Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-17050-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03251000 PsLoadedModuleList = 0xfffff800`0348ee50
Debug session time: Wed Jun 30 09:33:41.236 2010 (GMT-4)
System Uptime: 0 days 6:06:25.922
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 6b05c, 0, 11685c}
Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000006b05c, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000011685c, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff800033512bc to fffff800032c1600
STACK_TEXT:
fffff880`080dbb78 fffff800`033512bc : 00000000`0000004e 00000000`00000099 00000000`0006b05c 00000000`00000000 : nt!KeBugCheckEx
fffff880`080dbb80 fffff800`032ab994 : 00000000`00000000 fffffa80`0168bdf0 00000000`00002001 80000000`783f5882 : nt!MiBadShareCount+0x4c
fffff880`080dbbc0 fffff800`035b3203 : fffffa80`04552c10 00000000`00000000 fffffa80`04552c10 00000000`00002001 : nt!MiDeleteSegmentPages+0x404
fffff880`080dbc70 fffff800`032f4e5c : fffffa80`04552c00 00000000`00000000 fffffa80`04552c10 00000000`00000000 : nt!MiSegmentDelete+0x7b
fffff880`080dbcb0 fffff800`035db170 : fffffa80`05e5dbe0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0x26c
fffff880`080dbdd0 fffff800`035db57b : 00000000`00000000 00000000`053f0000 fffffa80`00000001 00000000`00000000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`080dbe90 fffff800`032c0853 : 00000000`0000570f fffff800`0343d480 fffffa80`03a029e0 fffffa80`03ce0720 : nt!NtUnmapViewOfSection+0x5f
fffff880`080dbee0 fffff800`032bcdf0 : fffff880`03e4577a 00000000`80000000 00000000`00000013 00000000`2a677641 : nt!KiSystemServiceCopyEnd+0x13
fffff880`080dc078 fffff880`03e4577a : 00000000`80000000 00000000`00000013 00000000`2a677641 00000000`00000001 : nt!KiServiceLinkage
fffff880`080dc080 00000000`80000000 : 00000000`00000013 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 : avgldx64+0x277a
fffff880`080dc088 00000000`00000013 : 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 : 0x80000000
fffff880`080dc090 00000000`2a677641 : 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 : 0x13
fffff880`080dc098 00000000`00000001 : fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 : 0x2a677641
fffff880`080dc0a0 fffff880`03e80fa0 : fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 : 0x1
fffff880`080dc0a8 fffff880`03e68eb5 : 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 : avgldx64+0x3dfa0
fffff880`080dc0b0 00000000`00000020 : fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 : avgldx64+0x25eb5
fffff880`080dc0b8 fffff8a0`08a0a0a8 : 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 : 0x20
fffff880`080dc0c0 00000000`000493e0 : fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 : 0xfffff8a0`08a0a0a8
fffff880`080dc0c8 fffff880`03e80fa0 : fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 00000000`00000000 : 0x493e0
fffff880`080dc0d0 fffff880`080dc4b0 : fffff880`080dc110 00000000`00000000 00000000`00000000 00000000`0000004c : avgldx64+0x3dfa0
fffff880`080dc0d8 fffff880`080dc110 : 00000000`00000000 00000000`00000000 00000000`0000004c fffff880`03e5cf49 : 0xfffff880`080dc4b0
fffff880`080dc0e0 00000000`00000000 : 00000000`00000000 00000000`0000004c fffff880`03e5cf49 00000000`00000000 : 0xfffff880`080dc110
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`033512bc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-29390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`0305ce50
Debug session time: Wed Jun 30 03:25:46.168 2010 (GMT-4)
System Uptime: 0 days 0:10:16.853
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002fc30bf, fffff8800998adf0, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002fc30bf, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800998adf0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008 cmp qword ptr [rax+8],r10
CONTEXT: fffff8800998adf0 -- (.cxr 0xfffff8800998adf0)
rax=0065006300720075 rbx=0000000000000000 rcx=fffffa8003965190
rdx=fffff8a00ccb8c50 rsi=0000000000000000 rdi=fffff8a00e356c00
rip=fffff80002fc30bf rsp=fffff8800998b7c0 rbp=0000000000000000
r8=006f0073006f0072 r9=fffff8a00ccb93c0 r10=fffff8a00ccb93d0
r11=0000000000000001 r12=fffffa8003964500 r13=0000000000000000
r14=0000000000000003 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExDeferredFreePool+0x233:
fffff800`02fc30bf 4c395008 cmp qword ptr [rax+8],r10 ds:002b:00650063`0072007d=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: avgchsva.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002fc30bf
STACK_TEXT:
fffff880`0998b7c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x233
FOLLOWUP_IP:
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008 cmp qword ptr [rax+8],r10
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+233
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff8800998adf0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+233
BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+233
Followup: Pool_corruption
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14617-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e52000 PsLoadedModuleList = 0xfffff800`0308fe50
Debug session time: Wed Jun 30 16:21:47.817 2010 (GMT-4)
System Uptime: 0 days 0:50:32.503
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88007ba8228, fffff88007ba7a90, fffff80002e7f217}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCachedRead+180 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007ba8228
Arg3: fffff88007ba7a90
Arg4: fffff80002e7f217
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007ba8228 -- (.exr 0xfffff88007ba8228)
ExceptionAddress: fffff80002e7f217 (nt!MiInvalidateCollidedIos+0x0000000000000047)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88007ba7a90 -- (.cxr 0xfffff88007ba7a90)
rax=006100730070005c rbx=0000000000000000 rcx=fffffa80045277a0
rdx=0000000000000000 rsi=fffffa80045277a0 rdi=ffffffffffffffff
rip=fffff80002e7f217 rsp=fffff88007ba8460 rbp=fffffa80045277a0
r8=003400360057004f r9=fffffa8005527890 r10=fffffa80045277a0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000058000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!MiInvalidateCollidedIos+0x47:
fffff800`02e7f217 4c8900 mov qword ptr [rax],r8 ds:002b:00610073`0070005c=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fa0e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCachedRead+180
fffff880`0125afc0 84c0 test al,al
FAULTING_IP:
nt!MiInvalidateCollidedIos+47
fffff800`02e7f217 4c8900 mov qword ptr [rax],r8
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002eb3cf6 to fffff80002e7f217
STACK_TEXT:
fffff880`07ba8460 fffff800`02eb3cf6 : 00000000`00000000 fffffa80`045277a0 00000000`00000000 fffffa80`06300800 : nt!MiInvalidateCollidedIos+0x47
fffff880`07ba84b0 fffff800`02f06c8c : fffffa80`045277a0 00000000`00000000 00000000`00000000 00000000`00000052 : nt!MiWaitForInPageComplete+0xa4a
fffff880`07ba8590 fffff800`031e090b : 00000000`00000000 00000000`00052c00 fffffa80`03cdef20 00000000`000fd4e0 : nt!CcFetchDataForRead+0x20c
fffff880`07ba85f0 fffff880`0125afc0 : fffff8a0`00000000 fffff880`00000005 fffffa80`0002d400 fffff880`012ae001 : nt!CcCopyRead+0x16b
fffff880`07ba86b0 fffff880`0125f303 : 00000000`00052c00 fffff8a0`0173f670 fffff880`07ba88e0 fffff880`07ba87d8 : Ntfs!NtfsCachedRead+0x180
fffff880`07ba8710 fffff880`01261f78 : fffffa80`059767e0 fffffa80`03dd2780 fffff880`07ba8801 fffffa80`05cfe900 : Ntfs!NtfsCommonRead+0x583
fffff880`07ba88b0 fffff880`0107a23f : fffffa80`03dd2b20 fffffa80`03dd2780 fffffa80`05cfe930 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`07ba8960 fffff880`010786df : fffffa80`04906de0 00000000`00000001 fffffa80`04906d00 fffffa80`03dd2780 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07ba89f0 fffff800`031d9c49 : 00000000`00000000 fffffa80`03cdef20 00000000`00000001 fffffa80`03dd2780 : fltmgr!FltpDispatch+0xcf
fffff880`07ba8a50 fffff800`031e1453 : fffffa80`03cdef20 fffffa80`03cdef20 fffffa80`03cdef20 fffff880`009e7180 : nt!IopSynchronousServiceTail+0xf9
fffff880`07ba8ac0 fffff800`02ec1853 : 00000000`0000016c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`07ba8bb0 00000000`74132dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001be5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74132dd9
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: Ntfs!NtfsCachedRead+180
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88007ba7a90 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCachedRead+180
BUCKET_ID: X64_0x24_Ntfs!NtfsCachedRead+180
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14820-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`03095e50
Debug session time: Wed Jun 30 15:30:44.737 2010 (GMT-4)
System Uptime: 0 days 0:38:50.048
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff880079caa8c, fffff880031c3eb8, fffff880031c3720}
Probably caused by : avgldx64.sys ( avgldx64+28a8c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880079caa8c, The address that the exception occurred at
Arg3: fffff880031c3eb8, Exception Record Address
Arg4: fffff880031c3720, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
avgldx64+28a8c
fffff880`079caa8c 458b442404 mov r8d,dword ptr [r12+4]
EXCEPTION_RECORD: fffff880031c3eb8 -- (.exr 0xfffff880031c3eb8)
ExceptionAddress: fffff880079caa8c (avgldx64+0x0000000000028a8c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000063eb62c
Attempt to read from address 00000000063eb62c
CONTEXT: fffff880031c3720 -- (.cxr 0xfffff880031c3720)
rax=00000000052b0008 rbx=fffff880079dffa0 rcx=000000000113b620
rdx=0000000000632440 rsi=000000000000002c rdi=0000000000003757
rip=fffff880079caa8c rsp=fffff880031c40f0 rbp=000000000063246c
r8=0000000000000000 r9=0000000000000000 r10=305a28f2f699a73f
r11=0000000000000000 r12=00000000063eb628 r13=0000000000a4e4c4
r14=0000000000a87626 r15=000000000000002c
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
avgldx64+0x28a8c:
fffff880`079caa8c 458b442404 mov r8d,dword ptr [r12+4] ds:002b:00000000`063eb62c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000063eb62c
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031000e0
00000000063eb62c
FOLLOWUP_IP:
avgldx64+28a8c
fffff880`079caa8c 458b442404 mov r8d,dword ptr [r12+4]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff880079dffa0 to fffff880079caa8c
STACK_TEXT:
fffff880`031c40f0 fffff880`079dffa0 : fffff880`079dffa0 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 : avgldx64+0x28a8c
fffff880`031c40f8 fffff880`079dffa0 : 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 00000000`00560723 : avgldx64+0x3dfa0
fffff880`031c4100 00000000`052b0008 : fffff8a0`07976018 00000000`052b0008 00000000`00560723 00152410`00000000 : avgldx64+0x3dfa0
fffff880`031c4108 fffff8a0`07976018 : 00000000`052b0008 00000000`00560723 00152410`00000000 00000000`052b0008 : 0x52b0008
fffff880`031c4110 00000000`052b0008 : 00000000`00560723 00152410`00000000 00000000`052b0008 00000000`00632440 : 0xfffff8a0`07976018
fffff880`031c4118 00000000`00560723 : 00152410`00000000 00000000`052b0008 00000000`00632440 00000000`05820008 : 0x52b0008
fffff880`031c4120 00152410`00000000 : 00000000`052b0008 00000000`00632440 00000000`05820008 00000000`057b77d8 : 0x560723
fffff880`031c4128 00000000`052b0008 : 00000000`00632440 00000000`05820008 00000000`057b77d8 00000000`00000000 : 0x152410`00000000
fffff880`031c4130 00000000`00632440 : 00000000`05820008 00000000`057b77d8 00000000`00000000 fffff880`031c4370 : 0x52b0008
fffff880`031c4138 00000000`05820008 : 00000000`057b77d8 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 : 0x632440
fffff880`031c4140 00000000`057b77d8 : 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 : 0x5820008
fffff880`031c4148 00000000`00000000 : fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 00000000`00000000 : 0x57b77d8
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: avgldx64+28a8c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: avgldx64
IMAGE_NAME: avgldx64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b737eff
STACK_COMMAND: .cxr 0xfffff880031c3720 ; kb
FAILURE_BUCKET_ID: X64_0x7E_avgldx64+28a8c
BUCKET_ID: X64_0x7E_avgldx64+28a8c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-19172-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e50000 PsLoadedModuleList = 0xfffff800`0308de50
Debug session time: Wed Jun 30 14:51:17.709 2010 (GMT-4)
System Uptime: 0 days 5:17:04.005
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, a8e67, 0, a9167}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000a8e67, page frame number
Arg3: 0000000000000000, current page state
Arg4: 00000000000a9167, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SearchFilterHo
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f502bc to fffff80002ec0600
STACK_TEXT:
fffff880`07c11108 fffff800`02f502bc : 00000000`0000004e 00000000`00000099 00000000`000a8e67 00000000`00000000 : nt!KeBugCheckEx
fffff880`07c11110 fffff800`02f32937 : fffff880`02fd5180 fffff800`02ef4326 00000000`00000000 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`07c11150 fffff800`02e94b43 : fffffa80`03d47060 fffff700`000002c0 0000007f`fffffff8 fffff8a0`0326fc28 : nt! ?? ::FNODOBFM::`string'+0x3227e
fffff880`07c111e0 fffff800`02e935a2 : fffffa80`03d47060 fffffa80`0000006f 00000000`000000dd fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`07c11a90 fffff800`031a6c4f : fffff8a0`082269a0 00000000`00000001 00000000`00000000 fffffa80`03fc6340 : nt!MmCleanProcessAddressSpace+0x96
fffff880`07c11ae0 fffff800`0317e6eb : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`07c11ba0 fffff800`02ebf853 : fffffa80`03d47060 00000000`00000000 00000000`00153b01 fffffa80`03fc6340 : nt!NtTerminateProcess+0x25b
fffff880`07c11c20 00000000`775e017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000afd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775e017a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f502bc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070510-17456-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e67000 PsLoadedModuleList = 0xfffff800`030a4e50
Debug session time: Mon Jul 5 03:12:30.128 2010 (GMT-4)
System Uptime: 0 days 0:31:45.813
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {403, fffff68000010050, b39000003c932867, fffff6fc80614cca}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f32 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000010050
Arg3: b39000003c932867
Arg4: fffff6fc80614cca
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_403
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002f49608 to fffff80002ed7600
STACK_TEXT:
fffff880`0a4cb7b8 fffff800`02f49608 : 00000000`0000001a 00000000`00000403 fffff680`00010050 b3900000`3c932867 : nt!KeBugCheckEx
fffff880`0a4cb7c0 fffff800`02f08251 : 00000000`00000000 fffff680`00010440 fffffa80`063bdb30 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31f32
fffff880`0a4cb970 fffff800`02f18fca : 00000000`00000000 00000000`02088fff fffffa80`00000000 fffffa80`063bdb30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0a4cbb30 fffff800`02ed6853 : ffffffff`ffffffff 00000000`0302db90 00000000`0302db58 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0a4cbc20 00000000`76de009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0302dac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de009a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+31f32
fffff800`02f49608 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+31f32
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32
BUCKET_ID: X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32
Followup: MachineOwner
---------