[list=1]
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011112-20467-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03262000 PsLoadedModuleList = 0xfffff800`034a7670
Debug session time: Wed Jan 11 06:43:16.543 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:50.730
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff98058aabfeb, 0, fffff880012d5caf, 5}
Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckAttributeRecord+df )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff98058aabfeb, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880012d5caf, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003511100
fffff98058aabfeb
FAULTING_IP:
Ntfs!NtfsCheckAttributeRecord+df
fffff880`012d5caf 0f8535830400 jne Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea)
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: uTorrent.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88008a74c40 -- (.trap 0xfffff88008a74c40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=0000000000000020
rdx=0000000000000028 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012d5caf rsp=fffff88008a74dd0 rbp=0000000000000090
r8=fffff98013aa0780 r9=0000000000000000 r10=0000000000000400
r11=fffffa8008f83180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
Ntfs!NtfsCheckAttributeRecord+0xdf:
fffff880`012d5caf 0f8535830400 jne Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea) [br=0]
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032893bf to fffff800032dec40
STACK_TEXT:
fffff880`08a74ad8 fffff800`032893bf : 00000000`00000050 fffff980`58aabfeb 00000000`00000000 fffff880`08a74c40 : nt!KeBugCheckEx
fffff880`08a74ae0 fffff800`032dcd6e : 00000000`00000000 fffff980`58aabfeb ffff0800`00000000 fffff980`13aa0750 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`08a74c40 fffff880`012d5caf : 0073002e`00000000 fffff980`13aa1400 fffffa80`06a21bc0 fffffa80`0a488060 : nt!KiPageFault+0x16e
fffff880`08a74dd0 fffff880`012d6475 : fffffa80`08f83180 00000000`02ed9234 00000000`00000000 00000000`00000090 : Ntfs!NtfsCheckAttributeRecord+0xdf
fffff880`08a74e40 fffff880`012d1d5c : fffff880`08a75340 fffffa80`08f83180 fffff8a0`0481a5c8 fffff880`08a75101 : Ntfs!NtfsReadMftRecord+0x344
fffff880`08a74ef0 fffff880`012d6ae0 : fffff880`08a75290 fffff8a0`0481a7a0 fffff8a0`0481a6f0 fffff880`08a75120 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`08a74f80 fffff880`012dadb1 : fffff880`08a75340 fffffa80`0a99f3d0 00000000`01760174 fffff8a0`0c742762 : Ntfs!FindFirstIndexEntry+0x50
fffff880`08a75010 fffff880`012cecf5 : fffff880`08a75340 fffff880`08a75340 fffff8a0`0c075601 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`08a75080 fffff880`012b0441 : fffff880`08a75340 fffffa80`098f8470 fffff880`08a75290 fffffa80`098f8400 : Ntfs!NtfsCommonCreate+0x7c5
fffff880`08a75260 fffff880`00da5367 : fffffa80`098f8470 fffffa80`098f8858 fffff880`08a755d0 fffffa80`08364b00 : Ntfs!NtfsNetworkOpenCreate+0x115
fffff880`08a75540 fffff880`00dc6aed : 00000000`00000000 fffffa80`098f8858 00000000`0000000c 00000000`0000000c : fltmgr!FltpPerformFastIoCall+0x357
fffff880`08a755a0 fffff800`035dd4c8 : 00000000`00000045 fffff880`08a759e0 fffffa80`00000080 00000000`000007ff : fltmgr!FltpFastIoQueryOpen+0x15d
fffff880`08a75640 fffff800`035d9838 : fffffa80`08eb5cd0 fffff800`00000000 fffffa80`0aaa9680 00000000`00000101 : nt!IopParseDevice+0xad8
fffff880`08a757d0 fffff800`035daa56 : 00000000`00000000 fffffa80`0aaa9680 fffffa80`6d4e624f fffffa80`06b07660 : nt!ObpLookupObjectName+0x588
fffff880`08a758c0 fffff800`035ba9d6 : fffffa80`0a488060 00000000`0202e7f8 fffff880`08a75a01 00000000`00000004 : nt!ObOpenObjectByName+0x306
fffff880`08a75990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryAttributesFile+0x145
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs!NtfsCheckAttributeRecord+df
fffff880`012d5caf 0f8535830400 jne Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea)
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Ntfs!NtfsCheckAttributeRecord+df
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
FAILURE_BUCKET_ID: X64_0x50_Ntfs!NtfsCheckAttributeRecord+df
BUCKET_ID: X64_0x50_Ntfs!NtfsCheckAttributeRecord+df
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011312-19297-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0325f000 PsLoadedModuleList = 0xfffff800`034a4670
Debug session time: Fri Jan 13 09:48:40.692 2012 (UTC - 7:00)
System Uptime: 0 days 1:18:18.879
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff96000600011, 8, fffff96000600011, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600011, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600011, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350e100
fffff96000600011
FAULTING_IP:
+3566393831333761
fffff960`00600011 ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: Steam.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800a664ff0 -- (.trap 0xfffff8800a664ff0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff900c0a49ba0
rdx=fffff900c554e470 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600011 rsp=fffff8800a665180 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=fffff8800a6652d0
r11=000000000000000b r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
fffff960`00600011 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032879fc to fffff800032dbc40
STACK_TEXT:
fffff880`0a664e88 fffff800`032879fc : 00000000`00000050 fffff960`00600011 00000000`00000008 fffff880`0a664ff0 : nt!KeBugCheckEx
fffff880`0a664e90 fffff800`032d9d6e : 00000000`00000008 fffff960`00600011 fffff880`0a665200 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0a664ff0 fffff960`00600011 : fffff900`c09e5b80 fffff900`c0a49780 fffff900`c09e5b80 fffff900`c0a49630 : nt!KiPageFault+0x16e
fffff880`0a665180 fffff900`c09e5b80 : fffff900`c0a49780 fffff900`c09e5b80 fffff900`c0a49630 00000000`00000000 : 0xfffff960`00600011
fffff880`0a665188 fffff900`c0a49780 : fffff900`c09e5b80 fffff900`c0a49630 00000000`00000000 fffff880`0a665210 : 0xfffff900`c09e5b80
fffff880`0a665190 fffff900`c09e5b80 : fffff900`c0a49630 00000000`00000000 fffff880`0a665210 00000000`7efdb3a8 : 0xfffff900`c0a49780
fffff880`0a665198 fffff900`c0a49630 : 00000000`00000000 fffff880`0a665210 00000000`7efdb3a8 00000000`0008fd20 : 0xfffff900`c09e5b80
fffff880`0a6651a0 00000000`00000000 : fffff880`0a665210 00000000`7efdb3a8 00000000`0008fd20 00000000`7efdb000 : 0xfffff900`c0a49630
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`032879fc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4611f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011412-18392-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03254000 PsLoadedModuleList = 0xfffff800`03499670
Debug session time: Sat Jan 14 01:52:23.400 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:19.586
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff80003000002, 8, fffff80003000002, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80003000002, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff80003000002, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003503100
fffff80003000002
FAULTING_IP:
+3566393831333761
fffff800`03000002 ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88005f94820 -- (.trap 0xfffff88005f94820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff8a0014ad0e0
rdx=000000000000000e rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003000002 rsp=fffff88005f949b0 rbp=000000006353624f
r8=0000000000000000 r9=0000000000000000 r10=fffff80003254000
r11=fffff88005f94b38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
fffff800`03000002 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000327c9fc to fffff800032d0c40
STACK_TEXT:
fffff880`05f946b8 fffff800`0327c9fc : 00000000`00000050 fffff800`03000002 00000000`00000008 fffff880`05f94820 : nt!KeBugCheckEx
fffff880`05f946c0 fffff800`032ced6e : 00000000`00000008 fffff800`03000002 fffff880`05f94b00 fffff8a0`014ad000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`05f94820 fffff800`03000002 : fffff880`05f94ca0 fffff8a0`014b0940 00000000`00cde718 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`05f949b0 fffff880`05f94ca0 : fffff8a0`014b0940 00000000`00cde718 00000000`00000001 00000000`746c6644 : 0xfffff800`03000002
fffff880`05f949b8 fffff8a0`014b0940 : 00000000`00cde718 00000000`00000001 00000000`746c6644 fffff880`05f94ad8 : 0xfffff880`05f94ca0
fffff880`05f949c0 00000000`00cde718 : 00000000`00000001 00000000`746c6644 fffff880`05f94ad8 fffff8a0`014ad0e0 : 0xfffff8a0`014b0940
fffff880`05f949c8 00000000`00000001 : 00000000`746c6644 fffff880`05f94ad8 fffff8a0`014ad0e0 000007ff`fffae000 : 0xcde718
fffff880`05f949d0 00000000`746c6644 : fffff880`05f94ad8 fffff8a0`014ad0e0 000007ff`fffae000 fffffa80`08b01b30 : 0x1
fffff880`05f949d8 fffff880`05f94ad8 : fffff8a0`014ad0e0 000007ff`fffae000 fffffa80`08b01b30 00000000`00000000 : 0x746c6644
fffff880`05f949e0 fffff8a0`014ad0e0 : 000007ff`fffae000 fffffa80`08b01b30 00000000`00000000 00000000`00000000 : 0xfffff880`05f94ad8
fffff880`05f949e8 000007ff`fffae000 : fffffa80`08b01b30 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`014ad0e0
fffff880`05f949f0 fffffa80`08b01b30 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff`fffae000
fffff880`05f949f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffffff`fffffffe : 0xfffffa80`08b01b30
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`0327c9fc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4611f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011412-21559-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0325b000 PsLoadedModuleList = 0xfffff800`034a0670
Debug session time: Sat Jan 14 08:39:51.076 2012 (UTC - 7:00)
System Uptime: 0 days 0:13:37.231
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff96000600049, 8, fffff96000600049, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600049, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600049, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350a100
fffff96000600049
FAULTING_IP:
+3034323862323064
fffff960`00600049 ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88009211f20 -- (.trap 0xfffff88009211f20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000c2000000 rbx=0000000000000000 rcx=fffff900c2a649e0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600049 rsp=fffff880092120b0 rbp=fffff900c2a64630
r8=0000000000000204 r9=0000000000000000 r10=0000000000000001
r11=fffff88009212148 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
fffff960`00600049 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032839fc to fffff800032d7c40
STACK_TEXT:
fffff880`09211db8 fffff800`032839fc : 00000000`00000050 fffff960`00600049 00000000`00000008 fffff880`09211f20 : nt!KeBugCheckEx
fffff880`09211dc0 fffff800`032d5d6e : 00000000`00000008 fffff960`00600049 00000000`00000000 fffff900`c2a64630 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`09211f20 fffff960`00600049 : 00000000`000009a0 00000000`00000000 00000000`00000000 fffff960`000e5629 : nt!KiPageFault+0x16e
fffff880`092120b0 00000000`000009a0 : 00000000`00000000 00000000`00000000 fffff960`000e5629 00000000`3f800000 : 0xfffff960`00600049
fffff880`092120b8 00000000`00000000 : 00000000`00000000 fffff960`000e5629 00000000`3f800000 00000000`00000000 : 0x9a0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`032839fc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4611f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+4611f
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011512-18361-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03253000 PsLoadedModuleList = 0xfffff800`03498670
Debug session time: Sun Jan 15 02:54:16.616 2012 (UTC - 7:00)
System Uptime: 0 days 0:55:07.469
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff96000600000, 8, fffff96000600000, 0}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!GrayShrinkDIB_CX+19f )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600000, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600000, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003502100
fffff96000600000
FAULTING_IP:
+3034323862323064
fffff960`00600000 ?? ???
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88009e416a0 -- (.trap 0xfffff88009e416a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000017 rbx=0000000000000000 rcx=fffff900c3581824
rdx=fffff900c35817c8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600000 rsp=fffff88009e41830 rbp=fffff900c3f36020
r8=fffff900c08c9221 r9=0000000000000001 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
fffff960`00600000 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000327b9fc to fffff800032cfc40
STACK_TEXT:
fffff880`09e41538 fffff800`0327b9fc : 00000000`00000050 fffff960`00600000 00000000`00000008 fffff880`09e416a0 : nt!KeBugCheckEx
fffff880`09e41540 fffff800`032cdd6e : 00000000`00000008 fffff960`00600000 00000000`00000800 fffff900`c08c91c0 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`09e416a0 fffff960`00600000 : fffff900`c08c91c0 00000000`4004600c fffff880`09e418f4 fffff880`09e418fc : nt!KiPageFault+0x16e
fffff880`09e41830 fffff900`c08c91c0 : 00000000`4004600c fffff880`09e418f4 fffff880`09e418fc fffff900`00002800 : 0xfffff960`00600000
fffff880`09e41838 00000000`4004600c : fffff880`09e418f4 fffff880`09e418fc fffff900`00002800 00001f80`ffffffe0 : 0xfffff900`c08c91c0
fffff880`09e41840 fffff880`09e418f4 : fffff880`09e418fc fffff900`00002800 00001f80`ffffffe0 00000000`00000017 : 0x4004600c
fffff880`09e41848 fffff880`09e418fc : fffff900`00002800 00001f80`ffffffe0 00000000`00000017 fffff880`09e41904 : 0xfffff880`09e418f4
fffff880`09e41850 fffff900`00002800 : 00001f80`ffffffe0 00000000`00000017 fffff880`09e41904 fffff880`09e4190c : 0xfffff880`09e418fc
fffff880`09e41858 00001f80`ffffffe0 : 00000000`00000017 fffff880`09e41904 fffff880`09e4190c fffff900`00000ae0 : 0xfffff900`00002800
fffff880`09e41860 00000000`00000017 : fffff880`09e41904 fffff880`09e4190c fffff900`00000ae0 fffff960`00207c78 : 0x1f80`ffffffe0
fffff880`09e41868 fffff880`09e41904 : fffff880`09e4190c fffff900`00000ae0 fffff960`00207c78 00000020`00000017 : 0x17
fffff880`09e41870 fffff880`09e4190c : fffff900`00000ae0 fffff960`00207c78 00000020`00000017 fffff900`00000000 : 0xfffff880`09e41904
fffff880`09e41878 fffff900`00000ae0 : fffff960`00207c78 00000020`00000017 fffff900`00000000 00000000`00000001 : 0xfffff880`09e4190c
fffff880`09e41880 fffff960`00207c77 : 00000020`00000017 fffff900`00000000 00000000`00000001 fffff880`09e41d80 : 0xfffff900`00000ae0
fffff880`09e41888 00000102`00082044 : fffff960`00207ad8 fffff960`001fe6c0 fffff960`001fe6c0 fffff960`002005d8 : win32k!GrayShrinkDIB_CX+0x19f
fffff880`09e418b8 fffff960`00207ad7 : fffff960`001fe6c0 fffff960`001fe6c0 fffff960`002005d8 fffff960`00200694 : 0x102`00082044
fffff880`09e418c0 fffff880`09e41ba8 : fffff900`c00d4280 fffff960`00358e80 fffffa80`0452d990 00000000`00000000 : win32k!GrayExpandDIB_CY+0x79f
fffff880`09e41c20 fffff900`c00d4280 : fffff960`00358e80 fffffa80`0452d990 00000000`00000000 fffff8a0`00000001 : 0xfffff880`09e41ba8
fffff880`09e41c28 fffff960`00358e80 : fffffa80`0452d990 00000000`00000000 fffff8a0`00000001 fffff900`c35815a8 : 0xfffff900`c00d4280
fffff880`09e41c30 fffffa80`0452d990 : 00000000`00000000 fffff8a0`00000001 fffff900`c35815a8 00000017`04010001 : win32k!xloIdent
fffff880`09e41c38 00000000`00000000 : fffff8a0`00000001 fffff900`c35815a8 00000017`04010001 00000004`00000017 : 0xfffffa80`0452d990
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!GrayShrinkDIB_CX+19f
fffff960`00207c77 90 nop
SYMBOL_STACK_INDEX: e
SYMBOL_NAME: win32k!GrayShrinkDIB_CX+19f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
FAILURE_BUCKET_ID: X64_0x50_win32k!GrayShrinkDIB_CX+19f
BUCKET_ID: X64_0x50_win32k!GrayShrinkDIB_CX+19f
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011512-22791-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03217000 PsLoadedModuleList = 0xfffff800`0345c670
Debug session time: Sun Jan 15 14:33:45.921 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:34.060
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa8009647630, fffffa8009647910, fffff800035978b0}
Probably caused by : csrss.exe
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8009647630, Terminating object
Arg3: fffffa8009647910, Process image file name
Arg4: fffff800035978b0, Explanatory message (ascii)
Debugging Details:
------------------
PROCESS_OBJECT: fffffa8009647630
IMAGE_NAME: csrss.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: csrss
FAULTING_MODULE: 0000000000000000
PROCESS_NAME: csrss.exe
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0xF4_C0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
STACK_TEXT:
fffff880`027e9b58 fffff800`0361e5e2 : 00000000`000000f4 00000000`00000003 fffffa80`09647630 fffffa80`09647910 : nt!KeBugCheckEx
fffff880`027e9b60 fffff800`035cb99b : ffffffff`ffffffff fffffa80`079fdb60 fffffa80`09647630 fffffa80`09647630 : nt!PspCatchCriticalBreak+0x92
fffff880`027e9ba0 fffff800`0354b448 : ffffffff`ffffffff 00000000`00000001 fffffa80`09647630 fffffa80`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`027e9bf0 fffff800`03292ed3 : fffffa80`09647630 fffffa80`c0000005 fffffa80`079fdb60 fffff880`010a34e6 : nt!NtTerminateProcess+0xf4
fffff880`027e9c70 fffff800`0328f470 : fffff800`032df67f fffff880`027eaa00 fffff880`027ea340 fffff880`027eac20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`027e9e08 fffff800`032df67f : fffff880`027eaa00 fffff880`027ea340 fffff880`027eac20 00000000`00000002 : nt!KiServiceLinkage
fffff880`027e9e10 fffff800`032e1af8 : fffff880`027eaa00 fffff880`027eaa00 fffff880`027eac20 fffff880`027ea4e0 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`027ea4b0 fffff800`032959fb : fffff880`027eaa00 fffffa80`079fdb60 00000000`003cd960 fffff880`027eabc0 : nt!KiRaiseException+0x1b4
fffff880`027eaae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtRaiseException+0x7b
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe
BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe
Followup: MachineOwner
---------
[/list]