Random Crashes BSOD Win 7

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by PhotographicaUK, Mar 20, 2011.

  1. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    caches.JPG Memory .JPG Memory Slot 2.JPG Mainboard.JPG Memory Slot 1.JPG memory slot 4.JPG Memory slot 3.JPG Graphics.JPG CPU.JPG

    Hello all,

    I have a randon BSOD crash problem that is driving me mad, I hope you can help.

    My PC is a self build with the components in the Jpegs above. The case is a CoolerMaster HAF and the powersupply is a modular 900w.

    The BSODs occur at apparently random intervals and the system can be fine for days with no problems. the BSODs occur even when the PC is idle, having just booted up and no user activity has taken place.

    The most recent crash was typical; the pc was switched on and left to start up, windows loaded and was idle, the PC BSOD'd and restarted, then BSOD'd again, eventually windows start up repair kicked in and was unable to repair. I switched off PC (no power) switched it back on again and windows loaded fine (although when this happens I have to tell Avira Firewall what applications it can trust again - not sure if that is a red herring).

    I have asked a local supplier to analyse the PC for faults (Novatech - charged for of course) they had it for a week and could find nothing saying it did not crash). It sometimes does not crash for several weeks!



    Things I have tried;
    • I have swapped the Graphics card (was an ATI 5870, now is an nvidia GTX570)
    • I ran memtest86 for 15 hours and it did not detect any errors.
    • I ran a similar test for the graphics card memory for 6-7 hours and again no errors were found.
    • I changed from AVG2011 to Avira in case it was that.
    I have attached a zip file with the latest series of crash dump files in the hope that someone can spot something, unfortunately they are beyond my experience level to understand...

    I would be very grateful if someone could take a look and give me a pointer as to what to try next.

    Thanks
     

    Attached Files:

    #1 PhotographicaUK, Mar 20, 2011
    Last edited: Mar 20, 2011
  2. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    Welcome to windows7forums. :)



    You attached more information that I ever dreamt of to have for analysis. :)


    1. RAM: 4 identical Corsair sticks rated 1333Mhz 9-9-9-24 1.5v. Your current settings are 1316Mhz 9-9-9-24 which is wrong and that's why you're getting memory_corruption in some of your crash dumps. You need to set it 1333Mhz to have it work smooth.




    2. Update drivers:


    Wacom Mouse
    wacommousefilter.sys Fri Feb 16 13:12:17 2007


    Realtek Audio
    RTKVHD64.sys Tue Nov 03 06:39:55 2009


    Realtek LAN
    Rt64win7.sys Fri May 22 10:52:30 2009


    Motherboard USB 3.0 Controller
    nusb3hub.sys Mon Oct 26 10:19:44 2009
    nusb3xhc.sys Mon Oct 26 10:19:48 2009

    Marvell (SATA Controller)
    mv61xx.sys Wed Aug 05 23:20:12 2009



    Intel Management Engine Interface
    HECIx64.sys Thu Sep 17 15:54:16 2009


    3. Update or better uninstall for now,


    RemotelyAnywhere
    RaInfo.sys Fri Jan 04 13:57:14 2008


    LogMeIn
    lmimirr.sys Tue Apr 10 18:32:45 2007






    4. Should crashes persist, I would also recommend to replce Avira with MSE for as long as you're having blue screens.








    CRASH DUMPS

    Code:
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\032011-34881-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c0c000 PsLoadedModuleList = 0xfffff800`03e49e50
    Debug session time: Sun Mar 20 05:19:05.781 2011 (UTC - 4:00)
    System Uptime: 0 days 0:01:19.843
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff96000311897, fffff88008685730, 0}
    
    Probably caused by : win32k.sys ( win32k!BmfdQueryAdvanceWidthsTE+3f )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff96000311897, Address of the instruction which caused the bugcheck
    Arg3: fffff88008685730, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    win32k!BmfdQueryAdvanceWidthsTE+3f
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]
    
    CONTEXT:  fffff88008685730 -- (.cxr 0xfffff88008685730)
    rax=fffff88008686158 rbx=00000000ffffffff rcx=fffef900c0d5b020
    rdx=fffff88008686138 rsi=fffff900c08dcca0 rdi=fffff900c08dccb8
    rip=fffff96000311897 rsp=fffff88008686100 rbp=0000000000000001
     r8=fffff88008686160  r9=0000000000000001 r10=0000000000000008
    r11=fffff80003e7cb60 r12=fffff88008686220 r13=0000000000000001
    r14=0000000000000001 r15=fffff900c0081000
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    win32k!BmfdQueryAdvanceWidthsTE+0x3f:
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h] ds:002b:fffef900`c0d5b030=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000311897
    
    STACK_TEXT:  
    fffff880`08686100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!BmfdQueryAdvanceWidthsTE+0x3f
    
    
    FOLLOWUP_IP: 
    win32k!BmfdQueryAdvanceWidthsTE+3f
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  win32k!BmfdQueryAdvanceWidthsTE+3f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME:  win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d23ecb0
    
    STACK_COMMAND:  .cxr 0xfffff88008685730 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f
    
    BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\032011-28750-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c4a000 PsLoadedModuleList = 0xfffff800`03e87e50
    Debug session time: Sun Mar 20 05:28:53.459 2011 (UTC - 4:00)
    System Uptime: 0 days 0:05:41.911
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    ...
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff800040317f1, fffff88008bca0f0, 0}
    
    Probably caused by : ntkrnlmp.exe ( nt!AuthzBasepRemoveSecurityAttributeFromLists+31 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800040317f1, Address of the instruction which caused the bugcheck
    Arg3: fffff88008bca0f0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    nt!AuthzBasepRemoveSecurityAttributeFromLists+31
    fffff800`040317f1 f6423801        test    byte ptr [rdx+38h],1
    
    CONTEXT:  fffff88008bca0f0 -- (.cxr 0xfffff88008bca0f0)
    rax=00000000000000c8 rbx=fffef8a005e1fcf8 rcx=fffff8a005e1fcf0
    rdx=fffef8a005e1fcf8 rsi=fffff8a005e1fcf8 rdi=fffff8a005f88060
    rip=fffff800040317f1 rsp=fffff88008bcaac8 rbp=fffff8a005e1fcf0
     r8=0000000000000001  r9=0000000000000000 r10=fffff8a005e1fcf0
    r11=00000000001f0001 r12=0000000000000000 r13=0000000000000001
    r14=0000000001a4f550 r15=0000000000000001
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    nt!AuthzBasepRemoveSecurityAttributeFromLists+0x31:
    fffff800`040317f1 f6423801        test    byte ptr [rdx+38h],1 ds:002b:fffef8a0`05e1fd30=??
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  wmpnetwk.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff80003feb8c3 to fffff800040317f1
    
    STACK_TEXT:  
    fffff880`08bcaac8 fffff800`03feb8c3 : fffff8a0`05e849e0 fffff800`03def2dd fffffa80`066a0a20 00000000`00000000 : nt!AuthzBasepRemoveSecurityAttributeFromLists+0x31
    fffff880`08bcaad0 fffff800`03cbf8b4 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`066a0a20 : nt! ?? ::NNGAKEGL::`string'+0x101c5
    fffff880`08bcab00 fffff800`03fa569e : 00000000`00000000 fffff8a0`05d1bd40 fffff8a0`05d1bd20 00000000`00000001 : nt!ObfDereferenceObject+0xd4
    fffff880`08bcab60 fffff800`03fb9d68 : fffff8a0`05d1bd20 00000000`00000001 fffffa80`06e5e910 00000000`ffffffff : nt!AlpcpSecurityDestroyProcedure+0x10e
    fffff880`08bcab90 fffff800`03f55cfd : fffff8a0`05d1bd40 fffffa80`06e5e910 fffffa80`06e5e910 00000000`00000000 : nt!AlpcpDestroyBlob+0x28
    fffff880`08bcabc0 fffff800`03cb9993 : fffffa80`06c7fb60 fffff880`08bcaca0 00000000`01a4f660 fffffa80`06e5e910 : nt!NtAlpcDeleteSecurityContext+0xdd
    fffff880`08bcac20 00000000`779afe8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`01a4f4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779afe8a
    
    
    FOLLOWUP_IP: 
    nt!AuthzBasepRemoveSecurityAttributeFromLists+31
    fffff800`040317f1 f6423801        test    byte ptr [rdx+38h],1
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!AuthzBasepRemoveSecurityAttributeFromLists+31
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd
    
    STACK_COMMAND:  .cxr 0xfffff88008bca0f0 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x3B_nt!AuthzBasepRemoveSecurityAttributeFromLists+31
    
    BUCKET_ID:  X64_0x3B_nt!AuthzBasepRemoveSecurityAttributeFromLists+31
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\031311-45645-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03811000 PsLoadedModuleList = 0xfffff800`03a4ee50
    Debug session time: Sun Mar 13 11:23:55.216 2011 (UTC - 4:00)
    System Uptime: 0 days 0:17:09.668
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    ........
    Loading User Symbols
    Loading unloaded module list
    ...................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff88001050e99, fffff880097bab60, 0}
    
    Probably caused by : Npfs.SYS ( Npfs!NpCreateClientEnd+45d )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff88001050e99, Address of the instruction which caused the bugcheck
    Arg3: fffff880097bab60, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    Npfs!NpCreateClientEnd+45d
    fffff880`01050e99 488b01          mov     rax,qword ptr [rcx]
    
    CONTEXT:  fffff880097bab60 -- (.cxr 0xfffff880097bab60)
    rax=fffff8a001188a08 rbx=0000000000000001 rcx=fffefa800b2c9d68
    rdx=fffff8a002ca6cf8 rsi=fffff8a002ca6c50 rdi=fffff880097bb700
    rip=fffff88001050e99 rsp=fffff880097bb530 rbp=0000000000000004
     r8=fffff880097bb690  r9=0000000000000000 r10=fffff800039fd480
    r11=fffff8a00314e188 r12=0000000000000000 r13=0000000000000000
    r14=fffffa800ad59340 r15=fffff8a0011889a0
    iopl=0         nv up ei ng nz na pe cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
    Npfs!NpCreateClientEnd+0x45d:
    fffff880`01050e99 488b01          mov     rax,qword ptr [rcx] ds:002b:fffefa80`0b2c9d68=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  wmpnetwk.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88001050e99
    
    STACK_TEXT:  
    fffff880`097bb530 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Npfs!NpCreateClientEnd+0x45d
    
    
    FOLLOWUP_IP: 
    Npfs!NpCreateClientEnd+45d
    fffff880`01050e99 488b01          mov     rax,qword ptr [rcx]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  Npfs!NpCreateClientEnd+45d
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Npfs
    
    IMAGE_NAME:  Npfs.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc114
    
    STACK_COMMAND:  .cxr 0xfffff880097bab60 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x3B_Npfs!NpCreateClientEnd+45d
    
    BUCKET_ID:  X64_0x3B_Npfs!NpCreateClientEnd+45d
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\032011-33056-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c1e000 PsLoadedModuleList = 0xfffff800`03e5be50
    Debug session time: Sun Mar 20 05:00:31.949 2011 (UTC - 4:00)
    System Uptime: 0 days 0:25:03.379
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    ....
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 24, {1904fb, fffff88009eec8d8, fffff88009eec140, fffff880012b9660}
    
    Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+1a0 )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff88009eec8d8
    Arg3: fffff88009eec140
    Arg4: fffff880012b9660
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_RECORD:  fffff88009eec8d8 -- (.exr 0xfffff88009eec8d8)
    ExceptionAddress: fffff880012b9660 (Ntfs!NtfsCommonClose+0x00000000000001a0)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    CONTEXT:  fffff88009eec140 -- (.cxr 0xfffff88009eec140)
    rax=fffef8a00c4c6990 rbx=fffffa80085aec40 rcx=fffffa80085aec88
    rdx=fffff8a00c4c67a0 rsi=fffff8a00c4c6670 rdi=fffff88009eecc38
    rip=fffff880012b9660 rsp=fffff88009eecb10 rbp=fffff80003e335a0
     r8=0000000000000000  r9=0000000000000009 r10=0000000000000004
    r11=fffffa80081c78b0 r12=fffffa80081c7180 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000001
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    Ntfs!NtfsCommonClose+0x1a0:
    fffff880`012b9660 f6400804        test    byte ptr [rax+8],4 ds:002b:fffef8a0`0c4c6998=??
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ec60e0
     ffffffffffffffff 
    
    FOLLOWUP_IP: 
    Ntfs!NtfsCommonClose+1a0
    fffff880`012b9660 f6400804        test    byte ptr [rax+8],4
    
    FAULTING_IP: 
    Ntfs!NtfsCommonClose+1a0
    fffff880`012b9660 f6400804        test    byte ptr [rax+8],4
    
    BUGCHECK_STR:  0x24
    
    LAST_CONTROL_TRANSFER:  from fffff8800129338f to fffff880012b9660
    
    STACK_TEXT:  
    fffff880`09eecb10 fffff880`0129338f : fffffa80`085aec40 fffff8a0`0c4c67a0 fffff8a0`0c4c6670 fffffa80`081c7180 : Ntfs!NtfsCommonClose+0x1a0
    fffff880`09eecbe0 fffff800`03c9b961 : 00000000`00000000 fffff880`01892500 fffffa80`0ae85f01 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
    fffff880`09eeccb0 fffff800`03f317c6 : 00000000`1167b07b fffffa80`0b85a660 00000000`00000080 fffffa80`067215f0 : nt!ExpWorkerThread+0x111
    fffff880`09eecd40 fffff800`03c6cc26 : fffff880`02fd5180 fffffa80`0b85a660 fffffa80`06741b60 fffff880`0121d534 : nt!PspSystemThreadStartup+0x5a
    fffff880`09eecd80 00000000`00000000 : fffff880`09eed000 fffff880`09ee7000 fffff880`09eec700 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  Ntfs!NtfsCommonClose+1a0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f
    
    STACK_COMMAND:  .cxr 0xfffff88009eec140 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1a0
    
    BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1a0
    
    Followup: MachineOwner
    ---------
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\032011-30076-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c0a000 PsLoadedModuleList = 0xfffff800`03e47e50
    Debug session time: Sun Mar 20 05:21:33.097 2011 (UTC - 4:00)
    System Uptime: 0 days 0:00:48.158
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c000001d, fffff96000149d9d, fffff8800602d510, 0}
    
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c000001d, Exception code that caused the bugcheck
    Arg2: fffff96000149d9d, Address of the instruction which caused the bugcheck
    Arg3: fffff8800602d510, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.
    
    FAULTING_IP: 
    win32k!xxxCreateWindowSmIcon+7d
    fffff960`00149d9d 4c              ???
    
    CONTEXT:  fffff8800602d510 -- (.cxr 0xfffff8800602d510)
    rax=fffff900c0581414 rbx=0000000000000000 rcx=fffff900c0580a70
    rdx=00000000fffffffe rsi=fffff900c0c08670 rdi=0000000000000000
    rip=fffff96000149d9d rsp=fffff8800602dee0 rbp=fffff900c00e3b40
     r8=fffff900c0581290  r9=0000000000004000 r10=0000000000000003
    r11=0000000000000003 r12=0000000000000001 r13=0000000000000005
    r14=0000000000000000 r15=0000000000010027
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
    win32k!xxxCreateWindowSmIcon+0x7d:
    fffff960`00149d9d 4c              ???
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  AsLoader.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff96000149cd0 to fffff96000149d9d
    
    STACK_TEXT:  
    fffff880`0602dee0 fffff960`00149cd0 : 00000000`00000000 fffff900`c0c08670 00000000`00000001 00000000`00000000 : win32k!xxxCreateWindowSmIcon+0x7d
    fffff880`0602df20 fffff960`00179e34 : 00000000`00000002 fffff900`c0c08670 00000000`00000001 00000000`00000000 : win32k!xxxDWP_SetIcon+0x1a0
    fffff880`0602df70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!xxxRealDefWindowProc+0xa7c
    
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
        fffff96000149d9e - win32k!xxxCreateWindowSmIcon+7e
        [ 0f:0e ]
    1 error : !win32k (fffff96000149d9e)
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MEMORY_CORRUPTOR:  ONE_BIT
    
    STACK_COMMAND:  .cxr 0xfffff8800602d510 ; kb
    
    FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
    
    BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT
    
    Followup: memory_corruption
    ---------
    
    
    
    


    DRIVERS

    Code:
    start             end                 module name
    fffff880`041c1000 fffff880`041ff000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
    fffff880`00f30000 fffff880`00f87000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
    fffff880`02cfd000 fffff880`02d87000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
    fffff880`048b2000 fffff880`048c8000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
    fffff880`0111e000 fffff880`01129000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
    fffff880`04014000 fffff880`04037000   AnyDVD   AnyDVD.sys   Wed Dec 01 14:06:20 2010 (4CF69CAC)
    fffff880`04000000 fffff880`04008000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
    fffff880`03bf5000 fffff880`03bfb000   AsIO     AsIO.sys     Mon Aug 03 03:03:16 2009 (4A768BB4)
    fffff880`00d92000 fffff880`00d9b000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`00d9b000 fffff880`00dc5000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
    fffff880`10d36000 fffff880`10d85000   atksgt   atksgt.sys   Sun May 17 09:36:34 2009 (4A1012E2)
    fffff960`00a70000 fffff960`00ad1000   ATMFD    ATMFD.DLL    Fri Jan 07 00:49:20 2011 (4D26A960)
    fffff880`01073000 fffff880`0108e000   avfwim   avfwim.sys   Mon Feb 15 05:30:26 2010 (4B792242)
    fffff880`02cd9000 fffff880`02cfd000   avfwot   avfwot.sys   Wed Apr 14 04:46:47 2010 (4BC580F7)
    fffff880`058aa000 fffff880`058c7000   avgntflt avgntflt.sys Thu Nov 11 10:59:48 2010 (4CDC12F4)
    fffff880`03bd3000 fffff880`03bf5000   avipbb   avipbb.sys   Mon Feb 22 05:08:50 2010 (4B8257B2)
    fffff880`018af000 fffff880`018b6000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
    fffff880`03bc2000 fffff880`03bd3000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
    fffff880`04a00000 fffff880`04a1e000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
    fffff880`0187c000 fffff880`018a6000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
    fffff880`04833000 fffff880`04845000   circlass circlass.sys Mon Jul 13 20:06:34 2009 (4A5BCC0A)
    fffff880`01816000 fffff880`01846000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
    fffff880`00d1a000 fffff880`00d78000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
    fffff880`10c09000 fffff880`10c19000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`05c00000 fffff880`05c0e000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
    fffff880`03b21000 fffff880`03ba4000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
    fffff880`059b1000 fffff880`059e6000   CT20XUT  CT20XUT.SYS  Wed May 05 09:01:28 2010 (4BE16C28)
    fffff880`058e8000 fffff880`05996000   ctac32k  ctac32k.sys  Wed Jul 02 04:38:22 2008 (486B3E7E)
    fffff880`0403a000 fffff880`040df700   ctaud2k  ctaud2k.sys  Wed May 05 08:59:48 2010 (4BE16BC4)
    fffff880`05c73000 fffff880`05dd0000   CTEXFIFX CTEXFIFX.SYS Wed May 05 09:01:21 2010 (4BE16C21)
    fffff880`05996000 fffff880`059b1000   CTHWIUT  CTHWIUT.SYS  Wed May 05 09:01:32 2010 (4BE16C2C)
    fffff880`04182000 fffff880`041b3000   ctoss2k  ctoss2k.sys  Wed May 05 08:57:46 2010 (4BE16B4A)
    fffff880`041b3000 fffff880`041bb000   ctprxy2k ctprxy2k.sys Wed May 05 08:59:51 2010 (4BE16BC7)
    fffff880`057c1000 fffff880`057f9000   ctsfm2k  ctsfm2k.sys  Wed May 05 08:57:33 2010 (4BE16B3D)
    fffff880`03ba4000 fffff880`03bc2000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
    fffff880`03b12000 fffff880`03b21000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
    fffff880`01800000 fffff880`01816000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`0411d000 fffff880`0413f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
    fffff880`05c1a000 fffff880`05c23000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`05c0e000 fffff880`05c1a000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`05c23000 fffff880`05c36000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
    fffff880`05e00000 fffff880`05e0c000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
    fffff960`004d0000 fffff960`004ee000   dxg      dxg.sys      Mon Jul 13 19:38:28 2009 (4A5BC574)
    fffff880`11880000 fffff880`11974000   dxgkrnl  dxgkrnl.sys  Tue Jan 25 23:22:56 2011 (4D3FA1A0)
    fffff880`03b06000 fffff880`03b12000   ElbyCDIO ElbyCDIO.sys Thu Dec 16 17:58:13 2010 (4D0A9985)
    fffff880`04b44000 fffff880`04b8e000   emupia2k emupia2k.sys Wed May 05 08:57:27 2010 (4BE16B37)
    fffff880`01175000 fffff880`01189000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
    fffff880`01129000 fffff880`01175000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
    fffff960`009b0000 fffff960`009b9000   framebuf framebuf.dll Mon Jul 13 19:38:47 2009 (4A5BC587)
    fffff880`013ec000 fffff880`013f6000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
    fffff880`019bb000 fffff880`019f5000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
    fffff880`018b8000 fffff880`01902000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
    fffff880`119eb000 fffff880`119f8000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
    fffff880`05640000 fffff880`057c1000   ha20x2k  ha20x2k.sys  Wed May 05 08:59:10 2010 (4BE16B9E)
    fffff800`041e7000 fffff800`04230000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
    fffff880`11974000 fffff880`11998000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
    fffff880`11998000 fffff880`119a9000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
    fffff880`0108e000 fffff880`010a7000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
    fffff880`03a92000 fffff880`03a9a080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
    fffff880`059e6000 fffff880`059f4000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
    fffff880`10c20000 fffff880`10ce8000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
    fffff880`019b2000 fffff880`019bb000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
    fffff880`03a26000 fffff880`03a3c000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
    fffff880`04988000 fffff880`04997000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`05800000 fffff880`0580e000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
    fffff800`00bbc000 fffff800`00bc6000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
    fffff880`0413f000 fffff880`04182000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
    fffff880`013c1000 fffff880`013db000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
    fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
    fffff880`041bb000 fffff880`041c0200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
    fffff880`04845000 fffff880`04848d80   LGBusEnum LGBusEnum.sys Mon Nov 23 20:36:48 2009 (4B0B38B0)
    fffff880`05600000 fffff880`05615000   LHidFilt LHidFilt.Sys Thu Mar 18 04:51:17 2010 (4BA1E985)
    fffff880`04a86000 fffff880`04a93000   lirsgt   lirsgt.sys   Sun May 17 09:06:57 2009 (4A100BF1)
    fffff880`04bcd000 fffff880`04be2000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`10c19000 fffff880`10c20000   lmimirr  lmimirr.sys  Tue Apr 10 18:32:45 2007 (461C108D)
    fffff880`05615000 fffff880`05629000   LMouFilt LMouFilt.Sys Thu Mar 18 04:51:24 2010 (4BA1E98C)
    fffff880`05887000 fffff880`058aa000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
    fffff880`00cc2000 fffff880`00d06000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
    fffff880`04997000 fffff880`049a6000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`04b1a000 fffff880`04b27000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
    fffff880`00d78000 fffff880`00d92000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`04a1e000 fffff880`04a36000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
    fffff880`04a36000 fffff880`04a63000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
    fffff880`10ce8000 fffff880`10d36000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
    fffff880`04a63000 fffff880`04a86000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
    fffff880`015d7000 fffff880`015e2000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`00f90000 fffff880`00f9a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
    fffff880`01195000 fffff880`011f3000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
    fffff880`03afb000 fffff880`03b06000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
    fffff880`019a0000 fffff880`019b2000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
    fffff880`010a8000 fffff880`010ef000   mv61xx   mv61xx.sys   Wed Aug 05 23:20:12 2009 (4A7A4BEC)
    fffff880`014d3000 fffff880`015c5000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
    fffff880`048ec000 fffff880`048f8000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
    fffff880`048f8000 fffff880`04927000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
    fffff880`04b2f000 fffff880`04b44000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
    fffff880`02dd5000 fffff880`02de4000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff880`02c94000 fffff880`02cd9000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
    fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
    fffff880`015e2000 fffff880`015f3000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`03aef000 fffff880`03afb000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
    fffff800`03c0a000 fffff800`041e7000   nt       ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD)
    fffff880`0121e000 fffff880`013c1000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
    fffff880`018a6000 fffff880`018af000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
    fffff880`04b03000 fffff880`04b1a000   nusb3hub nusb3hub.sys Mon Oct 26 10:19:44 2009 (4AE5B000)
    fffff880`119ba000 fffff880`119e9000   nusb3xhc nusb3xhc.sys Mon Oct 26 10:19:48 2009 (4AE5B004)
    fffff880`1187e000 fffff880`1187f180   nvBridge nvBridge.kmd Fri Jan 07 20:57:22 2011 (4D27C482)
    fffff880`05dd0000 fffff880`05df9000   nvhda64v nvhda64v.sys Thu Nov 11 18:10:36 2010 (4CDC77EC)
    fffff880`05831000 fffff880`0583e000   nx6000   nx6000.sys   Thu Dec 02 17:23:39 2010 (4CF81C6B)
    fffff880`02d9b000 fffff880`02dc1000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
    fffff880`00fda000 fffff880`00fef000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
    fffff880`00f9a000 fffff880`00fcd000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`00e71000 fffff880`00e78000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
    fffff880`00fef000 fffff880`00fff000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`013db000 fffff880`013ec000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
    fffff880`040e0000 fffff880`0411d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
    fffff880`00d06000 fffff880`00d1a000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
    fffff880`01189000 fffff880`01194e00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
    fffff880`05df9000 fffff880`05e00000   RaInfo   RaInfo.sys   Fri Jan 04 13:57:14 2008 (477E818A)
    fffff880`048c8000 fffff880`048ec000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
    fffff880`04927000 fffff880`04942000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
    fffff880`04942000 fffff880`04963000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
    fffff880`04963000 fffff880`0497d000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
    fffff880`03a9e000 fffff880`03aef000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
    fffff880`0497d000 fffff880`04988000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
    fffff880`019f5000 fffff880`019fe000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`015c5000 fffff880`015ce000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`015ce000 fffff880`015d7000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
    fffff880`01966000 fffff880`019a0000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
    fffff880`04be2000 fffff880`04bfa000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`00dc5000 fffff880`00dfe000   Rt64win7 Rt64win7.sys Fri May 22 10:52:30 2009 (4A16BC2E)
    fffff880`05e0d000 fffff880`05ff9780   RTKVHD64 RTKVHD64.sys Tue Nov 03 06:39:55 2009 (4AF0168B)
    fffff880`04bbf000 fffff880`04bcd000   scfilter scfilter.sys Mon Jul 13 19:50:17 2009 (4A5BC839)
    fffff880`010ef000 fffff880`0111e000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
    fffff880`04008000 fffff880`04014000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`02c00000 fffff880`02c1d000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
    fffff880`0195e000 fffff880`01966000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
    fffff880`04831000 fffff880`04832480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
    fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
    fffff880`015f3000 fffff880`01600000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
    fffff880`01200000 fffff880`0121e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
    fffff880`02de4000 fffff880`02df8000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
    fffff960`00730000 fffff960`0073a000   TSDDD    TSDDD.dll    unavailable (00000000)
    fffff880`03a00000 fffff880`03a26000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
    fffff880`04860000 fffff880`04872000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
    fffff880`0586c000 fffff880`05886c00   usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07)
    fffff880`05c36000 fffff880`05c53000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
    fffff880`119e9000 fffff880`119eaf00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
    fffff880`119a9000 fffff880`119ba000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
    fffff880`04aa9000 fffff880`04b03000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
    fffff880`03a3c000 fffff880`03a92000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
    fffff880`0488f000 fffff880`0489e000   usbrpm   usbrpm.sys   Mon Jul 13 20:35:14 2009 (4A5BD2C2)
    fffff880`0580e000 fffff880`0581f000   usbscan  usbscan.sys  Mon Jul 13 20:35:32 2009 (4A5BD2D4)
    fffff880`05c53000 fffff880`05c6e000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
    fffff880`0583e000 fffff880`0586b200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
    fffff880`00fcd000 fffff880`00fda000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
    fffff880`0148b000 fffff880`01499000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
    fffff880`01499000 fffff880`014be000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
    fffff880`01902000 fffff880`01912000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
    fffff880`00e00000 fffff880`00e15000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`00e15000 fffff880`00e71000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
    fffff880`01912000 fffff880`0195e000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
    fffff880`049a6000 fffff880`049e2000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
    fffff880`02dc1000 fffff880`02dd5000   vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE)
    fffff880`04872000 fffff880`0488f000   vpcusb   vpcusb.sys   Tue Sep 22 21:32:39 2009 (4AB97AB7)
    fffff880`02c38000 fffff880`02c8e180   vpcvmm   vpcvmm.sys   Tue Sep 22 21:32:38 2009 (4AB97AB6)
    fffff880`04b27000 fffff880`04b2f000   wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
    fffff880`04037000 fffff880`04039a00   wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
    fffff880`02c1d000 fffff880`02c38000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
    fffff880`014be000 fffff880`014ce000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
    fffff880`00e7d000 fffff880`00f21000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
    fffff880`00f21000 fffff880`00f30000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`02d92000 fffff880`02d9b000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff960`000d0000 fffff960`003e0000   win32k   win32k.sys   Tue Jan 04 22:59:44 2011 (4D23ECB0)
    fffff880`05629000 fffff880`0563a000   WinUSB   WinUSB.sys   Mon Jul 13 20:06:28 2009 (4A5BCC04)
    fffff880`04849000 fffff880`0484dd00   WmBEnum  WmBEnum.sys  Tue Apr 27 16:10:19 2010 (4BD744AB)
    fffff880`0581f000 fffff880`05828180   WmFilter WmFilter.sys Tue Apr 27 16:10:19 2010 (4BD744AB)
    fffff880`10c00000 fffff880`10c09000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`00f87000 fffff880`00f90000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`0484e000 fffff880`0485f480   WmXlCore WmXlCore.sys Tue Apr 27 16:09:26 2010 (4BD74476)
    fffff880`02d87000 fffff880`02d92000   ws2ifsl  ws2ifsl.sys  Mon Jul 13 20:10:33 2009 (4A5BCCF9)
    fffff880`058c7000 fffff880`058e8000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
    fffff880`04b8e000 fffff880`04bbf000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)
    
    Unloaded modules:
    fffff880`05c53000 fffff880`05c64000   WinUSB.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`05800000 fffff880`05831000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`10c23000 fffff880`1187e000   nvlddmkm.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00C5B000
    fffff880`01846000 fffff880`01854000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000E000
    fffff880`01854000 fffff880`01860000   dump_ataport
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000C000
    fffff880`01860000 fffff880`01869000   dump_atapi.s
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00009000
    fffff880`01869000 fffff880`0187c000   dump_dumpfve
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00013000
    fffff880`04800000 fffff880`04831000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`049a6000 fffff880`049d7000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    
    

     
  3. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    spd 4.JPG spd 2.JPG memory 1.JPG cpu.JPG spd 3.JPG spd 1.JPG cache.JPG

    Hello Cybercore,

    Thank you for a really speedy reponse.

    I have been into the BIOS and changed the DRAM Frequency to 1333. Is that the correct one to change? it was originally set to Auto. Can you tell me how you knew what it was set to please? I was trying to check where you picked it up from to see if I had changed the right setting, but cannot see it in an obvious place?

    I have redone the CPUz images (attached fresh) and the Rammon (v2) file...

    Am currently updating drivers...

    The Asus Mobo has a utility for "saving energy". I believe this changes some settings on the fly when PC idle for example; would this be overriding the memory settings? should it be removed/disabled?

    Thanks again.
     

    Attached Files:

  4. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    You're still having it 1316Mhz. You need 1333Mhz.


    Good tip, uninstall it for now.


    No more SPD attachments, CPU-Z memory will be enough.
     
  5. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    Bios1. CPUz Memory 3.JPG

    Hello again Cybercore,

    I have removed the utility (Asus EVO) and also another called Turbo EVO.

    I attach the latest CPUz meomory tab and a screen photo of the Bios settings screen showing 1333MHz.

    Not sure what else I should be changing?

    Thanks for your patience...
     
  6. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    Looks good now, 1333Mhz 9-9-9-24. Should be no more crashes, but if you get any then turn off in the bios:


    - OC Tuner [Disabled]


    - ASUS / 3rd Party UI Priority [Disabled]


    - AI Overclock Tuner [Disabled]
     
  7. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    Hello Cybercore,

    Thanks for your help, will leave you in peace to see if more stable. As a matter of interest, how did you know was not set to 1333 from the info I posted?
     
  8. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321

    Your CPU-Z screenshots told me that. As a matter of fact, this is the only reason I ask users to attach this kind of information. : )
     
  9. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    I must be really stupid, I keep looking at the memory screenshot, I cannot see that number for the life of me...
     
  10. PhotographicaUK

    PhotographicaUK New Member

    Joined:
    Mar 20, 2011
    Messages:
    12
    Likes Received:
    0
    SPD slot 3.JPG SPD Slot 4.JPG Spd Slot 2.JPG Mainboard.JPG CPU.JPGView attachment Minidumps.zipView attachment RAMMon - SPD Info.txt Memory.JPG SPD slot 1.JPG Graphics.JPG Caches.JPG

    Hello Cybercore,

    I am still getting BSODs at random times, usually when I first switch the PC on. I have attached the latest batch of info files in the hope you might spot something obvious - I am stumped. Any help, ideas, guidance would be appreciated. Thanks.
     
  11. cybercore

    cybercore New Member

    Joined:
    Jul 7, 2009
    Messages:
    15,823
    Likes Received:
    321
    Let's look for the obvious then:




    Follow my 1st post:

    Update drivers:

    Intel - HECIx64.sys Thu Sep 17 15:54:16 2009
    Logitech - LGVirHid.sys Mon Nov 23 20:36:48 2009
    Marvell - mv61xx.sys Wed Aug 05 23:20:12 2009
    Wacom - wacommousefilter.sys Fri Feb 16 13:12:17 2007


    Uninstall LogMeIn:

    lmimirr.sys Tue Apr 10 18:32:45 2007
    LMIRfsDriver.sys Mon Jul 14 12:26:56 2008
    RaInfo.sys Fri Jan 04 13:57:14 2008




    CRASH DUMPS

    Code:
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\033111-28766-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c63000 PsLoadedModuleList = 0xfffff800`03ea0e50
    Debug session time: Thu Mar 31 13:42:15.368 2011 (UTC - 4:00)
    System Uptime: 0 days 0:00:24.804
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ............................
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C4, {91, 0, fffffa800a927b60, 0}
    
    Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for nvlddmkm.sys
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
    Probably caused by : nvlddmkm.sys ( nvlddmkm+9b1df )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught.  This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Arguments:
    Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    	the operating system. The only supported way to extend a kernel
    	mode stack is by using KeExpandKernelStackAndCallout.
    Arg2: 0000000000000000
    Arg3: fffffa800a927b60
    Arg4: 0000000000000000
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0xc4_91
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  0
    
    EXCEPTION_RECORD:  fffff880029eaab8 -- (.exr 0xfffff880029eaab8)
    ExceptionAddress: 0000000000000000
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000008
       Parameter[1]: 0000000000000000
    Attempt to execute non-executable address 0000000000000000
    
    TRAP_FRAME:  fffff880029eab60 -- (.trap 0xfffff880029eab60)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800a683e30 rbx=0000000000000000 rcx=fffffa800a683000
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=0000000000000000 rsp=fffff880029eacfd rbp=fffff880029f7598
     r8=fffff8801149a4a0  r9=0000000000000000 r10=fffff80003e62888
    r11=00000000000008c8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    00000000`00000000 ??              ???
    Resetting default scope
    
    UNALIGNED_STACK_POINTER:  fffff880029eacfd
    
    LAST_CONTROL_TRANSFER:  from fffff80003d2824a to fffff80003cd3740
    
    STACK_TEXT:  
    fffff880`029eacfd fffff880`10d6e1df : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
    fffff880`029ead05 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x9b1df
    
    
    STACK_COMMAND:  .trap 0xfffff880029eab60 ; kb
    
    FOLLOWUP_IP: 
    nvlddmkm+9b1df
    fffff880`10d6e1df ??              ???
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nvlddmkm+9b1df
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nvlddmkm
    
    IMAGE_NAME:  nvlddmkm.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d27c6da
    
    FAILURE_BUCKET_ID:  X64_0xc4_91_nvlddmkm+9b1df
    
    BUCKET_ID:  X64_0xc4_91_nvlddmkm+9b1df
    
    Followup: MachineOwner
    ---------
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\032011-34881-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c0c000 PsLoadedModuleList = 0xfffff800`03e49e50
    Debug session time: Sun Mar 20 05:19:05.781 2011 (UTC - 4:00)
    System Uptime: 0 days 0:01:19.843
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff96000311897, fffff88008685730, 0}
    
    Probably caused by : win32k.sys ( win32k!BmfdQueryAdvanceWidthsTE+3f )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff96000311897, Address of the instruction which caused the bugcheck
    Arg3: fffff88008685730, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    win32k!BmfdQueryAdvanceWidthsTE+3f
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]
    
    CONTEXT:  fffff88008685730 -- (.cxr 0xfffff88008685730)
    rax=fffff88008686158 rbx=00000000ffffffff rcx=fffef900c0d5b020
    rdx=fffff88008686138 rsi=fffff900c08dcca0 rdi=fffff900c08dccb8
    rip=fffff96000311897 rsp=fffff88008686100 rbp=0000000000000001
     r8=fffff88008686160  r9=0000000000000001 r10=0000000000000008
    r11=fffff80003e7cb60 r12=fffff88008686220 r13=0000000000000001
    r14=0000000000000001 r15=fffff900c0081000
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    win32k!BmfdQueryAdvanceWidthsTE+0x3f:
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h] ds:002b:fffef900`c0d5b030=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000311897
    
    STACK_TEXT:  
    fffff880`08686100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!BmfdQueryAdvanceWidthsTE+0x3f
    
    
    FOLLOWUP_IP: 
    win32k!BmfdQueryAdvanceWidthsTE+3f
    fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  win32k!BmfdQueryAdvanceWidthsTE+3f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME:  win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d23ecb0
    
    STACK_COMMAND:  .cxr 0xfffff88008685730 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f
    
    BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f
    
    Followup: MachineOwner
    ---------
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\033111-28719-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c5d000 PsLoadedModuleList = 0xfffff800`03e9ae50
    Debug session time: Thu Mar 31 13:24:49.458 2011 (UTC - 4:00)
    System Uptime: 0 days 0:24:06.894
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .....
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 24, {1904fb, fffff8800b4d7fd8, fffff8800b4d7840, fffff80003e020f3}
    
    Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2cc9 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff8800b4d7fd8
    Arg3: fffff8800b4d7840
    Arg4: fffff80003e020f3
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_RECORD:  fffff8800b4d7fd8 -- (.exr 0xfffff8800b4d7fd8)
    Cannot read Exception record @ fffff8800b4d7fd8
    
    CONTEXT:  fffff8800b4d7840 -- (.cxr 0xfffff8800b4d7840)
    rax=0000000000000000 rbx=fffffa800812eca0 rcx=fffefa8007ecb580
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80003e020f3 rsp=fffff8800b4d8210 rbp=0000000000000000
     r8=fffff8800b4d83c8  r9=fffff8800b4d83c0 r10=fffffa800812ed18
    r11=fffff80003cec7d0 r12=0000000000000001 r13=fffefa8007ecb580
    r14=fffffa80080ada90 r15=fffff8800b4d8c20
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    nt!ExFreePoolWithTag+0x43:
    fffff800`03e020f3 418b45f0        mov     eax,dword ptr [r13-10h] ds:002b:fffefa80`07ecb570=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  DkService.exe
    
    CURRENT_IRQL:  1
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003f050e0
     ffffffffffffffff 
    
    FOLLOWUP_IP: 
    Ntfs! ?? ::FNODOBFM::`string'+2cc9
    fffff880`0123a3d8 cc              int     3
    
    FAULTING_IP: 
    nt!ExFreePoolWithTag+43
    fffff800`03e020f3 418b45f0        mov     eax,dword ptr [r13-10h]
    
    BUGCHECK_STR:  0x24
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003e020f3
    
    STACK_TEXT:  
    fffff880`0b4d7008 fffff880`0123a3d8 : 00000000`00000024 00000000`001904fb fffff880`0b4d7fd8 fffff880`0b4d7840 : nt!KeBugCheckEx
    fffff880`0b4d7010 fffff880`012973cf : fffff880`0126ab0c fffff880`0b4d8880 fffff880`0b4d8880 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x2cc9
    fffff880`0b4d7050 fffff800`03cfbd1c : fffff880`0b4d7088 00000000`00000000 fffff880`0b4d71b0 fffff800`03c5d000 : Ntfs! ?? ::NNGAKEGL::`string'+0x81c8
    fffff880`0b4d7090 fffff800`03cf340d : fffff880`0126ab00 fffff880`0b4d8880 00000000`00000000 fffff880`01219000 : nt!_C_specific_handler+0x8c
    fffff880`0b4d7100 fffff800`03cfaa90 : fffff880`0126ab00 fffff880`0b4d7178 fffff880`0b4d7fd8 fffff880`01219000 : nt!RtlpExecuteHandlerForException+0xd
    fffff880`0b4d7130 fffff800`03d079ef : fffff880`0b4d7fd8 fffff880`0b4d7840 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
    fffff880`0b4d7810 fffff800`03cccd82 : fffff880`0b4d7fd8 fffffa80`0812eca0 fffff880`0b4d8080 00000000`00000000 : nt!KiDispatchException+0x16f
    fffff880`0b4d7ea0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
    
    
    STACK_COMMAND:  kb
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2cc9
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f
    
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9
    
    BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9
    
    Followup: MachineOwner
    ---------
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\041211-35615-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c0f000 PsLoadedModuleList = 0xfffff800`03e4ce50
    Debug session time: Tue Apr 12 02:06:15.390 2011 (UTC - 4:00)
    System Uptime: 0 days 0:02:32.826
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 3B, {c0000005, fffff80003cb2ec1, fffff8800875efa0, 0}
    
    Probably caused by : memory_corruption ( nt!MiRemoveMappedView+1a1 )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80003cb2ec1, Address of the instruction which caused the bugcheck
    Arg3: fffff8800875efa0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    nt!MiRemoveMappedView+1a1
    fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax
    
    CONTEXT:  fffff8800875efa0 -- (.cxr 0xfffff8800875efa0)
    rax=fffffa800b06bf50 rbx=ffffffffffffffff rcx=ffff7a800805b7e0
    rdx=0000000000216fff rsi=fffffa8007e81c80 rdi=fffffa800b21ec60
    rip=fffff80003cb2ec1 rsp=fffff8800875f970 rbp=0000000000000000
     r8=fffff6fb40000000  r9=fffffa8006843b30 r10=0000000fffffffff
    r11=fffffa800000001c r12=fffffa8006830060 r13=fffffa8007e81d00
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!MiRemoveMappedView+0x1a1:
    fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax ds:002b:ffff7a80`0805b7e8=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x3B
    
    PROCESS_NAME:  wmpnscfg.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003cb2ec1
    
    STACK_TEXT:  
    fffff880`0875f970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0x1a1
    
    
    FOLLOWUP_IP: 
    nt!MiRemoveMappedView+1a1
    fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!MiRemoveMappedView+1a1
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd
    
    STACK_COMMAND:  .cxr 0xfffff8800875efa0 ; kb
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  X64_0x3B_nt!MiRemoveMappedView+1a1
    
    BUCKET_ID:  X64_0x3B_nt!MiRemoveMappedView+1a1
    
    Followup: MachineOwner
    ---------
    
    
    
    
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\DMP\041411-31340-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
    Machine Name:
    Kernel base = 0xfffff800`03c57000 PsLoadedModuleList = 0xfffff800`03e94e50
    Debug session time: Thu Apr 14 05:15:22.420 2011 (UTC - 4:00)
    System Uptime: 0 days 0:03:52.856
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    ..
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {0, 0, 0, 0}
    
    Probably caused by : CLASSPNP.SYS ( CLASSPNP!ClasspSendSynchronousCompletion+31 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: 0000000000000000, The exception code that was not handled
    Arg2: 0000000000000000, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
    
    FAULTING_IP: 
    +3764363430363961
    00000000`00000000 ??              ???
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000000
    
    ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0
    
    BUGCHECK_STR:  0x1E_0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    EXCEPTION_RECORD:  fffff88002f1b5f8 -- (.exr 0xfffff88002f1b5f8)
    ExceptionAddress: fffff880012022e1 (CLASSPNP!ClasspSendSynchronousCompletion+0x0000000000000031)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    TRAP_FRAME:  fffff88002f1b6a0 -- (.trap 0xfffff88002f1b6a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=fffef88009641bd8
    rdx=fffffa800b13ecb0 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff880012022e1 rsp=fffff88002f1b830 rbp=0000000000000000
     r8=fffffa80079117a8  r9=0000000000000000 r10=fffff88003529000
    r11=fffff88002f1b948 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    CLASSPNP!ClasspSendSynchronousCompletion+0x31:
    fffff880`012022e1 488901          mov     qword ptr [rcx],rax ds:fffef880`09641bd8=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80003cbf46e to fffff80003cc7710
    
    STACK_TEXT:  
    fffff880`02f1a6e8 fffff800`03cbf46e : fffffa80`0a912820 00000000`00000000 fffff880`02f1ae60 fffff800`03cf4668 : nt!KeBugCheck
    fffff880`02f1a6f0 fffff800`03ced40d : fffff800`03ed5b7c fffff800`03e0fea4 fffff800`03c57000 fffff880`02f1b5f8 : nt!KiKernelCalloutExceptionHandler+0xe
    fffff880`02f1a720 fffff800`03cf4a90 : fffff800`03e16b34 fffff880`02f1a798 fffff880`02f1b5f8 fffff800`03c57000 : nt!RtlpExecuteHandlerForException+0xd
    fffff880`02f1a750 fffff800`03d019ef : fffff880`02f1b5f8 fffff880`02f1ae60 fffff880`00000000 fffffa80`0b13ecb0 : nt!RtlDispatchException+0x410
    fffff880`02f1ae30 fffff800`03cc6d82 : fffff880`02f1b5f8 fffffa80`0b13ecb0 fffff880`02f1b6a0 00000000`00000000 : nt!KiDispatchException+0x16f
    fffff880`02f1b4c0 fffff800`03cc568a : 00000000`00000000 fffffa80`0ad04f50 00000000`00007000 fffff800`03c10524 : nt!KiExceptionDispatch+0xc2
    fffff880`02f1b6a0 fffff880`012022e1 : fffff880`00c5d12c fffff880`00c8a552 00000000`00000008 fffff800`03c12a56 : nt!KiGeneralProtectionFault+0x10a
    fffff880`02f1b830 fffff800`03cc9d26 : fffffa80`06b640e0 fffff800`03c13156 fffffa80`06690ea0 00000000`00007200 : CLASSPNP!ClasspSendSynchronousCompletion+0x31
    fffff880`02f1b870 fffff880`00c8f41a : 00000000`00007200 00000000`00000001 fffffa80`08250b80 00000000`00000000 : nt!IopfCompleteRequest+0x3a6
    fffff880`02f1b950 fffff880`00c8f184 : fffffa80`08250b80 fffff880`00c91b3b fffffa80`06b64010 fffffa80`075107d0 : ataport!IdeCompleteScsiIrp+0x62
    fffff880`02f1b980 fffff880`00c89e32 : 00000000`00000000 00000000`00000000 fffffa80`074fa500 fffffa80`075107d0 : ataport!IdeAlwaysSuccessCrbCompletion+0x2c
    fffff880`02f1b9b0 fffff880`00c927ed : fffffa80`074f91a0 fffffa80`08250b80 00000000`00000000 fffffa80`08250b80 : ataport!IdeTranslateCompletedRequest+0x236
    fffff880`02f1bae0 fffff880`00c920ec : fffffa80`074f91a0 00000000`00000000 fffffa80`074f91a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
    fffff880`02f1bc10 fffff800`03cd2bfc : fffff880`009eb180 00000000`26253cdc fffffa80`074f9050 fffffa80`074f9118 : ataport!IdePortCompletionDpc+0x1a8
    fffff880`02f1bcd0 fffff800`03ccfeea : fffff880`009eb180 fffff880`009f5fc0 00000000`00000000 fffff880`00c91f44 : nt!KiRetireDpcList+0x1bc
    fffff880`02f1bd80 00000000`00000000 : fffff880`02f1c000 fffff880`02f16000 fffff880`02f1bd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    CLASSPNP!ClasspSendSynchronousCompletion+31
    fffff880`012022e1 488901          mov     qword ptr [rcx],rax
    
    SYMBOL_STACK_INDEX:  7
    
    SYMBOL_NAME:  CLASSPNP!ClasspSendSynchronousCompletion+31
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: CLASSPNP
    
    IMAGE_NAME:  CLASSPNP.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc11e
    
    FAILURE_BUCKET_ID:  X64_0x1E_0_CLASSPNP!ClasspSendSynchronousCompletion+31
    
    BUCKET_ID:  X64_0x1E_0_CLASSPNP!ClasspSendSynchronousCompletion+31
    
    Followup: MachineOwner
    ---------
    
    
    
    




    DRIVERS

    Code:
    start             end                 module name
    fffff880`0433e000 fffff880`0437c000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
    fffff880`00f90000 fffff880`00fe7000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
    fffff880`02c00000 fffff880`02c8a000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
    fffff880`04209000 fffff880`0421f000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
    fffff880`011c4000 fffff880`011cf000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
    fffff880`04390000 fffff880`043b3000   AnyDVD   AnyDVD.sys   Wed Dec 01 14:06:20 2010 (4CF69CAC)
    fffff880`0437c000 fffff880`04384000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
    fffff880`03ff3000 fffff880`03ff9000   AsIO     AsIO.sys     Mon Aug 03 03:03:16 2009 (4A768BB4)
    fffff880`03fed000 fffff880`03ff3000   AsUpIO   AsUpIO.sys   Sun Jul 05 22:21:38 2009 (4A515FB2)
    fffff880`00ec7000 fffff880`00ed0000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`00c86000 fffff880`00cb0000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
    fffff880`0640f000 fffff880`0645e000   atksgt   atksgt.sys   Sun May 17 09:36:34 2009 (4A1012E2)
    fffff960`00860000 fffff960`008c1000   ATMFD    ATMFD.DLL    unavailable (00000000)
    fffff880`02ccd000 fffff880`02cd4000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
    fffff880`03fdc000 fffff880`03fed000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
    fffff880`05f7f000 fffff880`05f9d000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
    fffff960`00760000 fffff960`00787000   cdd      cdd.dll      unavailable (00000000)
    fffff880`00dc5000 fffff880`00def000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`00ed0000 fffff880`00f90000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
    fffff880`04912000 fffff880`04924000   circlass circlass.sys Mon Jul 13 20:06:34 2009 (4A5BCC0A)
    fffff880`01200000 fffff880`01230000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
    fffff880`00d0a000 fffff880`00d68000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`01487000 fffff880`014fa000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
    fffff880`043c9000 fffff880`043d9000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`0645e000 fffff880`06467000   cpuz135_x64 cpuz135_x64.sys Wed Jan 19 11:42:06 2011 (4D37145E)
    fffff880`05851000 fffff880`0585f000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
    fffff880`03f3b000 fffff880`03fbe000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
    fffff880`0531d000 fffff880`05352000   CT20XUT  CT20XUT.SYS  Wed May 05 09:01:28 2010 (4BE16C28)
    fffff880`05254000 fffff880`05302000   ctac32k  ctac32k.sys  Wed Jul 02 04:38:22 2008 (486B3E7E)
    fffff880`04000000 fffff880`040a5700   ctaud2k  ctaud2k.sys  Wed May 05 08:59:48 2010 (4BE16BC4)
    fffff880`05862000 fffff880`059bf000   CTEXFIFX CTEXFIFX.SYS Wed May 05 09:01:21 2010 (4BE16C21)
    fffff880`05302000 fffff880`0531d000   CTHWIUT  CTHWIUT.SYS  Wed May 05 09:01:32 2010 (4BE16C2C)
    fffff880`042ff000 fffff880`04330000   ctoss2k  ctoss2k.sys  Wed May 05 08:57:46 2010 (4BE16B4A)
    fffff880`04330000 fffff880`04338000   ctprxy2k ctprxy2k.sys Wed May 05 08:59:51 2010 (4BE16BC7)
    fffff880`048ae000 fffff880`048e6000   ctsfm2k  ctsfm2k.sys  Wed May 05 08:57:33 2010 (4BE16B3D)
    fffff880`03fbe000 fffff880`03fdc000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
    fffff880`03f2c000 fffff880`03f3b000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
    fffff880`015e5000 fffff880`015fb000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`041de000 fffff880`04200000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
    fffff880`059f4000 fffff880`059fd000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`059e8000 fffff880`059f4000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`0539b000 fffff880`053ae000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
    fffff880`05838000 fffff880`05844000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
    fffff880`118d3000 fffff880`119c7000   dxgkrnl  dxgkrnl.sys  Tue Jan 25 23:22:56 2011 (4D3FA1A0)
    fffff880`10c00000 fffff880`10c46000   dxgmms1  dxgmms1.sys  Tue Jan 25 23:22:12 2011 (4D3FA174)
    fffff880`03f20000 fffff880`03f2c000   ElbyCDIO ElbyCDIO.sys Thu Dec 16 17:58:13 2010 (4D0A9985)
    fffff880`05000000 fffff880`0504a000   emupia2k emupia2k.sys Wed May 05 08:57:27 2010 (4BE16B37)
    fffff880`011cf000 fffff880`011e3000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
    fffff880`01000000 fffff880`0104c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
    fffff880`0150b000 fffff880`01515000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
    fffff880`015ab000 fffff880`015e5000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
    fffff880`01515000 fffff880`0155f000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
    fffff880`043b3000 fffff880`043c0000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
    fffff880`0506b000 fffff880`051ec000   ha20x2k  ha20x2k.sys  Wed May 05 08:59:10 2010 (4BE16B9E)
    fffff800`03c0e000 fffff800`03c57000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
    fffff880`10c46000 fffff880`10c6a000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
    fffff880`119c7000 fffff880`119d8000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
    fffff880`043e3000 fffff880`043fc000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
    fffff880`04200000 fffff880`04208080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
    fffff880`053bc000 fffff880`053ca000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
    fffff880`05eb7000 fffff880`05f7f000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
    fffff880`016b5000 fffff880`016be000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
    fffff880`040ce000 fffff880`040e4000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
    fffff880`04890000 fffff880`0489f000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`053ca000 fffff880`053d8000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
    fffff800`00b96000 fffff800`00ba0000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
    fffff880`042bc000 fffff880`042ff000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
    fffff880`0146d000 fffff880`01487000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
    fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
    fffff880`04338000 fffff880`0433d200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
    fffff880`04924000 fffff880`04927d80   LGBusEnum LGBusEnum.sys Mon Nov 23 20:36:48 2009 (4B0B38B0)
    fffff880`0648e000 fffff880`06490480   LGVirHid LGVirHid.sys Mon Nov 23 20:36:48 2009 (4B0B38B0)
    fffff880`053e9000 fffff880`053fe000   LHidFilt LHidFilt.Sys Tue Aug 24 13:21:36 2010 (4C73FFA0)
    fffff880`06467000 fffff880`06474000   lirsgt   lirsgt.sys   Sun May 17 09:06:57 2009 (4A100BF1)
    fffff880`119e9000 fffff880`119fe000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`043d9000 fffff880`043e0000   lmimirr  lmimirr.sys  Tue Apr 10 18:32:45 2007 (461C108D)
    fffff880`0647b000 fffff880`0648e000   LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 (487B7E50)
    fffff880`05200000 fffff880`05214000   LMouFilt LMouFilt.Sys Tue Aug 24 13:21:43 2010 (4C73FFA7)
    fffff880`0521e000 fffff880`05241000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
    fffff880`00cb2000 fffff880`00cf6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
    fffff880`053ae000 fffff880`053bc000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
    fffff880`0489f000 fffff880`048ae000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`0485a000 fffff880`04867000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
    fffff880`00c6c000 fffff880`00c86000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`02c93000 fffff880`02cc4000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
    fffff880`05e71000 fffff880`05e81000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
    fffff880`05f9d000 fffff880`05fb5000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
    fffff880`05fb5000 fffff880`05fe2000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
    fffff880`05e00000 fffff880`05e4e000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
    fffff880`05e4e000 fffff880`05e71000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
    fffff880`02d32000 fffff880`02d3d000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`00ff0000 fffff880`00ffa000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
    fffff880`0140f000 fffff880`0146d000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
    fffff880`03f15000 fffff880`03f20000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
    fffff880`016a3000 fffff880`016b5000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
    fffff880`0104c000 fffff880`01093000   mv61xx   mv61xx.sys   Wed Aug 05 23:20:12 2009 (4A7A4BEC)
    fffff880`010c2000 fffff880`0114f000   mv91xx   mv91xx.sys   Wed Mar 17 03:53:06 2010 (4BA08A62)
    fffff880`0114f000 fffff880`01157000   mvxxmm   mvxxmm.sys   Wed Mar 17 03:52:37 2010 (4BA08A45)
    fffff880`016cb000 fffff880`017bd000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
    fffff880`04243000 fffff880`0424f000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
    fffff880`0424f000 fffff880`0427e000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
    fffff880`0504a000 fffff880`0505f000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
    fffff880`01243000 fffff880`01252000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff880`02d79000 fffff880`02dbe000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
    fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
    fffff880`09364000 fffff880`09379000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
    fffff880`02d3d000 fffff880`02d4e000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`03f09000 fffff880`03f15000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
    fffff800`03c57000 fffff800`04234000   nt       ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD)
    fffff880`0125b000 fffff880`013fe000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
    fffff880`02cc4000 fffff880`02ccd000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
    fffff880`118d1000 fffff880`118d2180   nvBridge nvBridge.kmd Wed Feb 23 02:34:23 2011 (4D64B87F)
    fffff880`059bf000 fffff880`059e8000   nvhda64v nvhda64v.sys Thu Nov 11 18:10:36 2010 (4CDC77EC)
    fffff880`10c75000 fffff880`118d0180   nvlddmkm nvlddmkm.sys Wed Feb 23 02:46:52 2011 (4D64BB6C)
    fffff880`05844000 fffff880`05851000   nx6000   nx6000.sys   Thu Dec 02 17:23:39 2010 (4CF81C6B)
    fffff880`02dbe000 fffff880`02de4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
    fffff880`00d9b000 fffff880`00db0000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
    fffff880`00d68000 fffff880`00d9b000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`00ec0000 fffff880`00ec7000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
    fffff880`00c5c000 fffff880`00c6c000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`014fa000 fffff880`0150b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
    fffff880`06491000 fffff880`06537000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
    fffff880`041a1000 fffff880`041de000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
    fffff880`00cf6000 fffff880`00d0a000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
    fffff880`011e3000 fffff880`011eee00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
    fffff880`06474000 fffff880`0647b000   RaInfo   RaInfo.sys   Fri Jan 04 13:57:14 2008 (477E818A)
    fffff880`0421f000 fffff880`04243000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
    fffff880`0427e000 fffff880`04299000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
    fffff880`04299000 fffff880`042ba000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
    fffff880`0486b000 fffff880`04885000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
    fffff880`03eb8000 fffff880`03f09000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
    fffff880`04885000 fffff880`04890000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
    fffff880`02d17000 fffff880`02d20000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`02d20000 fffff880`02d29000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`02d29000 fffff880`02d32000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
    fffff880`017bd000 fffff880`017f7000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
    fffff880`05e9f000 fffff880`05eb7000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`0413a000 fffff880`041a1000   Rt64win7 Rt64win7.sys Fri Jan 21 02:34:00 2011 (4D3936E8)
    fffff880`049ec000 fffff880`049fa000   scfilter scfilter.sys Mon Jul 13 19:50:17 2009 (4A5BC839)
    fffff880`01093000 fffff880`010c2000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
    fffff880`06537000 fffff880`06542000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
    fffff880`04384000 fffff880`04390000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`03e15000 fffff880`03e32000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
    fffff880`0169b000 fffff880`016a3000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
    fffff880`092ce000 fffff880`09364000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
    fffff880`06581000 fffff880`065e8000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
    fffff880`06542000 fffff880`0656f000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
    fffff880`01162000 fffff880`011c4000   storport storport.sys Mon Jul 13 20:01:18 2009 (4A5BCACE)
    fffff880`04910000 fffff880`04911480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
    fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
    fffff880`0656f000 fffff880`06581000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
    fffff880`02d6c000 fffff880`02d79000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
    fffff880`02d4e000 fffff880`02d6c000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
    fffff880`03ea4000 fffff880`03eb8000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
    fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    unavailable (00000000)
    fffff880`040a8000 fffff880`040ce000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
    fffff880`0493f000 fffff880`04951000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
    fffff880`05380000 fffff880`0539ac00   usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07)
    fffff880`05800000 fffff880`0581d000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
    fffff880`0497d000 fffff880`0497ef00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
    fffff880`119d8000 fffff880`119e9000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
    fffff880`04800000 fffff880`0485a000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
    fffff880`040e4000 fffff880`0413a000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
    fffff880`0496e000 fffff880`0497d000   usbrpm   usbrpm.sys   Mon Jul 13 20:35:14 2009 (4A5BD2C2)
    fffff880`053d8000 fffff880`053e9000   usbscan  usbscan.sys  Mon Jul 13 20:35:32 2009 (4A5BD2D4)
    fffff880`0581d000 fffff880`05838000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
    fffff880`05352000 fffff880`0537f200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
    fffff880`00eb3000 fffff880`00ec0000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
    fffff880`02cd4000 fffff880`02ce2000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
    fffff880`02ce2000 fffff880`02d07000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
    fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
    fffff880`00db0000 fffff880`00dc5000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
    fffff880`0155f000 fffff880`015ab000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
    fffff880`0497f000 fffff880`049bb000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
    fffff880`02de4000 fffff880`02df8000   vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE)
    fffff880`04951000 fffff880`0496e000   vpcusb   vpcusb.sys   Tue Sep 22 21:32:39 2009 (4AB97AB7)
    fffff880`03e4d000 fffff880`03ea3180   vpcvmm   vpcvmm.sys   Tue Sep 22 21:32:38 2009 (4AB97AB6)
    fffff880`051ec000 fffff880`051f4000   wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
    fffff880`043e0000 fffff880`043e2a00   wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
    fffff880`03e32000 fffff880`03e4d000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
    fffff880`02d07000 fffff880`02d17000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
    fffff880`00e00000 fffff880`00ea4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
    fffff880`00ea4000 fffff880`00eb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`02c8a000 fffff880`02c93000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff960`00060000 fffff960`00370000   win32k   win32k.sys   unavailable (00000000)
    fffff880`05241000 fffff880`05252000   WinUSB   WinUSB.sys   Mon Jul 13 20:06:28 2009 (4A5BCC04)
    fffff880`04928000 fffff880`0492cd00   WmBEnum  WmBEnum.sys  Tue Apr 27 16:10:19 2010 (4BD744AB)
    fffff880`05214000 fffff880`0521d180   WmFilter WmFilter.sys Tue Apr 27 16:10:19 2010 (4BD744AB)
    fffff880`043c0000 fffff880`043c9000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`00fe7000 fffff880`00ff0000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`0492d000 fffff880`0493e480   WmXlCore WmXlCore.sys Tue Apr 27 16:09:26 2010 (4BD74476)
    fffff880`048e6000 fffff880`04907000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
    fffff880`049bb000 fffff880`049ec000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)
    
    Unloaded modules:
    fffff880`0581d000 fffff880`0582e000   WinUSB.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    fffff880`0582e000 fffff880`0585f000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`01400000 fffff880`0140e000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000E000
    fffff880`016be000 fffff880`016ca000   dump_ataport
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000C000
    fffff880`017f7000 fffff880`01800000   dump_atapi.s
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00009000
    fffff880`01230000 fffff880`01243000   dump_dumpfve
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00013000
    fffff880`048df000 fffff880`04910000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`048ae000 fffff880`048df000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`01157000 fffff880`01162000   acs6nts.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000B000
    
    
     

Share This Page

Loading...