Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\Temp\Rar$DI00.156\091210-17484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c50000 PsLoadedModuleList = 0x82d98810
Debug session time: Sat Sep 11 23:08:04.594 2010 (UTC - 4:00)
System Uptime: 0 days 5:59:28.356
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.........
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: a9eb46b8
Arg3: a9eb4290
Arg4: 83b0c804
Debugging Details:
------------------
EXCEPTION_RECORD: a9eb46b8 -- (.exr 0xffffffffa9eb46b8)
ExceptionAddress: 83b0c804 (Ntfs!TxfMoveAttrToDifferentFile+0x00000030)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: a9eb4290 -- (.cxr 0xffffffffa9eb4290)
eax=0000008f ebx=00000000 ecx=00000000 edx=a9eb499c esi=8faa15e8 edi=00000000
eip=83b0c804 esp=a9eb4780 ebp=a9eb4800 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!TxfMoveAttrToDifferentFile+0x30:
83b0c804 c6 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x24
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
LAST_CONTROL_TRANSFER: from 83b0e20d to 83b0c804
STACK_TEXT:
a9eb4800 83b0e20d 85e7eac0 92acc578 b2b9cc88 Ntfs!TxfMoveAttrToDifferentFile+0x30
a9eb487c 83b0eed0 85e7eac0 92acc578 92acc668 Ntfs!TxfMoveAttrInternal+0x88
a9eb48e4 83a573ba 92acc668 9ef63978 92acc578 Ntfs!TxfCreateBackupAttr+0x176
a9eb4974 83aa6194 85e7eac0 00acc668 a9eb499c Ntfs!TxfOverwriteAttribute+0x1c9
a9eb4a0c 83abd19c 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOverwriteAttr+0x60e
a9eb4af4 83abd677 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOpenAttributeInExistingFile+0x729
a9eb4ba0 83abca2d 85e7eac0 85e5e620 92acc810 Ntfs!NtfsOpenExistingPrefixFcb+0x26e
a9eb4c00 83abec5c 85e7eac0 85e5e620 8c9be4c0 Ntfs!NtfsFindStartingNode+0xb88
a9eb4cdc 83a45210 85e7eac0 85e5e620 a4f1b944 Ntfs!NtfsCommonCreate+0x65f
a9eb4d1c 82cc011e a4f1b8dc 00000000 ffffffff Ntfs!NtfsCommonCreateCallout+0x20
a9eb4d1c 82cc0215 a4f1b8dc 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x15a
a4f1b840 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
83b0c801 - Ntfs!TxfMoveAttrToDifferentFile+2d
[ 46:44 ]
1 error : !Ntfs (83b0c801)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xffffffffa9eb4290 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------