Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030511-14664-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83214000 PsLoadedModuleList = 0x8335c810
Debug session time: Sat Mar 5 10:26:48.174 2011 (UTC - 5:00)
System Uptime: 0 days 10:47:57.171
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8344bcb1, a7be36dc, 0}
Probably caused by : ntkrpamp.exe ( nt!CmpRemoveFromDelayedClose+54 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8344bcb1, The address that the exception occurred at
Arg3: a7be36dc, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!CmpRemoveFromDelayedClose+54
8344bcb1 890a mov dword ptr [edx],ecx
TRAP_FRAME: a7be36dc -- (.trap 0xffffffffa7be36dc)
ErrCode = 00000002
eax=893894dc ebx=8337b0c0 ecx=bb8f7edc edx=2087a1bc esi=89389468 edi=86015d48
eip=8344bcb1 esp=a7be3750 ebp=a7be3760 iopl=0 nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212
nt!CmpRemoveFromDelayedClose+0x54:
8344bcb1 890a mov dword ptr [edx],ecx ds:0023:2087a1bc=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8348acdd to 8344bcb1
STACK_TEXT:
a7be3760 8348acdd 0000fffe 89389468 a7be380c nt!CmpRemoveFromDelayedClose+0x54
a7be3770 834555ac a7be3a00 a7be3a28 00000000 nt!CmpReferenceKeyControlBlock+0x4a
a7be37b4 83468f15 a7be37f0 00000004 a7be3a28 nt!CmpKcbCacheLookup+0x5fa
a7be39a0 8344a901 a08824c8 a7be3a60 a7be39e4 nt!CmpBuildHashStackAndLookupCache+0x2e6
a7be3b48 8343521f a08824c8 859f5980 881d47c8 nt!CmpParseKey+0x36e
a7be3bc4 8345b28d 0000011e a7be3c18 00000040 nt!ObpLookupObjectName+0x4fa
a7be3c20 834529e4 039aec44 859f5980 00000001 nt!ObOpenObjectByName+0x159
a7be3d00 8344d737 039af19c 00000001 039aec44 nt!CmOpenKey+0x1f4
a7be3d1c 8325744a 039af19c 00000001 039aec44 nt!NtOpenKeyEx+0x18
a7be3d1c 777e64f4 039af19c 00000001 039aec44 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
039aee78 00000000 00000000 00000000 00000000 0x777e64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!CmpRemoveFromDelayedClose+54
8344bcb1 890a mov dword ptr [edx],ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CmpRemoveFromDelayedClose+54
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cacf
FAILURE_BUCKET_ID: 0x8E_nt!CmpRemoveFromDelayedClose+54
BUCKET_ID: 0x8E_nt!CmpRemoveFromDelayedClose+54
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030411-18080-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83216000 PsLoadedModuleList = 0x8335e810
Debug session time: Fri Mar 4 21:39:16.146 2011 (UTC - 5:00)
System Uptime: 0 days 0:16:35.144
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8341946b, 9db3bb94, 0}
Probably caused by : ntkrpamp.exe ( nt!HvpIsFreeNeighbor+49 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8341946b, The address that the exception occurred at
Arg3: 9db3bb94, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!HvpIsFreeNeighbor+49
8341946b 8b0e mov ecx,dword ptr [esi]
TRAP_FRAME: 9db3bb94 -- (.trap 0xffffffff9db3bb94)
ErrCode = 00000000
eax=a55c3ff8 ebx=00000000 ecx=255be4b8 edx=9db3bc2c esi=255be4b8 edi=a55ba000
eip=8341946b esp=9db3bc08 ebp=9db3bc10 iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
nt!HvpIsFreeNeighbor+0x49:
8341946b 8b0e mov ecx,dword ptr [esi] ds:0023:255be4b8=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 834136db to 8341946b
STACK_TEXT:
9db3bc10 834136db a55339d0 00000000 0005eff8 nt!HvpIsFreeNeighbor+0x49
9db3bc30 8341657b a55339d0 0005eff8 a55339d0 nt!HvFreeCell+0xde
9db3bc40 83410aa1 a55c020c 00000000 a1512aa8 nt!CmpFreeValue+0x3d
9db3bc60 83412d6b 0005b208 00000005 a13e5460 nt!CmpFreeKeyByCell+0x174
9db3bcc4 83413589 a13e5460 00000af4 043aeca4 nt!CmDeleteKey+0x86a
9db3bd28 8325944a 00000af4 043aecd4 77a164f4 nt!NtDeleteKey+0x332
9db3bd28 77a164f4 00000af4 043aecd4 77a164f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
043aecd4 00000000 00000000 00000000 00000000 0x77a164f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!HvpIsFreeNeighbor+49
8341946b 8b0e mov ecx,dword ptr [esi]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!HvpIsFreeNeighbor+49
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cacf
FAILURE_BUCKET_ID: 0x8E_nt!HvpIsFreeNeighbor+49
BUCKET_ID: 0x8E_nt!HvpIsFreeNeighbor+49
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030611-19640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83445000 PsLoadedModuleList = 0x8358d810
Debug session time: Sun Mar 6 12:50:26.011 2011 (UTC - 5:00)
System Uptime: 0 days 0:42:01.993
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.....
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 8f657b68
Arg3: 8f657740
Arg4: 8baba51e
Debugging Details:
------------------
EXCEPTION_RECORD: 8f657b68 -- (.exr 0xffffffff8f657b68)
ExceptionAddress: 8baba51e (Ntfs!NtfsCommonClose+0x000004b5)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 0a75a57c
Attempt to write to address 0a75a57c
CONTEXT: 8f657740 -- (.cxr 0xffffffff8f657740)
eax=0a75a57c ebx=8a75a530 ecx=8a75a57c edx=00180041 esi=86564338 edi=8f657cd0
eip=8baba51e esp=8f657c30 ebp=8f657c6c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
Ntfs!NtfsCommonClose+0x4b5:
8baba51e 8908 mov dword ptr [eax],ecx ds:0023:0a75a57c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 1
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 0a75a57c
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 835ad718
Unable to read MiSystemVaType memory at 8358d160
0a75a57c
FOLLOWUP_IP:
Ntfs!NtfsCommonClose+4b5
8baba51e 8908 mov dword ptr [eax],ecx
FAULTING_IP:
Ntfs!NtfsCommonClose+4b5
8baba51e 8908 mov dword ptr [eax],ecx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 8bad94c3 to 8baba51e
STACK_TEXT:
8f657c6c 8bad94c3 86564338 8a75a318 8a75a228 Ntfs!NtfsCommonClose+0x4b5
8f657d00 834b2f3b 00000000 00000000 864d5b40 Ntfs!NtfsFspClose+0x118
8f657d50 836536bb 80000000 a2e7c2b0 00000000 nt!ExpWorkerThread+0x10d
8f657d90 835050f9 834b2e2e 80000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsCommonClose+4b5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf45
STACK_COMMAND: .cxr 0xffffffff8f657740 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsCommonClose+4b5
BUCKET_ID: 0x24_Ntfs!NtfsCommonClose+4b5
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030611-19531-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83407000 PsLoadedModuleList = 0x8354f810
Debug session time: Sun Mar 6 13:03:08.539 2011 (UTC - 5:00)
System Uptime: 0 days 0:12:12.146
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 836a1f51, 8db93bd0, 8db937b0}
Probably caused by : ntkrpamp.exe ( nt!CmpDelayCloseWorker+79 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 836a1f51, The address that the exception occurred at
Arg3: 8db93bd0, Exception Record Address
Arg4: 8db937b0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!CmpDelayCloseWorker+79
836a1f51 c702a8e05683 mov dword ptr [edx],offset nt!CmpDelayedLRUListHead (8356e0a8)
EXCEPTION_RECORD: 8db93bd0 -- (.exr 0xffffffff8db93bd0)
ExceptionAddress: 836a1f51 (nt!CmpDelayCloseWorker+0x00000079)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 36f43c5c
Attempt to write to address 36f43c5c
CONTEXT: 8db937b0 -- (.cxr 0xffffffff8db937b0)
eax=b6f43468 ebx=46188e4e ecx=8db93cd4 edx=36f43c5c esi=0000092e edi=8356e0c0
eip=836a1f51 esp=8db93c98 ebp=8db93d00 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!CmpDelayCloseWorker+0x79:
836a1f51 c702a8e05683 mov dword ptr [edx],offset nt!CmpDelayedLRUListHead (8356e0a8) ds:0023:36f43c5c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 36f43c5c
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8356f718
Unable to read MiSystemVaType memory at 8354f160
36f43c5c
FOLLOWUP_IP:
nt!CmpDelayCloseWorker+79
836a1f51 c702a8e05683 mov dword ptr [edx],offset nt!CmpDelayedLRUListHead (8356e0a8)
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 83474f3b to 836a1f51
STACK_TEXT:
8db93d00 83474f3b 00000000 00000000 85dd1a70 nt!CmpDelayCloseWorker+0x79
8db93d50 836156bb 00000001 a02dbb88 00000000 nt!ExpWorkerThread+0x10d
8db93d90 834c70f9 83474e2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CmpDelayCloseWorker+79
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cacf
STACK_COMMAND: .cxr 0xffffffff8db937b0 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!CmpDelayCloseWorker+79
BUCKET_ID: 0x7E_nt!CmpDelayCloseWorker+79
Followup: MachineOwner
---------