BSOD Problems...

iNewb · 09-26-2008, 10:27 AM

Hi,
Last time I started to get BSOD's, that often happens when I play Team Fortress 2, Appears to be very random.
However it is very rare that I get BSOD's when I'm not playing.. even if I have very heavy and memory consuming programs.

On last bootup(after bsod) I decided to post here the memory dumps, because I have absolutely no knowledge in analizing them.
The files are attached to this post.

My system specs are:
ASROCK AM2NF6G - VSTA MOBO
AMD Athlon 64 X2 DualCore 6000+
3GB RAM (2x1GB, 2x512GB)
GPU OnBoard (nvidia 6200)
160GB WesternDigital HD SATA
80GB Seagate HD IDE

Operating System:
Windows Vista Ultimate x64

I appreciate any kind of help.

iNewb · 09-26-2008, 01:06 PM

It happened again..
Plz help me out, this is VERY annoying..

Vista window after BSOD:

Code:

    Problem signature:
  Problem Event Name:	BlueScreen
  OS Version:	6.0.6001.2.1.0.256.1
  Locale ID:	1033

    Additional information about the problem:
  BCCode:	1e
  BCP1:	FFFFFFFFC0000005
  BCP2:	FFFFF800024C22DD
  BCP3:	0000000000000000
  BCP4:	00000000000000D0
  OS Version:	6_0_6001
  Service Pack:	1_0
  Product:	256_1

    Files that help describe the problem:
  C:\Windows\Minidump\Mini092608-02.dmp
  C:\Users\mcComBat\AppData\Local\Temp\WER-32062-0.sysdata.xml
  C:\Users\mcComBat\AppData\Local\Temp\WERCAB2.tmp.version.txt

    Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409

New files are attached.

**jcgriff2** · 09-26-2008, 03:23 PM

Hi. . .

I ran the memory dumps -

Both had a bugcheck of 0x0000001e (0xffffffffc0000005, 0xfffff800024c22dd, 0x0, 0xd0) listing the probable cause as kl1.sys - Kaspersky. The process running at the time was hl2.exe, which I believe is Counter-Strike Source.

0x0000001e = 0x1e = kernel-mode program generated an exception, which in this case is the first parm inside the parenthesis - 0xc...5 - and it tells us that a memory access violation occurred. For info, the 2nd parm is a memory address (of the exception origin) and does differ between the 2 dumps, which is normal.

Normally, I would be the 1st to point at Kapersky and still have my suspicions. the kl1.sys driver has a timestamp of Mon Jul 21 10:33:52 2008 , so it is very likely that your system was recently updated w/it. Most likely, what is happening now is that the updated Kaspersky module is conflicting w/ another driver - one that existed before it.

So, based on the information at hand, you can remove Kaspersky from your system, which I usually recommend, especially if it is the Internet Security Suite (KIS). In my opinion, there is no need for a firewall besides the Windows Firewall.

Run the Kaspersky Removal Tool (KRT). Click on the Kaspersky RT link in my signature area below and download/SAVE it to your desktop. Then go to desktop, RIGHT-click on the KRT icon and select Run as Administrator. When complete - re-boot.

Now reset the Windows Firewall to its default settings -
START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on "Restore Defaults" | Click Apply (if applicable) | Click OK

There are other items that may cause you trouble in the near future. You have some aging drivers in your system. It is possible that one of these is clashing w/ Kaspersky.

Take a look though the area below and you can see kl1. It is the areas in between that have no name that could be of concern here.

Code:

fffff80 : nt!RtlVirtualUnwind+0x25
2409000 : nt!PspGetSetContextInter
0000000 : nt!PspGetSetContextSpeci
87848f0 : nt!KiDeliverApc+0x1e2
0000000 : nt!KiApcInterrupt+0x103
1923002 : kl1+0x4babe
34666ff : 0xfffffa80`071a8c70
0000000 : 0xfffffa80`08a63f20
28bf2e0 : 0xfffffa80`04365054
6501b20 : 0xfffffa60`00000000
28bf170 : 0xfffa8006`11923002
28bf170 : kl1+0x586ff
34573ce : 0x0
1ffffff : 0xfffffa80`028bf2e0
0000040 : 0xfffffa80`06501b20
28bf010 : 0xfffffa80`028bf170
4365010 : 0xfffffa80`028bf170
cc23000 : kl1+0x493ce
340ffff : 0x1ffffff
0e69740 : 0x40
65019d0 : 0xfffffa80`028bf010
28bf280 : 0xfffffa80`04365010
28bf010 : 0xfffa8006`0cc23000
28bf170 : kl1+0x1fff
3410416 : 0xfffff900`c0e69740
0000000 : 0xfffffa80`065019d0
0000040 : 0x28bf280
0000000 : 0xfffffa80`028bf010
0000000 : 0xfffffa80`028bf170
28ab1b8 : kl1+0x2416
00000ff : 0x0
00000ff : 0x40
396c596 : 0x0

.

One way to help further determine if KIS is the culprit or not is to run the driver verifier. It will stress-test all non-MS drivers and should be helpful in the event of future BSODs.
Bring up an Elevated command prompt -
START | type cmd.exe | right-click on cmd.exe uptop under programs | Run as Administrator | type verifier & hit enter - the Verifier screen will appear | do the following:

Code:


1. Select 2nd option - Create custom settings (for code developers)
2. Select 2nd option - Select individual settings from a full list.
3. Check the boxes• Special Pool 
• Pool Tracking 
• Force IRQL checking4. Select last option - Select driver names from a list 
5. Click on the Provider heading - sorts list by Provider
6. Check ALL boxes where Microsoft is not the Provider
7. Click on Finish 
8. Re-boot

The driver verifier will stress your system out and may cause its own BSOD w/ a 0x000000c4 bugcheck - which should contain the driver name causing problems. Should this happen, when the system re-boots, it will take you into into the recovery partition - perform a Windows System restore.
To turn driver verifier off, bring up an elevated command prompt and type verifier /reset then re-boot.

The choice is yours of course, but I would advise running the driver verifier. The dbug output is below.

Please let me know how you make out.

Regards. . .

jcgriff2

Code:

Loading Dump File [A:\D\#Dumps\iNewb_Vista_09-26-08\Mini092608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18063.amd64fre.vistasp1_gdr.080425-1930
Kernel base = 0xfffff800`02409000 PsLoadedModuleList = 0xfffff800`025cedb0
Debug session time: Fri Sep 26 11:37:50.805 2008 (GMT-4)
System Uptime: 0 days 1:06:09.618
Loading Kernel Symbols
...........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800024712dd, 0, d0}

Unable to load image \SystemRoot\system32\DRIVERS\kl1.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for kl1.sys
*** ERROR: Module load completed but symbols could not be loaded for kl1.sys
Probably caused by : kl1.sys ( kl1+4babe )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800024712dd, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 00000000000000d0, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlVirtualUnwind+25d
fffff800`024712dd 488b02          mov     rax,qword ptr [rdx]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000000000d0

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002632080
 00000000000000d0 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  hl2.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffa6006cc69c0 -- (.trap 0xfffffa6006cc69c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000050 rbx=fffffa80089cfc10 rcx=0000000000000004
rdx=00000000000000d0 rsi=0000000000070000 rdi=fffff80002435809
rip=fffff800024712dd rsp=fffffa6006cc6b50 rbp=0000000000000233
 r8=0000000000000006  r9=fffff80002409000 r10=ffffffffffffff80
r11=fffff80002608000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!RtlVirtualUnwind+0x25d:
fffff800`024712dd 488b02          mov     rax,qword ptr [rdx] ds:0018:00000000`000000d0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002437e77 to fffff8000245e390

STACK_TEXT:  
fffffa60`06cc61d8 fffff800`02437e77 : 00000000`0000001e ffffffff`c0000005 fffff800`024712dd 00000000`00000000 : nt!KeBugCheckEx
fffffa60`06cc61e0 fffff800`0245e1e9 : fffffa60`06cc6918 00000000`00000001 fffffa60`06cc69c0 fffffa60`06cc6c10 : nt! ?? ::FNODOBFM::`string'+0x29317
fffffa60`06cc67e0 fffff800`0245cfe5 : 00000000`00000000 00000000`00000000 fffffa60`06cc6e00 00000000`00000001 : nt!KiExceptionDispatch+0xa9
fffffa60`06cc69c0 fffff800`024712dd : 00000000`00000002 fffff800`0292f5cb fffffa80`089cfc10 fffffa80`087848f0 : nt!KiPageFault+0x1e5
fffffa60`06cc6b50 fffff800`026f7efa : fffff800`00000001 fffffa60`09f2f500 00000000`00000000 ffffffff`ffffff80 : nt!RtlVirtualUnwind+0x25d
fffffa60`06cc6bc0 fffff800`024792bd : ffffffff`ffffff80 fffffa80`087848f0 fffffa60`09f2f570 fffff800`02409000 : nt!PspGetSetContextInternal+0x36a
fffffa60`06cc7110 fffff800`02488362 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspGetSetContextSpecialApc+0x9d
fffffa60`06cc7220 fffff800`0248c093 : fffffa60`06cc7340 00000000`00000000 00000000`00000000 fffffa80`087848f0 : nt!KiDeliverApc+0x1e2
fffffa60`06cc72c0 fffffa60`03459abe : fffffa80`071a8c70 fffffa80`08a63f20 fffffa80`04365054 fffffa60`00000000 : nt!KiApcInterrupt+0x103
fffffa60`06cc7450 fffffa80`071a8c70 : fffffa80`08a63f20 fffffa80`04365054 fffffa60`00000000 fffa8006`11923002 : kl1+0x4babe
fffffa60`06cc7458 fffffa80`08a63f20 : fffffa80`04365054 fffffa60`00000000 fffa8006`11923002 fffffa60`034666ff : 0xfffffa80`071a8c70
fffffa60`06cc7460 fffffa80`04365054 : fffffa60`00000000 fffa8006`11923002 fffffa60`034666ff 00000000`00000000 : 0xfffffa80`08a63f20
fffffa60`06cc7468 fffffa60`00000000 : fffa8006`11923002 fffffa60`034666ff 00000000`00000000 fffffa80`028bf2e0 : 0xfffffa80`04365054
fffffa60`06cc7470 fffa8006`11923002 : fffffa60`034666ff 00000000`00000000 fffffa80`028bf2e0 fffffa80`06501b20 : 0xfffffa60`00000000
fffffa60`06cc7478 fffffa60`034666ff : 00000000`00000000 fffffa80`028bf2e0 fffffa80`06501b20 fffffa80`028bf170 : 0xfffa8006`11923002
fffffa60`06cc7480 00000000`00000000 : fffffa80`028bf2e0 fffffa80`06501b20 fffffa80`028bf170 fffffa80`028bf170 : kl1+0x586ff
fffffa60`06cc7488 fffffa80`028bf2e0 : fffffa80`06501b20 fffffa80`028bf170 fffffa80`028bf170 fffffa60`034573ce : 0x0
fffffa60`06cc7490 fffffa80`06501b20 : fffffa80`028bf170 fffffa80`028bf170 fffffa60`034573ce 00000000`01ffffff : 0xfffffa80`028bf2e0
fffffa60`06cc7498 fffffa80`028bf170 : fffffa80`028bf170 fffffa60`034573ce 00000000`01ffffff 00000000`00000040 : 0xfffffa80`06501b20
fffffa60`06cc74a0 fffffa80`028bf170 : fffffa60`034573ce 00000000`01ffffff 00000000`00000040 fffffa80`028bf010 : 0xfffffa80`028bf170
fffffa60`06cc74a8 fffffa60`034573ce : 00000000`01ffffff 00000000`00000040 fffffa80`028bf010 fffffa80`04365010 : 0xfffffa80`028bf170
fffffa60`06cc74b0 00000000`01ffffff : 00000000`00000040 fffffa80`028bf010 fffffa80`04365010 fffa8006`0cc23000 : kl1+0x493ce
fffffa60`06cc74b8 00000000`00000040 : fffffa80`028bf010 fffffa80`04365010 fffa8006`0cc23000 fffffa60`0340ffff : 0x1ffffff
fffffa60`06cc74c0 fffffa80`028bf010 : fffffa80`04365010 fffa8006`0cc23000 fffffa60`0340ffff fffff900`c0e69740 : 0x40
fffffa60`06cc74c8 fffffa80`04365010 : fffa8006`0cc23000 fffffa60`0340ffff fffff900`c0e69740 fffffa80`065019d0 : 0xfffffa80`028bf010
fffffa60`06cc74d0 fffa8006`0cc23000 : fffffa60`0340ffff fffff900`c0e69740 fffffa80`065019d0 00000000`028bf280 : 0xfffffa80`04365010
fffffa60`06cc74d8 fffffa60`0340ffff : fffff900`c0e69740 fffffa80`065019d0 00000000`028bf280 fffffa80`028bf010 : 0xfffa8006`0cc23000
fffffa60`06cc74e0 fffff900`c0e69740 : fffffa80`065019d0 00000000`028bf280 fffffa80`028bf010 fffffa80`028bf170 : kl1+0x1fff
fffffa60`06cc74e8 fffffa80`065019d0 : 00000000`028bf280 fffffa80`028bf010 fffffa80`028bf170 fffffa60`03410416 : 0xfffff900`c0e69740
fffffa60`06cc74f0 00000000`028bf280 : fffffa80`028bf010 fffffa80`028bf170 fffffa60`03410416 00000000`00000000 : 0xfffffa80`065019d0
fffffa60`06cc74f8 fffffa80`028bf010 : fffffa80`028bf170 fffffa60`03410416 00000000`00000000 00000000`00000040 : 0x28bf280
fffffa60`06cc7500 fffffa80`028bf170 : fffffa60`03410416 00000000`00000000 00000000`00000040 00000000`00000000 : 0xfffffa80`028bf010
fffffa60`06cc7508 fffffa60`03410416 : 00000000`00000000 00000000`00000040 00000000`00000000 00000000`00000000 : 0xfffffa80`028bf170
fffffa60`06cc7510 00000000`00000000 : 00000000`00000040 00000000`00000000 00000000`00000000 fffffa80`028ab1b8 : kl1+0x2416
fffffa60`06cc7518 00000000`00000040 : 00000000`00000000 00000000`00000000 fffffa80`028ab1b8 00000000`000000ff : 0x0
fffffa60`06cc7520 00000000`00000000 : 00000000`00000000 fffffa80`028ab1b8 00000000`000000ff 00000000`000000ff : 0x40
fffffa60`06cc7528 00000000`00000000 : fffffa80`028ab1b8 00000000`000000ff 00000000`000000ff fffffa60`0396c596 : 0x0
fffffa60`06cc7530 fffffa80`028ab1b8 : 00000000`000000ff 00000000`000000ff fffffa60`0396c596 fffffa80`00000040 : 0x0
fffffa60`06cc7538 00000000`000000ff : 00000000`000000ff fffffa60`0396c596 fffffa80`00000040 fffffa60`03935000 : 0xfffffa80`028ab1b8
fffffa60`06cc7540 00000000`000000ff : fffffa60`0396c596 fffffa80`00000040 fffffa60`03935000 fffffa80`028bf2a0 : 0xff
fffffa60`06cc7548 fffffa60`0396c596 : fffffa80`00000040 fffffa60`03935000 fffffa80`028bf2a0 fffffa80`028bf280 : 0xff
fffffa60`06cc7550 fffffa60`0397eada : fffffa80`028bf280 fffffa60`06cc7ca0 fffffa80`03f46b00 00000000`00000040 : afd!AfdGetBufferFast+0x56
fffffa60`06cc7580 fffffa60`03959fd6 : fffffa80`03f46b00 fffffa60`06cc7820 fffffa60`00000040 fffff960`00000006 : afd! ?? ::GFJBLGFE::`string'+0x72d2
fffffa60`06cc7670 fffff800`026e45ab : 00000000`00000040 fffffa80`08a17670 00000000`00000001 fffffa80`089cfc01 : afd!AfdFastIoDeviceControl+0xfc6
fffffa60`06cc79f0 fffff800`026fd546 : 00000000`00000001 00000000`000001c0 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x35b
fffffa60`06cc7b40 fffff800`0245de33 : 00000000`00000001 fffff800`0292f5cb fffff900`c0756010 fffffa60`06cc7ca0 : nt!NtDeviceIoControlFile+0x56
fffffa60`06cc7bb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
kl1+4babe
fffffa60`03459abe ??              ???

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  kl1+4babe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: kl1

IMAGE_NAME:  kl1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48849e50

FAILURE_BUCKET_ID:  X64_0x1E_kl1+4babe

BUCKET_ID:  X64_0x1E_kl1+4babe

Followup: MachineOwner
---------

rax=00000000000000d0 rbx=fffffa6006cc6918 rcx=000000000000001e
rdx=ffffffffc0000005 rsi=0000000000000000 rdi=fffffa6006cc69c0
rip=fffff8000245e390 rsp=fffffa6006cc61d8 rbp=fffffa6006cc6a40
 r8=fffff800024712dd  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=fffffa6006cc67e0 r13=fffff8000245de33
r14=fffff80002409000 r15=fffff8000260cdf4
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00200246
nt!KeBugCheckEx:
fffff800`0245e390 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffa60`06cc61e0=000000000000001e
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`06cc61d8 fffff800`02437e77 : 00000000`0000001e ffffffff`c0000005 fffff800`024712dd 00000000`00000000 : nt!KeBugCheckEx
fffffa60`06cc61e0 fffff800`0245e1e9 : fffffa60`06cc6918 00000000`00000001 fffffa60`06cc69c0 fffffa60`06cc6c10 : nt! ?? ::FNODOBFM::`string'+0x29317
fffffa60`06cc67e0 fffff800`0245cfe5 : 00000000`00000000 00000000`00000000 fffffa60`06cc6e00 00000000`00000001 : nt!KiExceptionDispatch+0xa9
fffffa60`06cc69c0 fffff800`024712dd : 00000000`00000002 fffff800`0292f5cb fffffa80`089cfc10 fffffa80`087848f0 : nt!KiPageFault+0x1e5 (TrapFrame @ fffffa60`06cc69c0)
fffffa60`06cc6b50 fffff800`026f7efa : fffff800`00000001 fffffa60`09f2f500 00000000`00000000 ffffffff`ffffff80 : nt!RtlVirtualUnwind+0x25d
fffffa60`06cc6bc0 fffff800`024792bd : ffffffff`ffffff80 fffffa80`087848f0 fffffa60`09f2f570 fffff800`02409000 : nt!PspGetSetContextInternal+0x36a
fffffa60`06cc7110 fffff800`02488362 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspGetSetContextSpecialApc+0x9d
fffffa60`06cc7220 fffff800`0248c093 : fffffa60`06cc7340 00000000`00000000 00000000`00000000 fffffa80`087848f0 : nt!KiDeliverApc+0x1e2
fffffa60`06cc72c0 fffffa60`03459abe : fffffa80`071a8c70 fffffa80`08a63f20 fffffa80`04365054 fffffa60`00000000 : nt!KiApcInterrupt+0x103 (TrapFrame @ fffffa60`06cc72c0)
fffffa60`06cc7450 fffffa80`071a8c70 : fffffa80`08a63f20 fffffa80`04365054 fffffa60`00000000 fffa8006`11923002 : kl1+0x4babe
fffffa60`06cc7458 fffffa80`08a63f20 : fffffa80`04365054 fffffa60`00000000 fffa8006`11923002 fffffa60`034666ff : 0xfffffa80`071a8c70
fffffa60`06cc7460 fffffa80`04365054 : fffffa60`00000000 fffa8006`11923002 fffffa60`034666ff 00000000`00000000 : 0xfffffa80`08a63f20
fffffa60`06cc7468 fffffa60`00000000 : fffa8006`11923002 fffffa60`034666ff 00000000`00000000 fffffa80`028bf2e0 : 0xfffffa80`04365054
fffffa60`06cc7470 fffa8006`11923002 : fffffa60`034666ff 00000000`00000000 fffffa80`028bf2e0 fffffa80`06501b20 : 0xfffffa60`00000000
fffffa60`06cc7478 fffffa60`034666ff : 00000000`00000000 fffffa80`028bf2e0 fffffa80`06501b20 fffffa80`028bf170 : 0xfffa8006`11923002
fffffa60`06cc7480 00000000`00000000 : fffffa80`028bf2e0 fffffa80`06501b20 fffffa80`028bf170 fffffa80`028bf170 : kl1+0x586ff
fffffa60`06cc7488 fffffa80`028bf2e0 : fffffa80`06501b20 fffffa80`028bf170 fffffa80`028bf170 fffffa60`034573ce : 0x0
fffffa60`06cc7490 fffffa80`06501b20 : fffffa80`028bf170 fffffa80`028bf170 fffffa60`034573ce 00000000`01ffffff : 0xfffffa80`028bf2e0
fffffa60`06cc7498 fffffa80`028bf170 : fffffa80`028bf170 fffffa60`034573ce 00000000`01ffffff 00000000`00000040 : 0xfffffa80`06501b20
fffffa60`06cc74a0 fffffa80`028bf170 : fffffa60`034573ce 00000000`01ffffff 00000000`00000040 fffffa80`028bf010 : 0xfffffa80`028bf170
start             end                 module name
fffff800`02409000 fffff800`02921000   nt       ntkrnlmp.exe Sat Apr 26 01:56:07 2008 (4812C3F7)
fffff800`02921000 fffff800`02967000   hal      hal.dll      Sat Jan 19 02:55:25 2008 (4791ACED)
fffff960`000f0000 fffff960`003a1000   win32k   win32k.sys   Thu Feb 28 23:46:45 2008 (47C78E35)
fffff960`00410000 fffff960`0041a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`00660000 fffff960`00671000   cdd      cdd.dll      Fri Aug 01 23:40:21 2008 (4893D725)
fffff960`00870000 fffff960`008d1000   ATMFD    ATMFD.DLL    Sat Jan 19 01:08:00 2008 (479193C0)
fffffa60`0060e000 fffffa60`00618000   kdcom    kdcom.dll    Sat Jan 19 02:58:25 2008 (4791ADA1)
fffffa60`00618000 fffffa60`0062c000   PSHED    PSHED.dll    Sat Jan 19 02:58:13 2008 (4791AD95)
fffffa60`0062c000 fffffa60`00689000   CLFS     CLFS.SYS     Sat Jan 19 00:53:58 2008 (47919076)
fffffa60`00689000 fffffa60`0073b000   CI       CI.dll       Fri Feb 22 00:20:54 2008 (47BE5BB6)
fffffa60`0073b000 fffffa60`00798000   storport storport.sys Sat Jan 19 01:29:09 2008 (479198B5)
fffffa60`00798000 fffffa60`007ba000   nvstor64 nvstor64.sys Thu Aug 09 14:11:52 2007 (46BB58E8)
fffffa60`007ba000 fffffa60`00800000   fltmgr   fltmgr.sys   Sat Jan 19 00:54:10 2008 (47919082)
fffffa60`00803000 fffffa60`008dd000   Wdf01000 Wdf01000.sys Sat Jan 19 01:33:27 2008 (479199B7)
fffffa60`008dd000 fffffa60`008eb000   WDFLDR   WDFLDR.SYS   Sat Jan 19 01:32:33 2008 (47919981)
fffffa60`008eb000 fffffa60`0091b000   pci      pci.sys      Sat Jan 19 01:02:57 2008 (47919291)
fffffa60`0091b000 fffffa60`00981000   volmgrx  volmgrx.sys  Sat Jan 19 01:29:45 2008 (479198D9)
fffffa60`00981000 fffffa60`00991000   PCIIDEX  PCIIDEX.SYS  Sat Jan 19 01:28:53 2008 (479198A5)
fffffa60`00991000 fffffa60`009a4000   mountmgr mountmgr.sys Sat Jan 19 01:28:01 2008 (47919871)
fffffa60`009a4000 fffffa60`009ac000   atapi    atapi.sys    Sat Jan 19 01:28:49 2008 (479198A1)
fffffa60`009ac000 fffffa60`009d0000   ataport  ataport.SYS  Sat Jan 19 01:28:52 2008 (479198A4)
fffffa60`009d0000 fffffa60`009df000   nvstor   nvstor.sys   Tue Oct 03 20:24:56 2006 (4522FF58)
fffffa60`009df000 fffffa60`009f3000   fileinfo fileinfo.sys Sat Jan 19 01:05:23 2008 (47919323)
fffffa60`009f3000 fffffa60`009ff000   klbg     klbg.sys     Tue Jan 29 09:29:22 2008 (479F3842)
fffffa60`00a00000 fffffa60`00a07000   pciide   pciide.sys   Thu Nov 02 05:38:14 2006 (4549BC86)
fffffa60`00a07000 fffffa60`00b3b000   sptd     sptd.sys     Wed Mar 05 19:34:27 2008 (47CF3C13)
fffffa60`00b3b000 fffffa60`00b44000   WMILIB   WMILIB.SYS   Sat Jan 19 01:33:45 2008 (479199C9)
fffffa60`00b44000 fffffa60`00b72000   SCSIPORT SCSIPORT.SYS Sat Jan 19 01:28:52 2008 (479198A4)
fffffa60`00b72000 fffffa60`00bc8000   acpi     acpi.sys     Sat Jan 19 01:02:45 2008 (47919285)
fffffa60`00bc8000 fffffa60`00bd2000   msisadrv msisadrv.sys Sat Jan 19 01:02:50 2008 (4791928A)
fffffa60`00bd2000 fffffa60`00be7000   partmgr  partmgr.sys  Sat Jan 19 01:29:14 2008 (479198BA)
fffffa60`00be7000 fffffa60`00bfb000   volmgr   volmgr.sys   Sat Jan 19 01:29:12 2008 (479198B8)
fffffa60`00c00000 fffffa60`00c0c000   mouclass mouclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`00c0f000 fffffa60`00c94000   ksecdd   ksecdd.sys   Sat Jan 19 01:16:38 2008 (479195C6)
fffffa60`00c94000 fffffa60`00ce4000   msrpc    msrpc.sys    unavailable (00000000)
fffffa60`00ce4000 fffffa60`00d3c000   NETIO    NETIO.SYS    Sat Jan 19 01:37:27 2008 (47919AA7)
fffffa60`00d3c000 fffffa60`00d68000   CLASSPNP CLASSPNP.SYS Sat Jan 19 01:28:53 2008 (479198A5)
fffffa60`00d9d000 fffffa60`00db1000   amdk8    amdk8.sys    Sat Jan 19 00:52:45 2008 (4791902D)
fffffa60`00db1000 fffffa60`00dbe000   fdc      fdc.sys      unavailable (00000000)
fffffa60`00dbe000 fffffa60`00dda000   parport  parport.sys  Sat Jan 19 01:28:36 2008 (47919894)
fffffa60`00dda000 fffffa60`00df0000   i8042prt i8042prt.sys Sat Jan 19 01:28:08 2008 (47919878)
fffffa60`00df0000 fffffa60`00dfe000   kbdclass kbdclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`00e00000 fffffa60`00e0a000   VMkbd    VMkbd.sys    Fri May 16 02:53:12 2008 (482D2F58)
fffffa60`00e0c000 fffffa60`00fcf000   ndis     ndis.sys     Sat Jan 19 01:37:13 2008 (47919A99)
fffffa60`00fcf000 fffffa60`00ff8000   fvevol   fvevol.sys   Sat Jan 19 00:52:29 2008 (4791901D)
fffffa60`01000000 fffffa60`0100c000   tunnel   tunnel.sys   Sat Jan 19 01:36:44 2008 (47919A7C)
fffffa60`0100c000 fffffa60`01180000   tcpip    tcpip.sys    Sat Apr 26 02:33:23 2008 (4812CCB3)
fffffa60`01180000 fffffa60`011ac000   fwpkclnt fwpkclnt.sys Sat Jan 19 01:36:43 2008 (47919A7B)
fffffa60`011ac000 fffffa60`011d8000   ecache   ecache.sys   Sat Jan 19 01:30:39 2008 (4791990F)
fffffa60`011d8000 fffffa60`011ec000   disk     disk.sys     Sat Jan 19 01:29:02 2008 (479198AE)
fffffa60`011f6000 fffffa60`011ff000   tunmp    tunmp.sys    Sat Jan 19 01:36:30 2008 (47919A6E)
fffffa60`0120e000 fffffa60`01392000   Ntfs     Ntfs.sys     Sat Jan 19 00:55:29 2008 (479190D1)
fffffa60`01392000 fffffa60`013d6000   volsnap  volsnap.sys  Sat Jan 19 01:29:47 2008 (479198DB)
fffffa60`013d6000 fffffa60`013de000   spldr    spldr.sys    Thu Jun 21 20:57:56 2007 (467B1E94)
fffffa60`013de000 fffffa60`013f0000   mup      mup.sys      Sat Jan 19 00:54:18 2008 (4791908A)
fffffa60`013f0000 fffffa60`013fa000   crcdisk  crcdisk.sys  Thu Nov 02 05:39:40 2006 (4549BCDC)
fffffa60`013fa000 fffffa60`013fe500   BtHidBus BtHidBus.sys Thu Jul 31 08:44:08 2008 (4891B398)
fffffa60`0220e000 fffffa60`02376c80   nvmfdx64 nvmfdx64.sys Sat Nov 17 18:47:57 2007 (473F7DAD)
fffffa60`02377000 fffffa60`0239a000   rasl2tp  rasl2tp.sys  Sat Jan 19 01:37:33 2008 (47919AAD)
fffffa60`0239a000 fffffa60`023cb000   ndiswan  ndiswan.sys  Sat Jan 19 01:37:33 2008 (47919AAD)
fffffa60`023cb000 fffffa60`023e9000   raspptp  raspptp.sys  Sat Jan 19 01:37:34 2008 (47919AAE)
fffffa60`023e9000 fffffa60`023f1000   btnetdrv btnetdrv.sys Mon Jan 21 06:26:42 2008 (47948172)
fffffa60`02405000 fffffa60`02422000   serial   serial.sys   Sat Jan 19 01:28:41 2008 (47919899)
fffffa60`02422000 fffffa60`0242e000   serenum  serenum.sys  Sat Jan 19 01:28:36 2008 (47919894)
fffffa60`0242e000 fffffa60`02439000   usbohci  usbohci.sys  Sat Jan 19 01:33:56 2008 (479199D4)
fffffa60`02439000 fffffa60`0247f000   USBPORT  USBPORT.SYS  Sat Jan 19 01:34:00 2008 (479199D8)
fffffa60`0247f000 fffffa60`0248b000   klfltdev klfltdev.sys Thu Mar 13 11:02:30 2008 (47D94206)
fffffa60`0248b000 fffffa60`0249c000   usbehci  usbehci.sys  Sat Jan 19 01:33:57 2008 (479199D5)
fffffa60`0249c000 fffffa60`024af000   HDAudBus HDAudBus.sys Tue Nov 27 18:24:06 2007 (474CA716)
fffffa60`024af000 fffffa60`024cb000   cdrom    cdrom.sys    Sat Jan 19 01:29:04 2008 (479198B0)
fffffa60`024cb000 fffffa60`025aa000   dxgkrnl  dxgkrnl.sys  Fri Aug 01 21:19:59 2008 (4893B63F)
fffffa60`025aa000 fffffa60`025c2000   rassstp  rassstp.sys  Sat Jan 19 01:37:42 2008 (47919AB6)
fffffa60`025c2000 fffffa60`025e5000   drmk     drmk.sys     Sat Jan 19 02:20:04 2008 (4791A4A4)
fffffa60`02605000 fffffa60`02f3ca80   nvlddmkm nvlddmkm.sys Wed Sep 12 02:27:05 2007 (46E786B9)
fffffa60`02f3d000 fffffa60`02f4c000   watchdog watchdog.sys Sat Jan 19 01:07:23 2008 (4791939B)
fffffa60`02f4c000 fffffa60`02f90000   ai2b7au7 ai2b7au7.SYS Sun Jul 20 20:17:14 2008 (4883D58A)
fffffa60`02f90000 fffffa60`02f97c80   VcommMgr VcommMgr.sys Wed Jul 02 02:57:01 2008 (486B26BD)
fffffa60`02f98000 fffffa60`02f9e180   IvtBtBus IvtBtBus.sys Wed Jul 02 02:57:21 2008 (486B26D1)
fffffa60`02f9f000 fffffa60`02fd7000   msiscsi  msiscsi.sys  Sat Jan 19 01:30:31 2008 (47919907)
fffffa60`02fd7000 fffffa60`02fe4000   TDI      TDI.SYS      Sat Jan 19 01:38:11 2008 (47919AD3)
fffffa60`02fe4000 fffffa60`02ff0000   ndistapi ndistapi.sys Sat Jan 19 01:37:22 2008 (47919AA2)
fffffa60`02ff0000 fffffa60`03000000   raspppoe raspppoe.sys Sat Jan 19 01:37:30 2008 (47919AAA)
fffffa60`03000000 fffffa60`03005180   ksthunk  ksthunk.sys  Sat Jan 19 01:28:14 2008 (4791987E)
fffffa60`03007000 fffffa60`030a1000   rdpdr    rdpdr.sys    Sat Jan 19 01:43:38 2008 (47919C1A)
fffffa60`030a1000 fffffa60`030b3000   termdd   termdd.sys   Sat Jan 19 01:42:03 2008 (47919BBB)
fffffa60`030b3000 fffffa60`030b4480   swenum   swenum.sys   Thu Nov 02 05:37:33 2006 (4549BC5D)
fffffa60`030b5000 fffffa60`030e9000   ks       ks.sys       Sat Jan 19 01:28:24 2008 (47919888)
fffffa60`030e9000 fffffa60`030f4000   mssmbios mssmbios.sys Sat Jan 19 01:02:54 2008 (4791928E)
fffffa60`030f4000 fffffa60`03104000   umbus    umbus.sys    Sat Jan 19 01:34:16 2008 (479199E8)
fffffa60`03104000 fffffa60`0310c000   vmnetadapter vmnetadapter.sys Fri Mar 16 06:07:20 2007 (45FA6C58)
fffffa60`0310c000 fffffa60`03116000   VMNET    VMNET.SYS    Fri Mar 16 06:06:46 2007 (45FA6C36)
fffffa60`03116000 fffffa60`03121000   flpydisk flpydisk.sys Sat Jan 19 01:28:45 2008 (4791989D)
fffffa60`03121000 fffffa60`03168000   usbhub   usbhub.sys   Sat Jan 19 01:34:13 2008 (479199E5)
fffffa60`03168000 fffffa60`0317c000   NDProxy  NDProxy.SYS  Sat Jan 19 01:37:26 2008 (47919AA6)
fffffa60`0317c000 fffffa60`031c5000   HdAudio  HdAudio.sys  Wed Nov 01 21:48:10 2006 (45494E5A)
fffffa60`031c5000 fffffa60`03200000   portcls  portcls.sys  Sat Jan 19 01:33:58 2008 (479199D6)
fffffa60`03207000 fffffa60`0323f000   klif     klif.sys     Fri Jul 18 09:36:51 2008 (48809C73)
fffffa60`0323f000 fffffa60`03249000   Fs_Rec   Fs_Rec.SYS   unavailable (00000000)
fffffa60`03249000 fffffa60`03252000   Null     Null.SYS     unavailable (00000000)
fffffa60`03252000 fffffa60`03260000   vga      vga.sys      Sat Jan 19 01:32:21 2008 (47919975)
fffffa60`03260000 fffffa60`03285000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 01:32:25 2008 (47919979)
fffffa60`03285000 fffffa60`0328e000   RDPCDD   RDPCDD.sys   Sat Jan 19 01:42:04 2008 (47919BBC)
fffffa60`0328e000 fffffa60`03297000   rdpencdd rdpencdd.sys Sat Jan 19 01:42:03 2008 (47919BBB)
fffffa60`03297000 fffffa60`032a2000   Msfs     Msfs.SYS     unavailable (00000000)
fffffa60`032a2000 fffffa60`032b3000   Npfs     Npfs.SYS     Sat Jan 19 00:53:57 2008 (47919075)
fffffa60`032b3000 fffffa60`032bc000   rasacd   rasacd.sys   Sat Jan 19 01:37:30 2008 (47919AAA)
fffffa60`032bc000 fffffa60`032d9000   tdx      tdx.sys      Sat Jan 19 01:36:53 2008 (47919A85)
fffffa60`032d9000 fffffa60`032f4000   smb      smb.sys      Sat Jan 19 01:36:17 2008 (47919A61)
fffffa60`032f4000 fffffa60`03312000   pacer    pacer.sys    Fri Apr 04 21:55:46 2008 (47F6DC22)
fffffa60`03312000 fffffa60`03321000   netbios  netbios.sys  Sat Jan 19 01:36:35 2008 (47919A73)
fffffa60`03321000 fffffa60`0333c000   wanarp   wanarp.sys   Sat Jan 19 01:37:35 2008 (47919AAF)
fffffa60`0333c000 fffffa60`0338a000   rdbss    rdbss.sys    Sat Jan 19 00:55:09 2008 (479190BD)
fffffa60`0338a000 fffffa60`03400000   csc      csc.sys      Sat Jan 19 00:55:39 2008 (479190DB)
fffffa60`03400000 fffffa60`0340c000   nsiproxy nsiproxy.sys Sat Jan 19 01:36:45 2008 (47919A7D)
fffffa60`0340e000 fffffa60`03935000   kl1      kl1.sys      Mon Jul 21 10:33:52 2008 (48849E50)
fffffa60`03935000 fffffa60`039a2000   afd      afd.sys      Sat Jan 19 01:38:15 2008 (47919AD7)
fffffa60`039a2000 fffffa60`039e6000   netbt    netbt.sys    Sat Jan 19 01:36:24 2008 (47919A68)
fffffa60`039e6000 fffffa60`039f1000   ws2ifsl  ws2ifsl.sys  Sat Jan 19 01:37:46 2008 (47919ABA)
fffffa60`039f1000 fffffa60`039fa000   klim6    klim6.sys    Wed Jul 09 10:28:14 2008 (4874CAFE)
fffffa60`03c0f000 fffffa60`03c2c000   dfsc     dfsc.sys     Sat Jan 19 00:54:16 2008 (47919088)
fffffa60`03c2c000 fffffa60`03c48000   cdfs     cdfs.sys     Sat Jan 19 00:53:45 2008 (47919069)
fffffa60`03c48000 fffffa60`03c56000   crashdmp crashdmp.sys Sat Jan 19 01:28:59 2008 (479198AB)
fffffa60`03c56000 fffffa60`03c60000   dump_diskdump dump_diskdump.sys Sat Jan 19 01:28:58 2008 (479198AA)
fffffa60`03c60000 fffffa60`03c82000   dump_nvstor64 dump_nvstor64.sys Thu Aug 09 14:11:52 2007 (46BB58E8)
fffffa60`03c82000 fffffa60`03c95000   dump_dumpfve dump_dumpfve.sys Sat Jan 19 00:52:25 2008 (47919019)
fffffa60`03c95000 fffffa60`03ca1000   Dxapi    Dxapi.sys    Sat Jan 19 01:08:00 2008 (479193C0)
fffffa60`03ca1000 fffffa60`03cb4000   monitor  monitor.sys  Sat Jan 19 01:32:34 2008 (47919982)
fffffa60`03cb4000 fffffa60`03cd6000   luafv    luafv.sys    Sat Jan 19 00:59:06 2008 (479191AA)
fffffa60`03cdf000 fffffa60`03d79000   spsys    spsys.sys    Thu Jun 21 21:02:05 2007 (467B1F8D)
fffffa60`03d79000 fffffa60`03d84000   vmnetbridge vmnetbridge.sys Fri Mar 16 06:06:57 2007 (45FA6C41)
fffffa60`03d84000 fffffa60`03d98000   lltdio   lltdio.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`03d98000 fffffa60`03dcc000   nwifi    nwifi.sys    Mon May 19 22:33:46 2008 (4832388A)
fffffa60`03dcc000 fffffa60`03dd7000   ndisuio  ndisuio.sys  Sat Jan 19 01:36:29 2008 (47919A6D)
fffffa60`03dd7000 fffffa60`03def000   rspndr   rspndr.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`0780f000 fffffa60`078aa000   HTTP     HTTP.sys     Sat Jan 19 01:36:22 2008 (47919A66)
fffffa60`078aa000 fffffa60`078d2000   srvnet   srvnet.sys   Sat Jan 19 00:56:38 2008 (47919116)
fffffa60`078d2000 fffffa60`078f0000   bowser   bowser.sys   Sat Jan 19 00:54:51 2008 (479190AB)
fffffa60`078f0000 fffffa60`0790a000   mpsdrv   mpsdrv.sys   Sat Jan 19 01:35:28 2008 (47919A30)
fffffa60`0790a000 fffffa60`07931000   mrxdav   mrxdav.sys   Sat Jan 19 00:55:28 2008 (479190D0)
fffffa60`07931000 fffffa60`07959000   mrxsmb   mrxsmb.sys   Sat Jan 19 00:55:21 2008 (479190C9)
fffffa60`07959000 fffffa60`079a2000   mrxsmb10 mrxsmb10.sys Wed May 07 23:26:31 2008 (482272E7)
fffffa60`079a2000 fffffa60`079c1000   mrxsmb20 mrxsmb20.sys Sat Jan 19 00:55:19 2008 (479190C7)
fffffa60`079c1000 fffffa60`079f2000   srv2     srv2.sys     Sat Jan 19 00:56:40 2008 (47919118)
fffffa60`07a04000 fffffa60`07a98000   srv      srv.sys      Sat Jan 19 00:57:09 2008 (47919135)
fffffa60`07a98000 fffffa60`07aa6000   hcmon    hcmon.sys    Fri May 16 02:26:37 2008 (482D291D)
fffffa60`07aa6000 fffffa60`07aae000   VMparport VMparport.sys Fri May 16 02:25:13 2008 (482D28C9)
fffffa60`07aae000 fffffa60`07ba3000   vmx86    vmx86.sys    Fri May 16 02:01:56 2008 (482D2354)
fffffa60`08001000 fffffa60`080b7000   peauth   peauth.sys   Mon Oct 23 07:57:00 2006 (453CAE0C)
fffffa60`080b7000 fffffa60`080c2000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffffa60`080c2000 fffffa60`080d1000   tcpipreg tcpipreg.sys Sat Jan 19 01:37:01 2008 (47919A8D)
fffffa60`080d1000 fffffa60`080db000   vmnetuserif vmnetuserif.sys Fri May 16 02:29:17 2008 (482D29BD)
fffffa60`080db000 fffffa60`080e5000   vstor2   vstor2.sys   Fri Mar 23 13:02:01 2007 (46040809)
fffffa60`080e5000 fffffa60`080ef000   vstor2_ws60 vstor2-ws60.sys Fri Nov 30 20:11:20 2007 (4750B4B8)
fffffa60`080ef000 fffffa60`080fc000   tdtcp    tdtcp.sys    Sat Jan 19 01:42:03 2008 (47919BBB)
fffffa60`080fc000 fffffa60`0810a000   tssecsrv tssecsrv.sys Sat Jan 19 01:42:10 2008 (47919BC2)
fffffa60`0810a000 fffffa60`08146000   RDPWD    RDPWD.SYS    Sat Jan 19 01:42:20 2008 (47919BCC)

Unloaded modules:
fffffa60`03cd6000 fffffa60`03cdf000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`01200000 fffffa60`0120e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`011ec000 fffffa60`011f6000   dump_storpor
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`00d68000 fffffa60`00d8a000   dump_nvstor6
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`00d8a000 fffffa60`00d9d000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
0: kd> lmv, kl1
Unknown option ','
              ^ Syntax error in 'lmv, kl1'
0: kd> lmvm kl1
start             end                 module name
fffffa60`0340e000 fffffa60`03935000   kl1      T (no symbols)           
    Loaded symbol image file: kl1.sys
    Image path: \SystemRoot\system32\DRIVERS\kl1.sys
    Image name: kl1.sys
    Timestamp:        Mon Jul 21 10:33:52 2008 (48849E50)
    CheckSum:         0002E55F
    ImageSize:        00527000
    Translations:     0000.04b0 0000.04e0 0409.04b0 0409.04e0