BSODs and unstable Win7

tumblebug · Jan 24, 2011

Hi

I've got a fairly new work laptop (4 months old - Toshiba Tecra A11) with Win7 Professional x64 and its been behaving very strangely with screen flashes, momentary system freezes and lately, frequent BSODs that appear to be mostly related to "ntoskrnl.exe".

I'm a web .net programmer so I push the laptop fairly hard with projects open in Visual Studio 2008, a XP SP2 virtual pc (in Virtual PC 2007) running Visual Studio 2003, source control, Office, etc, etc - standard developer stuff. No gaming, iTunes, movies, etc. When in the office, I have a Samsung SyncMaster 205bw external monitor hooked up as the primary display (with external keyboard and mouse) with the latop screen as the secondary display. When at home, I just used the laptop display.

Ever since I got the laptop, I've been having momentary freezes of the system, most noticeablely when hovering over the task bar and displaying the small snapshots of the currently open windows but the freeze would happen at other times as well - particularly when working in the virtual pc environment.

A while back I had a situation in the office where both displays would go black for a second, and then come back - it did this constantly for about 10 minutes and settled back down. I still get this but very sporadically.

Just recently I started a web project in the virtual pc environment that works with flash video and I don't know if its co-incidence, but the Windows 7 system gets more and more unstable with Skype, Messenger, the Desktop Manager, Windows Explorer, IE8, Intel Management, etc shutting down at random times to the point where a BSOD occurs (I've attached the last 5 dumps). The BSOD doesn't always occur though. The only hint of a pattern is that the random shutdowns occur AFTER I start working with video, or playing video through the browser. I've checked the flash plugin version and I have the latest one installed in both IE8 and Firefox.

I've opened the dumps in Windows Debugger but nothing really jumps out as a particular buggy driver - they mainly point to the ntoskrnl.exe or memory managment. The last dump from 2.38am this morning looks like it occured after a chkdsk run I left running overnight. I've done several chkdsks over the last few days which found and fixed bad/unreadable sectors on the disk.

I've run Memtest a couple of times but nothing appeared to be wrong there - although memtest DOES have a message saying "hardware issues exist" but doesn't say anything more than that. I'm going to try an overnight run for Memtest tonight.

Sorry for the long post, but anyone got any suggestions of where else to look? Maybe I've just got a lemon of a laptop

CarlTR6 · Jan 24, 2011

Hi tumblebug; welcome to the forum. I will take a look at your dumps; but please read this tutorial and follow the instructions. This will help us help you.

I looked at four of your five dumps. One of them is a Driver Verifier enabled dump. Make sure you have Driver Verifier turned off. Each dump shows a different bugcheck code; this generally means a hardware or hardware related (driver) problem. All the dumps indicate memory corruption.

Since I don't have the uploads that come from following the tutorial, I will start with drivers. Out of date drivers can cause conflicts, memory corruption and BSOD's. I find the following outsated drivers loaded on your system. One of them is really obsolete. Update these drivers or uninstall the software/hardware they are associated with.

pgeffect.sys Mon Jun 22 05:00:11 2009 - Pangu Effect driver, Toshiba Universal Camera Filter driver. Toshiba Support - Homepage. Update this driver or uninstall the camera and upgrade to a camera certified compatible with Win 7.

rimspe64.sys Wed Jul 01 19:54:49 2009 - Ricoh-PCIe-Memory-Stick-Host-Controller. OEM – none at Downloads | Ricoh Global. If you cannot update the Ricoh drivers from the Toshiba website, uninstall the device.

rixdpe64.sys Sat Jul 04 06:27:00 2009 - Ricoh-PCIe-Memory-Stick-Host-Controller. OEM - none at Downloads | Ricoh Global. See above.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Update this driver.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Update this driver.

tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 - Toshiba tos_sps64 Service. Toshiba Support - Homepage. Update.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Update.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. Update.

vmm.sys Fri May 15 08:28:12 2009 - Virtual Machine Monitor driver - Microsoft Virtual PC 2004. Microsoft Download Center. Upgrade your MS Virtual Machine software.

VMNetSrv.sys Wed Jan 24 07:05:46 2007 - Microsoft Virtual Machine Network Services Driver. Microsoft Download Center. Upgrade your MS Virtual Machine software.

Take care of these drivers reboot and see how your system runs. Post back and let us know. If you get another BSOD, upload it and we will go from there. I may find something else when you upload the files following the instructions in the tutorial.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03010000 PsLoadedModuleList = 0xfffff800`0324de50
Debug session time: Sun Jan 23 18:28:42.565 2011 (GMT-5)
System Uptime: 0 days 1:11:07.391
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, fffff8800dc20001, 157a, fffff78000001000}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff8800dc20001
Arg3: 000000000000157a
Arg4: fffff78000001000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800030d53b3 to fffff80003080740

STACK_TEXT:  
fffff880`0a164138 fffff800`030d53b3 : 00000000`0000001a 00000000`00041284 fffff880`0dc20001 00000000`0000157a : nt!KeBugCheckEx
fffff880`0a164140 fffff800`03025fbe : 00000000`0000157a fffffa80`040c5e70 00000000`00000000 fffffa80`07cf9060 : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`0a164180 fffff800`03430260 : fffff880`0dc20000 fffff800`00000c40 fffffa80`07089550 fffff880`04405e00 : nt! ?? ::FNODOBFM::`string'+0x2df20
fffff880`0a1642d0 fffff800`03430333 : fffff8a0`11264780 fffffa80`0b899000 fffff8a0`00f64000 fffffa80`0b899000 : nt!MiRemoveFromSystemSpace+0x1d0
fffff880`0a164330 fffff880`0441ab1e : fffffa80`0705e360 fffff880`0441b5fd 00000000`00000000 00000000`00000001 : nt!MmUnmapViewInSystemSpace+0x73
fffff880`0a164360 fffff880`0440198f : fffffa80`0b3411e0 fffff8a0`015da640 fffffa80`0b899000 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+0x146
fffff880`0a164440 fffff880`0452306f : fffff8a0`1086a210 00000000`00000000 fffff8a0`00f64000 00000000`00000174 : dxgmms1!VidMmDestroyAllocation+0x4f
fffff880`0a164470 fffff880`045233ac : fffff8a0`1086a210 00000000`00000000 00000000`00000001 fffff8a0`00f64000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x5eb
fffff880`0a164560 fffff880`04522651 : fffff8a0`00f64000 fffff8a0`00f64000 fffff8a0`05f25220 005c006c`00000000 : dxgkrnl!DXGDEVICE::DestroyResource+0x84
fffff880`0a164590 fffff880`045228e1 : fffffa80`0a3711a0 fffff8a0`00f64000 00000000`00000001 fffff8a0`0439e7f0 : dxgkrnl!DXGDEVICE::ProcessTerminationList+0x95
fffff880`0a1645e0 fffff880`045263e7 : fffff8a0`00f64000 00000000`400003c0 fffff880`0a164790 fffff880`044ed3af : dxgkrnl!DXGDEVICE::TerminateAllocations+0xb9
fffff880`0a164630 fffff880`0452ffc1 : fffff8a0`00f64000 fffff880`0a164728 00000000`00000b00 fffff880`0a164720 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x93
fffff880`0a1646c0 fffff960`00768804 : fffffa80`0b8f1250 00000000`00000000 00000000`00000050 00000000`00000000 : dxgkrnl!DxgkCddDestroyAllocation+0x241
fffff880`0a164770 fffff960`0076d69b : 00000000`00000000 fffff900`c00c39f0 00000000`00000990 00000000`0000045a : cdd!CDDPDEV::DestroyAllocation+0x68
fffff880`0a1647e0 fffff960`0076d6cd : fffffa80`07cf9168 fffff900`c00c0020 00000000`00000981 00000000`400003c0 : cdd!CddBitmapStagingApertureMem::InvalidateDeviceAllocations+0x2b
fffff880`0a164810 fffff960`0076bc1e : fffff900`c00c0020 00000000`00000981 00000000`00000001 fffff880`0718bad0 : cdd!CddBitmapStagingApertureMem::Reallocate+0x21
fffff880`0a164840 fffff960`0076c215 : fffffa80`00000000 fffff900`c00c7028 fffff880`0a164a30 00000000`00000001 : cdd!CStagingPoolBase::AllocateRect+0x366
fffff880`0a1648c0 fffff960`00779154 : 00000000`00000000 00000000`00000000 fffff900`c00c0020 fffff880`0a165180 : cdd!CStagingPool::GetGdiSurface+0x145
fffff880`0a164930 fffff960`0077a12b : 00000000`00000000 fffff900`c23a8468 fffff900`c5800018 00000000`00000000 : cdd!BitBltBitmap+0x53c
fffff880`0a164ec0 fffff960`0077b138 : 00000000`00000000 00000000`0000007f 00000000`00000000 00000000`00000000 : cdd!DrvBitBlt+0x17b
fffff880`0a1650e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cdd!DrvCopyBits+0x44


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146
fffff880`0441ab1e 488b8b48010000  mov     rcx,qword ptr [rbx+148h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ccf7c90

FAILURE_BUCKET_ID:  X64_0x1a_41284_dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

BUCKET_ID:  X64_0x1a_41284_dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

Followup: MachineOwner
---------

Debug session time: Sun Jan 23 18:59:13.095 2011 (GMT-5)
System Uptime: 0 days 0:29:42.000
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa83fe74081b, 0, fffff800030a353b, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+41b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa83fe74081b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800030a353b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c70e0
 fffffa83fe74081b 

FAULTING_IP: 
nt!MiAgeWorkingSet+41b
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880035167a0 -- (.trap 0xfffff880035167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffff6fcc0046348
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030a353b rsp=fffff88003516930 rbp=007ffffcc004634e
 r8=0000000000000001  r9=fffff8000321be00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiAgeWorkingSet+0x41b:
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh] ds:2030:00000000`0000001b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000310e8c1 to fffff8000308f740

STACK_TEXT:  
fffff880`03516638 fffff800`0310e8c1 : 00000000`00000050 fffffa83`fe74081b 00000000`00000000 fffff880`035167a0 : nt!KeBugCheckEx
fffff880`03516640 fffff800`0308d82e : 00000000`00000000 f8a00154`d1580400 00000000`00040000 00000000`0000000b : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`035167a0 fffff800`030a353b : 00000000`00006000 51e00001`25e73921 00000000`00000000 00000000`00002d1e : nt!KiPageFault+0x16e
fffff880`03516930 fffff800`03111a5e : fffff800`0321be00 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt!MiAgeWorkingSet+0x41b
fffff880`03516ae0 fffff800`030a3ee2 : 00000000`000006f8 00000000`00000000 fffffa80`00000000 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03516b80 fffff800`030a4173 : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03333c06 : fffffa80`06c8cb60 00000000`00000080 fffffa80`06be2420 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`0306dc26 : fffff880`009ea180 fffffa80`06c8cb60 fffff880`009f4fc0 6ebe9b7f`f2bffffe : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+41b
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+41b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

Followup: MachineOwner
---------

Debug session time: Sun Jan 23 21:33:51.091 2011 (GMT-5)
System Uptime: 0 days 0:20:13.231
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800ca51360, fffff80000b9c518, fffff98004dc0bd0}

*** WARNING: Unable to verify timestamp for usbhub.sys
*** ERROR: Module load completed but symbols could not be loaded for usbhub.sys
Probably caused by : usbhub.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800ca51360, Physical Device Object of the stack
Arg3: fffff80000b9c518, Functional Device Object of the stack
Arg4: fffff98004dc0bd0, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IRP_ADDRESS:  fffff98004dc0bd0

DEVICE_OBJECT: fffffa800cb5a050

DRIVER_OBJECT: fffffa800c986d60

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b18b9af

MODULE_NAME: usbhub

FAULTING_MODULE: fffff88007ae1000 usbhub

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030e7273 to fffff80003078740

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`030e7273 : 00000000`0000009f 00000000`00000003 fffffa80`0ca51360 fffff800`00b9c518 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`0308429e : fffff800`00b9c600 fffff800`00b9c600 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x292b0
fffff800`00b9c570 fffff800`03083dd6 : fffff800`03228700 00000000`00012fca 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
fffff800`00b9c5e0 fffff800`030844be : 00000002`d32468cc fffff800`00b9cc58 00000000`00012fca fffff800`031f6bc8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`03083cb7 : 00000000`c54ca5c1 00000000`00012fca 00000000`c54ca542 00000000`000000ca : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`03080eea : fffff800`031f2e80 fffff800`03200c40 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_VRF_IMAGE_usbhub.sys

BUCKET_ID:  X64_0x9F_VRF_IMAGE_usbhub.sys

Followup: MachineOwner
---------

Debug session time: Mon Jan 24 10:37:32.262 2011 (GMT-5)
System Uptime: 0 days 0:26:59.761
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff8a000fbd358, 8000000214426101, fffff88008c594a0, b}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4237e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8a000fbd358, Virtual address for the attempted write.
Arg2: 8000000214426101, PTE contents.
Arg3: fffff88008c594a0, (reserved)
Arg4: 000000000000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffff88008c594a0 -- (.trap 0xfffff88008c594a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a000fbd358 rbx=0000000000000000 rcx=fffff8a004fbd2c0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001508b76 rsp=fffff88008c59630 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff880014b3380
r11=fffff8a00607c928 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Ntfs!NtfsOpenAttribute+0x326:
fffff880`01508b76 4c8918          mov     qword ptr [rax],r11 ds:fffff8a0`00fbd358=0000004200000008
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000350aae2 to fffff8000348a740

STACK_TEXT:  
fffff880`08c59338 fffff800`0350aae2 : 00000000`000000be fffff8a0`00fbd358 80000002`14426101 fffff880`08c594a0 : nt!KeBugCheckEx
fffff880`08c59340 fffff800`0348882e : 00000000`00000001 fffffa80`06eafae0 fffffa80`071d0000 fffffa80`07498f70 : nt! ?? ::FNODOBFM::`string'+0x4237e
fffff880`08c594a0 fffff880`01508b76 : fffffa80`06eafae0 fffff880`02498400 fffff8a0`01749450 fffff8a0`04fbd3a8 : nt!KiPageFault+0x16e
fffff880`08c59630 fffff880`014f6e45 : fffffa80`06f30b10 fffffa80`07498f70 fffffa80`07e3b180 fffff8a0`04fbd3a8 : Ntfs!NtfsOpenAttribute+0x326
fffff880`08c59740 fffff880`014f378b : fffff880`024984b0 fffffa80`06f30b10 fffff8a0`04fbd3a8 fffff8a0`0000009a : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`08c59800 fffff880`014f3eff : fffffa80`06f30b10 fffffa80`07498bd0 fffff8a0`04fbd3a8 fffff880`0000009a : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`08c59990 fffff880`01504e76 : fffffa80`06f30b10 fffffa80`07498bd0 fffff8a0`04fbd3a8 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`08c59a80 fffff880`014ff28d : fffffa80`06f30b10 fffffa80`07498bd0 fffff880`08c59c60 fffff880`08c59ca8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`08c59b50 fffff880`01468c0d : fffffa80`06f30b10 fffffa80`07498bd0 fffff880`024984b0 fffffa80`0c078b00 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`08c59d30 fffff800`034825c7 : fffff880`02498420 00000000`002f4d68 00000000`002f4d68 00000000`002f4e10 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08c59d60 fffff800`03482581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`024982f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4237e
fffff800`0350aae2 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4237e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+4237e

BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+4237e

Followup: MachineOwner
---------

0: kd> lmtsmn
start             end                 module name
fffff880`00f9e000 fffff880`00ff5000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04339000 fffff880`043c3000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04666000 fffff880`0467c000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`07a4d000 fffff880`07b7e000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`01278000 fffff880`01283000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04a00000 fffff880`04a48000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`0123a000 fffff880`01243000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`01243000 fffff880`0126d000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`05400000 fffff880`054c1000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00e68000 fffff880`00e74000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`0428d000 fffff880`04294000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`04732000 fffff880`04743000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`029b0000 fffff880`029ce000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`006e0000 fffff960`00707000   cdd      cdd.dll      unavailable (00000000)
fffff880`0422d000 fffff880`04257000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cec000 fffff880`00dac000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01a50000 fffff880`01a80000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c8e000 fffff880`00cec000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05888000 fffff880`0588c500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01341000 fffff880`013b4000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e5f000 fffff880`00e68000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`04656000 fffff880`04666000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`07a35000 fffff880`07a43000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`046af000 fffff880`04732000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`0456e000 fffff880`04589000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`04550000 fffff880`0456e000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`04541000 fffff880`04550000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01a3a000 fffff880`01a50000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0559b000 fffff880`055bd000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`054c1000 fffff880`054d4000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`0400f000 fffff880`04217000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`07bd6000 fffff880`07be2000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`05249000 fffff880`0533d000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`0533d000 fffff880`05383000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`05394000 fffff880`053e3000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`012cf000 fffff880`012e3000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01283000 fffff880`012cf000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0142b000 fffff880`01435000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01a00000 fffff880`01a3a000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0168b000 fffff880`016d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039f6000 fffff800`03a3f000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`05200000 fffff880`05224000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05383000 fffff880`05394000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`028e8000 fffff880`029b0000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01bd3000 fffff880`01bdc000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0581b000 fffff880`05839000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01032000 fffff880`0123a000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a4a000 fffff880`051c4ce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`05861000 fffff880`05887c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`07b8f000 fffff880`07bd6000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`04769000 fffff880`0477f000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05839000 fffff880`05848000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bab000 fffff800`00bb5000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`04400000 fffff880`04443000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01400000 fffff880`0141a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`079ed000 fffff880`079f2200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`055e0000 fffff880`055f5000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`055bd000 fffff880`055e0000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c36000 fffff880`00c7a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`07b80000 fffff880`07b8f000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`054d4000 fffff880`054e2000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05848000 fffff880`05857000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00dac000 fffff880`00dc6000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04257000 fffff880`04284000   MpFilter MpFilter.sys Sat Mar 20 01:58:08 2010 (4BA463F0)
fffff880`08379000 fffff880`08389000   MpNWMon  MpNWMon.sys  Sat Mar 20 01:58:00 2010 (4BA463E8)
fffff880`029ce000 fffff880`029e6000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02800000 fffff880`0282d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`03cb2000 fffff880`03d00000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`03d00000 fffff880`03d23000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`0126d000 fffff880`01278000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`042f2000 fffff880`042fd000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e0a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`012e3000 fffff880`01341000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`04536000 fffff880`04541000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01bc1000 fffff880`01bd3000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016f3000 fffff880`017e5000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`053f4000 fffff880`05400000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`028bd000 fffff880`028d0000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04589000 fffff880`045b8000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05549000 fffff880`0555e000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`04000000 fffff880`0400f000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01a8e000 fffff880`01ad3000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0588d000 fffff880`05fec000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`042fd000 fffff880`0430e000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0452a000 fffff880`04536000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`0341a000 fffff800`039f6000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01457000 fffff880`015fa000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`04284000 fffff880`0428d000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`0286a000 fffff880`028bd000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`043cc000 fffff880`043f2000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e4a000 fffff880`00e5f000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e0a000 fffff880`00e3d000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00dc6000 fffff880`00dcd000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00dcd000 fffff880`00ddd000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0141a000 fffff880`0142b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`03d2d000 fffff880`03dd3000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`07a2e000 fffff880`07a34e80   pgeffect pgeffect.sys Mon Jun 22 05:00:11 2009 (4A3F481B)
fffff880`0555e000 fffff880`0559b000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c7a000 fffff880`00c8e000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`0467c000 fffff880`046a0000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`047d5000 fffff880`047f0000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`045b8000 fffff880`045d9000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`045d9000 fffff880`045f3000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`044d9000 fffff880`0452a000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`051f3000 fffff880`051fe000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`042d7000 fffff880`042e0000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`042e0000 fffff880`042e9000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`042e9000 fffff880`042f2000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01b87000 fffff880`01bc1000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`051c5000 fffff880`051de000   rimspe64 rimspe64.sys Wed Jul 01 19:54:49 2009 (4A4BF749)
fffff880`05224000 fffff880`0523d000   risdpe64 risdpe64.sys Fri Nov 27 07:53:49 2009 (4B0FCBDD)
fffff880`04600000 fffff880`04656000   rixdpe64 rixdpe64.sys Sat Jul 04 06:27:00 2009 (4A4F2E74)
fffff880`028d0000 fffff880`028e8000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`07801000 fffff880`079eca80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`03dd3000 fffff880`03dde000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`0580f000 fffff880`0581b000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`01bdc000 fffff880`01bf9000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01b7f000 fffff880`01b87000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`082e3000 fffff880`08379000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`03c3f000 fffff880`03ca6000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`03c00000 fffff880`03c2d000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`05246000 fffff880`05247480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01803000 fffff880`01a00000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`03c2d000 fffff880`03c3f000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`05857000 fffff880`05861000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0432c000 fffff880`04339000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`0430e000 fffff880`0432c000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`044c5000 fffff880`044d9000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01b73000 fffff880`01b7f000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01b71000 fffff880`01b72f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01af7000 fffff880`01b71000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`0523d000 fffff880`05246000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05800000 fffff880`0580f000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`00550000 fffff960`0055a000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04743000 fffff880`04769000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`016e5000 fffff880`016e9e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`05ff9000 fffff880`06000000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`04443000 fffff880`04455000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`07be2000 fffff880`07bff000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`07b7e000 fffff880`07b7ff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`053e3000 fffff880`053f4000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`054ef000 fffff880`05549000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`0477f000 fffff880`047d5000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`07a00000 fffff880`07a2d200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`043f2000 fffff880`043fc000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`04294000 fffff880`042a2000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`042a2000 fffff880`042c7000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`04478000 fffff880`044c5000   vmm      vmm.sys      Fri May 15 08:28:12 2009 (4A0D5FDC)
fffff880`051de000 fffff880`051f3000   VMNetSrv VMNetSrv.sys Wed Jan 24 07:05:46 2007 (45B74B9A)
fffff880`016d5000 fffff880`016e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e74000 fffff880`00e89000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e89000 fffff880`00ee5000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`013b4000 fffff880`01400000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`05fec000 fffff880`05ff9000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`01ad3000 fffff880`01ae9000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`03d23000 fffff880`03d2d000   vwifimp  vwifimp.sys  Mon Jul 13 20:07:28 2009 (4A5BCC40)
fffff880`017e5000 fffff880`01800000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`042c7000 fffff880`042d7000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eeb000 fffff880`00f8f000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f8f000 fffff880`00f9e000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`043c3000 fffff880`043cc000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000c0000 fffff960`003d0000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00ff5000 fffff880`00ffe000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04455000 fffff880`04476000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`08389000 fffff880`083fa000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01a80000 fffff880`01a8e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04012000 fffff880`0421a000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0421a000 fffff880`0422d000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

tumblebug · Jan 24, 2011

Hi CarlTR6

Thanks for the quick reply.

I assumed you meant the posting tutorial so I followed that and have uploaded another zipfile for you.

This system is currently still the oem install that came with the laptop. I keep it up to date with windows update - however I noticed this morning that it wasnt looking after the drivers so I enabled that. It didnt appear to do much.

I've tried to disable the driver verifier by deleting all existing settings but it said there were no settings to delete - is that all I need to do or is there a disable option somewhere I need to switch as well?

I'll fix up all these drivers and reboot. One thing though, I'm running Virtual PC 2007 - should I still upgrade these drivers?

Thanks heaps for the help

CarlTR6 · Jan 24, 2011

You are very welcome for the help. Thanks for uploading the files.

We recommend that you NOT use Windows update for drivers. We recommend going to the website of your computer manufacturer or the manufacturer of the device or software, download the updates and install them yourself. Unfortunately, Windows Update does not always have the latest third party drivers. I have Windows Update configured to notify me of updates. Then I pick the ones I wish to install. I usually do not let it install drivers.

If you can update the Virtual PC drivers to a date of 13 July 2009 or later, do so. If not, I suggest that you need to uninstall Virtual PC 2007 and upgrade to the latest version. Your version is not designed to run on Win 7.

tumblebug · Jan 24, 2011

Hi Carl

No problem - I've switched of the automated update for the device drivers. I'll set to and update them one by one. Let you know how I go

Tim

CarlTR6 · Jan 25, 2011

Very good, Tim. Upgrade your Virtual PC and see if that helps your system.

tumblebug · Jan 26, 2011

Hi Carl

Following actions taken

pgeffect.sys - datetime moved from 22/06/2009 05:00:11 to 23/06/2009 23:05:00 (note this is Australian time - UTC+10) so I'm not sure if this updated or not. I used the web cam installer from Australian Toshiba site that firstly removed the current webcam software, and then reinstalled.
rimspe64.sys - nothing on Aust Toshiba site so uninstalled device. On reboot, windows wanted to reinstall it so the device has been disabled
rixdpe64.sys - nothing on Aust Toshiba site so uninstalled device. On reboot, windows wanted to reinstall it so the device has been disabled
thpdrv.sys - updated - datetime moved from 28/06/2009 22:02:56 to 30/06/2009 4:25:00
Thpevm.SYS - updated - datetime moved from 29/06/2009 04:15:37 to 30/06/2009 10:16:00
tos_sps64 tos_sps64.sys - updated - datetime moved from 24/06/2009 01:31:09 to 25/07/2009 09:57:00
tosrfec.sys - updated - datetime moved from 01/06/2009 02:58:53 to 14/07/2009 16:12:00
TVALZFL.sys - updated - datetime moved from 19/06/2009 06:05:44 to 20/06/2009 13:15:00
vmm.sys - updated - datetime moved from 15/05/2009 08:28:12 to 27/01/2011 9:00:00 - applied Virtual PC 2007 SP1 from Microsoft website. Upon reboot this morning, Windows Update also advised a security patch to Virtual PC (which I applied).
VMNetSrv.sys - updated - datetime moved from 24/01/2007 07:05:46 to 05/02/2008 1:50:00 - applied Virtual PC 2007 SP1 from Microsoft website. Upon reboot this morning, Windows Update advised a security patch to Virtual PC (which I applied).

I have been in Virtual PC with my web video project, and also browsing video websites with IE8 in the win7 system - which is usually where the system instability starts and no BSODs...yet *crosses fingers*. My system has calmed down alot.

so far...so good

Thanks for your help thus far....

CarlTR6 · Jan 26, 2011

Good work! And a great report back. Glad your system is running better. Generally speaking, the "magic" date for third party drivers with Win 7 is 13 July 2009 or later. There are exceptions. Drivers dated in 2009, but prior to 13 July, are Vista drivers and some Vista drivers work well with Win 7. Being that VMNetSrv.sys is a Microsoft driver, the 05/02/2008 date may well be OK.

Please post back in two or three days and let us know how your system is running. If you get another BSOD, upload it and we will go from there.

You are welcome for the help.

tumblebug · Jan 27, 2011

Hi Carl

Got some more dump files - this time, I had been in Virtual PC but I'm fairly sure I'd shut it down again. I'd been editing some fairly large script files in SQL Management Tools but I'd also logged out of that too. No video programming or playing though.

I left the laptop open and on on the table and then heard it reboot itself. I didn't see the actually blue screens but I assume they happened.

Noticed two more dump files - one relating to ntfs.sys and the other win32k.sys. I've run the entire information gathering routine for you to look through - hope you find something

Given that I've run chkdsk and it reported unreadable sectors (which I did get it to fix) - could I be looking at a hard drive on its way out maybe?

Tim

CarlTR6 · Jan 27, 2011

Hi, Tim; I am sorry that you are still having problems.

How many bad or unreadable sectors did you have? A few is not unusual, even on a brand new HD. A lot of them can be an indication your hard drive is on its way out. I suggest that you backup all of your files to an external HD - which is a good idea to do routinely anyway. I recommend that you further test your hard drive: HD Diagnostic[FONT=&quot] (read the details at the link). Do keep in mind that other things such as a driver can cause this crash.

Bugcheck 19, BAD_POOL_HEADER. Usual causes: Device driver.

Bugcheck 50, PAGE_FAULT_IN_NONPAGED_AREA. Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS.

[/FONT]The second and most recent dump blames win32k.sys, which is a Windows system driver. When this driver is blames is usually another driver causing a conflict.

I believe that your problem is Microsoft Virtual PC 2004. It is XP software and not compatible with Win 7. Download details: Virtual PC 2004 SP1

Virtual PC 2004 SP1 runs on: Windows 2000 Professional SP4, Windows XP Professional, and Windows XP Tablet PC Edition.

I recommend that you uninstall this version and install Virtual PC 2007 which is compatible with Win 7. Windows Virtual PC: Home Page. I think this will improve your system's stability. Your most out of date drivers belong to Virtual PC.

vmm.sys Tue Apr 07 09:25:54 2009 - Virtual Machine Monitor driver - Microsoft Virtual PC 2004

VMNetSrv.sys Wed Jan 16 06:52:01 2008 - Microsoft Virtual Machine Network Services Driver.

Your remaining out of date drivers are Toshiba drivers.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Ignore this one for now.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Ignore this one for now.

tos_sps64.sys Wed Jun 24 01:31:09 2009 - . Toshiba Support - Homepage. Regarding this driver, read this article: TRS driver? - Toshiba Forums. You should get a chuckle out of the second post. After you read that article, you can decide if you want to try renaming this driver to disable it.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Rename this driver or uninstall the Toshiba Bluetooth utility.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. This appears to be a general utility driver and not necessary for your systems operation. Seeing that it is out of date, rename it.

Renaming drivers: create a restore point, using Windows Explorer, navigate to C:\Windows\System32\Drivers, locate the driver files, and rename them from .sys to .old. Reboot and the drivers will not load. This will break whatever software or hardware these drivers are associated with. This way you can always go back and rename the drivers again.

If you want to do this in stages, start with upgrading Virtual PC and see how your system runs. If you are BSOD free, you have solved the problem. If you get another BSOD, upload it and rename the drivers, reboot, and see how your system runs. Please post back and update us.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03450000 PsLoadedModuleList = 0xfffff800`0368de50
Debug session time: Thu Jan 27 06:57:14.744 2011 (GMT-5)
System Uptime: 0 days 0:07:20.242
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffff8a004dcb230, fffff8a004dcbc30, bca08000}

GetPointerFromAddress: unable to read from fffff800036f80e0
GetUlongFromAddress: unable to read from fffff800036661b0
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+203 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffff8a004dcb230, The pool entry we were looking for within the page.
Arg3: fffff8a004dcbc30, The next pool entry.
Arg4: 00000000bca08000, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff800036661b0

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffff8a004dcb230 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035f36d3 to fffff800034c0740

STACK_TEXT:  
fffff880`0338c8e8 fffff800`035f36d3 : 00000000`00000019 00000000`00000020 fffff8a0`04dcb230 fffff8a0`04dcbc30 : nt!KeBugCheckEx
fffff880`0338c8f0 fffff880`014d0cc7 : 00000000`00000703 00000000`00000130 00000000`60495bea 00000000`00000705 : nt!ExDeferredFreePool+0x12c4
fffff880`0338c9a0 fffff880`014d08d5 : 00000000`00000000 00000000`00000000 fffff800`03665500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x203
fffff880`0338c9e0 fffff880`01443cb4 : fffff8a0`050b69d0 fffff8a0`050b6ad0 fffff800`03665500 fffff880`0338cb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0338ca20 fffff880`014ce2dc : fffff8a0`050b69a0 fffff800`036655a0 fffff880`0338cb52 fffffa80`07085830 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0338ca50 fffff880`0144c882 : fffffa80`07085830 fffffa80`07085830 fffff8a0`050b69a0 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0338cad0 fffff880`014e5813 : fffffa80`07085830 fffff800`036655a0 fffff8a0`050b69a0 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0338cb10 fffff880`014bf38f : fffffa80`07085830 fffff8a0`050b6ad0 fffff8a0`050b69a0 fffffa80`09f5e180 : Ntfs!NtfsCommonClose+0x353
fffff880`0338cbe0 fffff800`034cd961 : 00000000`00000000 fffff800`034b4300 fffff800`036c7101 fffffa80`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`0338ccb0 fffff800`03764c06 : fbf75eff`69a1dd63 fffffa80`06c80b60 00000000`00000080 fffffa80`06be2420 : nt!ExpWorkerThread+0x111
fffff880`0338cd40 fffff800`0349ec26 : fffff880`031d5180 fffffa80`06c80b60 fffff880`031dffc0 e77fcfff`ecbcc63e : nt!PspSystemThreadStartup+0x5a
fffff880`0338cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsDeleteScb+203
fffff880`014d0cc7 e9cbfeffff      jmp     Ntfs!NtfsDeleteScb+0xd3 (fffff880`014d0b97)

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsDeleteScb+203

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x19_20_Ntfs!NtfsDeleteScb+203

BUCKET_ID:  X64_0x19_20_Ntfs!NtfsDeleteScb+203

Followup: MachineOwner
---------

Debug session time: Thu Jan 27 06:48:51.228 2011 (GMT-5)
System Uptime: 0 days 2:53:24.726
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c86b0fa0, 0, fffff9600018f4ba, 2}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!DwmNotifyChildrenLinkUnlink+c2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c86b0fa0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600018f4ba, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c50e0
 fffff900c86b0fa0 

FAULTING_IP: 
win32k!DwmNotifyChildrenLinkUnlink+c2
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008382990 -- (.trap 0xfffff88008382990)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800cad4090 rbx=0000000000000000 rcx=fffffa800cad4090
rdx=fffffa800bdcd701 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600018f4ba rsp=fffff88008382b20 rbp=fffff900c0659610
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffff88008382b10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
win32k!DwmNotifyChildrenLinkUnlink+0xc2:
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx] ds:0382:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000350c8f2 to fffff8000348d740

STACK_TEXT:  
fffff880`08382828 fffff800`0350c8f2 : 00000000`00000050 fffff900`c86b0fa0 00000000`00000000 fffff880`08382990 : nt!KeBugCheckEx
fffff880`08382830 fffff800`0348b82e : 00000000`00000000 fffff900`c86b0fa0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`08382990 fffff960`0018f4ba : fffff900`c86b0fa0 00000000`00000001 00000000`00000001 fffff960`002166ee : nt!KiPageFault+0x16e
fffff880`08382b20 fffff960`001902fe : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : win32k!DwmNotifyChildrenLinkUnlink+0xc2
fffff880`08382b70 fffff960`0016726b : fffffa80`0ba846a0 fffff880`08382ca0 00000000`00000000 00000000`00000000 : win32k!xxxDwmStopRedirection+0x82
fffff880`08382bc0 fffff960`00126f70 : 00000000`00000001 000007ff`fffd8000 00000000`00000020 000007ff`fffd8000 : win32k!xxxDwmProcessShutdown+0x3b
fffff880`08382bf0 fffff800`0348c993 : 00000000`0000032c 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserUnregisterSessionPort+0x40
fffff880`08382c20 00000000`7772baaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0393fb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7772baaa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!DwmNotifyChildrenLinkUnlink+c2
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!DwmNotifyChildrenLinkUnlink+c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cbe5d3e

FAILURE_BUCKET_ID:  X64_0x50_win32k!DwmNotifyChildrenLinkUnlink+c2

BUCKET_ID:  X64_0x50_win32k!DwmNotifyChildrenLinkUnlink+c2

Followup: MachineOwner
---------

Drivers

Code:

start             end                 module name
fffff880`00f9e000 fffff880`00ff5000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0402b000 fffff880`040b5000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`044fb000 fffff880`04511000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0748d000 fffff880`075be000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`0130e000 fffff880`01319000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04439000 fffff880`04481000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`089a2000 fffff880`089ad000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`012d0000 fffff880`012d9000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`012d9000 fffff880`01303000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`02282000 fffff880`02343000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00e68000 fffff880`00e74000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`04364000 fffff880`0436b000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02e9e000 fffff880`02eaf000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`02cd3000 fffff880`02cf1000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`007d0000 fffff960`007f7000   cdd      cdd.dll      Tue Nov 02 00:59:22 2010 (4CCF9AAA)
fffff880`04300000 fffff880`0432a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ce5000 fffff880`00da5000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01b9d000 fffff880`01bcd000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c87000 fffff880`00ce5000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`044d1000 fffff880`044d5500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e5f000 fffff880`00e68000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`044eb000 fffff880`044fb000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`07453000 fffff880`07461000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02e1b000 fffff880`02e9e000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02e00000 fffff880`02e1b000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`02fcd000 fffff880`02feb000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02fbe000 fffff880`02fcd000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01b87000 fffff880`01b9d000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0479e000 fffff880`047c0000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`07461000 fffff880`07474000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`040e4000 fffff880`042ec000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`07447000 fffff880`07453000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0b430000 fffff880`0b524000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`0b524000 fffff880`0b56a000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`0b57b000 fffff880`0b5ca000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`01365000 fffff880`01379000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01319000 fffff880`01365000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0142b000 fffff880`01435000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01b4d000 fffff880`01b87000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0168b000 fffff880`016d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039f9000 fffff800`03a42000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`0b5db000 fffff880`0b5ff000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`0b56a000 fffff880`0b57b000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`0236e000 fffff880`02387000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`02387000 fffff880`0238f080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`02360000 fffff880`0236e000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`02c0b000 fffff880`02cd3000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01b44000 fffff880`01b4d000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`05fb0000 fffff880`05fce000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010c8000 fffff880`012d0000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a78000 fffff880`051f2ce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`0449a000 fffff880`044c0c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`07400000 fffff880`07447000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`02ed5000 fffff880`02eeb000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05fce000 fffff880`05fdd000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bc8000 fffff800`00bd2000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0469d000 fffff880`046e0000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01400000 fffff880`0141a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`071f5000 fffff880`071fa200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`02221000 fffff880`02236000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`023d9000 fffff880`023fc000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c2f000 fffff880`00c73000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`075c0000 fffff880`075cf000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`023cb000 fffff880`023d9000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04481000 fffff880`04490000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`023be000 fffff880`023cb000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00da5000 fffff880`00dbf000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0432a000 fffff880`0435b000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`02da7000 fffff880`02db7000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`02cf1000 fffff880`02d09000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02d09000 fffff880`02d36000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`02d36000 fffff880`02d84000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`02d84000 fffff880`02da7000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01303000 fffff880`0130e000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`043c9000 fffff880`043d4000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e0a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01379000 fffff880`013d7000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02fb3000 fffff880`02fbe000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01b32000 fffff880`01b44000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016ed000 fffff880`017df000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04535000 fffff880`04541000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`02236000 fffff880`02249000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04541000 fffff880`04570000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0474c000 fffff880`04761000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`01a4f000 fffff880`01a5e000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01a00000 fffff880`01a45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`05829000 fffff880`05f88000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`0891c000 fffff880`08931000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`043d4000 fffff880`043e5000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02fa7000 fffff880`02fb3000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`0341d000 fffff800`039f9000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0144c000 fffff880`015ef000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0435b000 fffff880`04364000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04600000 fffff880`04653000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`040be000 fffff880`040e4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e4a000 fffff880`00e5f000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e0a000 fffff880`00e3d000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00dbf000 fffff880`00dc6000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00dc6000 fffff880`00dd6000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0141a000 fffff880`0142b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`064de000 fffff880`06584000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04761000 fffff880`0479e000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c73000 fffff880`00c87000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04511000 fffff880`04535000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04570000 fffff880`0458b000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`0458b000 fffff880`045ac000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`045ac000 fffff880`045c6000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02f56000 fffff880`02fa7000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`045c6000 fffff880`045d1000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`043ae000 fffff880`043b7000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043b7000 fffff880`043c0000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043c0000 fffff880`043c9000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01af8000 fffff880`01b32000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02249000 fffff880`02261000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`07009000 fffff880`071f4a80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`0b400000 fffff880`0b420000   sdbus    sdbus.sys    Fri Oct 09 22:41:20 2009 (4ACFF450)
fffff880`06584000 fffff880`0658f000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`05fa4000 fffff880`05fb0000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`01bdb000 fffff880`01bf8000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01af0000 fffff880`01af8000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`08886000 fffff880`0891c000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`06400000 fffff880`06467000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`0658f000 fffff880`065bc000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`045d1000 fffff880`045d2480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`065bc000 fffff880`065ce000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`04490000 fffff880`0449a000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0401e000 fffff880`0402b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`04000000 fffff880`0401e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02f42000 fffff880`02f56000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01ae4000 fffff880`01af0000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01ae2000 fffff880`01ae3f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01a68000 fffff880`01ae2000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`044c8000 fffff880`044d1000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05f95000 fffff880`05fa4000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`005b0000 fffff960`005ba000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02eaf000 fffff880`02ed5000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`016e5000 fffff880`016e9e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`044c1000 fffff880`044c8000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`046e0000 fffff880`046f2000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`02343000 fffff880`02360000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`075be000 fffff880`075bff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`0b5ca000 fffff880`0b5db000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`046f2000 fffff880`0474c000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`04a00000 fffff880`04a56000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`02390000 fffff880`023bd200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01a45000 fffff880`01a4f000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`0436b000 fffff880`04379000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`04379000 fffff880`0439e000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`02ef5000 fffff880`02f42000   vmm      vmm.sys      Tue Apr 07 09:25:54 2009 (49DB5462)
fffff880`044d6000 fffff880`044eb000   VMNetSrv VMNetSrv.sys Wed Jan 16 06:52:01 2008 (478DEFE1)
fffff880`016d5000 fffff880`016e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e74000 fffff880`00e89000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e89000 fffff880`00ee5000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`05f88000 fffff880`05f95000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`043e5000 fffff880`043fb000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`017df000 fffff880`017fa000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`0439e000 fffff880`043ae000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eeb000 fffff880`00f8f000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f8f000 fffff880`00f9e000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`040b5000 fffff880`040be000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00040000 fffff960`00350000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00ff5000 fffff880`00ffe000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`02200000 fffff880`02221000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`02db7000 fffff880`02dc1000   vwifimp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`08931000 fffff880`089a2000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01bcd000 fffff880`01bdb000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`040e5000 fffff880`042ed000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`042ed000 fffff880`04300000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

[FONT=&quot]

[/FONT]

tumblebug · Jan 27, 2011

Hi Carl

I've mentioned it a couple of times in previous posts but I'm already running Virtual PC 2007 now with SP1 and a couple of other little fixes (and I have been from the very beginning)

I remember quite alot of unreadable sector messages occuring during a full chkdsk run. I couldn't tell you if the machine fixed those errors or not 'cos I went to bed - its a 400G drive - a lot to check

I'll run the HD Diag today to see if it gives anymore info. I usually store my files on the office network and/or source control, and since this is a new pc, I haven't accumulated huge pockets of files just yet. I'll try your other ideas with the other drivers as well today - see what happens eh?

Tim

CarlTR6 · Jan 27, 2011

Are you running the Win 7 version of Virtual PC? VMNetSrv.sys is not a Win 7 driver. From what I read, the SP1 is for the Vista/XP version. You can try to run the version you have in the Vista compatibility mode or you can install the Win 7 version.

Win 7 version: Windows Virtual PC: Home Page

Compatibility mode: http://www.sevenforums.com/tutorials/316-compatibility-mode.html

tumblebug · Jan 27, 2011

Hi Carl

Penny's finally dropped! Just been reading the links and I'll give that a whirl.

Tim

tumblebug · Jan 27, 2011

Update -

Just ran the error checking in HDTune and it found no errors - I tried to run the Hitachi DFT tool but it will not detect my harddrive (or my dvd drive for that matter) to perform the fitness test. I've email Hitachi about that.

Am getting Windows XP Mode and the Win 7 version of Windows Virtual PC - I dont want to mess about with Vista compatabilty modes. It looks like I can use my current VMC file so I (hopefully) won't lose my current crop of work.

CarlTR6 · Jan 27, 2011

tumblebug said:
Hi Carl

Penny's finally dropped! Just been reading the links and I'll give that a whirl.

Tim

LOL! Sometimes communication is difficult when we are not face to face,

tumblebug said:
Update -

Just ran the error checking in HDTune and it found no errors - I tried to run the Hitachi DFT tool but it will not detect my harddrive (or my dvd drive for that matter) to perform the fitness test. I've email Hitachi about that.

Am getting Windows XP Mode and the Win 7 version of Windows Virtual PC - I dont want to mess about with Vista compatabilty modes. It looks like I can use my current VMC file so I (hopefully) won't lose my current crop of work.

That is good news about HDTune. It looks like your hard drive is OK.

I think you have picked the best solution; I would do the same. Maybe your files and work will transfer to the Win 7 version? That would be best and you wouldn't have mess with two version. I have no idea if that is possible.

tumblebug · Jan 27, 2011

Update -

I have Windows Virtual Machine loaded now and Virtual PC 2007 is uninstalled. I managed to get the Windows Virtual Machine to load the old virtual hard disk file so I didn't lose any .net 2003 work from the old virtual machine - yeehaa

I did have a BSOD when attempting to uninstal Virtual PC 2007 but I figured that was VPC having its last say before being wiped off the drive forever

I'll see how this performs over the next couple of days and then maybe try your ideas with the other drivers if I still got probems.

Props for the help...

Tim

tumblebug · Jan 28, 2011

Hi Carl

Sorry to keep bugging you about this

At the end of the day - laptop went abit nuts and crashed twice - first time, a number of apps crashed (Word, Firefox) but no actual blue screen, then after the reboot, opened up Word and then blue screen. Dump is attached.

Tim

CarlTR6 · Jan 29, 2011

Darn, Tim, I was hoping that the upgrade would solve your problem. Well, at least you have the latest and greatest Virtual Machine loaded now. Your latest dump is Bugcheck A and blames memory corruption. There is still a possibility that your out of date Toshiba drivers are causing this. Try to update from the Toshiba links provided.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Update this driver.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Update this driver.

tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 - Toshiba tos_sps64 Service. Toshiba Support - Homepage. Update.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Update.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. Update.

If there are no updates from the Toshiba link, try renaming tosrfec.sys and TVALZFL.sys. First create a restore point, then, using Windows Explorer, do a search of your hard drive for each of the drivers. Rename them from .sys to .old. Reboot and the drivers will not load. This will break whatever the drivers belong to.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03402000 PsLoadedModuleList = 0xfffff800`0363fe50
Debug session time: Fri Jan 28 03:01:29.479 2011 (GMT-5)
System Uptime: 0 days 0:08:19.000
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff68000045680, 0, 0, fffff800034862e2}

Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1c2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff68000045680, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034862e2, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036aa0e0
 fffff68000045680 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  dwm.exe

TRAP_FRAME:  fffff880035167a0 -- (.trap 0xfffff880035167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff68000045680
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800034862e2 rsp=fffff88003516930 rbp=0000000000045680
 r8=0000000000000001  r9=fffffa800cde83f8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!MiAgeWorkingSet+0x1c2:
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx] ds:fffff680`00045680=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003471ca9 to fffff80003472740

STACK_TEXT:  
fffff880`03516658 fffff800`03471ca9 : 00000000`0000000a fffff680`00045680 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03516660 fffff800`03470920 : 00000000`00000000 00000980`00000000 00000000`00001000 fffff800`035a6bfe : nt!KiBugCheckDispatch+0x69
fffff880`035167a0 fffff800`034862e2 : 00000000`00000106 00000000`00000001 00000000`00000002 00000000`00000105 : nt!KiPageFault+0x260
fffff880`03516930 fffff800`034f4a5e : fffffa80`0cde83f8 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt!MiAgeWorkingSet+0x1c2
fffff880`03516ae0 fffff800`03486ee2 : 00000000`000001f7 00000000`00000000 fffffa80`00000000 00000000`00000007 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03516b80 fffff800`03487173 : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03716c06 : fffffa80`06c72b60 00000000`00000080 fffffa80`06be2420 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`03450c26 : fffff880`009ea180 fffffa80`06c72b60 fffff880`009f4fc0 9002af11`78011421 : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : fffff880`03517000 fffff880`03511000 fffff880`03516710 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`034862e2 488b19          mov     rbx,qword ptr [rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+1c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiAgeWorkingSet+1c2

BUCKET_ID:  X64_0xA_nt!MiAgeWorkingSet+1c2

Followup: MachineOwner
---------

2: kd> lmtsmn
start             end                 module name
fffff880`00f76000 fffff880`00fcd000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0402b000 fffff880`040b5000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04795000 fffff880`047ab000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0763f000 fffff880`07770000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`012ea000 fffff880`012f5000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04726000 fffff880`0476e000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`07a25000 fffff880`07a30000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`012ac000 fffff880`012b5000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`012b5000 fffff880`012df000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00930000 fffff960`00991000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`040e4000 fffff880`041a5000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00da4000 fffff880`00db0000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`04367000 fffff880`0436e000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02fa8000 fffff880`02fb9000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`027d7000 fffff880`027f5000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00600000 fffff960`00627000   cdd      cdd.dll      Tue Nov 02 00:59:22 2010 (4CCF9AAA)
fffff880`055e2000 fffff880`055ff000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`04303000 fffff880`0432d000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00e03000 fffff880`00ec3000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01a50000 fffff880`01a80000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cfe000 fffff880`00d5c000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05800000 fffff880`05804500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00fed000 fffff880`00ff6000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`05805000 fffff880`05815000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05400000 fffff880`0540e000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02e00000 fffff880`02e83000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02f8d000 fffff880`02fa8000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`02f6f000 fffff880`02f8d000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02f60000 fffff880`02f6f000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01a3a000 fffff880`01a50000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0555a000 fffff880`0557c000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`026b7000 fffff880`026ca000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`024af000 fffff880`026b7000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`077c6000 fffff880`077d2000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0446e000 fffff880`04562000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`04562000 fffff880`045a8000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`04400000 fffff880`0444f000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`027a1000 fffff880`027d7000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`01341000 fffff880`01355000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`012f5000 fffff880`01341000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`015d9000 fffff880`015e3000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01a00000 fffff880`01a3a000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`013b3000 fffff880`013fd000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039de000 fffff800`03a27000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`046e2000 fffff880`04706000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`045a8000 fffff880`045b9000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`077e0000 fffff880`077f9000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`07600000 fffff880`07608080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`077d2000 fffff880`077e0000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`041a5000 fffff880`0426d000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01bc1000 fffff880`01bca000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`05fa9000 fffff880`05fc7000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010a4000 fffff880`012ac000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a41000 fffff880`051bbce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`0476e000 fffff880`04794c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`0777f000 fffff880`077c6000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`02fdf000 fffff880`02ff5000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05fc7000 fffff880`05fd6000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`07626000 fffff880`07634000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00b9a000 fffff800`00ba4000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`045b9000 fffff880`045fc000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`015ae000 fffff880`015c8000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`075fa000 fffff880`075ff200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`0270e000 fffff880`02723000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`026ca000 fffff880`026ed000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00ca6000 fffff880`00cea000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`07770000 fffff880`0777f000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`07400000 fffff880`0740e000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05fd6000 fffff880`05fe5000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`07609000 fffff880`07616000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c5c000 fffff880`00c76000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0432d000 fffff880`0435e000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`07a00000 fffff880`07a10000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`02400000 fffff880`02418000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02418000 fffff880`02445000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`02445000 fffff880`02493000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0540e000 fffff880`05431000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`012df000 fffff880`012ea000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`043cc000 fffff880`043d7000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd6000 fffff880`00fe0000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01355000 fffff880`013b3000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02f55000 fffff880`02f60000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01baf000 fffff880`01bc1000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016c8000 fffff880`017ba000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`05815000 fffff880`05821000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`02776000 fffff880`02789000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`047cf000 fffff880`047fe000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05508000 fffff880`0551d000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`01be8000 fffff880`01bf7000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`017ba000 fffff880`017ff000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`05822000 fffff880`05f81000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`07a10000 fffff880`07a25000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`043d7000 fffff880`043e8000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02f49000 fffff880`02f55000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03402000 fffff800`039de000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0140b000 fffff880`015ae000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0435e000 fffff880`04367000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`02723000 fffff880`02776000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`040be000 fffff880`040e4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00d8f000 fffff880`00da4000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d5c000 fffff880`00d8f000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00ff6000 fffff880`00ffd000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00c76000 fffff880`00c86000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`015c8000 fffff880`015d9000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`07a69000 fffff880`07b0f000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`07616000 fffff880`07626000   point64  point64.sys  Tue Jun 29 04:54:31 2010 (4C29B4C7)
fffff880`0551d000 fffff880`0555a000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cea000 fffff880`00cfe000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`047ab000 fffff880`047cf000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04600000 fffff880`0461b000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`0461b000 fffff880`0463c000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`0463c000 fffff880`04656000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02ef8000 fffff880`02f49000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04656000 fffff880`04661000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`043b1000 fffff880`043ba000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043ba000 fffff880`043c3000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043c3000 fffff880`043cc000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01b75000 fffff880`01baf000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02789000 fffff880`027a1000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`0740e000 fffff880`075f9a80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`04706000 fffff880`04726000   sdbus    sdbus.sys    Fri Oct 09 22:41:20 2009 (4ACFF450)
fffff880`07b0f000 fffff880`07b1a000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`05f9d000 fffff880`05fa9000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`0169b000 fffff880`016b8000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01b6d000 fffff880`01b75000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`05431000 fffff880`054a2000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`0426d000 fffff880`04303000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07b59000 fffff880`07bc0000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`07b1a000 fffff880`07b47000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04661000 fffff880`04662480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01802000 fffff880`019ff000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`07b47000 fffff880`07b59000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`05fe5000 fffff880`05fef000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0401e000 fffff880`0402b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`04000000 fffff880`0401e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02ee4000 fffff880`02ef8000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01b61000 fffff880`01b6d000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01b5f000 fffff880`01b60f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01ae5000 fffff880`01b5f000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`05ff6000 fffff880`05fff000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05f8e000 fffff880`05f9d000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`00440000 fffff960`0044a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02fb9000 fffff880`02fdf000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`01ae0000 fffff880`01ae4e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`05fef000 fffff880`05ff6000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`04663000 fffff880`04675000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`0557c000 fffff880`05599000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04684000 fffff880`04685f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`0444f000 fffff880`04460000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`054ae000 fffff880`05508000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`0468c000 fffff880`046e2000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04675000 fffff880`04684000   usbrpm   usbrpm.sys   Mon Jul 13 20:35:14 2009 (4A5BD2C2)
fffff880`05599000 fffff880`055b4000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`055b4000 fffff880`055e1200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00fe0000 fffff880`00fed000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01bca000 fffff880`01bd4000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`0436e000 fffff880`0437c000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0437c000 fffff880`043a1000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00db0000 fffff880`00dc5000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01a94000 fffff880`01ae0000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`04a00000 fffff880`04a3c000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
fffff880`01bd4000 fffff880`01be8000   vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE)
fffff880`051bc000 fffff880`051d9000   vpcusb   vpcusb.sys   Tue Sep 22 21:32:39 2009 (4AB97AB7)
fffff880`02e8d000 fffff880`02ee3580   vpcvmm   vpcvmm.sys   Thu Dec 31 02:27:33 2009 (4B3C5265)
fffff880`05f81000 fffff880`05f8e000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`043e8000 fffff880`043fe000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`02493000 fffff880`0249d000   vwifimp  vwifimp.sys  Mon Jul 13 20:07:28 2009 (4A5BCC40)
fffff880`015e3000 fffff880`015fe000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`043a1000 fffff880`043b1000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ec3000 fffff880`00f67000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f67000 fffff880`00f76000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`040b5000 fffff880`040be000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00080000 fffff960`00390000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00fcd000 fffff880`00fd6000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`026ed000 fffff880`0270e000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`07bc0000 fffff880`07bf1000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`01a80000 fffff880`01a8e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`040e8000 fffff880`042f0000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`042f0000 fffff880`04303000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

tumblebug · Jan 30, 2011

Hi Carl

Yeah - I'd thought we'd cracked it too. Anyhoo...

According the (australian) Toshiba website (Support :: Toshiba) and the "Toshiba Software Installer", I've got all the latest 64bit drivers for everything. The only thing I've not done is the BIOS update. So I've renamed those two drivers, tosrfec.sys and TVALZFL.sys,and rebooted.

During the above process, IE8 shutdown and restarted, and I tried to start an app called "Toshiba Service Centre" it crashed straightaway. Then I got a BSOD when rebooting after renaming the drivers (dump attached).

Given the amount of Toshiba-related utilities on here, I'm suspecting that one or more of these apps aren't playing properly with Win7. There is quite alot of stuff running in the background which I think I don't need (fingerprint scanners and the like).

tumblebug · Jan 30, 2011

I thought I'd post the output of HijackThis too so you can see what's loading and if you think anything is not needed here. There's lots of "file missing" messages there

Code:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:43 AM, on 24/01/2011
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Program Files\WhoCrashed\whocrashedex.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL="http://toshiba.msn.com"]MSN.com by TOSHIBA[/URL]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL="http://go.microsoft.com/fwlink/?LinkId=69157"]MSN.com[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [URL="http://go.microsoft.com/fwlink/?LinkId=69157"]MSN.com[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: BHOHOOK - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\TFPU\x86\TFPUPWDBankBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files (x86)\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\windows\Samsung\PanelMgr\ssmmgr.exe /autorun
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Online plug-in.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files (x86)\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: [URL]http://*.drnick[/URL]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [URL]http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab[/URL]
O16 - DPF: {E3089160-E8AD-4C5B-B47C-ADDF3DF660DD} (PjAdoInfo4 Class) - [URL]http://drnick/pwa/_layouts/pwa/objects/pjclient.cab[/URL]
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - [URL]https://mia.bt.com/dana-cached/sc/JuniperSetupClient.cab[/URL]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O17 - HKLM\System\CCS\Services\Tcpip\..\{60BD32C6-18A8-453D-A35D-B40262ADA0CE}: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cirrusau.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: Domain = cirrusau.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B6A48AB-14DF-465F-A249-2A0E007B16B5}: NameServer = 172.17.0.206
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Program Files\Fingerprint Sensor\ATService.exe
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: ShrewSoft DNS Proxy Daemon (dtpd) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\dtpd.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-30007 (IISADMIN) - Unknown owner - C:\windows\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: ShrewSoft IKE Daemon (iked) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\iked.exe
O23 - Service: ShrewSoft IPSEC Daemon (ipsecd) - Unknown owner - C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - Unknown owner - C:\windows\system32\ThpSrv.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%windir%\system32\inetsrv\iisres.dll,-20001 (WMSVC) - Unknown owner - C:\windows\system32\inetsrv\wmsvc.exe (file missing)
--
End of file - 15682 bytes

BSODs and unstable Win7

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

Antique Senior Member

My Computer My Computer

New member

My Computer My Computer

New member

My Computer My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer