Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\051311-48999-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x83001000 PsLoadedModuleList = 0x8314b850
Debug session time: Fri May 13 11:37:26.643 2011 (UTC - 4:00)
System Uptime: 0 days 0:03:22.016
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
...................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 83905487, a76e6434, 0}
Unable to load image \SystemRoot\system32\DRIVERS\MpFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
Probably caused by : ataport.SYS ( ataport!IdePortDispatchDeviceControl+b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 83905487, The address that the exception occurred at
Arg3: a76e6434, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
ataport!IdePortDispatchDeviceControl+b
83905487 80b98600000000 cmp byte ptr [ecx+86h],0
TRAP_FRAME: a76e6434 -- (.trap 0xffffffffa76e6434)
ErrCode = 00000000
eax=86d5ff08 ebx=00000000 ecx=00000000 edx=86e25218 esi=86d5ff08 edi=86d5ff08
eip=83905487 esp=a76e64a8 ebp=a76e64a8 iopl=0 nv up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010283
ataport!IdePortDispatchDeviceControl+0xb:
83905487 80b98600000000 cmp byte ptr [ecx+86h],0 ds:0023:00000086=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: WmiPrvSE.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 83038593 to 83905487
STACK_TEXT:
a76e64a8 83038593 86d5ff08 86e25218 87d9bb88 ataport!IdePortDispatchDeviceControl+0xb
a76e64c0 832e353b 85daa4f8 85daa61c 00000000 nt!IofCallDriver+0x63
a76e6534 8319d1ce 85db1968 85caf128 a76e6564 nt!RawQueryFsSizeInfo+0xbe
a76e6558 8319c0bd 85daa4f8 00000018 8b7a871e nt!RawQueryVolumeInformation+0x7e
a76e65a0 83038593 87d9bad0 85daa4f8 85daa4f8 nt!RawDispatch+0xd9
a76e65b8 839313e8 85cabb30 00000000 85db1968 nt!IofCallDriver+0x63
a76e65e4 83038593 85cabb30 85daa4f8 85daa4f8 fltmgr!FltpDispatch+0xe2
a76e65fc 8322c99f 85daa61c 85daa4f8 20206f49 nt!IofCallDriver+0x63
a76e661c 83259708 85cabb30 85db1968 00000001 nt!IopSynchronousServiceTail+0x1f8
a76e66a8 8303f1ea 80000801 a76e6798 a76e6780 nt!NtQueryVolumeInformationFile+0x440
a76e66a8 8303dc55 80000801 a76e6798 a76e6780 nt!KiFastCallEntry+0x12a
a76e6734 8394fead 80000868 a76e6798 a76e6780 nt!ZwQueryVolumeInformationFile+0x11
a76e6754 8b7e0560 80000868 a76e6798 a76e6780 fltmgr!FltQueryVolumeInformation+0x2f
WARNING: Stack unwind information not available. Following frames may be wrong.
a76e67d8 8b7e5a4e a76e689c 00000008 00000001 MpFilter+0x9560
a76e6880 83945bf5 a76e689c 00000005 00000008 MpFilter+0xea4e
a76e68b4 83946417 85dd5450 00000005 24fda078 fltmgr!FltpDoInstanceSetupNotification+0x69
a76e6900 839467d1 874ad008 86f89a20 00000005 fltmgr!FltpInitInstance+0x25d
a76e6970 839468d7 874ad008 86f89a20 00000005 fltmgr!FltpCreateInstanceFromName+0x285
a76e69dc 8394fcde 874ad008 86f89a20 00000005 fltmgr!FltpEnumerateRegistryInstances+0xf9
a76e6a2c 839447f4 86f89a20 85c7d008 87ecfb58 fltmgr!FltpDoFilterNotificationForNewVolume+0xe0
a76e6a70 83038593 85cabb30 86f89a20 87ecfbb4 fltmgr!FltpCreate+0x206
a76e6a88 832482a9 8b7a89de a76e6c30 00000000 nt!IofCallDriver+0x63
a76e6b60 83227ac5 86d5ff08 a5bd6eb0 85d54a38 nt!IopParseDevice+0xed7
a76e6bdc 83237ed6 00000000 a76e6c30 00000040 nt!ObpLookupObjectName+0x4fa
a76e6c38 8322e9b4 00e1e634 85bd6eb0 00000001 nt!ObOpenObjectByName+0x165
a76e6cb4 83252218 00e1e690 80100080 00e1e634 nt!IopCreateFile+0x673
a76e6d00 8303f1ea 00e1e690 80100080 00e1e634 nt!NtCreateFile+0x34
a76e6d00 77d270b4 00e1e690 80100080 00e1e634 nt!KiFastCallEntry+0x12a
00e1e698 00000000 00000000 00000000 00000000 0x77d270b4
STACK_COMMAND: kb
FOLLOWUP_IP:
ataport!IdePortDispatchDeviceControl+b
83905487 80b98600000000 cmp byte ptr [ecx+86h],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: ataport!IdePortDispatchDeviceControl+b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ataport
IMAGE_NAME: ataport.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf16
FAILURE_BUCKET_ID: 0x8E_ataport!IdePortDispatchDeviceControl+b
BUCKET_ID: 0x8E_ataport!IdePortDispatchDeviceControl+b
Followup: MachineOwner
---------