BSOD - ntoskrnl.exe+70740 - w/ dump info

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by Sasha 789, Oct 25, 2010.

  1. Sasha 789

    Sasha 789 New Member

    Joined:
    Oct 25, 2010
    Messages:
    8
    Likes Received:
    0
    Hi everybody. I just stumbled on this board, hope I'm practicing proper etiquette here...but I'm having a BSOD issue. It seems to happen most frequently while using iTunes or MediaMonkey, but has happened without either of those programs being open.

    I just did a clean install of Windows 7 (64-bit) but after a few days of serenity, back to rebooting every now and then.

    Windows Memory Diagnostics doesn't show any memory issues. I used BlueScreenView to grab the following (UPDATE: actual dump files in zip below, too) ---

    Thank you!
    Sasha



    ==================================================
    Dump File : 102510-27112-01.dmp
    Crash Time : 10/25/2010 11:30:38 AM
    Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code : 0x0000001e
    Parameter 1 : ffffffff`c0000005
    Parameter 2 : fffff800`028b57e7
    Parameter 3 : 00000000`00000000
    Parameter 4 : 000007ff`fffa0000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+70740
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
    Processor : x64
    Computer Name :
    Full Path : C:\Windows\Minidump\102510-27112-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7600
    ==================================================

    ==================================================
    Dump File : 102510-36956-01.dmp
    Crash Time : 10/25/2010 10:33:04 AM
    Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
    Bug Check Code : 0x00000050
    Parameter 1 : fffff880`0824d928
    Parameter 2 : 00000000`00000000
    Parameter 3 : fffffa80`047b0058
    Parameter 4 : 00000000`00000000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+70740
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
    Processor : x64
    Computer Name :
    Full Path : C:\Windows\Minidump\102510-36956-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7600
    ==================================================

    ==================================================
    Dump File : 102510-37955-01.dmp
    Crash Time : 10/25/2010 10:17:18 AM
    Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code : 0x0000001e
    Parameter 1 : ffffffff`c0000005
    Parameter 2 : fffff800`028aa7e7
    Parameter 3 : 00000000`00000000
    Parameter 4 : 000007ff`fffa0000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+70740
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
    Processor : x64
    Computer Name :
    Full Path : C:\Windows\Minidump\102510-37955-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7600
    ==================================================

    ==================================================
    Dump File : 102310-38532-01.dmp
    Crash Time : 10/23/2010 1:40:39 PM
    Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code : 0x0000001e
    Parameter 1 : ffffffff`c0000005
    Parameter 2 : fffff800`028577e7
    Parameter 3 : 00000000`00000000
    Parameter 4 : 000007ff`fffa0000
    Caused By Driver : ntoskrnl.exe
    Caused By Address : ntoskrnl.exe+70740
    File Description : NT Kernel & System
    Product Name : Microsoft® Windows® Operating System
    Company : Microsoft Corporation
    File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
    Processor : x64
    Computer Name :
    Full Path : C:\Windows\Minidump\102310-38532-01.dmp
    Processors Count : 8
    Major Version : 15
    Minor Version : 7600
    ==================================================
     

    Attached Files:

    #1 Sasha 789, Oct 25, 2010
    Last edited: Oct 25, 2010
  2. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    Attach the .dmp's found in your C:\Windows\Minidump.
     
  3. Sasha 789

    Sasha 789 New Member

    Joined:
    Oct 25, 2010
    Messages:
    8
    Likes Received:
    0
    oops. Okay, attached them in a zip file - hope that works.
     
  4. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    1. Update:

    atikmdag.sys Fri Apr 24 13:51:57 2009
    ATI

    Rt64win7.sys Thu Feb 26 11:04:13 2009
    Realtek 8136/8168/8169 PCI/PCIe Adapters




    2. Uninstall Avast, replace it with MSE:

    avast! Uninstall Utility

    http://www.microsoft.com/security_essentials/




    3. If crashes still occur, run memtest overnight:

    RAM - Test with Memtest86+ - Windows 7 Forums



    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [I:\102510-36956-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`0281f000 PsLoadedModuleList = 0xfffff800`02a5ce50
    Debug session time: Mon Oct 25 17:30:14.705 2010 (UTC - 5:00)
    System Uptime: 0 days 0:13:36.736
    Loading Kernel Symbols
    ..
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    .............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffff8800824d928, 0, fffffa80047b0058, 0}
    
    
    Could not read faulting driver name
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42837 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff8800824d928, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffffa80047b0058, If non-zero, the instruction address which referenced the bad memory
    	address.
    Arg4: 0000000000000000, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac70e0
     fffff8800824d928 
    
    FAULTING_IP: 
    +3163303463316639
    fffffa80`047b0058 8b4358          mov     eax,dword ptr [rbx+58h]
    
    MM_INTERNAL_CODE:  0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    TRAP_FRAME:  fffff88002e14880 -- (.trap 0xfffff88002e14880)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8003d5bee1
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffffa80047b0058 rsp=fffff88002e14a10 rbp=fffff88002e14b10
     r8=fffffa8003ef3370  r9=0000000000000130 r10=fffff88002f640c0
    r11=fffffa80054bfb60 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    fffffa80`047b0058 8b4358          mov     eax,dword ptr [rbx+58h] ds:d8d0:00000000`00000058=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000290ff14 to fffff8000288f740
    
    STACK_TEXT:  
    fffff880`02e14718 fffff800`0290ff14 : 00000000`00000050 fffff880`0824d928 00000000`00000000 fffff880`02e14880 : nt!KeBugCheckEx
    fffff880`02e14720 fffff800`0288d82e : 00000000`00000000 fffff880`0824d8d0 fffffa80`05db9800 fffff880`00eb9400 : nt! ?? ::FNODOBFM::`string'+0x42837
    fffff880`02e14880 fffffa80`047b0058 : fffff880`00000000 fffffa80`00000008 fffffa80`0000000a ffffffff`80003378 : nt!KiPageFault+0x16e
    fffff880`02e14a10 fffff880`00000000 : fffffa80`00000008 fffffa80`0000000a ffffffff`80003378 00000000`00000000 : 0xfffffa80`047b0058
    fffff880`02e14a18 fffffa80`00000008 : fffffa80`0000000a ffffffff`80003378 00000000`00000000 00000000`00000001 : 0xfffff880`00000000
    fffff880`02e14a20 fffffa80`0000000a : ffffffff`80003378 00000000`00000000 00000000`00000001 00000000`00000e9c : 0xfffffa80`00000008
    fffff880`02e14a28 ffffffff`80003378 : 00000000`00000000 00000000`00000001 00000000`00000e9c 00000000`00000000 : 0xfffffa80`0000000a
    fffff880`02e14a30 00000000`00000000 : 00000000`00000001 00000000`00000e9c 00000000`00000000 00000000`00000030 : 0xffffffff`80003378
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+42837
    fffff800`0290ff14 cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+42837
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+42837
    
    BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+42837
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [I:\102510-37955-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`0285a000 PsLoadedModuleList = 0xfffff800`02a97e50
    Debug session time: Mon Oct 25 17:14:37.269 2010 (UTC - 5:00)
    System Uptime: 0 days 12:12:51.300
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff800028aa7e7, 0, 7fffffa0000}
    
    Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff800028aa7e7, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 000007fffffa0000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    FAULTING_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  000007fffffa0000
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b020e0
     000007fffffa0000 
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    BUGCHECK_STR:  0x1E_c0000005
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  conhost.exe
    
    CURRENT_IRQL:  0
    
    EXCEPTION_RECORD:  fffff88003369438 -- (.exr 0xfffff88003369438)
    ExceptionAddress: fffff800028aa7e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000007fffffa0000
    Attempt to read from address 000007fffffa0000
    
    TRAP_FRAME:  fffff880033694e0 -- (.trap 0xfffff880033694e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
    rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800028aa7e7 rsp=fffff88003369678 rbp=fffff880033697b0
     r8=0000000000000000  r9=fffff880033696b8 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!RtlImageNtHeaderEx+0x3f:
    fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002904a39 to fffff800028ca740
    
    STACK_TEXT:  
    fffff880`03368c68 fffff800`02904a39 : 00000000`0000001e ffffffff`c0000005 fffff800`028aa7e7 00000000`00000000 : nt!KeBugCheckEx
    fffff880`03368c70 fffff800`028c9d82 : fffff880`03369438 fffff880`0879d8d0 fffff880`033694e0 00000000`00000000 : nt!KiDispatchException+0x1b9
    fffff880`03369300 fffff800`028c88fa : 00000000`00000000 fffff880`0879d8d0 fffffa80`05985100 fffff800`02be0d2e : nt!KiExceptionDispatch+0xc2
    fffff880`033694e0 fffff800`028aa7e7 : fffff800`028aa872 00000000`00000010 00000000`00000082 fffff880`033696a8 : nt!KiPageFault+0x23a
    fffff880`03369678 fffff800`028aa872 : 00000000`00000010 00000000`00000082 fffff880`033696a8 fffffa80`0371e040 : nt!RtlImageNtHeaderEx+0x3f
    fffff880`03369680 fffffa80`047afbc6 : fffff880`033697b0 00000000`00000000 fffffa80`047b4260 fffffa80`047b8300 : nt!RtlImageNtHeader+0x1e
    fffff880`033696b0 fffff880`033697b0 : 00000000`00000000 fffffa80`047b4260 fffffa80`047b8300 00000000`00000000 : 0xfffffa80`047afbc6
    fffff880`033696b8 00000000`00000000 : fffffa80`047b4260 fffffa80`047b8300 00000000`00000000 00000000`00000000 : 0xfffff880`033697b0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [I:\102510-27112-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02865000 PsLoadedModuleList = 0xfffff800`02aa2e50
    Debug session time: Mon Oct 25 18:28:07.403 2010 (UTC - 5:00)
    System Uptime: 0 days 0:55:41.434
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff800028b57e7, 0, 7fffffa0000}
    
    Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff800028b57e7, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 000007fffffa0000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    FAULTING_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  000007fffffa0000
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b0d0e0
     000007fffffa0000 
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    BUGCHECK_STR:  0x1E_c0000005
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  conhost.exe
    
    CURRENT_IRQL:  0
    
    EXCEPTION_RECORD:  fffff88003362438 -- (.exr 0xfffff88003362438)
    ExceptionAddress: fffff800028b57e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000007fffffa0000
    Attempt to read from address 000007fffffa0000
    
    TRAP_FRAME:  fffff880033624e0 -- (.trap 0xfffff880033624e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
    rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800028b57e7 rsp=fffff88003362678 rbp=fffff880033627b0
     r8=0000000000000000  r9=fffff880033626b8 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!RtlImageNtHeaderEx+0x3f:
    fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000290fa39 to fffff800028d5740
    
    STACK_TEXT:  
    fffff880`03361c68 fffff800`0290fa39 : 00000000`0000001e ffffffff`c0000005 fffff800`028b57e7 00000000`00000000 : nt!KeBugCheckEx
    fffff880`03361c70 fffff800`028d4d82 : fffff880`03362438 fffff880`06a338d0 fffff880`033624e0 00000000`00000000 : nt!KiDispatchException+0x1b9
    fffff880`03362300 fffff800`028d38fa : 00000000`00000000 fffff880`06a338d0 fffffa80`066b1000 fffff800`02bebd2e : nt!KiExceptionDispatch+0xc2
    fffff880`033624e0 fffff800`028b57e7 : fffff800`028b5872 00000000`00000010 00000000`00000082 fffff880`033626a8 : nt!KiPageFault+0x23a
    fffff880`03362678 fffff800`028b5872 : 00000000`00000010 00000000`00000082 fffff880`033626a8 fffffa80`0372a680 : nt!RtlImageNtHeaderEx+0x3f
    fffff880`03362680 fffffa80`047aebc6 : fffff880`033627b0 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 : nt!RtlImageNtHeader+0x1e
    fffff880`033626b0 fffff880`033627b0 : 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 : 0xfffffa80`047aebc6
    fffff880`033626b8 00000000`00000000 : fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 00000000`00000000 : 0xfffff880`033627b0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [I:\102310-38532-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02807000 PsLoadedModuleList = 0xfffff800`02a44e50
    Debug session time: Sat Oct 23 20:37:42.333 2010 (UTC - 5:00)
    System Uptime: 0 days 2:34:06.252
    Loading Kernel Symbols
    ..
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    .............................................................
    ................................................................
    ..................
    Loading User Symbols
    Loading unloaded module list
    ....................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff800028577e7, 0, 7fffffa0000}
    
    Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )
    
    Followup: MachineOwner
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff800028577e7, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 000007fffffa0000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    FAULTING_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028577e7 66390a          cmp     word ptr [rdx],cx
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  000007fffffa0000
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aaf0e0
     000007fffffa0000 
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
    
    BUGCHECK_STR:  0x1E_c0000005
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  conhost.exe
    
    CURRENT_IRQL:  0
    
    EXCEPTION_RECORD:  fffff88003377438 -- (.exr 0xfffff88003377438)
    ExceptionAddress: fffff800028577e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000007fffffa0000
    Attempt to read from address 000007fffffa0000
    
    TRAP_FRAME:  fffff880033774e0 -- (.trap 0xfffff880033774e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
    rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800028577e7 rsp=fffff88003377678 rbp=fffff880033777b0
     r8=0000000000000000  r9=fffff880033776b8 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    nt!RtlImageNtHeaderEx+0x3f:
    fffff800`028577e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800028b1a39 to fffff80002877740
    
    STACK_TEXT:  
    fffff880`03376c68 fffff800`028b1a39 : 00000000`0000001e ffffffff`c0000005 fffff800`028577e7 00000000`00000000 : nt!KeBugCheckEx
    fffff880`03376c70 fffff800`02876d82 : fffff880`03377438 fffff880`0693e8d0 fffff880`033774e0 00000000`00000000 : nt!KiDispatchException+0x1b9
    fffff880`03377300 fffff800`028758fa : 00000000`00000000 fffff880`0693e8d0 fffffa80`07002900 fffff800`02b8dd2e : nt!KiExceptionDispatch+0xc2
    fffff880`033774e0 fffff800`028577e7 : fffff800`02857872 00000000`00000010 00000000`00000082 fffff880`033776a8 : nt!KiPageFault+0x23a
    fffff880`03377678 fffff800`02857872 : 00000000`00000010 00000000`00000082 fffff880`033776a8 fffffa80`0371d680 : nt!RtlImageNtHeaderEx+0x3f
    fffff880`03377680 fffffa80`047aebc6 : fffff880`033777b0 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 : nt!RtlImageNtHeader+0x1e
    fffff880`033776b0 fffff880`033777b0 : 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 : 0xfffffa80`047aebc6
    fffff880`033776b8 00000000`00000000 : fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 00000000`00000000 : 0xfffff880`033777b0
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!RtlImageNtHeaderEx+3f
    fffff800`028577e7 66390a          cmp     word ptr [rdx],cx
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9
    
    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
    
    
    
    fffff880`00e0f000 fffff880`00e66000   ACPI     ACPI.sys     Tue Jul 14 02:19:34 2009 (4A5BC106)
    fffff880`02c18000 fffff880`02ca2000   afd      afd.sys      Tue Jul 14 02:21:40 2009 (4A5BC184)
    fffff880`0422d000 fffff880`04243000   AgileVpn AgileVpn.sys Tue Jul 14 03:10:24 2009 (4A5BCCF0)
    fffff880`00c54000 fffff880`00c5f000   amdxata  amdxata.sys  Tue May 19 20:56:59 2009 (4A12F2EB)
    fffff880`025d0000 fffff880`025d9000   aswFsBlk aswFsBlk.SYS Tue Sep 07 17:47:09 2010 (4C86506D)
    fffff880`02596000 fffff880`025d0000   aswMonFlt aswMonFlt.sys Tue Sep 07 17:47:32 2010 (4C865084)
    fffff880`02ca2000 fffff880`02cac000   aswRdr   aswRdr.SYS   Tue Sep 07 17:47:47 2010 (4C865093)
    fffff880`04181000 fffff880`041a4000   aswSP    aswSP.SYS    Tue Sep 07 17:52:07 2010 (4C865197)
    fffff880`01872000 fffff880`01882000   aswTdi   aswTdi.SYS   Tue Sep 07 17:52:27 2010 (4C8651AB)
    fffff880`06400000 fffff880`0640b000   asyncmac asyncmac.sys Tue Jul 14 03:10:13 2009 (4A5BCCE5)
    fffff880`00ff6000 fffff880`00fff000   atapi    atapi.sys    Tue Jul 14 02:19:47 2009 (4A5BC113)
    fffff880`00c2a000 fffff880`00c54000   ataport  ataport.SYS  Tue Jul 14 02:19:52 2009 (4A5BC118)
    fffff880`048b7000 fffff880`04dd9000   atikmdag atikmdag.sys Fri Apr 24 13:51:57 2009 (49F199CD)
    fffff960`00930000 fffff960`00991000   ATMFD    ATMFD.DLL    unavailable (00000000)
    fffff880`019b8000 fffff880`019bf000   Beep     Beep.SYS     Tue Jul 14 03:00:13 2009 (4A5BCA8D)
    fffff880`04170000 fffff880`04181000   blbdrive blbdrive.sys Tue Jul 14 02:35:59 2009 (4A5BC4DF)
    fffff880`06133000 fffff880`06151000   bowser   bowser.sys   Tue Jul 14 02:23:50 2009 (4A5BC206)
    fffff960`006f0000 fffff960`00717000   cdd      cdd.dll      unavailable (00000000)
    fffff880`0640b000 fffff880`06435000   cdrom    cdrom.sys    Tue Jul 14 02:19:54 2009 (4A5BC11A)
    fffff880`00e92000 fffff880`00f52000   CI       CI.dll       Tue Jul 14 04:32:13 2009 (4A5BE01D)
    fffff880`0191f000 fffff880`0194f000   CLASSPNP CLASSPNP.SYS Tue Jul 14 02:19:58 2009 (4A5BC11E)
    fffff880`00ce5000 fffff880`00d43000   CLFS     CLFS.SYS     Tue Jul 14 02:19:57 2009 (4A5BC11D)
    fffff880`010f7000 fffff880`0116a000   cng      cng.sys      Tue Jul 14 02:49:40 2009 (4A5BC814)
    fffff880`0421d000 fffff880`0422d000   CompositeBus CompositeBus.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
    fffff880`0253d000 fffff880`0254b000   crashdmp crashdmp.sys Tue Jul 14 03:01:01 2009 (4A5BCABD)
    fffff880`040cf000 fffff880`04152000   csc      csc.sys      Tue Jul 14 02:24:26 2009 (4A5BC22A)
    fffff880`04152000 fffff880`04170000   dfsc     dfsc.sys     Tue Jul 14 02:23:44 2009 (4A5BC200)
    fffff880`02de3000 fffff880`02df2000   discache discache.sys Tue Jul 14 02:37:18 2009 (4A5BC52E)
    fffff880`01909000 fffff880`0191f000   disk     disk.sys     Tue Jul 14 02:19:57 2009 (4A5BC11D)
    fffff880`04f0d000 fffff880`04f2f000   drmk     drmk.sys     Tue Jul 14 04:01:25 2009 (4A5BD8E5)
    fffff880`02557000 fffff880`02560000   dump_atapi dump_atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
    fffff880`0254b000 fffff880`02557000   dump_dumpata dump_dumpata.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
    fffff880`02560000 fffff880`02573000   dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
    fffff880`04f75000 fffff880`04f81000   Dxapi    Dxapi.sys    Tue Jul 14 02:38:28 2009 (4A5BC574)
    fffff880`042a1000 fffff880`04395000   dxgkrnl  dxgkrnl.sys  Fri Oct 02 04:00:14 2009 (4AC5509E)
    fffff880`04395000 fffff880`043db000   dxgmms1  dxgmms1.sys  Tue Jul 14 02:38:32 2009 (4A5BC578)
    fffff880`01085000 fffff880`01099000   fileinfo fileinfo.sys Tue Jul 14 02:34:25 2009 (4A5BC481)
    fffff880`01039000 fffff880`01085000   fltmgr   fltmgr.sys   Tue Jul 14 02:19:59 2009 (4A5BC11F)
    fffff880`013d0000 fffff880`013da000   Fs_Rec   Fs_Rec.sys   Tue Jul 14 02:19:45 2009 (4A5BC111)
    fffff880`018cf000 fffff880`01909000   fvevol   fvevol.sys   Tue Jul 14 02:22:15 2009 (4A5BC1A7)
    fffff880`0157f000 fffff880`015c9000   fwpkclnt fwpkclnt.sys Tue Jul 14 02:21:08 2009 (4A5BC164)
    fffff880`06435000 fffff880`06442000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 15:17:04 2009 (4A1151C0)
    fffff800`02de3000 fffff800`02e2c000   hal      hal.dll      Tue Jul 14 04:27:36 2009 (4A5BDF08)
    fffff880`04067000 fffff880`0408b000   HDAudBus HDAudBus.sys Tue Jul 14 03:06:13 2009 (4A5BCBF5)
    fffff880`04e74000 fffff880`04ed0000   HdAudio  HdAudio.sys  Tue Jul 14 03:06:59 2009 (4A5BCC23)
    fffff880`04f43000 fffff880`04f5c000   HIDCLASS HIDCLASS.SYS Tue Jul 14 03:06:21 2009 (4A5BCBFD)
    fffff880`04f5c000 fffff880`04f64080   HIDPARSE HIDPARSE.SYS Tue Jul 14 03:06:17 2009 (4A5BCBF9)
    fffff880`04f35000 fffff880`04f43000   hidusb   hidusb.sys   Tue Jul 14 03:06:22 2009 (4A5BCBFE)
    fffff880`0606b000 fffff880`06133000   HTTP     HTTP.sys     Tue Jul 14 02:22:16 2009 (4A5BC1A8)
    fffff880`015f3000 fffff880`015fc000   hwpolicy hwpolicy.sys Tue Jul 14 02:19:22 2009 (4A5BC0FA)
    fffff880`041ca000 fffff880`041e0000   intelppm intelppm.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
    fffff880`043e7000 fffff880`043f6000   kbdclass kbdclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
    fffff880`04f67000 fffff880`04f75000   kbdhid   kbdhid.sys   Tue Jul 14 03:00:20 2009 (4A5BCA94)
    fffff800`00bc0000 fffff800`00bc3000   kdcom    kdcom.dll    Fri Oct 08 14:17:09 2010 (4CAEFDB5)
    fffff880`01882000 fffff880`018c5000   ks       ks.sys       Tue Jul 14 03:00:31 2009 (4A5BCA9F)
    fffff880`013a5000 fffff880`013bf000   ksecdd   ksecdd.sys   Tue Jul 14 02:20:54 2009 (4A5BC156)
    fffff880`01554000 fffff880`0157f000   ksecpkg  ksecpkg.sys  Fri Dec 11 08:03:32 2009 (4B21E0B4)
    fffff880`04f2f000 fffff880`04f34200   ksthunk  ksthunk.sys  Tue Jul 14 03:00:19 2009 (4A5BCA93)
    fffff880`02400000 fffff880`02415000   lltdio   lltdio.sys   Tue Jul 14 03:08:50 2009 (4A5BCC92)
    fffff880`02573000 fffff880`02596000   luafv    luafv.sys    Tue Jul 14 02:26:13 2009 (4A5BC295)
    fffff880`00c8d000 fffff880`00cd1000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 04:29:10 2009 (4A5BDF66)
    fffff880`04fa9000 fffff880`04fb7000   monitor  monitor.sys  Tue Jul 14 02:38:52 2009 (4A5BC58C)
    fffff880`0486a000 fffff880`04879000   mouclass mouclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
    fffff880`04f9c000 fffff880`04fa9000   mouhid   mouhid.sys   Tue Jul 14 03:00:20 2009 (4A5BCA94)
    fffff880`00c10000 fffff880`00c2a000   mountmgr mountmgr.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
    fffff880`06151000 fffff880`06169000   mpsdrv   mpsdrv.sys   Tue Jul 14 03:08:25 2009 (4A5BCC79)
    fffff880`06169000 fffff880`06196000   mrxsmb   mrxsmb.sys   Sat Feb 27 09:52:19 2010 (4B88CF33)
    fffff880`06196000 fffff880`061e4000   mrxsmb10 mrxsmb10.sys Sat Feb 27 09:52:28 2010 (4B88CF3C)
    fffff880`06000000 fffff880`06023000   mrxsmb20 mrxsmb20.sys Sat Feb 27 09:52:26 2010 (4B88CF3A)
    fffff880`0182b000 fffff880`01836000   Msfs     Msfs.SYS     Tue Jul 14 02:19:47 2009 (4A5BC113)
    fffff880`00e6f000 fffff880`00e79000   msisadrv msisadrv.sys Tue Jul 14 02:19:26 2009 (4A5BC0FE)
    fffff880`01099000 fffff880`010f7000   msrpc    msrpc.sys    Tue Jul 14 02:21:32 2009 (4A5BC17C)
    fffff880`02dd8000 fffff880`02de3000   mssmbios mssmbios.sys Tue Jul 14 02:31:10 2009 (4A5BC3BE)
    fffff880`015e1000 fffff880`015f3000   mup      mup.sys      Tue Jul 14 02:23:45 2009 (4A5BC201)
    fffff880`01402000 fffff880`014f4000   ndis     ndis.sys     Tue Jul 14 02:21:40 2009 (4A5BC184)
    fffff880`04267000 fffff880`04273000   ndistapi ndistapi.sys Tue Jul 14 03:10:00 2009 (4A5BCCD8)
    fffff880`04800000 fffff880`0482f000   ndiswan  ndiswan.sys  Tue Jul 14 03:10:11 2009 (4A5BCCE3)
    fffff880`04e5f000 fffff880`04e74000   NDProxy  NDProxy.SYS  Tue Jul 14 03:10:05 2009 (4A5BCCDD)
    fffff880`02d20000 fffff880`02d2f000   netbios  netbios.sys  Tue Jul 14 03:09:26 2009 (4A5BCCB6)
    fffff880`02cac000 fffff880`02cf1000   netbt    netbt.sys    Tue Jul 14 02:21:28 2009 (4A5BC178)
    fffff880`014f4000 fffff880`01554000   NETIO    NETIO.SYS    Tue Jul 14 02:21:46 2009 (4A5BC18A)
    fffff880`01836000 fffff880`01847000   Npfs     Npfs.SYS     Tue Jul 14 02:19:48 2009 (4A5BC114)
    fffff880`02dcc000 fffff880`02dd8000   nsiproxy nsiproxy.sys Tue Jul 14 02:21:02 2009 (4A5BC15E)
    fffff800`02807000 fffff800`02de3000   nt       ntkrnlmp.exe Sat Jun 19 07:16:41 2010 (4C1C44A9)
    fffff880`01202000 fffff880`013a5000   Ntfs     Ntfs.sys     Tue Jul 14 02:20:47 2009 (4A5BC14F)
    fffff880`019af000 fffff880`019b8000   Null     Null.SYS     Tue Jul 14 02:19:37 2009 (4A5BC109)
    fffff880`02cfa000 fffff880`02d20000   pacer    pacer.sys    Tue Jul 14 03:09:41 2009 (4A5BCCC5)
    fffff880`04200000 fffff880`0421d000   parport  parport.sys  Tue Jul 14 03:00:40 2009 (4A5BCAA8)
    fffff880`00d76000 fffff880`00d8b000   partmgr  partmgr.sys  Tue Jul 14 02:19:58 2009 (4A5BC11E)
    fffff880`00d43000 fffff880`00d76000   pci      pci.sys      Tue Jul 14 02:19:51 2009 (4A5BC117)
    fffff880`00e86000 fffff880`00e8d000   pciide   pciide.sys   Tue Jul 14 02:19:49 2009 (4A5BC115)
    fffff880`00c00000 fffff880`00c10000   PCIIDEX  PCIIDEX.SYS  Tue Jul 14 02:19:48 2009 (4A5BC114)
    fffff880`013bf000 fffff880`013d0000   pcw      pcw.sys      Tue Jul 14 02:19:27 2009 (4A5BC0FF)
    fffff880`0242d000 fffff880`024d3000   peauth   peauth.sys   Tue Jul 14 04:01:19 2009 (4A5BD8DF)
    fffff880`04ed0000 fffff880`04f0d000   portcls  portcls.sys  Tue Jul 14 03:06:27 2009 (4A5BCC03)
    fffff880`00cd1000 fffff880`00ce5000   PSHED    PSHED.dll    Tue Jul 14 04:32:23 2009 (4A5BE027)
    fffff880`04243000 fffff880`04267000   rasl2tp  rasl2tp.sys  Tue Jul 14 03:10:11 2009 (4A5BCCE3)
    fffff880`04273000 fffff880`0428e000   raspppoe raspppoe.sys Tue Jul 14 03:10:17 2009 (4A5BCCE9)
    fffff880`0482f000 fffff880`04850000   raspptp  raspptp.sys  Tue Jul 14 03:10:18 2009 (4A5BCCEA)
    fffff880`04850000 fffff880`0486a000   rassstp  rassstp.sys  Tue Jul 14 03:10:25 2009 (4A5BCCF1)
    fffff880`02d7b000 fffff880`02dcc000   rdbss    rdbss.sys    Tue Jul 14 02:24:09 2009 (4A5BC219)
    fffff880`0428e000 fffff880`04299000   rdpbus   rdpbus.sys   Tue Jul 14 03:17:46 2009 (4A5BCEAA)
    fffff880`01810000 fffff880`01819000   RDPCDD   RDPCDD.sys   Tue Jul 14 03:16:34 2009 (4A5BCE62)
    fffff880`01819000 fffff880`01822000   rdpencdd rdpencdd.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
    fffff880`01822000 fffff880`0182b000   rdprefmp rdprefmp.sys Tue Jul 14 03:16:35 2009 (4A5BCE63)
    fffff880`011b6000 fffff880`011f0000   rdyboost rdyboost.sys Tue Jul 14 02:34:34 2009 (4A5BC48A)
    fffff880`02415000 fffff880`0242d000   rspndr   rspndr.sys   Tue Jul 14 03:08:50 2009 (4A5BCC92)
    fffff880`0408b000 fffff880`040bd000   Rt64win7 Rt64win7.sys Thu Feb 26 11:04:13 2009 (49A65B0D)
    fffff880`06023000 fffff880`0602e000   secdrv   secdrv.SYS   Wed Sep 13 16:18:38 2006 (4508052E)
    fffff880`043db000 fffff880`043e7000   serenum  serenum.sys  Tue Jul 14 03:00:33 2009 (4A5BCAA1)
    fffff880`02d2f000 fffff880`02d4c000   serial   serial.sys   Tue Jul 14 03:00:40 2009 (4A5BCAA8)
    fffff880`015d9000 fffff880`015e1000   spldr    spldr.sys    Mon May 11 19:56:27 2009 (4A0858BB)
    fffff880`064f9000 fffff880`0658f000   srv      srv.sys      Fri Aug 27 06:38:00 2010 (4C773318)
    fffff880`06492000 fffff880`064f9000   srv2     srv2.sys     Fri Aug 27 06:37:46 2010 (4C77330A)
    fffff880`0602e000 fffff880`0605b000   srvnet   srvnet.sys   Fri Aug 27 06:37:24 2010 (4C7732F4)
    fffff880`043f6000 fffff880`043f7480   swenum   swenum.sys   Tue Jul 14 03:00:18 2009 (4A5BCA92)
    fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Mon Jun 14 06:39:04 2010 (4C15A458)
    fffff880`061e4000 fffff880`061f6000   tcpipreg tcpipreg.sys Tue Jul 14 03:09:49 2009 (4A5BCCCD)
    fffff880`01865000 fffff880`01872000   TDI      TDI.SYS      Tue Jul 14 02:21:18 2009 (4A5BC16E)
    fffff880`01847000 fffff880`01865000   tdx      tdx.sys      Tue Jul 14 02:21:15 2009 (4A5BC16B)
    fffff880`02d67000 fffff880`02d7b000   termdd   termdd.sys   Tue Jul 14 03:16:36 2009 (4A5BCE64)
    fffff960`00590000 fffff960`0059a000   TSDDD    TSDDD.dll    Tue Jul 14 03:16:34 2009 (4A5BCE62)
    fffff880`041a4000 fffff880`041ca000   tunnel   tunnel.sys   Tue Jul 14 03:09:37 2009 (4A5BCCC1)
    fffff880`024e9000 fffff880`0253d000   udfs     udfs.sys     Tue Jul 14 02:23:37 2009 (4A5BC1F9)
    fffff880`04879000 fffff880`0488b000   umbus    umbus.sys    Tue Jul 14 03:06:56 2009 (4A5BCC20)
    fffff880`04f65000 fffff880`04f66f00   USBD     USBD.SYS     Tue Jul 14 03:06:23 2009 (4A5BCBFF)
    fffff880`04056000 fffff880`04067000   usbehci  usbehci.sys  Tue Jul 14 03:06:30 2009 (4A5BCC06)
    fffff880`04e05000 fffff880`04e5f000   usbhub   usbhub.sys   Tue Jul 14 03:07:09 2009 (4A5BCC2D)
    fffff880`04000000 fffff880`04056000   USBPORT  USBPORT.SYS  Tue Jul 14 03:06:31 2009 (4A5BCC07)
    fffff880`06442000 fffff880`0645d000   USBSTOR  USBSTOR.SYS  Tue Jul 14 03:06:34 2009 (4A5BCC0A)
    fffff880`041e0000 fffff880`041ed000   usbuhci  usbuhci.sys  Tue Jul 14 03:06:27 2009 (4A5BCC03)
    fffff880`00e79000 fffff880`00e86000   vdrvroot vdrvroot.sys Tue Jul 14 03:01:31 2009 (4A5BCADB)
    fffff880`019bf000 fffff880`019cd000   vga      vga.sys      Tue Jul 14 02:38:47 2009 (4A5BC587)
    fffff880`019cd000 fffff880`019f2000   VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:38:51 2009 (4A5BC58B)
    fffff880`015c9000 fffff880`015d9000   vmstorfl vmstorfl.sys Tue Jul 14 02:42:54 2009 (4A5BC67E)
    fffff880`00d8b000 fffff880`00da0000   volmgr   volmgr.sys   Tue Jul 14 02:19:57 2009 (4A5BC11D)
    fffff880`00da0000 fffff880`00dfc000   volmgrx  volmgrx.sys  Tue Jul 14 02:20:33 2009 (4A5BC141)
    fffff880`0116a000 fffff880`011b6000   volsnap  volsnap.sys  Tue Jul 14 02:20:08 2009 (4A5BC128)
    fffff880`02d4c000 fffff880`02d67000   wanarp   wanarp.sys   Tue Jul 14 03:10:21 2009 (4A5BCCED)
    fffff880`01800000 fffff880`01810000   watchdog watchdog.sys Tue Jul 14 02:37:35 2009 (4A5BC53F)
    fffff880`00f52000 fffff880`00ff6000   Wdf01000 Wdf01000.sys Tue Jul 14 02:22:07 2009 (4A5BC19F)
    fffff880`00e00000 fffff880`00e0f000   WDFLDR   WDFLDR.SYS   Tue Jul 14 02:19:54 2009 (4A5BC11A)
    fffff880`02cf1000 fffff880`02cfa000   wfplwf   wfplwf.sys   Tue Jul 14 03:09:26 2009 (4A5BCCB6)
    fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Wed Sep 01 05:58:04 2010 (4C7DC13C)
    fffff880`00e66000 fffff880`00e6f000   WMILIB   WMILIB.SYS   Tue Jul 14 02:19:51 2009 (4A5BC117)
    fffff880`025d9000 fffff880`025fa000   WudfPf   WudfPf.sys   Tue Jul 14 03:05:37 2009 (4A5BCBD1)
    
    Unloaded modules:
    fffff880`0645d000 fffff880`0646e000   usbaapl64.sy
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`04fb7000 fffff880`04fe8000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`0646e000 fffff880`0647f000   WinUsb.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`0658f000 fffff880`06600000   spsys.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00071000
    fffff880`0658f000 fffff880`065a0000   usbaapl64.sy
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`065b1000 fffff880`065e2000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`065a0000 fffff880`065b1000   WinUsb.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`065c0000 fffff880`065d1000   usbaapl64.sy
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`0645d000 fffff880`0648e000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`065d1000 fffff880`065e2000   WinUsb.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`0645d000 fffff880`0646e000   usbaapl64.sy
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`0658f000 fffff880`065c0000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`0646e000 fffff880`0647f000   WinUsb.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`04f81000 fffff880`04f9c000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`0658f000 fffff880`06600000   spsys.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00071000
    fffff880`01985000 fffff880`019af000   cdrom.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0002A000
    fffff880`0194f000 fffff880`0195d000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000E000
    fffff880`0195d000 fffff880`01969000   dump_ataport
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000C000
    fffff880`01969000 fffff880`01972000   dump_atapi.s
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00009000
    fffff880`01972000 fffff880`01985000   dump_dumpfve
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00013000
    
    
     
  5. Sasha 789

    Sasha 789 New Member

    Joined:
    Oct 25, 2010
    Messages:
    8
    Likes Received:
    0
    Thank you. I should mention, I did run MSE previously and only switched to AVAST for the fresh install. I will try that memtest.
     
  6. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    MSE is BSOD-proof and is always recommended for the period of troubleshooting. Later if and when your system is stable, you can install any AV you want. But for now MSE please.
     
  7. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    Update those 2 drivers I listed above, and if you run memtest make sure you run it overnight.
     
  8. Sasha 789

    Sasha 789 New Member

    Joined:
    Oct 25, 2010
    Messages:
    8
    Likes Received:
    0
    OK, thanks. I'm a little hazy on how to update said drivers.

    I did find a scenario that was bringing the BSOD without fail - converting an album using dbPoweramp. Around the second track, every time, it would go BSOD - and once even just a black-screen, no-dump reboot.

    I re-installed Windows again, and the first thing I did - after installing MSE and Chrome - was reinstall dbPoweramp and convert the same album, and it went through without trouble.

    Anyway, I don't know if that indicates anything. But I'll be running the memtest all night tonight.
     
  9. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
  10. TorrentG

    TorrentG Banned

    Joined:
    May 31, 2010
    Messages:
    7,814
    Likes Received:
    372
    Here's the correct Realtek lan driver:

    RTL8111
     

Share This Page

Loading...