Loading Dump File [D:\Kingston\BSODDmpFiles\Chatta66\032912-20170-01\032912-20170-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e05000 PsLoadedModuleList = 0xfffff800`03049650
Debug session time: Thu Mar 29 18:39:19.743 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:12.304
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {f6, 3e0, fffffa8009721230, fffff880053a9640}
Unable to load image LMouKE.Sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for LMouKE.Sys
*** ERROR: Module load completed but symbols could not be loaded for LMouKE.Sys
Probably caused by : LMouKE.Sys ( LMouKE+e640 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 00000000000003e0, Handle value being referenced.
Arg3: fffffa8009721230, Address of the current process.
Arg4: fffff880053a9640, Address inside the driver that is performing the incorrect reference.
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_f6
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: KHALMNPR.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000330a3dc to fffff80002e81d40
STACK_TEXT:
fffff880`09868f98 fffff800`0330a3dc : 00000000`000000c4 00000000`000000f6 00000000`000003e0 fffffa80`09721230 : nt!KeBugCheckEx
fffff880`09868fa0 fffff800`0331fae4 : 00000000`000003e0 fffffa80`09721230 00000000`00000002 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`09868fe0 fffff800`031bea85 : 00000000`00000000 00000000`000003e0 fffff880`09869170 ffffffff`fffffd90 : nt!VfCheckUserHandle+0x1b4
fffff880`098690c0 fffff800`02e80fd3 : fffffa80`0b0b4060 fffff800`02eacb4b 00000000`00000001 fffff800`02e40f0e : nt! ?? ::NNGAKEGL::`string'+0x23045
fffff880`098690f0 fffff800`02e7d570 : fffff880`053a9640 fffff880`098695a9 fffff880`098695a0 ffffffff`fffffd90 : nt!KiSystemServiceCopyEnd+0x13
fffff880`09869288 fffff880`053a9640 : fffff880`098695a9 fffff880`098695a0 ffffffff`fffffd90 00000000`00000009 : nt!KiServiceLinkage
fffff880`09869290 fffff880`098695a9 : fffff880`098695a0 ffffffff`fffffd90 00000000`00000009 00000000`00000000 : LMouKE+0xe640
fffff880`09869298 fffff880`098695a0 : ffffffff`fffffd90 00000000`00000009 00000000`00000000 fffff880`00000000 : 0xfffff880`098695a9
fffff880`098692a0 ffffffff`fffffd90 : 00000000`00000009 00000000`00000000 fffff880`00000000 fffff880`098692e0 : 0xfffff880`098695a0
fffff880`098692a8 00000000`00000009 : 00000000`00000000 fffff880`00000000 fffff880`098692e0 0053002b`00000000 : 0xffffffff`fffffd90
fffff880`098692b0 00000000`00000000 : fffff880`00000000 fffff880`098692e0 0053002b`00000000 00000000`00140012 : 0x9
STACK_COMMAND: kb
FOLLOWUP_IP:
LMouKE+e640
fffff880`053a9640 488d4c2440 lea rcx,[rsp+40h]
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: LMouKE+e640
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: LMouKE
IMAGE_NAME: LMouKE.Sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e60769c
FAILURE_BUCKET_ID: X64_0xc4_f6_LMouKE+e640
BUCKET_ID: X64_0xc4_f6_LMouKE+e640
Followup: MachineOwner
---------
1: kd> lmvm LMouKE
start end module name
fffff880`0539b000 fffff880`053bc000 LMouKE T (no symbols)
Loaded symbol image file: LMouKE.Sys
Image path: LMouKE.Sys
Image name: LMouKE.Sys
Timestamp: Fri Sep 02 00:24:28 2011 (4E60769C)
CheckSum: 0002B0B5
ImageSize: 00021000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4