Windows 7 BSOD Windows 7 irql not less or equal + system service exception + kmode exception not handled

Kieranr1

New Member
Joined
Mar 19, 2011
( Dell Inspiron 545 mini tower Windows 7x64 home premium (not activated), avg installed, recent restore to factory settings)
Hi,
i guess i should explain a fair bit about how i got into this situation so skip this paragraph to see whats actually happening. it started when i installed a virus (not on purpose) on my PC when i clicked on the application the computer crashed and when it started up it went into a blue screen, so I did restore to before i installed the program and this made it worse. when the pc started up i got the classic black screen with cursor. so long story short i Restored to Dell factory image. and heres where i am now.

After the Restore my pc became unbelievably unstable with Bsod`s such as irql not less or equal and system service exception. but it would start up occasionally but crash if anything strenuous happens, so i managed to install avg and other items like itunes blue screen view e.t.c. i then updated all the drivers by right clicking on computer then manage E.t.c. this seemed to stabalize it a bit, but now when i try to install .net framework 4 it crashes about 3 minutes into the install and then does a blue screen of Irql_not less or equal (which if my memory serves me correctly is the first crash on my dmp file ill add later) and it keeps on staring up and BSODing and some times crashing on the welcome screen with the spinning blue circle and the funky back ground. So now im not sure whether to install windows updates cus people are saying they fail sometimes and i cant install .net framework, and my pc is occasionally unstable. And ill add that i have run memtest and that came up with no errors and i have also run dskchk, with no errors found and many other tests including changing ram places and removing ram and changing graphics cards. So any help will be gratly Appreciated thanks!!
P.s here are the DMP fules from the first crash from installing .net (or atleast trying to) right up to the last crash when i got bored and shut it down for a while.
 

Attachments

  • My DMP files.zip
    406 KB · Views: 347
1. Uninstall AVG


2. Install MSE Link Removed due to 404 Error


3. Update drivers:


RawDisk Driver by EldoS Corporation
elrawdsk.sys Sat Jul 26 13:59:09 2008


Realtek Audio
RTKVHD64.sys Tue Jun 02 06:15:09 2009


Realtek LAN
Rt64win7.sys Wed Jun 23 05:10:45 2010


4. If crashes reoccur, uninstall Daemon Tools



CRASH DUMPS

Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\031911-19094-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e4ee50
Debug session time: Sat Mar 19 08:14:08.709 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:25.552
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 2, 0, fffff80002ca2c06}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ca2c06, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb90e0
 0000000000000001 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c73
fffff800`02ca2c06 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  PhotoshopEleme

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88004d26610 -- (.trap 0xfffff88004d26610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88004adf3b8 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca2c06 rsp=fffff88004d267a0 rbp=0000000000000000
 r8=0000000000000000  r9=fffff88004d268a0 r10=0000000000000002
r11=fffffa80043af9e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!IopCompleteRequest+0xc73:
fffff800`02ca2c06 488b09          mov     rcx,qword ptr [rcx] ds:00000000`00000001=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c82469 to fffff80002c82f00

STACK_TEXT:  
fffff880`04d264c8 fffff800`02c82469 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`04d264d0 fffff800`02c810e0 : 00000000`00000000 fffffa80`04deb410 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`04d26610 fffff800`02ca2c06 : fffffa80`034cc060 fffff800`02c88dda 00000202`00000023 0000002b`00e1fff0 : nt!KiPageFault+0x260
fffff880`04d267a0 fffff800`02c5f92f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCompleteRequest+0xc73
fffff880`04d26870 fffff800`02c8a25d : fffffa80`034cc060 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`04d268f0 fffff800`02c8dac1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x3dd
fffff880`04d26980 fffff800`02f7b6d7 : 00000000`00000000 fffff880`04d26b20 00000000`746c6644 fffff880`04d26a88 : nt!KeRemoveQueueEx+0x301
fffff880`04d26a30 fffff800`02f3cf05 : 00000000`00000000 fffff880`04d26b28 fffff880`04d26b20 ffffe008`6712cf01 : nt!IoRemoveIoCompletion+0x47
fffff880`04d26ac0 fffff800`02c82153 : fffffa80`034cc060 00000000`0077f118 fffff880`04d26b88 00000000`00000000 : nt!NtRemoveIoCompletion+0x145
fffff880`04d26b70 00000000`74292dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0077f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74292dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02c810e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

























Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\031911-16988-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02416000 PsLoadedModuleList = 0xfffff800`02653e50
Debug session time: Sat Mar 19 08:06:29.524 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:24.382
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff800024a7c06}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800024a7c06, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800026be0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c73
fffff800`024a7c06 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  taskhost.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88004e60300 -- (.trap 0xfffff88004e60300)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88004e603b8 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800024a7c06 rsp=fffff88004e60490 rbp=0000000000000000
 r8=fffffa800347ed20  r9=fffff88004e60590 r10=0000000000000002
r11=fffffa800345fc60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc73:
fffff800`024a7c06 488b09          mov     rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002487469 to fffff80002487f00

STACK_TEXT:  
fffff880`04e601b8 fffff800`02487469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`04e601c0 fffff800`024860e0 : fffffa80`0355d0e0 fffffa80`0355d0e0 00000000`00000000 fffff880`04e603b0 : nt!KiBugCheckDispatch+0x69
fffff880`04e60300 fffff800`024a7c06 : fffffa80`035f0060 fffff800`0248ddda 00000000`00000000 fffff800`02600e01 : nt!KiPageFault+0x260
fffff880`04e60490 fffff800`0246492f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000d62 : nt!IopCompleteRequest+0xc73
fffff880`04e60560 fffff800`02429720 : fffff880`009b8180 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`04e605e0 fffff800`0243cd0e : 00000000`00000000 fffff880`009b8180 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x2b47d
fffff880`04e60650 fffff800`0248d0b4 : 00000000`00000000 fffff8a0`02c0f7a0 fffffa80`00ce3d50 fffffa80`00ce3ab0 : nt!KeFlushQueuedDpcs+0x1c2
fffff880`04e60700 fffff800`0279b194 : fffff8a0`02c0f7a0 00000000`00000000 fffffa80`035f0060 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`04e60760 fffff800`02744870 : 00000000`000000a0 fffff8a0`02c0f7a0 fffff8a0`02c8f280 00000000`000000a0 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`04e607f0 fffff800`027447e4 : 00000000`00000004 00000000`00000000 fffffa80`02955340 fffff800`0272df21 : nt!ObpCloseHandleProcedure+0x30
fffff880`04e60830 fffff800`027436ae : fffff8a0`02c91001 fffff880`04e60be0 fffffa80`02955340 fffffa80`02955401 : nt!ExSweepHandleTable+0x74
fffff880`04e60870 fffff800`0276a724 : fffff8a0`02c91060 00000000`00000000 00000000`00000000 fffffa80`02ede660 : nt!ObKillProcess+0x62
fffff880`04e608b0 fffff800`02744b3d : 00000000`00000000 fffffa80`00ce4f01 000007ff`fffd9000 00000000`00000000 : nt!PspExitThread+0x3f4
fffff880`04e60980 fffff800`02464a43 : fffffa80`0299c010 fffffa80`0299c1c8 fffff880`04e609d0 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`04e609b0 fffff800`02464e80 : 00000000`000e70d0 fffff880`04e60a30 fffff800`02745710 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`04e60a30 fffff800`024871f7 : 00000000`000002cb 00000000`00000000 00000000`00000001 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`04e60b70 00000000`772101ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`01f4ed78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772101ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`024860e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------























Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\031911-18096-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1e000 PsLoadedModuleList = 0xfffff800`02e5be50
Debug session time: Sat Mar 19 08:12:45.291 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:23.134
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cafa83}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cafa83, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec60e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02cafa83 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  PhotoshopEleme

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88004d475d0 -- (.trap 0xfffff88004d475d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88004d2b728 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cafa83 rsp=fffff88004d47760 rbp=fffff88004d478b0
 r8=fffffa8004b13d60  r9=fffff88004d47860 r10=0000000000000002
r11=fffffa8004b1b2f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`02cafa83 488b09          mov     rcx,qword ptr [rcx] ds:7878:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c8f469 to fffff80002c8ff00

STACK_TEXT:  
fffff880`04d47488 fffff800`02c8f469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`04d47490 fffff800`02c8e0e0 : fffff880`04d47738 fffffa80`0420c5b0 00000000`00000000 fffff8a0`0402b980 : nt!KiBugCheckDispatch+0x69
fffff880`04d475d0 fffff800`02cafa83 : fffffa80`0474c2c0 fffff880`04d47878 00000000`00000001 fffff880`00c4d000 : nt!KiPageFault+0x260
fffff880`04d47760 fffff800`02c6c92f : 00000000`00000001 fffff800`02cff3cc fffffa80`036ab400 00000000`00000000 : nt!IopCompleteRequest+0xae3
fffff880`04d47830 fffff800`02c6cce7 : fffff880`009b8180 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`04d478b0 fffff800`02f5b053 : 0000003f`00000100 00000000`00000000 00000000`00000202 fffff800`02c96297 : nt!KiApcInterrupt+0xd7
fffff880`04d47a40 fffff800`02c6e5b5 : fffff880`009b8180 00000000`00000000 fffff800`02f5b040 00000000`00000000 : nt!PspUserThreadStartup+0x13
fffff880`04d47aa0 fffff800`02c6e537 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`04d47be0 00000000`77473260 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`00acfcf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77473260


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02c8e0e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------





















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\031911-16255-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03406000 PsLoadedModuleList = 0xfffff800`03643e50
Debug session time: Sat Mar 19 08:04:45.572 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:24.554
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800034c3798, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!KiDpcInterruptBypass+18 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800034c3798, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiDpcInterruptBypass+18
fffff800`034c3798 c3              ret

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ae0e0
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800034b7a17 to fffff80003477f00

STACK_TEXT:  
fffff880`0277a9a8 fffff800`034b7a17 : 00000000`0000001e ffffffff`c0000005 fffff800`034c3798 00000000`00000000 : nt!KeBugCheckEx
fffff880`0277a9b0 fffff800`03477542 : fffff880`0277b188 fffff900`c00003d0 fffff880`0277b230 fffffa80`00cadb40 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`0277b050 fffff800`03475e4a : fffff880`010116e4 fffffa80`02a61fb0 fffffa80`00c396a8 fffff880`0101183a : nt!KiExceptionDispatch+0xc2
fffff880`0277b230 fffff800`034c3798 : 0050e0c2`4f000000 00000000`00000000 00000000`00000000 fffffa80`00cae040 : nt!KiGeneralProtectionFault+0x10a
fffff880`0277b3c8 0050e0c2`4f000000 : 00000000`00000000 00000000`00000000 fffffa80`00cae040 fffff800`035801ee : nt!KiDpcInterruptBypass+0x18
fffff880`0277b3d0 00000000`00000000 : 00000000`00000000 fffffa80`00cae040 fffff800`035801ee fffffa80`02ab3b60 : 0x50e0c2`4f000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDpcInterruptBypass+18
fffff800`034c3798 c3              ret

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!KiDpcInterruptBypass+18

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!KiDpcInterruptBypass+18

BUCKET_ID:  X64_0x1E_c0000005_nt!KiDpcInterruptBypass+18

Followup: MachineOwner
---------





















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\031911-24195-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c12000 PsLoadedModuleList = 0xfffff800`02e4fe50
Debug session time: Sat Mar 19 08:18:11.227 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:24.070
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002c884d8, fffff88004e3ba50, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiTryUnwaitThread+28 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002c884d8, Address of the instruction which caused the bugcheck
Arg3: fffff88004e3ba50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiTryUnwaitThread+28
fffff800`02c884d8 f0480fba6b4000  lock bts qword ptr [rbx+40h],0

CONTEXT:  fffff88004e3ba50 -- (.cxr 0xfffff88004e3ba50)
rax=fffff88004e3c3b8 rbx=5d4120c483485024 rcx=fffff80002dfce80
rdx=fffff88000ea4b7b rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c884d8 rsp=fffff88004e3c430 rbp=fffff88004e3c5e0
 r8=0000000000000100  r9=0000000000000000 r10=0000000000000002
r11=fffffa8004d7a520 r12=0000000000000000 r13=0000000000000000
r14=fffffa8004e35060 r15=fffff80002dfce80
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!KiTryUnwaitThread+0x28:
fffff800`02c884d8 f0480fba6b4000  lock bts qword ptr [rbx+40h],0 ds:002b:5d4120c4`83485064=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002c884d8

STACK_TEXT:  
fffff880`04e3c430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiTryUnwaitThread+0x28


FOLLOWUP_IP: 
nt!KiTryUnwaitThread+28
fffff800`02c884d8 f0480fba6b4000  lock bts qword ptr [rbx+40h],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiTryUnwaitThread+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff88004e3ba50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiTryUnwaitThread+28

BUCKET_ID:  X64_0x3B_nt!KiTryUnwaitThread+28

Followup: MachineOwner
---------



DRIVERS

Code:
start             end                 module name
fffff880`01038000 fffff880`0108f000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0200b000 fffff880`02095000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02e00000 fffff880`02e16000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00fef000 fffff880`00ffa000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00ea2000 fffff880`00eab000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00eab000 fffff880`00ed5000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`02e3c000 fffff880`03452000   atikmdag atikmdag.sys Sun Jun 14 22:41:39 2009 (4A35B4E3)
fffff880`02d00000 fffff880`02d4e000   atikmpag atikmpag.sys Wed Jan 26 17:13:33 2011 (4D409C8D)
fffff960`00980000 fffff960`009e1000   ATMFD    ATMFD.DLL    Mon Jul 13 19:38:13 2009 (4A5BC565)
fffff880`015c7000 fffff880`015d1000   AVGIDSEH AVGIDSEH.Sys Mon Sep 13 18:46:38 2010 (4C8EA9CE)
fffff880`0259b000 fffff880`025eb000   avgldx64 avgldx64.sys Tue Dec 07 21:01:55 2010 (4CFEE713)
fffff880`0122a000 fffff880`01239000   avgmfx64 avgmfx64.sys Mon Sep 06 20:49:14 2010 (4C858C0A)
fffff880`017ed000 fffff880`017f7000   avgrkx64 avgrkx64.sys Mon Sep 06 20:49:37 2010 (4C858C21)
fffff880`024f5000 fffff880`02556000   avgtdia  avgtdia.sys  Fri Nov 12 06:08:42 2010 (4CDD203A)
fffff880`014ba000 fffff880`014c1000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`021b7000 fffff880`021c8000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`04a00000 fffff880`04a1e000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00730000 fffff960`00757000   cdd      cdd.dll      unavailable (00000000)
fffff880`01200000 fffff880`0122a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0148a000 fffff880`014ba000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d26000 fffff880`00d84000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01539000 fffff880`015ac000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`035db000 fffff880`035eb000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`039ed000 fffff880`039fb000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02199000 fffff880`021b7000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`0218a000 fffff880`02199000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01474000 fffff880`0148a000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`03734000 fffff880`03756000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`0380c000 fffff880`03815000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`03800000 fffff880`0380c000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`03815000 fffff880`03828000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`0375c000 fffff880`03768000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`03452000 fffff880`03546000   dxgkrnl  dxgkrnl.sys  Mon Jul 13 19:38:56 2009 (4A5BC590)
fffff880`03546000 fffff880`0358c000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`02180000 fffff880`0218a000   elrawdsk elrawdsk.sys Sat Jul 26 13:59:09 2008 (488B65ED)
fffff880`00dd0000 fffff880`00de4000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`00d84000 fffff880`00dd0000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`015bd000 fffff880`015c7000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`0143a000 fffff880`01474000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`02480000 fffff880`024ca000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`035ce000 fffff880`035db000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`031ef000 fffff800`03238000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`0358c000 fffff880`035b0000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`0369b000 fffff880`036f7000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`037ae000 fffff880`037c7000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`037c7000 fffff880`037cf080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`037a0000 fffff880`037ae000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`04b29000 fffff880`04bf1000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01691000 fffff880`0169a000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`02cea000 fffff880`02d00000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`02c85000 fffff880`02c94000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`037d0000 fffff880`037de000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`02a7a000 fffff800`02a7d000   kdcom    kdcom.dll    Thu Feb 17 06:33:32 2011 (4D5D078C)
fffff880`02ca3000 fffff880`02ce6000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`0151f000 fffff880`01539000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01600000 fffff880`0162b000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`03756000 fffff880`0375b200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04a96000 fffff880`04aab000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03600000 fffff880`03623000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cce000 fffff880`00d12000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`037eb000 fffff880`037f9000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`02c94000 fffff880`02ca3000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`037de000 fffff880`037eb000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00e88000 fffff880`00ea2000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04a1e000 fffff880`04a36000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`04a36000 fffff880`04a62000   mrxsmb   mrxsmb.sys   Mon Jul 13 19:23:59 2009 (4A5BC20F)
fffff880`050eb000 fffff880`05138000   mrxsmb10 mrxsmb10.sys Mon Jul 13 19:24:08 2009 (4A5BC218)
fffff880`05138000 fffff880`0515b000   mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`02464000 fffff880`0246f000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f90000 fffff880`00f9a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`014c1000 fffff880`0151f000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02175000 fffff880`02180000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`0167f000 fffff880`01691000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`0169b000 fffff880`0178d000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`035eb000 fffff880`035f7000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`04afe000 fffff880`04b11000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`02c00000 fffff880`02c2f000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03686000 fffff880`0369b000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`020da000 fffff880`020e9000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02556000 fffff880`0259b000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0178d000 fffff880`017ed000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0246f000 fffff880`02480000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02169000 fffff880`02175000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02c12000 fffff800`031ef000   nt       ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`0125d000 fffff880`01400000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01239000 fffff880`01242000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04aab000 fffff880`04afe000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`0209e000 fffff880`020c4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00fda000 fffff880`00fef000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00fa7000 fffff880`00fda000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00e71000 fffff880`00e78000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e78000 fffff880`00e88000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`015ac000 fffff880`015bd000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`036f7000 fffff880`03734000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00d12000 fffff880`00d26000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`00de4000 fffff880`00defe00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`02e16000 fffff880`02e3a000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`02c2f000 fffff880`02c4a000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`02c4a000 fffff880`02c6b000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`02c6b000 fffff880`02c85000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02118000 fffff880`02169000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`02449000 fffff880`02452000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02452000 fffff880`0245b000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0245b000 fffff880`02464000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01400000 fffff880`0143a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`04b11000 fffff880`04b29000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`02da4000 fffff880`02dfa000   Rt64win7 Rt64win7.sys Wed Jun 23 05:10:45 2010 (4C21CF95)
fffff880`0383f000 fffff880`039ecc00   RTKVHD64 RTKVHD64.sys Tue Jun 02 06:15:09 2009 (4A24FBAD)
fffff880`01009000 fffff880`01038000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`01677000 fffff880`0167f000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`01094000 fffff880`011fa000   sptd     sptd.sys     Tue Jan 11 16:40:26 2011 (4D2CCE4A)
fffff880`035f7000 fffff880`035f8480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`02801000 fffff880`029fe000   tcpip    tcpip.sys    Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`024e8000 fffff880`024f5000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`024ca000 fffff880`024e8000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02104000 fffff880`02118000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`021c8000 fffff880`021ee000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`021ee000 fffff880`02200000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`03828000 fffff880`03839000   usbaapl64 usbaapl64.sys Fri Feb 11 13:13:08 2011 (4D557C34)
fffff880`03783000 fffff880`037a0000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`03839000 fffff880`0383af00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`035bd000 fffff880`035ce000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0362c000 fffff880`03686000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`02d4e000 fffff880`02da4000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`03768000 fffff880`03783000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`035b0000 fffff880`035bd000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00f9a000 fffff880`00fa7000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01242000 fffff880`01250000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`02414000 fffff880`02439000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00e00000 fffff880`00e15000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e15000 fffff880`00e71000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`0162b000 fffff880`01677000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`020c4000 fffff880`020da000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`020e9000 fffff880`02104000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`02439000 fffff880`02449000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00edd000 fffff880`00f81000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f81000 fffff880`00f90000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02095000 fffff880`0209e000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00060000 fffff960`0036f000   win32k   win32k.sys   Mon Jul 13 19:40:16 2009 (4A5BC5E0)
fffff880`025eb000 fffff880`025fc000   WinUsb   WinUsb.sys   Mon Jul 13 20:06:28 2009 (4A5BCC04)
fffff880`01000000 fffff880`01009000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`015d1000 fffff880`015f2000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`04a65000 fffff880`04a96000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`03600000 fffff880`03611000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`04489000 fffff880`044ba000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`015d1000 fffff880`015df000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`015df000 fffff880`015eb000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`017f7000 fffff880`01800000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`015eb000 fffff880`015fe000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
 
Back
Top Bottom