*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 1, 8be036ad}
Unable to load image \SystemRoot\system32\DRIVERS\avglogx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avglogx.sys
*** ERROR: Module load completed but symbols could not be loaded for avglogx.sys
*** WARNING: Unable to verify timestamp for avgmfx86.sys
*** ERROR: Module load completed but symbols could not be loaded for avgmfx86.sys
Probably caused by : avglogx.sys ( avglogx+36ad )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8be036ad, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82fbb848
Unable to read MiSystemVaType memory at 82f9ae20
00000000
CURRENT_IRQL: 2
FAULTING_IP:
avglogx+36ad
8be036ad 8901 mov dword ptr [ecx],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: svchost.exe
TRAP_FRAME: 991735ec -- (.trap 0xffffffff991735ec)
ErrCode = 00000002
eax=892b6288 ebx=8610d4c8 ecx=00000000 edx=88533c68 esi=88533c60 edi=6c677641
eip=8be036ad esp=99173660 ebp=99173668 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
avglogx+0x36ad:
8be036ad 8901 mov dword ptr [ecx],eax ds:0023:00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 8be036ad to 82e91cdb
STACK_TEXT:
991735ec 8be036ad badb0d00 88533c68 9917360c nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
99173668 8be0dd9a 99173688 991736f8 882c84b8 avglogx+0x36ad
9917368c 8be3585a 00030d40 00000000 8be39dba avglogx+0xdd9a
991736c0 8be2bbc9 00030d40 00000000 8be39dba avgmfx86+0xb85a
991736fc 8be340ab 99173730 00000000 882c84b8 avgmfx86+0x1bc9
99173748 8be2c11f 88f8cb80 00000000 882da708 avgmfx86+0xa0ab
99173880 8b8e2bf5 88f8cb78 00000005 00000008 avgmfx86+0x211f
991738b4 8b8e3417 8610f2e8 00000005 129aa0bf fltmgr!FltpDoInstanceSetupNotification+0x69
99173900 8b8e37d1 882da6d8 86119980 00000005 fltmgr!FltpInitInstance+0x25d
99173970 8b8e38d7 882da6d8 86119980 00000005 fltmgr!FltpCreateInstanceFromName+0x285
991739dc 8b8eccde 882da6d8 86119980 00000005 fltmgr!FltpEnumerateRegistryInstances+0xf9
99173a2c 8b8e17f4 86119980 89de0e20 89741f80 fltmgr!FltpDoFilterNotificationForNewVolume+0xe0
99173a70 82e87c29 86119ed8 86119980 89741fdc fltmgr!FltpCreate+0x206
99173a88 83098447 b2ac9160 99173c30 00000000 nt!IofCallDriver+0x63
99173b60 83077c4e 88317880 a579aeb0 89ecc318 nt!IopParseDevice+0xed7
99173bdc 83088060 00000000 99173c30 00000040 nt!ObpLookupObjectName+0x4fa
99173c38 8307eb3e 0196eb04 8579aeb0 89741f01 nt!ObOpenObjectByName+0x165
99173cb4 830a23c4 0196eb60 c0100080 0196eb04 nt!IopCreateFile+0x673
99173d00 82e8e8fa 0196eb60 c0100080 0196eb04 nt!NtCreateFile+0x34
99173d00 77197094 0196eb60 c0100080 0196eb04 nt!KiFastCallEntry+0x12a
0196eb68 00000000 00000000 00000000 00000000 0x77197094
STACK_COMMAND: kb
FOLLOWUP_IP:
avglogx+36ad
8be036ad 8901 mov dword ptr [ecx],eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: avglogx+36ad
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: avglogx
IMAGE_NAME: avglogx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 505bc167
FAILURE_BUCKET_ID: 0xD1_avglogx+36ad
BUCKET_ID: 0xD1_avglogx+36ad
Followup: MachineOwner
---------