Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\New folder\082910-16224-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a5e000 PsLoadedModuleList = 0xfffff800`02c9be50
Debug session time: Sun Aug 29 13:48:49.722 2010 (GMT-4)
System Uptime: 0 days 2:00:32.628
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffffffc8, 1, fffff80002aed107, 0}
Unable to load image avgntflt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgntflt.sys
*** ERROR: Module load completed but symbols could not be loaded for avgntflt.sys
Could not read faulting driver name
Probably caused by : avgntflt.sys ( avgntflt+14919 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffc8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002aed107, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d060e0
ffffffffffffffc8
FAULTING_IP:
nt!CcGetVirtualAddress+17
fffff800`02aed107 4156 push r14
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ParNRar.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff880093f0400 -- (.trap 0xfffff880093f0400)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800424c0b0
rdx=0000000000047000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aed107 rsp=fffff880093f0598 rbp=fffff8a0094b3140
r8=fffff880093f0698 r9=fffff880093f0690 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!CcGetVirtualAddress+0x17:
fffff800`02aed107 4156 push r14
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b4ef14 to fffff80002ace740
STACK_TEXT:
fffff880`093f0598 fffff800`02dd4942 : 00000000`00040000 00000000`00047000 fffff880`093f0698 fffff880`093f0690 : nt!CcGetVirtualAddress+0x17
fffff880`093f05d0 fffff880`01300025 : fffffa80`041da440 fffff8a0`094b3140 fffff8a0`00010000 fffff8a0`0000000e : nt!CcMapData+0xd2
fffff880`093f0690 fffff880`012e4a4d : fffff8a0`02239d00 00000000`00000047 fffff8a0`0a088470 fffff8a0`094b3140 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`093f0720 fffff880`012e1dfe : fffffa80`041da440 fffff8a0`0a088470 fffff8a0`094b3140 fffffa80`041da440 : Ntfs!NtfsRestartIndexEnumeration+0xed
fffff880`093f0940 fffff880`012e3421 : fffff880`093f0e40 00000000`00000000 fffffa80`051eccb0 fffffa80`04316010 : Ntfs!NtfsQueryDirectory+0x94e
fffff880`093f0ce0 fffff880`012e578f : fffffa80`041da440 00000000`00000000 fffff880`093f0de0 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
fffff880`093f0d20 fffff880`00db023f : fffffa80`043163b0 fffffa80`04316010 fffffa80`041da440 fffff880`093f0d48 : Ntfs!NtfsFsdDirectoryControl+0x10f
fffff880`093f0d90 fffff880`00dae6df : fffffa80`051eccb0 fffffa80`042f9100 fffffa80`051ecc00 fffffa80`04316010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`093f0e20 fffff800`02debcad : fffffa80`04316010 fffff880`093f1050 fffff880`093f1188 fffff880`093f0f78 : fltmgr!FltpDispatch+0xcf
fffff880`093f0e80 fffff800`02acd993 : fffffa80`0400f9b0 fffff880`093f1050 fffff880`093f1188 fffff880`093f0f78 : nt!NtQueryDirectoryFile+0x1ad
fffff880`093f0f60 fffff800`02ac9f30 : fffff880`00dd2e81 fffffa80`051eccb0 00000000`00000000 fffffa80`00000102 : nt!KiSystemServiceCopyEnd+0x13
fffff880`093f1168 fffff880`00dd2e81 : fffffa80`051eccb0 00000000`00000000 fffffa80`00000102 00000000`00000000 : nt!KiServiceLinkage
fffff880`093f1170 fffff880`00dd101e : 00000000`00000004 00000000`00000052 00000000`00000000 00000000`00000052 : fltmgr!FltpNormalizeNameComponent+0x221
fffff880`093f1270 fffff880`00dd2361 : 00000000`0000005f 00000000`0000005f 00000000`00000053 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
fffff880`093f12d0 fffff880`00dd213e : fffffa80`05b5e870 fffff8a0`09cb0000 00000000`00000000 00000000`0000000a : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
fffff880`093f1310 fffff880`00dbdb2d : c00000bb`00000000 00000000`00000000 00000000`00000000 fffff880`093f2000 : fltmgr!FltpCreateFileNameInformation+0xee
fffff880`093f1370 fffff880`00db7bd6 : fffffa80`04bca080 00000000`00000000 fffffa80`051ed8f8 1e34bd16`4527620b : fltmgr!HandleStreamListNotSupported+0x15d
fffff880`093f13b0 fffff880`00dbead4 : fffffa80`0423db00 00000000`00000000 00000000`00000000 00000000`00000101 : fltmgr! ?? ::FNODOBFM::`string'+0x3143
fffff880`093f1430 fffff880`0508a919 : fffffa80`05b5e870 fffffa80`04018700 fffffa80`05f55b50 00000000`c0000022 : fltmgr!FltGetFileNameInformation+0x184
fffff880`093f14c0 fffffa80`05b5e870 : fffffa80`04018700 fffffa80`05f55b50 00000000`c0000022 fffffa80`0638fc00 : avgntflt+0x14919
fffff880`093f14c8 fffffa80`04018700 : fffffa80`05f55b50 00000000`c0000022 fffffa80`0638fc00 fffffa80`0638fc10 : 0xfffffa80`05b5e870
fffff880`093f14d0 fffffa80`05f55b50 : 00000000`c0000022 fffffa80`0638fc00 fffffa80`0638fc10 fffffa80`051eccb0 : 0xfffffa80`04018700
fffff880`093f14d8 00000000`c0000022 : fffffa80`0638fc00 fffffa80`0638fc10 fffffa80`051eccb0 00000000`00000000 : 0xfffffa80`05f55b50
fffff880`093f14e0 fffffa80`0638fc00 : fffffa80`0638fc10 fffffa80`051eccb0 00000000`00000000 00000000`00000000 : 0xc0000022
fffff880`093f14e8 fffffa80`0638fc10 : fffffa80`051eccb0 00000000`00000000 00000000`00000000 fffff880`00db2fbc : 0xfffffa80`0638fc00
fffff880`093f14f0 fffffa80`051eccb0 : 00000000`00000000 00000000`00000000 fffff880`00db2fbc fffffa80`04018650 : 0xfffffa80`0638fc10
fffff880`093f14f8 00000000`00000000 : 00000000`00000000 fffff880`00db2fbc fffffa80`04018650 fffffa80`051eccb0 : 0xfffffa80`051eccb0
STACK_COMMAND: .trap 0xfffff880093f0400 ; kb
FOLLOWUP_IP:
avgntflt+14919
fffff880`0508a919 ?? ???
SYMBOL_STACK_INDEX: 13
SYMBOL_NAME: avgntflt+14919
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: avgntflt
IMAGE_NAME: avgntflt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b741e42
FAILURE_BUCKET_ID: X64_0x50_avgntflt+14919
BUCKET_ID: X64_0x50_avgntflt+14919
Followup: MachineOwner
---------