009 (4A5BCADB)
fffff880`00e40000 fffff880`00e50000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`00e52000 fffff880`00f12000   CI       CI.dll       Mon Jul 13 18:32:13 2009 (4A5BE01D)
fffff880`00f12000 fffff880`00fb6000   Wdf01000 Wdf01000.sys Mon Jul 13 16:22:07 2009 (4A5BC19F)
fffff880`00fb6000 fffff880`00fc5000   WDFLDR   WDFLDR.SYS   Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00fc5000 fffff880`00fce000   WMILIB   WMILIB.SYS   Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00fce000 fffff880`00fd8000   msisadrv msisadrv.sys Mon Jul 13 16:19:26 2009 (4A5BC0FE)
fffff880`00fd8000 fffff880`00fed000   partmgr  partmgr.sys  Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00fed000 fffff880`00ff4000   pciide   pciide.sys   Mon Jul 13 16:19:49 2009 (4A5BC115)
fffff880`00ff4000 fffff880`00ffd000   atapi    atapi.sys    Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`01000000 fffff880`0101e000   tdx      tdx.sys      Mon Jul 13 16:21:15 2009 (4A5BC16B)
fffff880`0101e000 fffff880`0102b000   TDI      TDI.SYS      Mon Jul 13 16:21:18 2009 (4A5BC16E)
fffff880`01037000 fffff880`01061000   ataport  ataport.SYS  Mon Jul 13 16:19:52 2009 (4A5BC118)
fffff880`01061000 fffff880`0106c000   amdxata  amdxata.sys  Tue May 19 10:56:59 2009 (4A12F2EB)
fffff880`0106c000 fffff880`010b8000   fltmgr   fltmgr.sys   Mon Jul 13 16:19:59 2009 (4A5BC11F)
fffff880`010b8000 fffff880`010cc000   fileinfo fileinfo.sys Mon Jul 13 16:34:25 2009 (4A5BC481)
fffff880`010cc000 fffff880`0112a000   msrpc    msrpc.sys    Mon Jul 13 16:21:32 2009 (4A5BC17C)
fffff880`0112a000 fffff880`0119d000   cng      cng.sys      Mon Jul 13 16:49:40 2009 (4A5BC814)
fffff880`0119d000 fffff880`011e9000   volsnap  volsnap.sys  Mon Jul 13 16:20:08 2009 (4A5BC128)
fffff880`011e9000 fffff880`011fd000   LMouFilt LMouFilt.Sys Wed Jun 17 09:49:43 2009 (4A391EA7)
fffff880`01202000 fffff880`013a5000   Ntfs     Ntfs.sys     Mon Jul 13 16:20:47 2009 (4A5BC14F)
fffff880`013a5000 fffff880`013bf000   ksecdd   ksecdd.sys   Mon Jul 13 16:20:54 2009 (4A5BC156)
fffff880`013bf000 fffff880`013d0000   pcw      pcw.sys      Mon Jul 13 16:19:27 2009 (4A5BC0FF)
fffff880`013d0000 fffff880`013da000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 16:19:45 2009 (4A5BC111)
fffff880`013da000 fffff880`013e3000   rdprefmp rdprefmp.sys Mon Jul 13 17:16:35 2009 (4A5BCE63)
fffff880`013e3000 fffff880`013ee000   Msfs     Msfs.SYS     Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`013ee000 fffff880`013ff000   Npfs     Npfs.SYS     Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`01400000 fffff880`0144a000   fwpkclnt fwpkclnt.sys Mon Jul 13 16:21:08 2009 (4A5BC164)
fffff880`01451000 fffff880`01543000   ndis     ndis.sys     Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`01543000 fffff880`015a3000   NETIO    NETIO.SYS    Mon Jul 13 16:21:46 2009 (4A5BC18A)
fffff880`015a3000 fffff880`015ce000   ksecpkg  ksecpkg.sys  Mon Jul 13 16:50:34 2009 (4A5BC84A)
fffff880`015ce000 fffff880`015de000   vmstorfl vmstorfl.sys Mon Jul 13 16:42:54 2009 (4A5BC67E)
fffff880`015de000 fffff880`015e6000   spldr    spldr.sys    Mon May 11 09:56:27 2009 (4A0858BB)
fffff880`015e6000 fffff880`015ef000   RDPCDD   RDPCDD.sys   Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`015ef000 fffff880`015f8000   rdpencdd rdpencdd.sys Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Mon Jul 13 16:25:34 2009 (4A5BC26E)
fffff880`01800000 fffff880`0180d000   mouhid   mouhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`01813000 fffff880`0183d000   cdrom    cdrom.sys    Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`0183d000 fffff880`0189a000   klif     klif.sys     Wed Nov 11 05:32:16 2009 (4AFABCE0)
fffff880`0189a000 fffff880`018a3000   Null     Null.SYS     Mon Jul 13 16:19:37 2009 (4A5BC109)
fffff880`018a3000 fffff880`018aa000   Beep     Beep.SYS     Mon Jul 13 17:00:13 2009 (4A5BCA8D)
fffff880`018aa000 fffff880`018b8000   vga      vga.sys      Mon Jul 13 16:38:47 2009 (4A5BC587)
fffff880`018b8000 fffff880`018dd000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 16:38:51 2009 (4A5BC58B)
fffff880`018dd000 fffff880`018ed000   watchdog watchdog.sys Mon Jul 13 16:37:35 2009 (4A5BC53F)
fffff880`018f5000 fffff880`0192f000   rdyboost rdyboost.sys Mon Jul 13 16:34:34 2009 (4A5BC48A)
fffff880`0192f000 fffff880`01941000   mup      mup.sys      Mon Jul 13 16:23:45 2009 (4A5BC201)
fffff880`01941000 fffff880`0194f000   klbg     klbg.sys     Wed Oct 14 10:18:13 2009 (4AD607D5)
fffff880`0194f000 fffff880`01958000   hwpolicy hwpolicy.sys Mon Jul 13 16:19:22 2009 (4A5BC0FA)
fffff880`01958000 fffff880`01992000   fvevol   fvevol.sys   Mon Jul 13 16:22:15 2009 (4A5BC1A7)
fffff880`01992000 fffff880`019a8000   disk     disk.sys     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`019a8000 fffff880`019d8000   CLASSPNP CLASSPNP.SYS Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`019d8000 fffff880`019eb000   LHidFilt LHidFilt.Sys Wed Jun 17 09:49:39 2009 (4A391EA3)
fffff880`019eb000 fffff880`019f9000   kbdhid   kbdhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`02c00000 fffff880`02c26000   tunnel   tunnel.sys   Mon Jul 13 17:09:37 2009 (4A5BCCC1)
fffff880`02c26000 fffff880`02c3c000   intelppm intelppm.sys Mon Jul 13 16:19:25 2009 (4A5BC0FD)
fffff880`02c47000 fffff880`02cd1000   afd      afd.sys      Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`02cd1000 fffff880`02d22000   rdbss    rdbss.sys    Mon Jul 13 16:24:09 2009 (4A5BC219)
fffff880`02d22000 fffff880`02d31000   discache discache.sys Mon Jul 13 16:37:18 2009 (4A5BC52E)
fffff880`02d31000 fffff880`02db4000   csc      csc.sys      Mon Jul 13 16:24:26 2009 (4A5BC22A)
fffff880`02db4000 fffff880`02dd2000   dfsc     dfsc.sys     Mon Jul 13 16:23:44 2009 (4A5BC200)
fffff880`02dd2000 fffff880`02de3000   blbdrive blbdrive.sys Mon Jul 13 16:35:59 2009 (4A5BC4DF)
fffff880`02de3000 fffff880`02dfc000   HIDCLASS HIDCLASS.SYS Mon Jul 13 17:06:21 2009 (4A5BCBFD)
fffff880`03c00000 fffff880`03cc8000   HTTP     HTTP.sys     Mon Jul 13 16:22:16 2009 (4A5BC1A8)
fffff880`03cc8000 fffff880`03ce6000   bowser   bowser.sys   Mon Jul 13 16:23:50 2009 (4A5BC206)
fffff880`03cfb000 fffff880`03d1e000   luafv    luafv.sys    Mon Jul 13 16:26:13 2009 (4A5BC295)
fffff880`03d1e000 fffff880`03d33000   lltdio   lltdio.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`03d33000 fffff880`03d4b000   rspndr   rspndr.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`03d4b000 fffff880`03d63000   mpsdrv   mpsdrv.sys   Mon Jul 13 17:08:25 2009 (4A5BCC79)
fffff880`03d63000 fffff880`03d73000   btusbflt btusbflt.sys Wed Aug 27 18:12:08 2008 (48B5FB68)
fffff880`03d73000 fffff880`03da0000   mrxsmb   mrxsmb.sys   Thu Jan 07 19:38:26 2010 (4B46A8B2)
fffff880`03da0000 fffff880`03db8000   BTHUSB   BTHUSB.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`04000000 fffff880`04045000   netbt    netbt.sys    Mon Jul 13 16:21:28 2009 (4A5BC178)
fffff880`04045000 fffff880`0404e000   wfplwf   wfplwf.sys   Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`0404e000 fffff880`04074000   pacer    pacer.sys    Mon Jul 13 17:09:41 2009 (4A5BCCC5)
fffff880`04074000 fffff880`0407e000   klmouflt klmouflt.sys Fri Oct 02 08:38:29 2009 (4AC61E75)
fffff880`0407e000 fffff880`0408d000   netbios  netbios.sys  Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`0408d000 fffff880`040a8000   wanarp   wanarp.sys   Mon Jul 13 17:10:21 2009 (4A5BCCED)
fffff880`040a8000 fffff880`040bc000   termdd   termdd.sys   Mon Jul 13 17:16:36 2009 (4A5BCE64)
fffff880`040bc000 fffff880`040c8000   nsiproxy nsiproxy.sys Mon Jul 13 16:21:02 2009 (4A5BC15E)
fffff880`040cc000 fffff880`045f5000   kl1      kl1.sys      Tue Sep 01 04:29:21 2009 (4A9D0591)
fffff880`045f5000 fffff880`04600000   mssmbios mssmbios.sys Mon Jul 13 16:31:10 2009 (4A5BC3BE)
fffff880`04a00000 fffff880`04a24000   rasl2tp  rasl2tp.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a24000 fffff880`04a53000   ndiswan  ndiswan.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a53000 fffff880`04a6e000   raspppoe raspppoe.sys Mon Jul 13 17:10:17 2009 (4A5BCCE9)
fffff880`04a6e000 fffff880`04a7c000   hidusb   hidusb.sys   Mon Jul 13 17:06:22 2009 (4A5BCBFE)
fffff880`04a82000 fffff880`04ab2000   nusb3xhc nusb3xhc.sys Fri Sep 25 06:58:31 2009 (4ABCCC87)
fffff880`04ab2000 fffff880`04ab3f00   USBD     USBD.SYS     Mon Jul 13 17:06:23 2009 (4A5BCBFF)
fffff880`04ab4000 fffff880`04ae8000   atikmpag atikmpag.sys Tue Feb 02 19:23:59 2010 (4B68EC4F)
fffff880`04ae8000 fffff880`04bdc000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 18:00:14 2009 (4AC5509E)
fffff880`04bdc000 fffff880`04bf2000   AgileVpn AgileVpn.sys Mon Jul 13 17:10:24 2009 (4A5BCCF0)
fffff880`04bf2000 fffff880`04bfe000   Dxapi    Dxapi.sys    Mon Jul 13 16:38:28 2009 (4A5BC574)
fffff880`04c00000 fffff880`04c11000   usbehci  usbehci.sys  Mon Jul 13 17:06:30 2009 (4A5BCC06)
fffff880`04c11000 fffff880`04c50000   Rt64win7 Rt64win7.sys Thu Aug 20 09:05:06 2009 (4A8D7432)
fffff880`04c50000 fffff880`04c8e000   1394ohci 1394ohci.sys Mon Jul 13 17:07:12 2009 (4A5BCC30)
fffff880`04c8e000 fffff880`04c9b000   fdc      fdc.sys      Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`04c9b000 fffff880`04ca4000   wmiacpi  wmiacpi.sys  Mon Jul 13 16:31:02 2009 (4A5BC3B6)
fffff880`04ca4000 fffff880`04cb4000   CompositeBus CompositeBus.sys Mon Jul 13 17:00:33 2009 (4A5BCAA1)
fffff880`04cb4000 fffff880`04cbc080   HIDPARSE HIDPARSE.SYS Mon Jul 13 17:06:17 2009 (4A5BCBF9)
fffff880`04cbf000 fffff880`05323000   atipmdag atipmdag.sys Tue Feb 02 20:21:24 2010 (4B68F9C4)
fffff880`05323000 fffff880`05369000   dxgmms1  dxgmms1.sys  Mon Jul 13 16:38:32 2009 (4A5BC578)
fffff880`05369000 fffff880`0538d000   HDAudBus HDAudBus.sys Mon Jul 13 17:06:13 2009 (4A5BCBF5)
fffff880`0538d000 fffff880`0539a000   usbuhci  usbuhci.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`0539a000 fffff880`053f0000   USBPORT  USBPORT.SYS  Mon Jul 13 17:06:31 2009 (4A5BCC07)
fffff880`053f0000 fffff880`053fc000   ndistapi ndistapi.sys Mon Jul 13 17:10:00 2009 (4A5BCCD8)
fffff880`05800000 fffff880`0583d000   portcls  portcls.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`0583d000 fffff880`0585f000   drmk     drmk.sys     Mon Jul 13 18:01:25 2009 (4A5BD8E5)
fffff880`0585f000 fffff880`05864200   ksthunk  ksthunk.sys  Mon Jul 13 17:00:19 2009 (4A5BCA93)
fffff880`05867000 fffff880`05888000   raspptp  raspptp.sys  Mon Jul 13 17:10:18 2009 (4A5BCCEA)
fffff880`05888000 fffff880`058a2000   rassstp  rassstp.sys  Mon Jul 13 17:10:25 2009 (4A5BCCF1)
fffff880`058a2000 fffff880`058ad000   rdpbus   rdpbus.sys   Mon Jul 13 17:17:46 2009 (4A5BCEAA)
fffff880`058ad000 fffff880`058bc000   kbdclass kbdclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`058bc000 fffff880`058cb000   mouclass mouclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`058cb000 fffff880`058cc480   swenum   swenum.sys   Mon Jul 13 17:00:18 2009 (4A5BCA92)
fffff880`058cd000 fffff880`05910000   ks       ks.sys       Mon Jul 13 17:00:31 2009 (4A5BCA9F)
fffff880`05910000 fffff880`05922000   umbus    umbus.sys    Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`05922000 fffff880`05938000   nusb3hub nusb3hub.sys Fri Sep 25 06:58:23 2009 (4ABCCC7F)
fffff880`05938000 fffff880`05992000   usbhub   usbhub.sys   Mon Jul 13 17:07:09 2009 (4A5BCC2D)
fffff880`05992000 fffff880`0599d000   flpydisk flpydisk.sys Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`0599d000 fffff880`059b2000   NDProxy  NDProxy.SYS  Mon Jul 13 17:10:05 2009 (4A5BCCDD)
fffff880`059b2000 fffff880`059d4000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 17:03:36 2010 (4B6233E8)
fffff880`059d4000 fffff880`059e2000   crashdmp crashdmp.sys Mon Jul 13 17:01:01 2009 (4A5BCABD)
fffff880`059e2000 fffff880`059eb000   dump_atapi dump_atapi.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`059eb000 fffff880`059fe000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 16:21:51 2009 (4A5BC18F)
fffff880`07608000 fffff880`077f2080   RTKVHD64 RTKVHD64.sys Wed Oct 21 07:27:48 2009 (4ADF1A64)
fffff880`077f3000 fffff880`077ff000   dump_dumpata dump_dumpata.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`08837000 fffff880`088c3000   bthport  bthport.sys  Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`088c3000 fffff880`08910000   mrxsmb10 mrxsmb10.sys Thu Jan 07 19:38:32 2010 (4B46A8B8)
fffff880`08910000 fffff880`0893c000   rfcomm   rfcomm.sys   Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`0893c000 fffff880`0895f000   mrxsmb20 mrxsmb20.sys Mon Jul 13 16:24:05 2009 (4A5BC215)
fffff880`0895f000 fffff880`0896f000   BthEnum  BthEnum.sys  Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`0896f000 fffff880`0898f000   bthpan   bthpan.sys   Mon Jul 13 17:07:00 2009 (4A5BCC24)
fffff880`0898f000 fffff880`089ad000   hidbth   hidbth.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`089ad000 fffff880`089b5000   cpuz132_x64 cpuz132_x64.sys Thu Mar 26 16:17:23 2009 (49CC0D03)
fffff880`09257000 fffff880`092c8000   spsys    spsys.sys    Mon May 11 10:20:58 2009 (4A085E7A)
fffff880`092c8000 fffff880`092d3000   asyncmac asyncmac.sys Mon Jul 13 17:10:13 2009 (4A5BCCE5)
fffff880`0aa00000 fffff880`0aa98000   srv      srv.sys      Tue Dec 08 00:32:55 2009 (4B1E0F37)
fffff880`0aa98000 fffff880`0aaa0000   rtkio    rtkio.sys    Fri Jun 19 23:00:25 2009 (4A3C7AF9)
fffff880`0aaa1000 fffff880`0ab47000   peauth   peauth.sys   Mon Jul 13 18:01:19 2009 (4A5BD8DF)
fffff880`0ab47000 fffff880`0ab52000   secdrv   secdrv.SYS   Wed Sep 13 06:18:38 2006 (4508052E)
fffff880`0ab52000 fffff880`0ab7f000   srvnet   srvnet.sys   Tue Dec 08 00:32:26 2009 (4B1E0F1A)
fffff880`0ab7f000 fffff880`0ab91000   tcpipreg tcpipreg.sys Mon Jul 13 17:09:49 2009 (4A5BCCCD)
fffff880`0ab91000 fffff880`0abfa000   srv2     srv2.sys     Mon Jul 13 16:25:02 2009 (4A5BC24E)
fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Mon Jul 13 16:40:17 2009 (4A5BC5E1)
fffff960`00590000 fffff960`0059a000   TSDDD    TSDDD.dll    Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff960`007a0000 fffff960`007c7000   cdd      cdd.dll      unavailable (00000000)
Unloaded modules:
fffff880`019d8000 fffff880`019e6000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019e6000 fffff880`019f2000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019f2000 fffff880`019fb000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01800000 fffff880`01813000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04074000 fffff880`0407e000   klim6.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
start             end                 module name
fffff880`04c50000 fffff880`04c8e000   1394ohci 1394ohci.sys Mon Jul 13 17:07:12 2009 (4A5BCC30)
fffff880`00d6b000 fffff880`00dc2000   ACPI     ACPI.sys     Mon Jul 13 16:19:34 2009 (4A5BC106)
fffff880`02c47000 fffff880`02cd1000   afd      afd.sys      Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`04bdc000 fffff880`04bf2000   AgileVpn AgileVpn.sys Mon Jul 13 17:10:24 2009 (4A5BCCF0)
fffff880`01061000 fffff880`0106c000   amdxata  amdxata.sys  Tue May 19 10:56:59 2009 (4A12F2EB)
fffff880`092c8000 fffff880`092d3000   asyncmac asyncmac.sys Mon Jul 13 17:10:13 2009 (4A5BCCE5)
fffff880`00ff4000 fffff880`00ffd000   atapi    atapi.sys    Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`01037000 fffff880`01061000   ataport  ataport.SYS  Mon Jul 13 16:19:52 2009 (4A5BC118)
fffff880`059b2000 fffff880`059d4000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 17:03:36 2010 (4B6233E8)
fffff880`04ab4000 fffff880`04ae8000   atikmpag atikmpag.sys Tue Feb 02 19:23:59 2010 (4B68EC4F)
fffff880`04cbf000 fffff880`05323000   atipmdag atipmdag.sys Tue Feb 02 20:21:24 2010 (4B68F9C4)
fffff880`018a3000 fffff880`018aa000   Beep     Beep.SYS     Mon Jul 13 17:00:13 2009 (4A5BCA8D)
fffff880`02dd2000 fffff880`02de3000   blbdrive blbdrive.sys Mon Jul 13 16:35:59 2009 (4A5BC4DF)
fffff880`03cc8000 fffff880`03ce6000   bowser   bowser.sys   Mon Jul 13 16:23:50 2009 (4A5BC206)
fffff880`0895f000 fffff880`0896f000   BthEnum  BthEnum.sys  Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`0896f000 fffff880`0898f000   bthpan   bthpan.sys   Mon Jul 13 17:07:00 2009 (4A5BCC24)
fffff880`08837000 fffff880`088c3000   bthport  bthport.sys  Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`03da0000 fffff880`03db8000   BTHUSB   BTHUSB.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`03d63000 fffff880`03d73000   btusbflt btusbflt.sys Wed Aug 27 18:12:08 2008 (48B5FB68)
fffff960`007a0000 fffff960`007c7000   cdd      cdd.dll      unavailable (00000000)
fffff880`01813000 fffff880`0183d000   cdrom    cdrom.sys    Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00e52000 fffff880`00f12000   CI       CI.dll       Mon Jul 13 18:32:13 2009 (4A5BE01D)
fffff880`019a8000 fffff880`019d8000   CLASSPNP CLASSPNP.SYS Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00d0d000 fffff880`00d6b000   CLFS     CLFS.SYS     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`0112a000 fffff880`0119d000   cng      cng.sys      Mon Jul 13 16:49:40 2009 (4A5BC814)
fffff880`04ca4000 fffff880`04cb4000   CompositeBus CompositeBus.sys Mon Jul 13 17:00:33 2009 (4A5BCAA1)
fffff880`089ad000 fffff880`089b5000   cpuz132_x64 cpuz132_x64.sys Thu Mar 26 16:17:23 2009 (49CC0D03)
fffff880`059d4000 fffff880`059e2000   crashdmp crashdmp.sys Mon Jul 13 17:01:01 2009 (4A5BCABD)
fffff880`02d31000 fffff880`02db4000   csc      csc.sys      Mon Jul 13 16:24:26 2009 (4A5BC22A)
fffff880`02db4000 fffff880`02dd2000   dfsc     dfsc.sys     Mon Jul 13 16:23:44 2009 (4A5BC200)
fffff880`02d22000 fffff880`02d31000   discache discache.sys Mon Jul 13 16:37:18 2009 (4A5BC52E)
fffff880`01992000 fffff880`019a8000   disk     disk.sys     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`0583d000 fffff880`0585f000   drmk     drmk.sys     Mon Jul 13 18:01:25 2009 (4A5BD8E5)
fffff880`059e2000 fffff880`059eb000   dump_atapi dump_atapi.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`077f3000 fffff880`077ff000   dump_dumpata dump_dumpata.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`059eb000 fffff880`059fe000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 16:21:51 2009 (4A5BC18F)
fffff880`04bf2000 fffff880`04bfe000   Dxapi    Dxapi.sys    Mon Jul 13 16:38:28 2009 (4A5BC574)
fffff880`04ae8000 fffff880`04bdc000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 18:00:14 2009 (4AC5509E)
fffff880`05323000 fffff880`05369000   dxgmms1  dxgmms1.sys  Mon Jul 13 16:38:32 2009 (4A5BC578)
fffff880`04c8e000 fffff880`04c9b000   fdc      fdc.sys      Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`010b8000 fffff880`010cc000   fileinfo fileinfo.sys Mon Jul 13 16:34:25 2009 (4A5BC481)
fffff880`05992000 fffff880`0599d000   flpydisk flpydisk.sys Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`0106c000 fffff880`010b8000   fltmgr   fltmgr.sys   Mon Jul 13 16:19:59 2009 (4A5BC11F)
fffff880`013d0000 fffff880`013da000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 16:19:45 2009 (4A5BC111)
fffff880`01958000 fffff880`01992000   fvevol   fvevol.sys   Mon Jul 13 16:22:15 2009 (4A5BC1A7)
fffff880`01400000 fffff880`0144a000   fwpkclnt fwpkclnt.sys Mon Jul 13 16:21:08 2009 (4A5BC164)
fffff800`035eb000 fffff800`03634000   hal      hal.dll      Mon Jul 13 18:27:36 2009 (4A5BDF08)
fffff880`05369000 fffff880`0538d000   HDAudBus HDAudBus.sys Mon Jul 13 17:06:13 2009 (4A5BCBF5)
fffff880`0898f000 fffff880`089ad000   hidbth   hidbth.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`02de3000 fffff880`02dfc000   HIDCLASS HIDCLASS.SYS Mon Jul 13 17:06:21 2009 (4A5BCBFD)
fffff880`04cb4000 fffff880`04cbc080   HIDPARSE HIDPARSE.SYS Mon Jul 13 17:06:17 2009 (4A5BCBF9)
fffff880`04a6e000 fffff880`04a7c000   hidusb   hidusb.sys   Mon Jul 13 17:06:22 2009 (4A5BCBFE)
fffff880`03c00000 fffff880`03cc8000   HTTP     HTTP.sys     Mon Jul 13 16:22:16 2009 (4A5BC1A8)
fffff880`0194f000 fffff880`01958000   hwpolicy hwpolicy.sys Mon Jul 13 16:19:22 2009 (4A5BC0FA)
fffff880`02c26000 fffff880`02c3c000   intelppm intelppm.sys Mon Jul 13 16:19:25 2009 (4A5BC0FD)
fffff880`00c5c000 fffff880`00c7c000   jraid    jraid.sys    Wed Oct 07 04:26:03 2009 (4ACC7ACB)
fffff880`058ad000 fffff880`058bc000   kbdclass kbdclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`019eb000 fffff880`019f9000   kbdhid   kbdhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff800`00b99000 fffff800`00ba3000   kdcom    kdcom.dll    Mon Jul 13 18:31:07 2009 (4A5BDFDB)
fffff880`040cc000 fffff880`045f5000   kl1      kl1.sys      Tue Sep 01 04:29:21 2009 (4A9D0591)
fffff880`01941000 fffff880`0194f000   klbg     klbg.sys     Wed Oct 14 10:18:13 2009 (4AD607D5)
fffff880`0183d000 fffff880`0189a000   klif     klif.sys     Wed Nov 11 05:32:16 2009 (4AFABCE0)
fffff880`04074000 fffff880`0407e000   klmouflt klmouflt.sys Fri Oct 02 08:38:29 2009 (4AC61E75)
fffff880`058cd000 fffff880`05910000   ks       ks.sys       Mon Jul 13 17:00:31 2009 (4A5BCA9F)
fffff880`013a5000 fffff880`013bf000   ksecdd   ksecdd.sys   Mon Jul 13 16:20:54 2009 (4A5BC156)
fffff880`015a3000 fffff880`015ce000   ksecpkg  ksecpkg.sys  Mon Jul 13 16:50:34 2009 (4A5BC84A)
fffff880`0585f000 fffff880`05864200   ksthunk  ksthunk.sys  Mon Jul 13 17:00:19 2009 (4A5BCA93)
fffff880`019d8000 fffff880`019eb000   LHidFilt LHidFilt.Sys Wed Jun 17 09:49:39 2009 (4A391EA3)
fffff880`03d1e000 fffff880`03d33000   lltdio   lltdio.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`011e9000 fffff880`011fd000   LMouFilt LMouFilt.Sys Wed Jun 17 09:49:43 2009 (4A391EA7)
fffff880`03cfb000 fffff880`03d1e000   luafv    luafv.sys    Mon Jul 13 16:26:13 2009 (4A5BC295)
fffff880`00cb5000 fffff880`00cf9000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 18:29:10 2009 (4A5BDF66)
fffff880`00df1000 fffff880`00dff000   monitor  monitor.sys  Mon Jul 13 16:38:52 2009 (4A5BC58C)
fffff880`058bc000 fffff880`058cb000   mouclass mouclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`01800000 fffff880`0180d000   mouhid   mouhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`00dd7000 fffff880`00df1000   mountmgr mountmgr.sys Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`03d4b000 fffff880`03d63000   mpsdrv   mpsdrv.sys   Mon Jul 13 17:08:25 2009 (4A5BCC79)
fffff880`03d73000 fffff880`03da0000   mrxsmb   mrxsmb.sys   Thu Jan 07 19:38:26 2010 (4B46A8B2)
fffff880`088c3000 fffff880`08910000   mrxsmb10 mrxsmb10.sys Thu Jan 07 19:38:32 2010 (4B46A8B8)
fffff880`0893c000 fffff880`0895f000   mrxsmb20 mrxsmb20.sys Mon Jul 13 16:24:05 2009 (4A5BC215)
fffff880`013e3000 fffff880`013ee000   Msfs     Msfs.SYS     Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`00fce000 fffff880`00fd8000   msisadrv msisadrv.sys Mon Jul 13 16:19:26 2009 (4A5BC0FE)
fffff880`010cc000 fffff880`0112a000   msrpc    msrpc.sys    Mon Jul 13 16:21:32 2009 (4A5BC17C)
fffff880`045f5000 fffff880`04600000   mssmbios mssmbios.sys Mon Jul 13 16:31:10 2009 (4A5BC3BE)
fffff880`0192f000 fffff880`01941000   mup      mup.sys      Mon Jul 13 16:23:45 2009 (4A5BC201)
fffff880`01451000 fffff880`01543000   ndis     ndis.sys     Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`053f0000 fffff880`053fc000   ndistapi ndistapi.sys Mon Jul 13 17:10:00 2009 (4A5BCCD8)
fffff880`04a24000 fffff880`04a53000   ndiswan  ndiswan.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`0599d000 fffff880`059b2000   NDProxy  NDProxy.SYS  Mon Jul 13 17:10:05 2009 (4A5BCCDD)
fffff880`0407e000 fffff880`0408d000   netbios  netbios.sys  Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`04000000 fffff880`04045000   netbt    netbt.sys    Mon Jul 13 16:21:28 2009 (4A5BC178)
fffff880`01543000 fffff880`015a3000   NETIO    NETIO.SYS    Mon Jul 13 16:21:46 2009 (4A5BC18A)
fffff880`013ee000 fffff880`013ff000   Npfs     Npfs.SYS     Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`040bc000 fffff880`040c8000   nsiproxy nsiproxy.sys Mon Jul 13 16:21:02 2009 (4A5BC15E)
fffff800`0300e000 fffff800`035eb000   nt       ntkrnlmp.exe Mon Jul 13 16:40:48 2009 (4A5BC600)
fffff880`01202000 fffff880`013a5000   Ntfs     Ntfs.sys     Mon Jul 13 16:20:47 2009 (4A5BC14F)
fffff880`0189a000 fffff880`018a3000   Null     Null.SYS     Mon Jul 13 16:19:37 2009 (4A5BC109)
fffff880`05922000 fffff880`05938000   nusb3hub nusb3hub.sys Fri Sep 25 06:58:23 2009 (4ABCCC7F)
fffff880`04a82000 fffff880`04ab2000   nusb3xhc nusb3xhc.sys Fri Sep 25 06:58:31 2009 (4ABCCC87)
fffff880`0404e000 fffff880`04074000   pacer    pacer.sys    Mon Jul 13 17:09:41 2009 (4A5BCCC5)
fffff880`00fd8000 fffff880`00fed000   partmgr  partmgr.sys  Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00fed000 fffff880`00ff4000   pciide   pciide.sys   Mon Jul 13 16:19:49 2009 (4A5BC115)
fffff880`00e40000 fffff880`00e50000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`013bf000 fffff880`013d0000   pcw      pcw.sys      Mon Jul 13 16:19:27 2009 (4A5BC0FF)
fffff880`0aaa1000 fffff880`0ab47000   peauth   peauth.sys   Mon Jul 13 18:01:19 2009 (4A5BD8DF)
fffff880`05800000 fffff880`0583d000   portcls  portcls.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`00cf9000 fffff880`00d0d000   PSHED    PSHED.dll    Mon Jul 13 18:32:23 2009 (4A5BE027)
fffff880`04a00000 fffff880`04a24000   rasl2tp  rasl2tp.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a53000 fffff880`04a6e000   raspppoe raspppoe.sys Mon Jul 13 17:10:17 2009 (4A5BCCE9)
fffff880`05867000 fffff880`05888000   raspptp  raspptp.sys  Mon Jul 13 17:10:18 2009 (4A5BCCEA)
fffff880`05888000 fffff880`058a2000   rassstp  rassstp.sys  Mon Jul 13 17:10:25 2009 (4A5BCCF1)
fffff880`02cd1000 fffff880`02d22000   rdbss    rdbss.sys    Mon Jul 13 16:24:09 2009 (4A5BC219)
fffff880`058a2000 fffff880`058ad000   rdpbus   rdpbus.sys   Mon Jul 13 17:17:46 2009 (4A5BCEAA)
fffff880`015e6000 fffff880`015ef000   RDPCDD   RDPCDD.sys   Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`015ef000 fffff880`015f8000   rdpencdd rdpencdd.sys Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`013da000 fffff880`013e3000   rdprefmp rdprefmp.sys Mon Jul 13 17:16:35 2009 (4A5BCE63)
fffff880`018f5000 fffff880`0192f000   rdyboost rdyboost.sys Mon Jul 13 16:34:34 2009 (4A5BC48A)
fffff880`08910000 fffff880`0893c000   rfcomm   rfcomm.sys   Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`03d33000 fffff880`03d4b000   rspndr   rspndr.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`04c11000 fffff880`04c50000   Rt64win7 Rt64win7.sys Thu Aug 20 09:05:06 2009 (4A8D7432)
fffff880`0aa98000 fffff880`0aaa0000   rtkio    rtkio.sys    Fri Jun 19 23:00:25 2009 (4A3C7AF9)
fffff880`07608000 fffff880`077f2080   RTKVHD64 RTKVHD64.sys Wed Oct 21 07:27:48 2009 (4ADF1A64)
fffff880`00c7c000 fffff880`00cab000   SCSIPORT SCSIPORT.SYS Mon Jul 13 17:01:04 2009 (4A5BCAC0)
fffff880`0ab47000 fffff880`0ab52000   secdrv   secdrv.SYS   Wed Sep 13 06:18:38 2006 (4508052E)
fffff880`015de000 fffff880`015e6000   spldr    spldr.sys    Mon May 11 09:56:27 2009 (4A0858BB)
fffff880`09257000 fffff880`092c8000   spsys    spsys.sys    Mon May 11 10:20:58 2009 (4A085E7A)
fffff880`0aa00000 fffff880`0aa98000   srv      srv.sys      Tue Dec 08 00:32:55 2009 (4B1E0F37)
fffff880`0ab91000 fffff880`0abfa000   srv2     srv2.sys     Mon Jul 13 16:25:02 2009 (4A5BC24E)
fffff880`0ab52000 fffff880`0ab7f000   srvnet   srvnet.sys   Tue Dec 08 00:32:26 2009 (4B1E0F1A)
fffff880`058cb000 fffff880`058cc480   swenum   swenum.sys   Mon Jul 13 17:00:18 2009 (4A5BCA92)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Mon Jul 13 16:25:34 2009 (4A5BC26E)
fffff880`0ab7f000 fffff880`0ab91000   tcpipreg tcpipreg.sys Mon Jul 13 17:09:49 2009 (4A5BCCCD)
fffff880`0101e000 fffff880`0102b000   TDI      TDI.SYS      Mon Jul 13 16:21:18 2009 (4A5BC16E)
fffff880`01000000 fffff880`0101e000   tdx      tdx.sys      Mon Jul 13 16:21:15 2009 (4A5BC16B)
fffff880`040a8000 fffff880`040bc000   termdd   termdd.sys   Mon Jul 13 17:16:36 2009 (4A5BCE64)
fffff960`00590000 fffff960`0059a000   TSDDD    TSDDD.dll    Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`02c00000 fffff880`02c26000   tunnel   tunnel.sys   Mon Jul 13 17:09:37 2009 (4A5BCCC1)
fffff880`05910000 fffff880`05922000   umbus    umbus.sys    Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`04ab2000 fffff880`04ab3f00   USBD     USBD.SYS     Mon Jul 13 17:06:23 2009 (4A5BCBFF)
fffff880`04c00000 fffff880`04c11000   usbehci  usbehci.sys  Mon Jul 13 17:06:30 2009 (4A5BCC06)
fffff880`05938000 fffff880`05992000   usbhub   usbhub.sys   Mon Jul 13 17:07:09 2009 (4A5BCC2D)
fffff880`0539a000 fffff880`053f0000   USBPORT  USBPORT.SYS  Mon Jul 13 17:06:31 2009 (4A5BCC07)
fffff880`0538d000 fffff880`0539a000   usbuhci  usbuhci.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 17:01:31 2009 (4A5BCADB)
fffff880`018aa000 fffff880`018b8000   vga      vga.sys      Mon Jul 13 16:38:47 2009 (4A5BC587)
fffff880`018b8000 fffff880`018dd000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 16:38:51 2009 (4A5BC58B)
fffff880`015ce000 fffff880`015de000   vmstorfl vmstorfl.sys Mon Jul 13 16:42:54 2009 (4A5BC67E)
fffff880`00dc2000 fffff880`00dd7000   volmgr   volmgr.sys   Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 16:20:33 2009 (4A5BC141)
fffff880`0119d000 fffff880`011e9000   volsnap  volsnap.sys  Mon Jul 13 16:20:08 2009 (4A5BC128)
fffff880`0408d000 fffff880`040a8000   wanarp   wanarp.sys   Mon Jul 13 17:10:21 2009 (4A5BCCED)
fffff880`018dd000 fffff880`018ed000   watchdog watchdog.sys Mon Jul 13 16:37:35 2009 (4A5BC53F)
fffff880`00f12000 fffff880`00fb6000   Wdf01000 Wdf01000.sys Mon Jul 13 16:22:07 2009 (4A5BC19F)
fffff880`00fb6000 fffff880`00fc5000   WDFLDR   WDFLDR.SYS   Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`04045000 fffff880`0404e000   wfplwf   wfplwf.sys   Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Mon Jul 13 16:40:17 2009 (4A5BC5E1)
fffff880`04c9b000 fffff880`04ca4000   wmiacpi  wmiacpi.sys  Mon Jul 13 16:31:02 2009 (4A5BC3B6)
fffff880`00fc5000 fffff880`00fce000   WMILIB   WMILIB.SYS   Mon Jul 13 16:19:51 2009 (4A5BC117)
Unloaded modules:
fffff880`019d8000 fffff880`019e6000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019e6000 fffff880`019f2000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019f2000 fffff880`019fb000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01800000 fffff880`01813000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04074000 fffff880`0407e000   klim6.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

And regarding KIS, first by KIS you mean (Kaspersky Internet Security), i got all the BSODs while KIS was running. Just shortly, i terminated it to see if it was the culprit (and I'm really having the feeling it is the one that made all this mess all along!).

( by the way, the commands you told me to put in dk> were executed while KIS was already terminated).

jcgriff2 said:

Hi -

Thank you for your trust and understanding opposite the Driver Verifier as well as the info you posted and the dump attached.

Capt.Jack Sparrow said:

Also if your using any third party Antivirus / Firewall uninstall it and see whether it makes any difference.

Thank you, Jack... your 4-day old post held the key for the latest BSOD granted to us by the Driver Verifier - in less than 3 min 8 secs ! !

The dump was indeed a VERIFIER_ENABLED_VISTA_MINIDUMP (Yes, Windows 7 D/V induced dumps do say "Vista"!). The bugcheck -

0xc1 = a driver has written to an invalid area of the special pool.

The cuprit caught red-handed =klif.sys Wed Nov 11 08:32:16 2009 (4AFABCE0)

Kaspersky Internet Security. It must go. Un-install KIS using the KIS Removal Tool (KRT) -

KRT download --> Kaspersky Americas Support and Services United States

Download the KRT; save to desktop.

Boot into SAFEMODE - NO Networking. Tap the F8 key repeatedly during boot-up.

Then go to desktop, RIGHT-click on the KRT icon and select "Run as Administrator". When complete - re-boot.

Reset the Windows Firewall to its default settings -
START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on "Restore Defaults" | Click Apply, OK

I would recommend Microsoft Security Essentials, available FREE --> http://www.microsoft.com/Security_Essentials/

See if BSODs persist pot-KIS removal.

Regards. . .

jcgriff2

.

Windows 7 x64 - DRIVER_VERIFIER_ENABLED_DUMP - Bugcheck 0xc1

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\!_jcgriff2\022010-36831-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
 
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03054000 PsLoadedModuleList = 0xfffff800`03291e50
Debug session time: Sat Feb 20 13:23:41.204 2010 (GMT-5)
System Uptime: 0 days 0:03:08.266
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff98025680f20, fffff98025680eee, fd40e0, 32}
Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+1b17c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98025680f20, address trying to free
Arg2: fffff98025680eee, address where one bit is corrupted
Arg3: 0000000000fd40e0, (reserved)
Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error
Debugging Details:
------------------
 
BUGCHECK_STR:  0xC1_32
SPECIAL_POOL_CORRUPTION_TYPE:  32
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  avp.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff80003154593 to fffff800030c5f00
STACK_TEXT:  
fffff880`049aa718 fffff800`03154593 : 00000000`000000c1 fffff980`25680f20 fffff980`25680eee 00000000`00fd40e0 : nt!KeBugCheckEx
fffff880`049aa720 fffff800`031cb613 : fffff980`1f3c8f00 00000000`0206f12c fffff980`25680f20 fffff980`1f356680 : nt!MiCheckSpecialPoolSlop+0x83
fffff880`049aa760 fffff800`031f7356 : 00000000`000000e1 00000000`69664c4b ffffffff`ffffff50 fffff980`1f356680 : nt!MmFreeSpecialPool+0x1d3
fffff880`049aa890 fffff880`03c2717c : 00000000`0000000f 00000000`c0000225 00000000`00000014 fffff980`1f356680 : nt!ExFreePool+0x9f3
fffff880`049aa940 00000000`0000000f : 00000000`c0000225 00000000`00000014 fffff980`1f356680 00000000`00000000 : klif+0x1b17c
fffff880`049aa948 00000000`c0000225 : 00000000`00000014 fffff980`1f356680 00000000`00000000 fffff880`03c51b50 : 0xf
fffff880`049aa950 00000000`00000014 : fffff980`1f356680 00000000`00000000 fffff880`03c51b50 00000000`00000000 : 0xc0000225
fffff880`049aa958 fffff980`1f356680 : 00000000`00000000 fffff880`03c51b50 00000000`00000000 00000000`00010212 : 0x14
fffff880`049aa960 00000000`00000000 : fffff880`03c51b50 00000000`00000000 00000000`00010212 fffff980`1f356680 : 0xfffff980`1f356680
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
klif+1b17c
fffff880`03c2717c ??              ???
SYMBOL_STACK_INDEX:  4
SYMBOL_NAME:  klif+1b17c
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: klif
IMAGE_NAME:  klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  4afabce0
FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_klif+1b17c
BUCKET_ID:  X64_0xC1_32_VRF_klif+1b17c
Followup: MachineOwner
---------
3: kd> lmvm klif
start             end                 module name
fffff880`03c0c000 fffff880`03c69000   klif     T (no symbols)           
Loaded symbol image file: klif.sys
Image path: \SystemRoot\system32\DRIVERS\klif.sys
Image name: klif.sys
Timestamp:        Wed Nov 11 08:32:16 2009 (4AFABCE0)
CheckSum:         00060F42
ImageSize:        0005D000
Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
3: kd> k
Child-SP          RetAddr           Call Site
fffff880`049aa718 fffff800`03154593 nt!KeBugCheckEx
fffff880`049aa720 fffff800`031cb613 nt!MiCheckSpecialPoolSlop+0x83
fffff880`049aa760 fffff800`031f7356 nt!MmFreeSpecialPool+0x1d3
fffff880`049aa890 fffff880`03c2717c nt!ExFreePool+0x9f3
fffff880`049aa940 00000000`0000000f klif+0x1b17c
fffff880`049aa948 00000000`c0000225 0xf
fffff880`049aa950 00000000`00000014 0xc0000225
fffff880`049aa958 fffff980`1f356680 0x14
fffff880`049aa960 00000000`00000000 0xfffff980`1f356680
3: kd> lmntsm
start             end                 module name
fffff880`05384000 fffff880`053c2000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f70000 fffff880`00fc7000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`03d1e000 fffff880`03da8000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`053c2000 fffff880`053d8000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`011ed000 fffff880`011f8000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`011ba000 fffff880`011c3000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011c3000 fffff880`011ed000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`05cbf000 fffff880`05ce1000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 20:03:36 2010 (4B6233E8)
fffff880`045c4000 fffff880`045f8000   atikmpag atikmpag.sys Tue Feb 02 22:23:59 2010 (4B68EC4F)
fffff880`04ce1000 fffff880`05345000   atipmdag atipmdag.sys Tue Feb 02 23:21:24 2010 (4B68F9C4)
fffff880`03c72000 fffff880`03c79000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`04545000 fffff880`04556000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05582000 fffff880`055a0000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`007d0000 fffff960`007f7000   cdd      cdd.dll      unavailable (00000000)
fffff880`01200000 fffff880`0122a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01416000 fffff880`01446000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d4a000 fffff880`00da8000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`014a4000 fffff880`01517000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`0568a000 fffff880`0569a000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05470000 fffff880`05478000   cpuz132_x64 cpuz132_x64.sys Thu Mar 26 19:17:23 2009 (49CC0D03)
fffff880`079f0000 fffff880`079fe000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`044a4000 fffff880`04527000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`04527000 fffff880`04545000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`0147c000 fffff880`0148b000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01400000 fffff880`01416000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05d1e000 fffff880`05d40000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05d52000 fffff880`05d5b000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05d46000 fffff880`05d52000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05d5b000 fffff880`05d6e000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05d9e000 fffff880`05daa000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`056a0000 fffff880`05794000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`05794000 fffff880`057da000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`05674000 fffff880`05681000   fdc      fdc.sys      Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`0104c000 fffff880`01060000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`05c9f000 fffff880`05caa000   flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`01000000 fffff880`0104c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01528000 fffff880`01532000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`015c6000 fffff880`01600000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`017a0000 fffff880`017ea000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`0300b000 fffff800`03054000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`057da000 fffff880`057fe000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05d7c000 fffff880`05d95000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05d95000 fffff880`05d9d080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`05d6e000 fffff880`05d7c000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`054ba000 fffff880`05582000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0161a000 fffff880`01623000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0457c000 fffff880`04592000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`01151000 fffff880`01171000   jraid    jraid.sys    Wed Oct 07 07:26:03 2009 (4ACC7ACB)
fffff880`04c9c000 fffff880`04cab000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05daa000 fffff880`05db8000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bd0000 fffff800`00bda000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03ed2000 fffff880`043fb000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffff880`015b8000 fffff880`015c6000   klbg     klbg.sys     Wed Oct 14 13:18:13 2009 (4AD607D5)
fffff880`03c0c000 fffff880`03c69000   klif     klif.sys     Wed Nov 11 08:32:16 2009 (4AFABCE0)
fffff880`05dc5000 fffff880`05dcf000   klmouflt klmouflt.sys Fri Oct 02 11:38:29 2009 (4AC61E75)
fffff880`04400000 fffff880`04443000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`013dd000 fffff880`013f7000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01775000 fffff880`017a0000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`05d40000 fffff880`05d45200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`05c00000 fffff880`05c15000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05ddd000 fffff880`05e00000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cf2000 fffff880`00d36000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`05dcf000 fffff880`05ddd000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04cab000 fffff880`04cba000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05db8000 fffff880`05dc5000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`011a0000 fffff880`011ba000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`055a0000 fffff880`055b8000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`055b8000 fffff880`055e5000   mrxsmb   mrxsmb.sys   Thu Jan 07 22:38:26 2010 (4B46A8B2)
fffff880`05400000 fffff880`0544d000   mrxsmb10 mrxsmb10.sys Thu Jan 07 22:38:32 2010 (4B46A8B8)
fffff880`0544d000 fffff880`05470000   mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`03cd7000 fffff880`03ce2000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd0000 fffff880`00fda000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01060000 fffff880`010be000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03c00000 fffff880`03c0b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01608000 fffff880`0161a000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01623000 fffff880`01715000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04c00000 fffff880`04c0c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`04c0c000 fffff880`04c3b000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05caa000 fffff880`05cbf000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`03e7e000 fffff880`03e8d000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03e00000 fffff880`03e45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01715000 fffff880`01775000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`03ce2000 fffff880`03cf3000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03ebc000 fffff880`03ec8000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03054000 fffff800`03631000   nt       ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`0123a000 fffff880`013dd000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`03c69000 fffff880`03c72000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04443000 fffff880`04459000   nusb3hub nusb3hub.sys Fri Sep 25 09:58:23 2009 (4ABCCC7F)
fffff880`04592000 fffff880`045c2000   nusb3xhc nusb3xhc.sys Fri Sep 25 09:58:31 2009 (4ABCCC87)
fffff880`03e4e000 fffff880`03e74000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`0113a000 fffff880`01141000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`01141000 fffff880`01151000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01517000 fffff880`01528000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`098e6000 fffff880`0998c000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05ce1000 fffff880`05d1e000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00d36000 fffff880`00d4a000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`053d8000 fffff880`053fc000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04c3b000 fffff880`04c56000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04c56000 fffff880`04c77000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`04c77000 fffff880`04c91000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03da8000 fffff880`03df9000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04c91000 fffff880`04c9c000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`03cbc000 fffff880`03cc5000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03cc5000 fffff880`03cce000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03cce000 fffff880`03cd7000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`0157e000 fffff880`015b8000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05c15000 fffff880`05c2d000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05345000 fffff880`05384000   Rt64win7 Rt64win7.sys Thu Aug 20 12:05:06 2009 (4A8D7432)
fffff880`0ab25000 fffff880`0ab2d000   rtkio    rtkio.sys    Sat Jun 20 02:00:25 2009 (4A3C7AF9)
fffff880`07805000 fffff880`079ef080   RTKVHD64 RTKVHD64.sys Wed Oct 21 10:27:48 2009 (4ADF1A64)
fffff880`01171000 fffff880`011a0000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0998c000 fffff880`09997000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`01600000 fffff880`01608000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0aa8d000 fffff880`0ab25000   srv      srv.sys      Tue Dec 08 03:32:55 2009 (4B1E0F37)
fffff880`09800000 fffff880`09869000   srv2     srv2.sys     Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`09997000 fffff880`099c4000   srvnet   srvnet.sys   Tue Dec 08 03:32:26 2009 (4B1E0F1A)
fffff880`0569a000 fffff880`0569b480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`099c4000 fffff880`099d6000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`03d11000 fffff880`03d1e000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`03cf3000 fffff880`03d11000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03ea8000 fffff880`03ebc000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005d0000 fffff960`005da000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04556000 fffff880`0457c000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04cba000 fffff880`04ccc000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`045c2000 fffff880`045c3f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`05663000 fffff880`05674000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05c45000 fffff880`05c9f000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`0560d000 fffff880`05663000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`05600000 fffff880`0560d000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`03c79000 fffff880`03c87000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`03c87000 fffff880`03cac000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`017ea000 fffff880`017fa000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e55000 fffff880`00e6a000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010de000 fffff880`0113a000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01532000 fffff880`0157e000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`03e8d000 fffff880`03ea8000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`03cac000 fffff880`03cbc000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ebd000 fffff880`00f61000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f61000 fffff880`00f70000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03e45000 fffff880`03e4e000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00000000 fffff960`0030f000   win32k   win32k.sys   Mon Jul 13 19:40:17 2009 (4A5BC5E1)
fffff880`05681000 fffff880`0568a000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fc7000 fffff880`00fd0000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
Unloaded modules:
fffff880`01446000 fffff880`01454000   crashdmp.sys
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01454000 fffff880`01460000   dump_ataport
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01460000 fffff880`01469000   dump_atapi.s
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`01469000 fffff880`0147c000   dump_dumpfve
Timestamp: unavailable (00000000)
Checksum:  00000000
fffff880`03e74000 fffff880`03e7e000   klim6.sys
Timestamp: unavailable (00000000)
Checksum:  00000000

sorry, sorry my friend. I haven't noticed this post. I was really frustrated with all the BSODs i got so for. ( man! those BSODs got me BIG TIME, even I had a dream yesterday about one of them)

The cuprit caught red-handed =klif.sys Wed Nov 11 08:32:16 2009 (4AFABCE0)

i knew it, I was always having this feeling about kaspersky!! I kept telling myself what if the problem is originated from KIS! But then i was afraid of throwing my machine defenseless without guards.
for sure, I'm gonna kill that basterd. I have paid "him" 29 dollars to guard my machine and look what i got in return.

Kaspersky Internet Security. It must go. Un-install KIS using the KIS Removal Tool (KRT) - KRT download --> Kaspersky Americas Support and Services United StatesDownload the KRT; save to desktop. Boot into SAFEMODE - NO Networking. Tap the F8 key repeatedly during boot-up.Then go to desktop, RIGHT-click on the KRT icon and select &quot;Run as Administrator&quot;. When complete - re-boot.Reset the Windows Firewall to its default settings - START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on &quot;Restore Defaults&quot; | Click Apply, OKI would recommend Microsoft Security Essentials, available FREE --> http://www.microsoft.com/Security_Essentials/See if BSODs persist pot-KIS removal.

I have done that and I will let my machine running for one complete day to see if things are stable.thank you guys for helping me out. i would not have done this without your help.

man!
I got another one!
it says memory corruption.

have a look please

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\sadon\Desktop\blue screens\022110-39218-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03009000 PsLoadedModuleList = 0xfffff800`03246e50
Debug session time: Sun Feb 21 20:42:11.015 2010 (GMT-8)
System Uptime: 0 days 2:45:41.005
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffa8027e05010, 2, 1, fffff80003137a57}
Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 )
Followup: MachineOwner
---------

Code:

7: kd> !analyze -v; kv; r; lmnt; lmntsm
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8027e05010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003137a57, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b10e0
 fffffa8027e05010 
CURRENT_IRQL:  2
FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`03137a57 480fb328        btr     qword ptr [rax],rbp
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  SearchProtocol
TRAP_FRAME:  fffff88009681590 -- (.trap 0xfffff88009681590)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800be05010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003137a57 rsp=fffff88009681720 rbp=00000000e0000000
 r8=fffff88009681750  r9=fffffa800c7b8470 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`03137a57 480fb328        btr     qword ptr [rax],rbp ds:17a8:fffffa80`0be05010=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff8000307a469 to fffff8000307af00
STACK_TEXT:  
fffff880`09681448 fffff800`0307a469 : 00000000`0000000a fffffa80`27e05010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09681450 fffff800`030790e0 : 00000000`00000000 fffffa80`0cad0b60 00000000`00000000 000007fe`fe9d9000 : nt!KiBugCheckDispatch+0x69
fffff880`09681590 fffff800`03137a57 : fffff880`00000001 fffffa80`0cad0b60 fffffa80`0bc56820 fffffa80`0bc56820 : nt!KiPageFault+0x260
fffff880`09681720 fffff800`030ed108 : e0000000`00000000 fffff800`00000000 00000000`00000040 00000000`01117000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`096817a0 fffff800`030ae5d9 : 000007fe`00000000 00000000`014d9fff 00000000`00000000 fffff800`03208888 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`09681960 fffff800`0304e080 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09681a80 fffff800`0335d7af : fffff8a0`10152a70 00000000`00000001 00000000`00000000 fffffa80`0cad0b60 : nt!MmCleanProcessAddressSpace+0x228
fffff880`09681ad0 fffff800`03336cb8 : 00000000`00000000 00000000`00000001 000007ff`fffdd000 00000000`00000000 : nt!PspExitThread+0x47f
fffff880`09681ba0 fffff800`0307a153 : fffffa80`0c7b8470 00000000`00000000 fffffa80`0cad0b60 fffffa80`0a007770 : nt!NtTerminateProcess+0x138
fffff880`09681c20 00000000`77b4017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000dfb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b4017a

STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`03137a57 480fb328        btr     qword ptr [rax],rbp
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+87
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
Followup: MachineOwner
---------
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`09681448 fffff800`0307a469 : 00000000`0000000a fffffa80`27e05010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09681450 fffff800`030790e0 : 00000000`00000000 fffffa80`0cad0b60 00000000`00000000 000007fe`fe9d9000 : nt!KiBugCheckDispatch+0x69
fffff880`09681590 fffff800`03137a57 : fffff880`00000001 fffffa80`0cad0b60 fffffa80`0bc56820 fffffa80`0bc56820 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`09681590)
fffff880`09681720 fffff800`030ed108 : e0000000`00000000 fffff800`00000000 00000000`00000040 00000000`01117000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`096817a0 fffff800`030ae5d9 : 000007fe`00000000 00000000`014d9fff 00000000`00000000 fffff800`03208888 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`09681960 fffff800`0304e080 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09681a80 fffff800`0335d7af : fffff8a0`10152a70 00000000`00000001 00000000`00000000 fffffa80`0cad0b60 : nt!MmCleanProcessAddressSpace+0x228
fffff880`09681ad0 fffff800`03336cb8 : 00000000`00000000 00000000`00000001 000007ff`fffdd000 00000000`00000000 : nt!PspExitThread+0x47f
fffff880`09681ba0 fffff800`0307a153 : fffffa80`0c7b8470 00000000`00000000 fffffa80`0cad0b60 fffffa80`0a007770 : nt!NtTerminateProcess+0x138
fffff880`09681c20 00000000`77b4017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`09681c20)
00000000`000dfb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b4017a
rax=fffff88009681550 rbx=fffffa800cad0b60 rcx=000000000000000a
rdx=fffffa8027e05010 rsi=fffffa800bc56820 rdi=0000000000000100
rip=fffff8000307af00 rsp=fffff88009681448 rbp=fffff88009681610
 r8=0000000000000002  r9=0000000000000001 r10=fffff80003137a57
r11=fffff6fb7ea009f8 r12=0000000000000000 r13=fffffa800be05000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!KeBugCheckEx:
fffff800`0307af00 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`09681450=000000000000000a
start             end                 module name
fffff800`00b9c000 fffff800`00ba6000   kdcom    kdcom.dll    Mon Jul 13 18:31:07 2009 (4A5BDFDB)
fffff800`03009000 fffff800`035e6000   nt       ntkrnlmp.exe Mon Jul 13 16:40:48 2009 (4A5BC600)
fffff800`035e6000 fffff800`0362f000   hal      hal.dll      Mon Jul 13 18:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00c20000   jraid    jraid.sys    Wed Oct 07 04:26:03 2009 (4ACC7ACB)
fffff880`00c20000 fffff880`00c4f000   SCSIPORT SCSIPORT.SYS Mon Jul 13 17:01:04 2009 (4A5BCAC0)
fffff880`00c5b000 fffff880`00c9f000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 18:29:10 2009 (4A5BDF66)
fffff880`00c9f000 fffff880`00cb3000   PSHED    PSHED.dll    Mon Jul 13 18:32:23 2009 (4A5BE027)
fffff880`00cb3000 fffff880`00d11000   CLFS     CLFS.SYS     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00d11000 fffff880`00dd1000   CI       CI.dll       Mon Jul 13 18:32:13 2009 (4A5BE01D)
fffff880`00dd1000 fffff880`00de1000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`00de1000 fffff880`00dfb000   mountmgr mountmgr.sys Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00e0a000 fffff880`00eae000   Wdf01000 Wdf01000.sys Mon Jul 13 16:22:07 2009 (4A5BC19F)
fffff880`00eae000 fffff880`00ebd000   WDFLDR   WDFLDR.SYS   Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00ebd000 fffff880`00f14000   ACPI     ACPI.sys     Mon Jul 13 16:19:34 2009 (4A5BC106)
fffff880`00f14000 fffff880`00f1d000   WMILIB   WMILIB.SYS   Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00f1d000 fffff880`00f27000   msisadrv msisadrv.sys Mon Jul 13 16:19:26 2009 (4A5BC0FE)
fffff880`00f27000 fffff880`00f5a000   pci      pci.sys      Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00f5a000 fffff880`00f67000   vdrvroot vdrvroot.sys Mon Jul 13 17:01:31 2009 (4A5BCADB)
fffff880`00f67000 fffff880`00f7c000   partmgr  partmgr.sys  Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00f7c000 fffff880`00f91000   volmgr   volmgr.sys   Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00f91000 fffff880`00fed000   volmgrx  volmgrx.sys  Mon Jul 13 16:20:33 2009 (4A5BC141)
fffff880`00fed000 fffff880`00ff4000   pciide   pciide.sys   Mon Jul 13 16:19:49 2009 (4A5BC115)
fffff880`00ff4000 fffff880`00ffd000   atapi    atapi.sys    Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 16:49:40 2009 (4A5BC814)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 16:20:08 2009 (4A5BC128)
fffff880`010bf000 fffff880`010dd000   tdx      tdx.sys      Mon Jul 13 16:21:15 2009 (4A5BC16B)
fffff880`010dd000 fffff880`010ea000   TDI      TDI.SYS      Mon Jul 13 16:21:18 2009 (4A5BC16E)
fffff880`010f7000 fffff880`01121000   ataport  ataport.SYS  Mon Jul 13 16:19:52 2009 (4A5BC118)
fffff880`01121000 fffff880`0112c000   amdxata  amdxata.sys  Tue May 19 10:56:59 2009 (4A12F2EB)
fffff880`0112c000 fffff880`01178000   fltmgr   fltmgr.sys   Mon Jul 13 16:19:59 2009 (4A5BC11F)
fffff880`01178000 fffff880`0118c000   fileinfo fileinfo.sys Mon Jul 13 16:34:25 2009 (4A5BC481)
fffff880`0118c000 fffff880`011ea000   msrpc    msrpc.sys    Mon Jul 13 16:21:32 2009 (4A5BC17C)
fffff880`01200000 fffff880`01211000   Npfs     Npfs.SYS     Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`0121b000 fffff880`013be000   Ntfs     Ntfs.sys     Mon Jul 13 16:20:47 2009 (4A5BC14F)
fffff880`013be000 fffff880`013d8000   ksecdd   ksecdd.sys   Mon Jul 13 16:20:54 2009 (4A5BC156)
fffff880`013d8000 fffff880`013e9000   pcw      pcw.sys      Mon Jul 13 16:19:27 2009 (4A5BC0FF)
fffff880`013e9000 fffff880`013f3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 16:19:45 2009 (4A5BC111)
fffff880`013f3000 fffff880`013fe000   Msfs     Msfs.SYS     Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`01400000 fffff880`0142b000   ksecpkg  ksecpkg.sys  Mon Jul 13 16:50:34 2009 (4A5BC84A)
fffff880`0142b000 fffff880`01475000   fwpkclnt fwpkclnt.sys Mon Jul 13 16:21:08 2009 (4A5BC164)
fffff880`01475000 fffff880`01485000   vmstorfl vmstorfl.sys Mon Jul 13 16:42:54 2009 (4A5BC67E)
fffff880`01485000 fffff880`0148d000   spldr    spldr.sys    Mon May 11 09:56:27 2009 (4A0858BB)
fffff880`0148d000 fffff880`01496000   rdprefmp rdprefmp.sys Mon Jul 13 17:16:35 2009 (4A5BCE63)
fffff880`01497000 fffff880`01589000   ndis     ndis.sys     Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`01589000 fffff880`015e9000   NETIO    NETIO.SYS    Mon Jul 13 16:21:46 2009 (4A5BC18A)
fffff880`015e9000 fffff880`015f9000   watchdog watchdog.sys Mon Jul 13 16:37:35 2009 (4A5BC53F)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Mon Jul 13 16:25:34 2009 (4A5BC26E)
fffff880`01800000 fffff880`0182a000   cdrom    cdrom.sys    Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`0182a000 fffff880`01887000   klif     klif.sys     Wed Nov 11 05:32:16 2009 (4AFABCE0)
fffff880`01887000 fffff880`01890000   Null     Null.SYS     Mon Jul 13 16:19:37 2009 (4A5BC109)
fffff880`01890000 fffff880`01897000   Beep     Beep.SYS     Mon Jul 13 17:00:13 2009 (4A5BCA8D)
fffff880`01897000 fffff880`018a5000   vga      vga.sys      Mon Jul 13 16:38:47 2009 (4A5BC587)
fffff880`018a5000 fffff880`018ca000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 16:38:51 2009 (4A5BC58B)
fffff880`018ca000 fffff880`018d3000   RDPCDD   RDPCDD.sys   Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`018d9000 fffff880`01913000   rdyboost rdyboost.sys Mon Jul 13 16:34:34 2009 (4A5BC48A)
fffff880`01913000 fffff880`01925000   mup      mup.sys      Mon Jul 13 16:23:45 2009 (4A5BC201)
fffff880`01925000 fffff880`01933000   klbg     klbg.sys     Wed Oct 14 10:18:13 2009 (4AD607D5)
fffff880`01933000 fffff880`0193c000   hwpolicy hwpolicy.sys Mon Jul 13 16:19:22 2009 (4A5BC0FA)
fffff880`0193c000 fffff880`01976000   fvevol   fvevol.sys   Mon Jul 13 16:22:15 2009 (4A5BC1A7)
fffff880`01976000 fffff880`0198c000   disk     disk.sys     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`0198c000 fffff880`019bc000   CLASSPNP CLASSPNP.SYS Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`019f2000 fffff880`019fb000   rdpencdd rdpencdd.sys Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`02c00000 fffff880`02c26000   tunnel   tunnel.sys   Mon Jul 13 17:09:37 2009 (4A5BCCC1)
fffff880`02c26000 fffff880`02c3c000   intelppm intelppm.sys Mon Jul 13 16:19:25 2009 (4A5BC0FD)
fffff880`02c48000 fffff880`02cd2000   afd      afd.sys      Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`02cd2000 fffff880`02d23000   rdbss    rdbss.sys    Mon Jul 13 16:24:09 2009 (4A5BC219)
fffff880`02d23000 fffff880`02d32000   discache discache.sys Mon Jul 13 16:37:18 2009 (4A5BC52E)
fffff880`02d32000 fffff880`02db5000   csc      csc.sys      Mon Jul 13 16:24:26 2009 (4A5BC22A)
fffff880`02db5000 fffff880`02dd3000   dfsc     dfsc.sys     Mon Jul 13 16:23:44 2009 (4A5BC200)
fffff880`02dd3000 fffff880`02de4000   blbdrive blbdrive.sys Mon Jul 13 16:35:59 2009 (4A5BC4DF)
fffff880`02de4000 fffff880`02dfc000   BTHUSB   BTHUSB.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`03805000 fffff880`038cd000   HTTP     HTTP.sys     Mon Jul 13 16:22:16 2009 (4A5BC1A8)
fffff880`038cd000 fffff880`038eb000   bowser   bowser.sys   Mon Jul 13 16:23:50 2009 (4A5BC206)
fffff880`038eb000 fffff880`03903000   mpsdrv   mpsdrv.sys   Mon Jul 13 17:08:25 2009 (4A5BCC79)
fffff880`03903000 fffff880`03930000   mrxsmb   mrxsmb.sys   Thu Jan 07 19:38:26 2010 (4B46A8B2)
fffff880`03930000 fffff880`0397d000   mrxsmb10 mrxsmb10.sys Thu Jan 07 19:38:32 2010 (4B46A8B8)
fffff880`0397d000 fffff880`039a0000   mrxsmb20 mrxsmb20.sys Mon Jul 13 16:24:05 2009 (4A5BC215)
fffff880`04000000 fffff880`0400b000   mssmbios mssmbios.sys Mon Jul 13 16:31:10 2009 (4A5BC3BE)
fffff880`0400c000 fffff880`04535000   kl1      kl1.sys      Tue Sep 01 04:29:21 2009 (4A9D0591)
fffff880`04535000 fffff880`0457a000   netbt    netbt.sys    Mon Jul 13 16:21:28 2009 (4A5BC178)
fffff880`0457a000 fffff880`04583000   wfplwf   wfplwf.sys   Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`04583000 fffff880`045a9000   pacer    pacer.sys    Mon Jul 13 17:09:41 2009 (4A5BCCC5)
fffff880`045b3000 fffff880`045c2000   netbios  netbios.sys  Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`045c2000 fffff880`045dd000   wanarp   wanarp.sys   Mon Jul 13 17:10:21 2009 (4A5BCCED)
fffff880`045dd000 fffff880`045f1000   termdd   termdd.sys   Mon Jul 13 17:16:36 2009 (4A5BCE64)
fffff880`045f1000 fffff880`045fd000   nsiproxy nsiproxy.sys Mon Jul 13 16:21:02 2009 (4A5BC15E)
fffff880`04a00000 fffff880`04a16000   AgileVpn AgileVpn.sys Mon Jul 13 17:10:24 2009 (4A5BCCF0)
fffff880`04a16000 fffff880`04a3a000   rasl2tp  rasl2tp.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a3a000 fffff880`04a69000   ndiswan  ndiswan.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a69000 fffff880`04a84000   raspppoe raspppoe.sys Mon Jul 13 17:10:17 2009 (4A5BCCE9)
fffff880`04a84000 fffff880`04a97000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 16:21:51 2009 (4A5BC18F)
fffff880`04aa2000 fffff880`04ad2000   nusb3xhc nusb3xhc.sys Fri Sep 25 06:58:31 2009 (4ABCCC87)
fffff880`04ad2000 fffff880`04ad3f00   USBD     USBD.SYS     Mon Jul 13 17:06:23 2009 (4A5BCBFF)
fffff880`04ad4000 fffff880`04b08000   atikmpag atikmpag.sys Tue Feb 02 19:23:59 2010 (4B68EC4F)
fffff880`04b08000 fffff880`04bfc000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 18:00:14 2009 (4AC5509E)
fffff880`04c00000 fffff880`04c56000   USBPORT  USBPORT.SYS  Mon Jul 13 17:06:31 2009 (4A5BCC07)
fffff880`04c56000 fffff880`04c67000   usbehci  usbehci.sys  Mon Jul 13 17:06:30 2009 (4A5BCC06)
fffff880`04c67000 fffff880`04ca6000   Rt64win7 Rt64win7.sys Thu Aug 20 09:05:06 2009 (4A8D7432)
fffff880`04ca6000 fffff880`04cb3000   fdc      fdc.sys      Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`04cb3000 fffff880`04cbc000   wmiacpi  wmiacpi.sys  Mon Jul 13 16:31:02 2009 (4A5BC3B6)
fffff880`04cbc000 fffff880`04ccc000   CompositeBus CompositeBus.sys Mon Jul 13 17:00:33 2009 (4A5BCAA1)
fffff880`04ccc000 fffff880`04cd8000   ndistapi ndistapi.sys Mon Jul 13 17:10:00 2009 (4A5BCCD8)
fffff880`04cdd000 fffff880`05341000   atipmdag atipmdag.sys Tue Feb 02 20:21:24 2010 (4B68F9C4)
fffff880`05341000 fffff880`05387000   dxgmms1  dxgmms1.sys  Mon Jul 13 16:38:32 2009 (4A5BC578)
fffff880`05387000 fffff880`053ab000   HDAudBus HDAudBus.sys Mon Jul 13 17:06:13 2009 (4A5BCBF5)
fffff880`053ab000 fffff880`053b8000   usbuhci  usbuhci.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`053b8000 fffff880`053f6000   1394ohci 1394ohci.sys Mon Jul 13 17:07:12 2009 (4A5BCC30)
fffff880`05800000 fffff880`0585a000   usbhub   usbhub.sys   Mon Jul 13 17:07:09 2009 (4A5BCC2D)
fffff880`0585a000 fffff880`05865000   flpydisk flpydisk.sys Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`05865000 fffff880`0587a000   NDProxy  NDProxy.SYS  Mon Jul 13 17:10:05 2009 (4A5BCCDD)
fffff880`0587a000 fffff880`0589c000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 17:03:36 2010 (4B6233E8)
fffff880`0589c000 fffff880`058be000   drmk     drmk.sys     Mon Jul 13 18:01:25 2009 (4A5BD8E5)
fffff880`058be000 fffff880`058c3200   ksthunk  ksthunk.sys  Mon Jul 13 17:00:19 2009 (4A5BCA93)
fffff880`058c4000 fffff880`058d0000   dump_dumpata dump_dumpata.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`058d8000 fffff880`058f9000   raspptp  raspptp.sys  Mon Jul 13 17:10:18 2009 (4A5BCCEA)
fffff880`058f9000 fffff880`05913000   rassstp  rassstp.sys  Mon Jul 13 17:10:25 2009 (4A5BCCF1)
fffff880`05913000 fffff880`0591e000   rdpbus   rdpbus.sys   Mon Jul 13 17:17:46 2009 (4A5BCEAA)
fffff880`0591e000 fffff880`0592d000   kbdclass kbdclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`0592d000 fffff880`0593c000   mouclass mouclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`0593c000 fffff880`0593d480   swenum   swenum.sys   Mon Jul 13 17:00:18 2009 (4A5BCA92)
fffff880`0593e000 fffff880`05981000   ks       ks.sys       Mon Jul 13 17:00:31 2009 (4A5BCA9F)
fffff880`05981000 fffff880`05993000   umbus    umbus.sys    Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`05993000 fffff880`059a9000   nusb3hub nusb3hub.sys Fri Sep 25 06:58:23 2009 (4ABCCC7F)
fffff880`059a9000 fffff880`059e6000   portcls  portcls.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`059e6000 fffff880`059ef000   dump_atapi dump_atapi.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`059ef000 fffff880`059ff000   btusbflt btusbflt.sys Wed Aug 27 18:12:08 2008 (48B5FB68)
fffff880`07600000 fffff880`0760e000   crashdmp crashdmp.sys Mon Jul 13 17:01:01 2009 (4A5BCABD)
fffff880`07615000 fffff880`077ff080   RTKVHD64 RTKVHD64.sys Wed Oct 21 07:27:48 2009 (4ADF1A64)
fffff880`0780e000 fffff880`0789a000   bthport  bthport.sys  Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`0789a000 fffff880`078a8000   hidusb   hidusb.sys   Mon Jul 13 17:06:22 2009 (4A5BCBFE)
fffff880`078a8000 fffff880`078c1000   HIDCLASS HIDCLASS.SYS Mon Jul 13 17:06:21 2009 (4A5BCBFD)
fffff880`078c1000 fffff880`078c9080   HIDPARSE HIDPARSE.SYS Mon Jul 13 17:06:17 2009 (4A5BCBF9)
fffff880`078ca000 fffff880`078d6000   Dxapi    Dxapi.sys    Mon Jul 13 16:38:28 2009 (4A5BC574)
fffff880`078d6000 fffff880`078e9000   LHidFilt LHidFilt.Sys Wed Jun 17 09:49:39 2009 (4A391EA3)
fffff880`078e9000 fffff880`078f7000   kbdhid   kbdhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`078f7000 fffff880`07923000   rfcomm   rfcomm.sys   Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`07923000 fffff880`07933000   BthEnum  BthEnum.sys  Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`07933000 fffff880`07953000   bthpan   bthpan.sys   Mon Jul 13 17:07:00 2009 (4A5BCC24)
fffff880`07953000 fffff880`07971000   hidbth   hidbth.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`07971000 fffff880`0797e000   mouhid   mouhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`0797e000 fffff880`07992000   LMouFilt LMouFilt.Sys Wed Jun 17 09:49:43 2009 (4A391EA7)
fffff880`07992000 fffff880`0799c000   klmouflt klmouflt.sys Fri Oct 02 08:38:29 2009 (4AC61E75)
fffff880`0799c000 fffff880`079aa000   monitor  monitor.sys  Mon Jul 13 16:38:52 2009 (4A5BC58C)
fffff880`079aa000 fffff880`079cd000   luafv    luafv.sys    Mon Jul 13 16:26:13 2009 (4A5BC295)
fffff880`079cd000 fffff880`079e2000   lltdio   lltdio.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`079e2000 fffff880`079fa000   rspndr   rspndr.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`08819000 fffff880`088bf000   peauth   peauth.sys   Mon Jul 13 18:01:19 2009 (4A5BD8DF)
fffff880`088bf000 fffff880`088ca000   secdrv   secdrv.SYS   Wed Sep 13 06:18:38 2006 (4508052E)
fffff880`088ca000 fffff880`088f7000   srvnet   srvnet.sys   Tue Dec 08 00:32:26 2009 (4B1E0F1A)
fffff880`088f7000 fffff880`08909000   tcpipreg tcpipreg.sys Mon Jul 13 17:09:49 2009 (4A5BCCCD)
fffff880`08909000 fffff880`08972000   srv2     srv2.sys     Mon Jul 13 16:25:02 2009 (4A5BC24E)
fffff880`09024000 fffff880`090bc000   srv      srv.sys      Tue Dec 08 00:32:55 2009 (4B1E0F37)
fffff880`090bc000 fffff880`090c4000   rtkio    rtkio.sys    Fri Jun 19 23:00:25 2009 (4A3C7AF9)
fffff880`09135000 fffff880`0916b000   fastfat  fastfat.SYS  Mon Jul 13 16:23:28 2009 (4A5BC1F0)
fffff880`0916b000 fffff880`09176000   asyncmac asyncmac.sys Mon Jul 13 17:10:13 2009 (4A5BCCE5)
fffff880`09176000 fffff880`091a2000   MpFilter MpFilter.sys Wed Jun 10 19:33:21 2009 (4A306CF1)
fffff880`091a2000 fffff880`091b2000   MpNWMon  MpNWMon.sys  Wed Jun 10 19:33:23 2009 (4A306CF3)
fffff960`000a0000 fffff960`003af000   win32k   win32k.sys   Mon Jul 13 16:40:17 2009 (4A5BC5E1)
fffff960`00490000 fffff960`0049a000   TSDDD    TSDDD.dll    Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff960`00700000 fffff960`00727000   cdd      cdd.dll      unavailable (00000000)
Unloaded modules:
fffff880`039a0000 fffff880`039a8000   cpuz132_x64.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`090c4000 fffff880`09135000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019bc000 fffff880`019ca000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019ca000 fffff880`019d6000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019d6000 fffff880`019df000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019df000 fffff880`019f2000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`045a9000 fffff880`045b3000   klim6.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
start             end                 module name
fffff880`053b8000 fffff880`053f6000   1394ohci 1394ohci.sys Mon Jul 13 17:07:12 2009 (4A5BCC30)
fffff880`00ebd000 fffff880`00f14000   ACPI     ACPI.sys     Mon Jul 13 16:19:34 2009 (4A5BC106)
fffff880`02c48000 fffff880`02cd2000   afd      afd.sys      Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`04a00000 fffff880`04a16000   AgileVpn AgileVpn.sys Mon Jul 13 17:10:24 2009 (4A5BCCF0)
fffff880`01121000 fffff880`0112c000   amdxata  amdxata.sys  Tue May 19 10:56:59 2009 (4A12F2EB)
fffff880`0916b000 fffff880`09176000   asyncmac asyncmac.sys Mon Jul 13 17:10:13 2009 (4A5BCCE5)
fffff880`00ff4000 fffff880`00ffd000   atapi    atapi.sys    Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`010f7000 fffff880`01121000   ataport  ataport.SYS  Mon Jul 13 16:19:52 2009 (4A5BC118)
fffff880`0587a000 fffff880`0589c000   AtiHdmi  AtiHdmi.sys  Thu Jan 28 17:03:36 2010 (4B6233E8)
fffff880`04ad4000 fffff880`04b08000   atikmpag atikmpag.sys Tue Feb 02 19:23:59 2010 (4B68EC4F)
fffff880`04cdd000 fffff880`05341000   atipmdag atipmdag.sys Tue Feb 02 20:21:24 2010 (4B68F9C4)
fffff880`01890000 fffff880`01897000   Beep     Beep.SYS     Mon Jul 13 17:00:13 2009 (4A5BCA8D)
fffff880`02dd3000 fffff880`02de4000   blbdrive blbdrive.sys Mon Jul 13 16:35:59 2009 (4A5BC4DF)
fffff880`038cd000 fffff880`038eb000   bowser   bowser.sys   Mon Jul 13 16:23:50 2009 (4A5BC206)
fffff880`07923000 fffff880`07933000   BthEnum  BthEnum.sys  Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`07933000 fffff880`07953000   bthpan   bthpan.sys   Mon Jul 13 17:07:00 2009 (4A5BCC24)
fffff880`0780e000 fffff880`0789a000   bthport  bthport.sys  Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`02de4000 fffff880`02dfc000   BTHUSB   BTHUSB.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`059ef000 fffff880`059ff000   btusbflt btusbflt.sys Wed Aug 27 18:12:08 2008 (48B5FB68)
fffff960`00700000 fffff960`00727000   cdd      cdd.dll      unavailable (00000000)
fffff880`01800000 fffff880`0182a000   cdrom    cdrom.sys    Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`00d11000 fffff880`00dd1000   CI       CI.dll       Mon Jul 13 18:32:13 2009 (4A5BE01D)
fffff880`0198c000 fffff880`019bc000   CLASSPNP CLASSPNP.SYS Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00cb3000 fffff880`00d11000   CLFS     CLFS.SYS     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 16:49:40 2009 (4A5BC814)
fffff880`04cbc000 fffff880`04ccc000   CompositeBus CompositeBus.sys Mon Jul 13 17:00:33 2009 (4A5BCAA1)
fffff880`07600000 fffff880`0760e000   crashdmp crashdmp.sys Mon Jul 13 17:01:01 2009 (4A5BCABD)
fffff880`02d32000 fffff880`02db5000   csc      csc.sys      Mon Jul 13 16:24:26 2009 (4A5BC22A)
fffff880`02db5000 fffff880`02dd3000   dfsc     dfsc.sys     Mon Jul 13 16:23:44 2009 (4A5BC200)
fffff880`02d23000 fffff880`02d32000   discache discache.sys Mon Jul 13 16:37:18 2009 (4A5BC52E)
fffff880`01976000 fffff880`0198c000   disk     disk.sys     Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`0589c000 fffff880`058be000   drmk     drmk.sys     Mon Jul 13 18:01:25 2009 (4A5BD8E5)
fffff880`059e6000 fffff880`059ef000   dump_atapi dump_atapi.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`058c4000 fffff880`058d0000   dump_dumpata dump_dumpata.sys Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`04a84000 fffff880`04a97000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 16:21:51 2009 (4A5BC18F)
fffff880`078ca000 fffff880`078d6000   Dxapi    Dxapi.sys    Mon Jul 13 16:38:28 2009 (4A5BC574)
fffff880`04b08000 fffff880`04bfc000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 18:00:14 2009 (4AC5509E)
fffff880`05341000 fffff880`05387000   dxgmms1  dxgmms1.sys  Mon Jul 13 16:38:32 2009 (4A5BC578)
fffff880`09135000 fffff880`0916b000   fastfat  fastfat.SYS  Mon Jul 13 16:23:28 2009 (4A5BC1F0)
fffff880`04ca6000 fffff880`04cb3000   fdc      fdc.sys      Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`01178000 fffff880`0118c000   fileinfo fileinfo.sys Mon Jul 13 16:34:25 2009 (4A5BC481)
fffff880`0585a000 fffff880`05865000   flpydisk flpydisk.sys Mon Jul 13 17:00:54 2009 (4A5BCAB6)
fffff880`0112c000 fffff880`01178000   fltmgr   fltmgr.sys   Mon Jul 13 16:19:59 2009 (4A5BC11F)
fffff880`013e9000 fffff880`013f3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 16:19:45 2009 (4A5BC111)
fffff880`0193c000 fffff880`01976000   fvevol   fvevol.sys   Mon Jul 13 16:22:15 2009 (4A5BC1A7)
fffff880`0142b000 fffff880`01475000   fwpkclnt fwpkclnt.sys Mon Jul 13 16:21:08 2009 (4A5BC164)
fffff800`035e6000 fffff800`0362f000   hal      hal.dll      Mon Jul 13 18:27:36 2009 (4A5BDF08)
fffff880`05387000 fffff880`053ab000   HDAudBus HDAudBus.sys Mon Jul 13 17:06:13 2009 (4A5BCBF5)
fffff880`07953000 fffff880`07971000   hidbth   hidbth.sys   Mon Jul 13 17:06:52 2009 (4A5BCC1C)
fffff880`078a8000 fffff880`078c1000   HIDCLASS HIDCLASS.SYS Mon Jul 13 17:06:21 2009 (4A5BCBFD)
fffff880`078c1000 fffff880`078c9080   HIDPARSE HIDPARSE.SYS Mon Jul 13 17:06:17 2009 (4A5BCBF9)
fffff880`0789a000 fffff880`078a8000   hidusb   hidusb.sys   Mon Jul 13 17:06:22 2009 (4A5BCBFE)
fffff880`03805000 fffff880`038cd000   HTTP     HTTP.sys     Mon Jul 13 16:22:16 2009 (4A5BC1A8)
fffff880`01933000 fffff880`0193c000   hwpolicy hwpolicy.sys Mon Jul 13 16:19:22 2009 (4A5BC0FA)
fffff880`02c26000 fffff880`02c3c000   intelppm intelppm.sys Mon Jul 13 16:19:25 2009 (4A5BC0FD)
fffff880`00c00000 fffff880`00c20000   jraid    jraid.sys    Wed Oct 07 04:26:03 2009 (4ACC7ACB)
fffff880`0591e000 fffff880`0592d000   kbdclass kbdclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`078e9000 fffff880`078f7000   kbdhid   kbdhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff800`00b9c000 fffff800`00ba6000   kdcom    kdcom.dll    Mon Jul 13 18:31:07 2009 (4A5BDFDB)
fffff880`0400c000 fffff880`04535000   kl1      kl1.sys      Tue Sep 01 04:29:21 2009 (4A9D0591)
fffff880`01925000 fffff880`01933000   klbg     klbg.sys     Wed Oct 14 10:18:13 2009 (4AD607D5)
fffff880`0182a000 fffff880`01887000   klif     klif.sys     Wed Nov 11 05:32:16 2009 (4AFABCE0)
fffff880`07992000 fffff880`0799c000   klmouflt klmouflt.sys Fri Oct 02 08:38:29 2009 (4AC61E75)
fffff880`0593e000 fffff880`05981000   ks       ks.sys       Mon Jul 13 17:00:31 2009 (4A5BCA9F)
fffff880`013be000 fffff880`013d8000   ksecdd   ksecdd.sys   Mon Jul 13 16:20:54 2009 (4A5BC156)
fffff880`01400000 fffff880`0142b000   ksecpkg  ksecpkg.sys  Mon Jul 13 16:50:34 2009 (4A5BC84A)
fffff880`058be000 fffff880`058c3200   ksthunk  ksthunk.sys  Mon Jul 13 17:00:19 2009 (4A5BCA93)
fffff880`078d6000 fffff880`078e9000   LHidFilt LHidFilt.Sys Wed Jun 17 09:49:39 2009 (4A391EA3)
fffff880`079cd000 fffff880`079e2000   lltdio   lltdio.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`0797e000 fffff880`07992000   LMouFilt LMouFilt.Sys Wed Jun 17 09:49:43 2009 (4A391EA7)
fffff880`079aa000 fffff880`079cd000   luafv    luafv.sys    Mon Jul 13 16:26:13 2009 (4A5BC295)
fffff880`00c5b000 fffff880`00c9f000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 18:29:10 2009 (4A5BDF66)
fffff880`0799c000 fffff880`079aa000   monitor  monitor.sys  Mon Jul 13 16:38:52 2009 (4A5BC58C)
fffff880`0592d000 fffff880`0593c000   mouclass mouclass.sys Mon Jul 13 16:19:50 2009 (4A5BC116)
fffff880`07971000 fffff880`0797e000   mouhid   mouhid.sys   Mon Jul 13 17:00:20 2009 (4A5BCA94)
fffff880`00de1000 fffff880`00dfb000   mountmgr mountmgr.sys Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`09176000 fffff880`091a2000   MpFilter MpFilter.sys Wed Jun 10 19:33:21 2009 (4A306CF1)
fffff880`091a2000 fffff880`091b2000   MpNWMon  MpNWMon.sys  Wed Jun 10 19:33:23 2009 (4A306CF3)
fffff880`038eb000 fffff880`03903000   mpsdrv   mpsdrv.sys   Mon Jul 13 17:08:25 2009 (4A5BCC79)
fffff880`03903000 fffff880`03930000   mrxsmb   mrxsmb.sys   Thu Jan 07 19:38:26 2010 (4B46A8B2)
fffff880`03930000 fffff880`0397d000   mrxsmb10 mrxsmb10.sys Thu Jan 07 19:38:32 2010 (4B46A8B8)
fffff880`0397d000 fffff880`039a0000   mrxsmb20 mrxsmb20.sys Mon Jul 13 16:24:05 2009 (4A5BC215)
fffff880`013f3000 fffff880`013fe000   Msfs     Msfs.SYS     Mon Jul 13 16:19:47 2009 (4A5BC113)
fffff880`00f1d000 fffff880`00f27000   msisadrv msisadrv.sys Mon Jul 13 16:19:26 2009 (4A5BC0FE)
fffff880`0118c000 fffff880`011ea000   msrpc    msrpc.sys    Mon Jul 13 16:21:32 2009 (4A5BC17C)
fffff880`04000000 fffff880`0400b000   mssmbios mssmbios.sys Mon Jul 13 16:31:10 2009 (4A5BC3BE)
fffff880`01913000 fffff880`01925000   mup      mup.sys      Mon Jul 13 16:23:45 2009 (4A5BC201)
fffff880`01497000 fffff880`01589000   ndis     ndis.sys     Mon Jul 13 16:21:40 2009 (4A5BC184)
fffff880`04ccc000 fffff880`04cd8000   ndistapi ndistapi.sys Mon Jul 13 17:10:00 2009 (4A5BCCD8)
fffff880`04a3a000 fffff880`04a69000   ndiswan  ndiswan.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`05865000 fffff880`0587a000   NDProxy  NDProxy.SYS  Mon Jul 13 17:10:05 2009 (4A5BCCDD)
fffff880`045b3000 fffff880`045c2000   netbios  netbios.sys  Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff880`04535000 fffff880`0457a000   netbt    netbt.sys    Mon Jul 13 16:21:28 2009 (4A5BC178)
fffff880`01589000 fffff880`015e9000   NETIO    NETIO.SYS    Mon Jul 13 16:21:46 2009 (4A5BC18A)
fffff880`01200000 fffff880`01211000   Npfs     Npfs.SYS     Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`045f1000 fffff880`045fd000   nsiproxy nsiproxy.sys Mon Jul 13 16:21:02 2009 (4A5BC15E)
fffff800`03009000 fffff800`035e6000   nt       ntkrnlmp.exe Mon Jul 13 16:40:48 2009 (4A5BC600)
fffff880`0121b000 fffff880`013be000   Ntfs     Ntfs.sys     Mon Jul 13 16:20:47 2009 (4A5BC14F)
fffff880`01887000 fffff880`01890000   Null     Null.SYS     Mon Jul 13 16:19:37 2009 (4A5BC109)
fffff880`05993000 fffff880`059a9000   nusb3hub nusb3hub.sys Fri Sep 25 06:58:23 2009 (4ABCCC7F)
fffff880`04aa2000 fffff880`04ad2000   nusb3xhc nusb3xhc.sys Fri Sep 25 06:58:31 2009 (4ABCCC87)
fffff880`04583000 fffff880`045a9000   pacer    pacer.sys    Mon Jul 13 17:09:41 2009 (4A5BCCC5)
fffff880`00f67000 fffff880`00f7c000   partmgr  partmgr.sys  Mon Jul 13 16:19:58 2009 (4A5BC11E)
fffff880`00f27000 fffff880`00f5a000   pci      pci.sys      Mon Jul 13 16:19:51 2009 (4A5BC117)
fffff880`00fed000 fffff880`00ff4000   pciide   pciide.sys   Mon Jul 13 16:19:49 2009 (4A5BC115)
fffff880`00dd1000 fffff880`00de1000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 16:19:48 2009 (4A5BC114)
fffff880`013d8000 fffff880`013e9000   pcw      pcw.sys      Mon Jul 13 16:19:27 2009 (4A5BC0FF)
fffff880`08819000 fffff880`088bf000   peauth   peauth.sys   Mon Jul 13 18:01:19 2009 (4A5BD8DF)
fffff880`059a9000 fffff880`059e6000   portcls  portcls.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`00c9f000 fffff880`00cb3000   PSHED    PSHED.dll    Mon Jul 13 18:32:23 2009 (4A5BE027)
fffff880`04a16000 fffff880`04a3a000   rasl2tp  rasl2tp.sys  Mon Jul 13 17:10:11 2009 (4A5BCCE3)
fffff880`04a69000 fffff880`04a84000   raspppoe raspppoe.sys Mon Jul 13 17:10:17 2009 (4A5BCCE9)
fffff880`058d8000 fffff880`058f9000   raspptp  raspptp.sys  Mon Jul 13 17:10:18 2009 (4A5BCCEA)
fffff880`058f9000 fffff880`05913000   rassstp  rassstp.sys  Mon Jul 13 17:10:25 2009 (4A5BCCF1)
fffff880`02cd2000 fffff880`02d23000   rdbss    rdbss.sys    Mon Jul 13 16:24:09 2009 (4A5BC219)
fffff880`05913000 fffff880`0591e000   rdpbus   rdpbus.sys   Mon Jul 13 17:17:46 2009 (4A5BCEAA)
fffff880`018ca000 fffff880`018d3000   RDPCDD   RDPCDD.sys   Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`019f2000 fffff880`019fb000   rdpencdd rdpencdd.sys Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`0148d000 fffff880`01496000   rdprefmp rdprefmp.sys Mon Jul 13 17:16:35 2009 (4A5BCE63)
fffff880`018d9000 fffff880`01913000   rdyboost rdyboost.sys Mon Jul 13 16:34:34 2009 (4A5BC48A)
fffff880`078f7000 fffff880`07923000   rfcomm   rfcomm.sys   Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`079e2000 fffff880`079fa000   rspndr   rspndr.sys   Mon Jul 13 17:08:50 2009 (4A5BCC92)
fffff880`04c67000 fffff880`04ca6000   Rt64win7 Rt64win7.sys Thu Aug 20 09:05:06 2009 (4A8D7432)
fffff880`090bc000 fffff880`090c4000   rtkio    rtkio.sys    Fri Jun 19 23:00:25 2009 (4A3C7AF9)
fffff880`07615000 fffff880`077ff080   RTKVHD64 RTKVHD64.sys Wed Oct 21 07:27:48 2009 (4ADF1A64)
fffff880`00c20000 fffff880`00c4f000   SCSIPORT SCSIPORT.SYS Mon Jul 13 17:01:04 2009 (4A5BCAC0)
fffff880`088bf000 fffff880`088ca000   secdrv   secdrv.SYS   Wed Sep 13 06:18:38 2006 (4508052E)
fffff880`01485000 fffff880`0148d000   spldr    spldr.sys    Mon May 11 09:56:27 2009 (4A0858BB)
fffff880`09024000 fffff880`090bc000   srv      srv.sys      Tue Dec 08 00:32:55 2009 (4B1E0F37)
fffff880`08909000 fffff880`08972000   srv2     srv2.sys     Mon Jul 13 16:25:02 2009 (4A5BC24E)
fffff880`088ca000 fffff880`088f7000   srvnet   srvnet.sys   Tue Dec 08 00:32:26 2009 (4B1E0F1A)
fffff880`0593c000 fffff880`0593d480   swenum   swenum.sys   Mon Jul 13 17:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Mon Jul 13 16:25:34 2009 (4A5BC26E)
fffff880`088f7000 fffff880`08909000   tcpipreg tcpipreg.sys Mon Jul 13 17:09:49 2009 (4A5BCCCD)
fffff880`010dd000 fffff880`010ea000   TDI      TDI.SYS      Mon Jul 13 16:21:18 2009 (4A5BC16E)
fffff880`010bf000 fffff880`010dd000   tdx      tdx.sys      Mon Jul 13 16:21:15 2009 (4A5BC16B)
fffff880`045dd000 fffff880`045f1000   termdd   termdd.sys   Mon Jul 13 17:16:36 2009 (4A5BCE64)
fffff960`00490000 fffff960`0049a000   TSDDD    TSDDD.dll    Mon Jul 13 17:16:34 2009 (4A5BCE62)
fffff880`02c00000 fffff880`02c26000   tunnel   tunnel.sys   Mon Jul 13 17:09:37 2009 (4A5BCCC1)
fffff880`05981000 fffff880`05993000   umbus    umbus.sys    Mon Jul 13 17:06:56 2009 (4A5BCC20)
fffff880`04ad2000 fffff880`04ad3f00   USBD     USBD.SYS     Mon Jul 13 17:06:23 2009 (4A5BCBFF)
fffff880`04c56000 fffff880`04c67000   usbehci  usbehci.sys  Mon Jul 13 17:06:30 2009 (4A5BCC06)
fffff880`05800000 fffff880`0585a000   usbhub   usbhub.sys   Mon Jul 13 17:07:09 2009 (4A5BCC2D)
fffff880`04c00000 fffff880`04c56000   USBPORT  USBPORT.SYS  Mon Jul 13 17:06:31 2009 (4A5BCC07)
fffff880`053ab000 fffff880`053b8000   usbuhci  usbuhci.sys  Mon Jul 13 17:06:27 2009 (4A5BCC03)
fffff880`00f5a000 fffff880`00f67000   vdrvroot vdrvroot.sys Mon Jul 13 17:01:31 2009 (4A5BCADB)
fffff880`01897000 fffff880`018a5000   vga      vga.sys      Mon Jul 13 16:38:47 2009 (4A5BC587)
fffff880`018a5000 fffff880`018ca000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 16:38:51 2009 (4A5BC58B)
fffff880`01475000 fffff880`01485000   vmstorfl vmstorfl.sys Mon Jul 13 16:42:54 2009 (4A5BC67E)
fffff880`00f7c000 fffff880`00f91000   volmgr   volmgr.sys   Mon Jul 13 16:19:57 2009 (4A5BC11D)
fffff880`00f91000 fffff880`00fed000   volmgrx  volmgrx.sys  Mon Jul 13 16:20:33 2009 (4A5BC141)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 16:20:08 2009 (4A5BC128)
fffff880`045c2000 fffff880`045dd000   wanarp   wanarp.sys   Mon Jul 13 17:10:21 2009 (4A5BCCED)
fffff880`015e9000 fffff880`015f9000   watchdog watchdog.sys Mon Jul 13 16:37:35 2009 (4A5BC53F)
fffff880`00e0a000 fffff880`00eae000   Wdf01000 Wdf01000.sys Mon Jul 13 16:22:07 2009 (4A5BC19F)
fffff880`00eae000 fffff880`00ebd000   WDFLDR   WDFLDR.SYS   Mon Jul 13 16:19:54 2009 (4A5BC11A)
fffff880`0457a000 fffff880`04583000   wfplwf   wfplwf.sys   Mon Jul 13 17:09:26 2009 (4A5BCCB6)
fffff960`000a0000 fffff960`003af000   win32k   win32k.sys   Mon Jul 13 16:40:17 2009 (4A5BC5E1)
fffff880`04cb3000 fffff880`04cbc000   wmiacpi  wmiacpi.sys  Mon Jul 13 16:31:02 2009 (4A5BC3B6)
fffff880`00f14000 fffff880`00f1d000   WMILIB   WMILIB.SYS   Mon Jul 13 16:19:51 2009 (4A5BC117)
Unloaded modules:
fffff880`039a0000 fffff880`039a8000   cpuz132_x64.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`090c4000 fffff880`09135000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019bc000 fffff880`019ca000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019ca000 fffff880`019d6000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019d6000 fffff880`019df000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019df000 fffff880`019f2000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`045a9000 fffff880`045b3000   klim6.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000