Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0340d000 PsLoadedModuleList = 0xfffff800`0364ae50
Debug session time: Sun Nov 21 19:34:43.072 2010 (GMT-5)
System Uptime: 0 days 0:33:51.196
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa800415edb0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339c8 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800415edb0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dw20.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800034f1058 to fffff8000347d740
STACK_TEXT:
fffff880`0c9d71d8 fffff800`034f1058 : 00000000`0000001a 00000000`00041790 fffffa80`0415edb0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0c9d71e0 fffff800`0345068a : fffffa80`08523060 fffffa80`00000001 00000000`000001a9 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x339c8
fffff880`0c9d7a90 fffff800`03762dcf : fffff8a0`033a9a50 00000000`00000001 00000000`00000000 fffffa80`0af59560 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0c9d7ae0 fffff800`0373a85b : 00000000`00000000 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`0c9d7ba0 fffff800`0347c993 : fffffa80`08523060 00000000`00000000 00000000`7efdb001 fffffa80`0af59560 : nt!NtTerminateProcess+0x25b
fffff880`0c9d7c20 00000000`77a6001a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a6001a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+339c8
fffff800`034f1058 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+339c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339c8
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339c8
Followup: MachineOwner
---------
Debug session time: Sun Nov 21 20:05:52.745 2010 (GMT-5)
System Uptime: 0 days 0:10:45.869
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800d4595e8, fffff8800d458e50, fffff880016d9173}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800d4595e8
Arg3: fffff8800d458e50
Arg4: fffff880016d9173
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800d4595e8 -- (.exr 0xfffff8800d4595e8)
ExceptionAddress: fffff880016d9173 (Ntfs!NtfsFcbTableCompare+0x0000000000000003)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000120
Attempt to read from address 0000000000000120
CONTEXT: fffff8800d458e50 -- (.cxr 0xfffff8800d458e50)
rax=001100000002a899 rbx=0000000000000100 rcx=fffffa80082f6640
rdx=fffff8800d459920 rsi=fffff8800d459920 rdi=fffffa80082f6640
rip=fffff880016d9173 rsp=fffff8800d459828 rbp=fffff8800d4598f0
r8=0000000000000120 r9=0000ffffffffffff r10=0000000000020000
r11=fffff8800d459968 r12=fffff8800d4599c4 r13=0000000000000000
r14=0000000000000000 r15=fffffa80082f6180
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
Ntfs!NtfsFcbTableCompare+0x3:
fffff880`016d9173 498b08 mov rcx,qword ptr [r8] ds:002b:00000000`00000120=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000120
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c10e0
0000000000000120
FOLLOWUP_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016d9173 498b08 mov rcx,qword ptr [r8]
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016d9173 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff800034ae4cd to fffff880016d9173
STACK_TEXT:
fffff880`0d459828 fffff800`034ae4cd : fffffa80`057cf4d0 00000000`00000090 00000000`0000000e fffff800`0378f942 : Ntfs!NtfsFcbTableCompare+0x3
fffff880`0d459830 fffff800`034ae465 : fffff880`0d4599a0 fffffa80`05b0c4d0 fffffa80`057cf4d0 fffff800`00000000 : nt!FindNodeOrParent+0x3d
fffff880`0d459860 fffff880`016cb631 : 00110000`0002a899 fffff880`016d0195 fffff8a0`00000000 fffff980`033bf800 : nt!RtlLookupElementGenericTableFullAvl+0x15
fffff880`0d459890 fffff880`01697cf6 : fffffa80`057cf4d0 fffffa80`082f6180 fffffa80`057cf4d0 00110000`0002a899 : Ntfs!NtfsCreateFcb+0x79
fffff880`0d459970 fffff880`016bbb04 : fffff880`0ae564b0 fffffa80`05b0c4d0 fffffa80`057cf4d0 00000000`00000000 : Ntfs!NtfsOpenFile+0x1ca
fffff880`0d459b50 fffff880`01624c0d : fffffa80`057cf4d0 fffffa80`05b0c4d0 fffff880`0ae564b0 fffffa80`0a6a8000 : Ntfs!NtfsCommonCreate+0xc54
fffff880`0d459d30 fffff800`034815c7 : fffff880`0ae56420 00000000`003707c0 00000000`77654270 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d459d60 fffff800`03481581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0ae562f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800d458e50 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
Followup: MachineOwner
---------
Debug session time: Sat Nov 20 20:09:48.725 2010 (GMT-5)
System Uptime: 0 days 0:03:37.754
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8000371e8df, fffff88009b9a070, 0}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+36b )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000371e8df, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009b9a070, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiUnsecureVirtualMemory+15f
fffff800`0371e8df 488b0f mov rcx,qword ptr [rdi]
CONTEXT: fffff88009b9a070 -- (.cxr 0xfffff88009b9a070)
rax=0000000000000100 rbx=fffffa800abc3b60 rcx=0000000000000100
rdx=0000000000000000 rsi=fffffa800b4b3060 rdi=0000000000000100
rip=fffff8000371e8df rsp=fffff88009b9aa40 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=00000000000035be
r11=fffff88009b9aa50 r12=fffffa800b4b3278 r13=0000000000000005
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!MiUnsecureVirtualMemory+0x15f:
fffff800`0371e8df 488b0f mov rcx,qword ptr [rdi] ds:002b:00000000`00000100=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000105403 to fffff8000371e8df
STACK_TEXT:
fffff880`09b9aa40 fffff960`00105403 : 00000000`00000001 fffff900`c00bf010 fffff900`c2923b10 00000000`00000000 : nt!MiUnsecureVirtualMemory+0x15f
fffff880`09b9aa70 fffff960`001057b4 : ffffffff`00000000 fffff880`00000000 fffff900`c2923b10 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x36b
fffff880`09b9abc0 fffff960`000c66e5 : ffffffff`b00511ea fffff900`c2923b10 00000000`000011ea 00000000`7efdb000 : win32k!bDeleteSurface+0x34
fffff880`09b9abf0 fffff800`03476993 : fffffa80`0abc3b60 fffff880`09b9aca0 00000000`062d0b60 00000000`0000c03b : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`09b9ac20 00000000`72bc2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0016e968 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x72bc2dd9
FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+36b
fffff960`00105403 e90d020000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`00105615)
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+36b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dc13c
STACK_COMMAND: .cxr 0xfffff88009b9a070 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!SURFACE::bDeleteSurface+36b
BUCKET_ID: X64_0x3B_win32k!SURFACE::bDeleteSurface+36b
Followup: MachineOwner
---------
Debug session time: Sat Nov 20 20:28:13.204 2010 (GMT-5)
System Uptime: 0 days 0:01:22.233
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800037a322c, 0, 100}
Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800037a322c, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000100, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiApplyCompressedFixups+40
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000100
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036f30e0
0000000000000100
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: Driver Sweeper
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff8800c791618 -- (.exr 0xfffff8800c791618)
ExceptionAddress: fffff800037a322c (nt!MiApplyCompressedFixups+0x0000000000000040)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000100
Attempt to read from address 0000000000000100
TRAP_FRAME: fffff8800c7916c0 -- (.trap 0xfffff8800c7916c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0023eb000 rbx=0000000000000000 rcx=fffffa800b29c2d0
rdx=fffff880029f6000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800037a322c rsp=fffff8800c791850 rbp=0000000000000003
r8=0000000000000100 r9=0000000000e70000 r10=0000000000000fff
r11=fffff880029f6000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiApplyCompressedFixups+0x40:
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx] ds:0488:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800034f5a39 to fffff800034bb740
STACK_TEXT:
fffff880`0c790e48 fffff800`034f5a39 : 00000000`0000001e ffffffff`c0000005 fffff800`037a322c 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c790e50 fffff800`034bad82 : fffff880`0c791618 00000000`00000100 fffff880`0c7916c0 00000000`00e70000 : nt!KiDispatchException+0x1b9
fffff880`0c7914e0 fffff800`034b98fa : 00000000`00000000 00000000`00000100 00000000`00000000 fffffa80`0ad6b420 : nt!KiExceptionDispatch+0xc2
fffff880`0c7916c0 fffff800`037a322c : fffff700`01080000 00000000`00000000 00000000`00000001 00000000`00158234 : nt!KiPageFault+0x23a
fffff880`0c791850 fffff800`037a30b1 : fffff880`029f6000 00000000`00e70000 00000000`00174000 fffffa80`03a02750 : nt!MiApplyCompressedFixups+0x40
fffff880`0c7918a0 fffff800`03790344 : fffffa80`00000000 fffffa80`0b01b060 00000000`00000000 fffffa80`00000000 : nt!MiPerformFixups+0x65
fffff880`0c7918f0 fffff800`034acc4c : fffffa80`03a02750 fffffa80`081fd950 00000000`00000000 00000000`00000000 : nt!MiRelocateImagePfn+0x114
fffff880`0c791950 fffff800`034ad52b : fffffa80`081fd890 fffff880`0c791a80 fffffa80`0afdf6b8 fffffa80`0b01b060 : nt!MiWaitForInPageComplete+0x89c
fffff880`0c791a30 fffff800`034d68bb : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff683`00000000 : nt!MiIssueHardFault+0x28b
fffff880`0c791ac0 fffff800`034b982e : 00000000`00000000 00000000`00174288 000007ff`0076ca01 00000000`001ecde8 : nt!MmAccessFault+0x14bb
fffff880`0c791c20 000007fe`f1a28912 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`001ec230 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`f1a28912
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiApplyCompressedFixups+40
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!MiApplyCompressedFixups+40
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
Followup: MachineOwner
---------