BSOD STOP errors on Vista

wally15 · 04-29-2009, 03:13 PM

Hi all,

Since building my system a year ago I've been getting intermittent blue-screens. It doesn't seem to occur at any specific point, i.e. I'm not always running games or certain apps when it crashes.

My system:
Vista 64bit
Mobo: Gigabyte Technology GA-N650SLI-DS4L
Graphics cards: 2x NVIDIA GeForce 9600 GT in Sli format
RAM: 4gb DDR2
Cpu: Intel(R) Core(TM)2 Quad CPU Q9300 @ 2.50GHz (4 CPUs), ~23.7GHz
HDD: Western Digital 500Gb SATA2

I’ve tried taking out one of my graphics cards and tested each stick of ram by running my comp on them separately. It seems that my system is more stable with 3gb rather than 4gb, but STOP errors are just more infrequent, not none existent.

I’ve ran RAM testing utilities and HDD testing utilities to no avail. I installed the latest beta of windows 7 and it blue screened within half an hour. I have the latest drivers for everything I can think of.

It blue screens roughly once a week at the moment on vista with 3gb of ram in.

Any ideas? I've got a memory.dmp file from my system root, which I'll upload if its needed, but its 300mb so I'm presuming I'm missing a trick here?

Hope someone can help. Thanks.

usasma · 04-30-2009, 06:20 AM

Since the dump is so large, you'll have to run the debugger yourself (and post the results here). Here's instructions from my blog. It may appear intimidating, but just follow it step by step and you'll get results from it:

Code:

Please note that though this process may appear long and daunting, it has been explained in such a way so that the steps will be easy to follow.

A memory dump is what happens when Windows crashes. The memory is dumped into the pagefile and saved for the next reboot. Once Windows reboots, it reclaims the memory dump data from the pagefile and saves it to a file, which usually ends with the .dmp extension. Analyzing these dump files can help to figure out what's causing your system to crash. While they don't offer a "sure" fix, they provide clues to the cause of a crash so that we can work on fixing them. In my experience most system crashes are caused by faulty/corrupted drivers, malware, or hardware failures (in that order). Following the steps below will help us determine what may be causing your computer to Blue Screen, or crash.

A. The first thing to do when your system crashes is to reboot. Doing so will create the memory dump file so it's able to be accessed. Windows may also ask permission to send the file for online analysis. I suggest that you always allow it to be sent. Most times you won't get anything back, but occasionally it will point out the problem and save you a lot of work trying to determine it on your own. Also, quite often the first crash is the only crash as Windows will fix the problem when it reboots, so there's no need to worry unless Windows crashes repeatedly. If you can't get into Windows, either in normal or Safe Mode, then just post straight to the appopriate forum and we'll help you from there. The various forums that we help diagnose crashes are:

* Windows Vista Forum
* Windows XP Forum
* Windows 2000 Forum

B. The next thing to do is to ensure that you are free of malware. If malware is present on your computer, it may have corrupted your installation, and be the cause of your crashes. I suggest you perform one of the free online scans that can be found at the following link:

Free Online Malware Scanners

C. Once you have completed an online scan, or two, please search your hard drive for files ending with the .dmp extension. There are several types of memory dumps that Windows may create. These are distinguished below:

1. A complete memory dump or a kernel memory dump that are usually saved in the C:\Windows directory and named MEMORY.DMP.
2. A small memory dump, aka a minidump, which are usually saved in the C:\Windows\Minidump directory. These are named Miniwwxxyy-zz.dmp, where the ww is the number of the month, the xx is the number of the day, the yy is the number of the year, and the zz is the number of the crash dump that day. For example, a minidump with the name of Mini070108-03.dmp is the 3rd minidump generated on July 1, 2008.

On some systems the directories where the dump files are stored are protected by being Hidden and System files.

To show Hidden and System files in Windows Explorer, click on the Start button, then select All Programs, then select Accessories, and finally select Windows Explorer.

1. Once opened, select the Tools menu and then select the File Options menu item. In Vista you may have to press and hold the Alt key to view this menu.
2. Then go to the View tab and check the box labeled Show Hidden Files and Folders and uncheck Hide Protected Operating System Files
3. You will now be at a dialog that asks you if you're sure you want to do this. Click on the Yes button to allow the change to take place.
4. Then click the OK buttons at the prompts to exit the dialog. You will now be able to view hidden and system directories.

Warning - These files are hidden for a reason and messing with some of them may cause problems with your system.

D. Once you've located the memory dump file(s), then you'll have to get a debugger to analyze them. The one that I'm familiar with is the free Microsoft Debugging Tools for Windows. Download the version, 32 or 64 bit, that's appropriate for the operating system that you'll be running the debugger on. The debugger can be found at the following link: Debugging Tools for Windows

Once it's downloaded, double click on it to install it. Once it's installed, open the debugger by doing the following:

1. Click on the Start Menu.
2. Click on the All Programs menu.
3. Select the Debugging Tools for Windows program folder.
4. Click on the WinDbg icon to start the program.

Once you've opened the program, click on the File menu item, then on Symbol File Path.

E. In the window that opens, insert the exact text on the next line in the Symbol File Path box. This is a critical step, and if done incorrectly you'll end up with symbol errors:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

The easiest thing to do is copy the above bolded text and then paste it into the box. Once that is done, click on OK to exit the dialog. Next, click on File menu and then select the Save Workspace menu option. This will save the symbol path for future use.

NOTE: You MUST be connected to the internet in order to use the Symbol server listed above.

F. Next, click on the File menu and select the Open Crash Dump option. When the dialog box opens, click on the Browse button and browse to the location of the memory dump file and then double-click on it to load it into the Debugger. You may be prompted to save the workspace again, but just click on the No button. A window will now open and the dump file text will fill the debugging screen.

Here's an example of of an analysis report from a Minidump file. If this was a complete or kernel dump, it would be much larger.

Loading Dump File [C:\Users\FUBAR\Desktop\Mini070108-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Tue Jul 1 16:28:22.439 2008 (GMT-4)
System Uptime: 0 days 0:04:00.921
Loading Kernel Symbols
................................................................................
..................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 84c64731, f4fecc3c, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

G. The next step is to click on the !analyze -v link that's highlighted in blue in the report above (I'm starting to incorporate typing !analyze -v;r;kv;lmtn;lmtsmn;.bugcheck into the text box at the bottom of the debugger - thanks to jcgriff2. This is not reflected in the samples on this page). This will generate more information, which would look something like this:

Loading Dump File [C:\Users\FUBAR\Desktop\Mini070108-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Tue Jul 1 16:28:22.439 2008 (GMT-4)
System Uptime: 0 days 0:04:00.921
Loading Kernel Symbols
................................................................................
..................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 84c64731, f4fecc3c, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 84c64731, The address that the exception occurred at
Arg3: f4fecc3c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
+ffffffff84c64731
84c64731 ?? ???

TRAP_FRAME: f4fecc3c -- (.trap 0xfffffffff4fecc3c)
Unable to read trap frame at f4fecc3c

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 84c64731

STACK_TEXT:
f4feccac 00000000 00000000 01790000 00000000 0x84c64731

STACK_COMMAND: .trap 0xfffffffff4fecc3c ; kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0x8E_ANALYSIS_INCONCLUSIVE

BUCKET_ID: 0x8E_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

H. Once this is done, we want to copy the text of the dump file analysis report. To do this, select the Edit menu item in the Debugging Tools window and then select Copy Window Text to Clipboard. Now, return to Bleeping Computer and paste the information into your next post.

I. If you haven't started a topic for your issue yet, you can start one at the appropriate link below. Please be sure and let us know the make and model of your system along with the symptoms that you're experiencing.

* Windows Vista Forum
* Windows XP Forum
* Windows 2000 Forum

wally15 · 04-30-2009, 12:34 PM

Thanks for that. Much appreciated!

I have used the Microsoft Debugging Tools for Windows on one memory dump and two mini dump files.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dave\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`02051000 PsLoadedModuleList = 0xfffff800`02216db0
Debug session time: Mon Apr 27 23:09:25.784 2009 (GMT+1)
System Uptime: 0 days 4:52:39.500
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8000232c624, fffffa600d60dea0, 0}

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Probably caused by : hardware ( nt!IopParseDevice+a14 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000232c624, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600d60dea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

CONTEXT:  fffffa600d60dea0 -- (.cxr 0xfffffa600d60dea0)
rax=0000000080120089 rbx=0000000000000004 rcx=0000000080100080
rdx=fffffa80024afb00 rsi=fffffa800325cb10 rdi=fffffa800513d4a0
rip=fffff8000232c624 rsp=fffffa600d60e700 rbp=0000000000000040
 r8=00000000a0000003  r9=0000000000000001 r10=fffffa800513d4a0
r11=fffff8800bd7ae8e r12=0000000000000001 r13=fffffa80045880f8
r14=fffff88000004d80 r15=fffffa8004588010
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!IopParseDevice+0xa14:
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch] ds:002b:00000002`00400270=????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

LAST_CONTROL_TRANSFER:  from fffff80002325ec9 to fffff8000232c624

STACK_TEXT:  
fffffa60`0d60e700 fffff800`02325ec9 : fffffa80`0513d4a0 00000000`00000000 fffffa80`04588010 fffffa60`0d60e801 : nt!IopParseDevice+0xa14
fffffa60`0d60e8a0 fffff800`02329db4 : 00000000`00000000 fffffa80`0411b801 fffff880`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0d60e9b0 fffff800`02336360 : fffffa80`80100080 00000000`0b7be8a0 fffffa80`024afb01 fffff800`020ad2a9 : nt!ObOpenObjectByName+0x2f4
fffffa60`0d60ea80 fffff800`02336e98 : 00000000`0b7be7d8 fffff800`80100080 00000000`00000000 00000000`0b7be7c8 : nt!IopCreateFile+0x290
fffffa60`0d60eb20 fffff800`020a50f3 : ffffffff`ffffffff fffffa80`0458bbb0 00000000`26e8df74 00000000`0b7be7f8 : nt!NtCreateFile+0x78
fffffa60`0d60ebb0 00000000`77215fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0b7be748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77215fca


FOLLOWUP_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopParseDevice+a14

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffffa600d60dea0 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dave\Desktop\Mini042409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`0205d000 PsLoadedModuleList = 0xfffff800`02222db0
Debug session time: Fri Apr 24 22:46:33.160 2009 (GMT+1)
System Uptime: 0 days 4:30:32.250
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffffa60036c218c, fffffa600b8d7c80, 0}

Probably caused by : hardware ( afd!AfdCreate+32c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffffa60036c218c, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600b8d7c80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
afd!AfdCreate+32c
fffffa60`036c218c 1f              ???

CONTEXT:  fffffa600b8d7c80 -- (.cxr 0xfffffa600b8d7c80)
rax=0000000000000000 rbx=fffffa800303ea30 rcx=0000000000000002
rdx=00000000000084e0 rsi=fffffa8002f16490 rdi=000000000000000f
rip=fffffa60036c218c rsp=fffffa600b8d84e0 rbp=fffffa800312a3f0
 r8=0000000000000006  r9=000000000000001a r10=0000000000000001
r11=0000000000000014 r12=fffffa800312a598 r13=00000000ffffffff
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
afd!AfdCreate+0x32c:
fffffa60`036c218c 1f              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
afd!AfdCreate+32c
fffffa60`036c218c 1f              ???

LAST_CONTROL_TRANSFER:  from fffffa60036d147c to fffffa60036c218c

STACK_TEXT:  
fffffa60`0b8d84e0 fffffa60`036d147c : fffffa80`06699a00 00000000`00000005 fffffa80`06699a00 fffffa80`0312a5e0 : afd!AfdCreate+0x32c
fffffa60`0b8d86c0 fffff800`023381f3 : 00000000`00000005 fffffa80`02f16490 00000000`00000042 00000000`00000000 : afd!AfdDispatch+0x5c
fffffa60`0b8d8700 fffff800`02331ec9 : fffffa80`06699a00 00000000`00000000 fffffa80`078bc6a0 fffffa60`0b8d8c01 : nt!IopParseDevice+0x5e3
fffffa60`0b8d88a0 fffff800`02335db4 : 00000000`00000000 fffffa80`07e38d01 00000000`00000042 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0b8d89b0 fffff800`02342360 : 00000000`c0140000 00000000`03c9e330 00000000`00000001 fffff800`020b92a9 : nt!ObOpenObjectByName+0x2f4
fffffa60`0b8d8a80 fffff800`02342e98 : 00000000`03c9e268 fffff800`c0140000 00000000`00000000 00000000`03c9e258 : nt!IopCreateFile+0x290
fffffa60`0b8d8b20 fffff800`020b10f3 : fffff880`0b061e20 fffffa80`02ff7bb0 00000000`00002be0 fffff800`0232f334 : nt!NtCreateFile+0x78
fffffa60`0b8d8bb0 00000000`76ed5fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03c9e1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ed5fca


FOLLOWUP_IP: 
afd!AfdCreate+32c
fffffa60`036c218c 1f              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  afd!AfdCreate+32c

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffffa600b8d7c80 ; kb

MODULE_NAME: hardware

IMAGE_NAME:  hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dave\Desktop\Mini042709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`02051000 PsLoadedModuleList = 0xfffff800`02216db0
Debug session time: Mon Apr 27 23:09:25.784 2009 (GMT+1)
System Uptime: 0 days 4:52:39.500
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8000232c624, fffffa600d60dea0, 0}

Probably caused by : hardware ( nt!IopParseDevice+a14 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000232c624, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600d60dea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

CONTEXT:  fffffa600d60dea0 -- (.cxr 0xfffffa600d60dea0)
rax=0000000080120089 rbx=0000000000000004 rcx=0000000080100080
rdx=fffffa80024afb00 rsi=fffffa800325cb10 rdi=fffffa800513d4a0
rip=fffff8000232c624 rsp=fffffa600d60e700 rbp=0000000000000040
 r8=00000000a0000003  r9=0000000000000001 r10=fffffa800513d4a0
r11=fffff8800bd7ae8e r12=0000000000000001 r13=fffffa80045880f8
r14=fffff88000004d80 r15=fffffa8004588010
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!IopParseDevice+0xa14:
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch] ds:002b:00000002`00400270=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

LAST_CONTROL_TRANSFER:  from fffff80002325ec9 to fffff8000232c624

STACK_TEXT:  
fffffa60`0d60e700 fffff800`02325ec9 : fffffa80`0513d4a0 00000000`00000000 fffffa80`04588010 fffffa60`0d60e801 : nt!IopParseDevice+0xa14
fffffa60`0d60e8a0 fffff800`02329db4 : 00000000`00000000 fffffa80`0411b801 fffff880`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0d60e9b0 fffff800`02336360 : fffffa80`80100080 00000000`0b7be8a0 fffffa80`024afb01 fffff800`020ad2a9 : nt!ObOpenObjectByName+0x2f4
fffffa60`0d60ea80 fffff800`02336e98 : 00000000`0b7be7d8 fffff800`80100080 00000000`00000000 00000000`0b7be7c8 : nt!IopCreateFile+0x290
fffffa60`0d60eb20 fffff800`020a50f3 : ffffffff`ffffffff fffffa80`0458bbb0 00000000`26e8df74 00000000`0b7be7f8 : nt!NtCreateFile+0x78
fffffa60`0d60ebb0 00000000`77215fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0b7be748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77215fca


FOLLOWUP_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopParseDevice+a14

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffffa600d60dea0 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

If anyone could take a look at these it would be a great help

**jcgriff2** · 04-30-2009, 11:18 PM

Hi -

Not enough info in dbug logs. Use !analyze -v;r;kv;lmtn;lmtsmn at kd> command line and re-post dbug logs.

I see exception codes 0xc0000005 (memory access violation) and 0xc000001d (illegal instruction.

For info, those are full kernel dumps. You should also have mini kernel dumps in c:\windows\minidump.

Run the driver verifier to help flush out the culprit, assuming software is the cause. D/V instructions can be found HERE.

Regards. . .

jcgriff2

.

wally15 · 05-01-2009, 12:29 PM

Thank you for your input jcgriff2.

I used !analyze -v;r;kv;lmtn;lmtsmn at kd> command line as you instructed on the main memory.dmp

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dave\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`02051000 PsLoadedModuleList = 0xfffff800`02216db0
Debug session time: Mon Apr 27 23:09:25.784 2009 (GMT+1)
System Uptime: 0 days 4:52:39.500
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8000232c624, fffffa600d60dea0, 0}

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Probably caused by : hardware ( nt!IopParseDevice+a14 )

Followup: MachineOwner
---------

2: kd> !analyze -v;r;kv;lmtn;lmtsmn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000232c624, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600d60dea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

CONTEXT:  fffffa600d60dea0 -- (.cxr 0xfffffa600d60dea0)
rax=0000000080120089 rbx=0000000000000004 rcx=0000000080100080
rdx=fffffa80024afb00 rsi=fffffa800325cb10 rdi=fffffa800513d4a0
rip=fffff8000232c624 rsp=fffffa600d60e700 rbp=0000000000000040
 r8=00000000a0000003  r9=0000000000000001 r10=fffffa800513d4a0
r11=fffff8800bd7ae8e r12=0000000000000001 r13=fffffa80045880f8
r14=fffff88000004d80 r15=fffffa8004588010
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!IopParseDevice+0xa14:
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch] ds:002b:00000002`00400270=????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

LAST_CONTROL_TRANSFER:  from fffff80002325ec9 to fffff8000232c624

STACK_TEXT:  
fffffa60`0d60e700 fffff800`02325ec9 : fffffa80`0513d4a0 00000000`00000000 fffffa80`04588010 fffffa60`0d60e801 : nt!IopParseDevice+0xa14
fffffa60`0d60e8a0 fffff800`02329db4 : 00000000`00000000 fffffa80`0411b801 fffff880`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0d60e9b0 fffff800`02336360 : fffffa80`80100080 00000000`0b7be8a0 fffffa80`024afb01 fffff800`020ad2a9 : nt!ObOpenObjectByName+0x2f4
fffffa60`0d60ea80 fffff800`02336e98 : 00000000`0b7be7d8 fffff800`80100080 00000000`00000000 00000000`0b7be7c8 : nt!IopCreateFile+0x290
fffffa60`0d60eb20 fffff800`020a50f3 : ffffffff`ffffffff fffffa80`0458bbb0 00000000`26e8df74 00000000`0b7be7f8 : nt!NtCreateFile+0x78
fffffa60`0d60ebb0 00000000`77215fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0b7be748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77215fca


FOLLOWUP_IP: 
nt!IopParseDevice+a14
fffff800`0232c624 ff448b6c        inc     dword ptr [rbx+rcx*4+6Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!IopParseDevice+a14

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffffa600d60dea0 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

rax=fffffa600d60d5f0 rbx=fffffa600d60ec20 rcx=000000000000003b
rdx=00000000c0000005 rsi=fffff800020a50f3 rdi=fffff80002254de8
rip=fffff800020a5650 rsp=fffffa600d60d4e8 rbp=fffffa600d60e4c8
 r8=fffff8000232c624  r9=fffffa600d60dea0 r10=0000000000000000
r11=0000000000000001 r12=fffffa600d607000 r13=fffffa600d60f000
r14=fffff80002051000 r15=fffff8000219f4ec
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!KeBugCheckEx:
fffff800`020a5650 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffa60`0d60d4f0=000000000000003b
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`0d60d4e8 fffff800`020a53ee : 00000000`0000003b 00000000`c0000005 fffff800`0232c624 fffffa60`0d60dea0 : nt!KeBugCheckEx
fffffa60`0d60d4f0 fffff800`020a4dbc : fffffa60`0d60e4c8 fffffa60`0d60dea0 fffff800`021a9708 fffff800`02051000 : nt!KiBugCheckDispatch+0x6e
fffffa60`0d60d630 fffff800`020b89cd : 00000000`00000000 fffff800`02051000 fffffa60`0d60f000 fffff800`02254de8 : nt!KiSystemServiceHandler+0x7c
fffffa60`0d60d670 fffff800`020bffef : fffffa60`00000001 00000000`00000001 00000000`00000000 fffffa60`0d60ec20 : nt!RtlpExecuteHandlerForException+0xd
fffffa60`0d60d6a0 fffff800`0207dda3 : fffffa60`0d60e4c8 fffffa60`0d60dea0 00000000`00000000 fffffa60`0d60e570 : nt!RtlDispatchException+0x22f
fffffa60`0d60dd90 fffff800`020a54a9 : fffffa60`0d60e4c8 00000000`00000004 fffffa60`0d60e570 fffffa80`0325cb10 : nt!KiDispatchException+0xc3
fffffa60`0d60e390 fffff800`020a42a5 : 00000000`00000001 fffff880`00e1ebd0 fffffa80`04076b00 00000000`00000004 : nt!KiExceptionDispatch+0xa9
fffffa60`0d60e570 fffff800`0232c624 : 00000000`00000004 00000000`00000040 fffffa80`0325cb10 00000000`00000001 : nt!KiPageFault+0x1e5 (TrapFrame @ fffffa60`0d60e570)
fffffa60`0d60e700 fffff800`02325ec9 : fffffa80`0513d4a0 00000000`00000000 fffffa80`04588010 fffffa60`0d60e801 : nt!IopParseDevice+0xa14
fffffa60`0d60e8a0 fffff800`02329db4 : 00000000`00000000 fffffa80`0411b801 fffff880`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x5eb
fffffa60`0d60e9b0 fffff800`02336360 : fffffa80`80100080 00000000`0b7be8a0 fffffa80`024afb01 fffff800`020ad2a9 : nt!ObOpenObjectByName+0x2f4
fffffa60`0d60ea80 fffff800`02336e98 : 00000000`0b7be7d8 fffff800`80100080 00000000`00000000 00000000`0b7be7c8 : nt!IopCreateFile+0x290
fffffa60`0d60eb20 fffff800`020a50f3 : ffffffff`ffffffff fffffa80`0458bbb0 00000000`26e8df74 00000000`0b7be7f8 : nt!NtCreateFile+0x78
fffffa60`0d60ebb0 00000000`77215fca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`0d60ec20)
00000000`0b7be748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77215fca
start             end                 module name
fffff800`0200b000 fffff800`02051000   hal      hal.dll      Sat Jan 19 07:55:25 2008 (4791ACED)
fffff800`02051000 fffff800`02569000   nt       ntkrnlmp.exe Tue Mar 03 02:20:17 2009 (49AC93E1)
fffff960`00010000 fffff960`002c1000   win32k   win32k.sys   Mon Feb 09 03:30:51 2009 (498FA36B)
fffff960`00440000 fffff960`0044a000   TSDDD    TSDDD.dll    Sat Jan 19 06:42:04 2008 (47919BBC)
fffff960`00610000 fffff960`00621000   cdd      cdd.dll      Sat Aug 02 04:40:21 2008 (4893D725)
fffff960`00890000 fffff960`008f1000   ATMFD    ATMFD.DLL    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`0060b000 fffffa60`00615000   kdcom    kdcom.dll    Sat Jan 19 07:58:25 2008 (4791ADA1)
fffffa60`00615000 fffffa60`00642000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Jan 19 07:56:17 2008 (4791AD21)
fffffa60`00642000 fffffa60`00656000   PSHED    PSHED.dll    Sat Jan 19 07:58:13 2008 (4791AD95)
fffffa60`00656000 fffffa60`006b3000   CLFS     CLFS.SYS     Sat Jan 19 05:53:58 2008 (47919076)
fffffa60`006b3000 fffffa60`00765000   CI       CI.dll       Fri Feb 22 05:20:54 2008 (47BE5BB6)
fffffa60`00765000 fffffa60`007cb000   volmgrx  volmgrx.sys  Sat Jan 19 06:29:45 2008 (479198D9)
fffffa60`007cb000 fffffa60`007f7000   CLASSPNP CLASSPNP.SYS Sat Jan 19 06:28:53 2008 (479198A5)
fffffa60`0080f000 fffffa60`008e9000   Wdf01000 Wdf01000.sys Sat Jan 19 06:33:27 2008 (479199B7)
fffffa60`008e9000 fffffa60`008f7000   WDFLDR   WDFLDR.SYS   Sat Jan 19 06:32:33 2008 (47919981)
fffffa60`008f7000 fffffa60`0094d000   acpi     acpi.sys     Sat Jan 19 06:02:45 2008 (47919285)
fffffa60`0094d000 fffffa60`00956000   WMILIB   WMILIB.SYS   Sat Jan 19 06:33:45 2008 (479199C9)
fffffa60`00956000 fffffa60`00960000   msisadrv msisadrv.sys Sat Jan 19 06:02:50 2008 (4791928A)
fffffa60`00960000 fffffa60`00990000   pci      pci.sys      Sat Jan 19 06:02:57 2008 (47919291)
fffffa60`00990000 fffffa60`009a5000   partmgr  partmgr.sys  Sat Jan 19 06:29:14 2008 (479198BA)
fffffa60`009a5000 fffffa60`009b9000   volmgr   volmgr.sys   Sat Jan 19 06:29:12 2008 (479198B8)
fffffa60`009b9000 fffffa60`009c0000   pciide   pciide.sys   Thu Nov 02 09:38:14 2006 (4549BC86)
fffffa60`009c0000 fffffa60`009d0000   PCIIDEX  PCIIDEX.SYS  Sat Jan 19 06:28:53 2008 (479198A5)
fffffa60`009d0000 fffffa60`009f3000   nvraid   nvraid.sys   Wed Jun 06 21:34:01 2007 (46671A39)
fffffa60`00a07000 fffffa60`00a30000   nvrd64   nvrd64.sys   Sat Dec 23 04:07:29 2006 (458CAB81)
fffffa60`00a30000 fffffa60`00a43000   mountmgr mountmgr.sys Sat Jan 19 06:28:01 2008 (47919871)
fffffa60`00a43000 fffffa60`00a4b000   atapi    atapi.sys    Sat Jan 19 06:28:49 2008 (479198A1)
fffffa60`00a4b000 fffffa60`00a6f000   ataport  ataport.SYS  Sat Jan 19 06:28:52 2008 (479198A4)
fffffa60`00a6f000 fffffa60`00a7f000   nvstor   nvstor.sys   Wed Jun 06 21:34:00 2007 (46671A38)
fffffa60`00a7f000 fffffa60`00adc000   storport storport.sys Sat Jan 19 06:29:09 2008 (479198B5)
fffffa60`00adc000 fffffa60`00b08000   nvstor64 nvstor64.sys Thu Nov 13 00:57:58 2008 (491B7B96)
fffffa60`00b08000 fffffa60`00b4e000   fltmgr   fltmgr.sys   Sat Jan 19 05:54:10 2008 (47919082)
fffffa60`00b4e000 fffffa60`00b62000   fileinfo fileinfo.sys Sat Jan 19 06:05:23 2008 (47919323)
fffffa60`00b62000 fffffa60`00b6d700   PxHlpa64 PxHlpa64.sys Wed Oct 17 19:25:02 2007 (4716537E)
fffffa60`00b6e000 fffffa60`00bf3000   ksecdd   ksecdd.sys   Sat Jan 19 06:16:38 2008 (479195C6)
fffffa60`00c08000 fffffa60`00dcb000   ndis     ndis.sys     Sat Jan 19 06:37:13 2008 (47919A99)
fffffa60`00dcb000 fffffa60`00dde000   HDAudBus HDAudBus.sys Tue Nov 27 23:24:06 2007 (474CA716)
fffffa60`00dde000 fffffa60`00e00000   luafv    luafv.sys    Sat Jan 19 05:59:06 2008 (479191AA)
fffffa60`00e00000 fffffa60`00e50000   msrpc    msrpc.sys    unavailable (FFFFFFFE)
fffffa60`00e50000 fffffa60`00ea8000   NETIO    NETIO.SYS    Sat Jan 19 06:37:27 2008 (47919AA7)
fffffa60`00ea8000 fffffa60`00ebc000   disk     disk.sys     Sat Jan 19 06:29:02 2008 (479198AE)
fffffa60`00ebc000 fffffa60`00ee8000   dump_nvstor64 dump_nvstor64.sys Thu Nov 13 00:57:58 2008 (491B7B96)
fffffa60`00ef6000 fffffa60`00f02000   tunnel   tunnel.sys   Sat Jan 19 06:36:44 2008 (47919A7C)
fffffa60`00f02000 fffffa60`00f0b000   tunmp    tunmp.sys    Sat Jan 19 06:36:30 2008 (47919A6E)
fffffa60`00f0b000 fffffa60`00f1e000   intelppm intelppm.sys Sat Jan 19 05:52:45 2008 (4791902D)
fffffa60`00f1e000 fffffa60`00ffd000   dxgkrnl  dxgkrnl.sys  Sat Aug 02 02:19:59 2008 (4893B63F)
fffffa60`01000000 fffffa60`01174000   tcpip    tcpip.sys    Sat Apr 26 07:33:23 2008 (4812CCB3)
fffffa60`01174000 fffffa60`011a0000   fwpkclnt fwpkclnt.sys Sat Jan 19 06:36:43 2008 (47919A7B)
fffffa60`011a0000 fffffa60`011d3000   snapman  snapman.sys  Fri Oct 06 14:43:53 2006 (45265D99)
fffffa60`011d3000 fffffa60`011ff000   ecache   ecache.sys   Sat Jan 19 06:30:39 2008 (4791990F)
fffffa60`0120c000 fffffa60`01390000   Ntfs     Ntfs.sys     Sat Jan 19 05:55:29 2008 (479190D1)
fffffa60`01390000 fffffa60`013d4000   volsnap  volsnap.sys  Sat Jan 19 06:29:47 2008 (479198DB)
fffffa60`013d4000 fffffa60`013dc000   spldr    spldr.sys    Fri Jun 22 01:57:56 2007 (467B1E94)
fffffa60`013dc000 fffffa60`013ee000   mup      mup.sys      Sat Jan 19 05:54:18 2008 (4791908A)
fffffa60`013ee000 fffffa60`013f8000   crcdisk  crcdisk.sys  Sat Jan 19 06:30:12 2008 (479198F4)
fffffa60`0220d000 fffffa60`02379180   nvmfdx64 nvmfdx64.sys Fri Aug 01 19:38:28 2008 (48935824)
fffffa60`0237a000 fffffa60`02387000   fdc      fdc.sys      unavailable (FFFFFFFE)
fffffa60`02387000 fffffa60`023a4000   serial   serial.sys   Sat Jan 19 06:28:41 2008 (47919899)
fffffa60`023a4000 fffffa60`023b0000   serenum  serenum.sys  Sat Jan 19 06:28:36 2008 (47919894)
fffffa60`023b0000 fffffa60`023cc000   parport  parport.sys  Sat Jan 19 06:28:36 2008 (47919894)
fffffa60`023cc000 fffffa60`023e2000   i8042prt i8042prt.sys Sat Jan 19 06:28:08 2008 (47919878)
fffffa60`023e2000 fffffa60`023f0000   kbdclass kbdclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`02806000 fffffa60`03153c80   nvlddmkm nvlddmkm.sys Thu Nov 13 00:22:43 2008 (491B7353)
fffffa60`03154000 fffffa60`03155400   nvBridge nvBridge.kmd Wed Nov 12 23:27:47 2008 (491B6673)
fffffa60`03156000 fffffa60`03165000   watchdog watchdog.sys Sat Jan 19 06:07:23 2008 (4791939B)
fffffa60`03165000 fffffa60`03170000   usbohci  usbohci.sys  Sat Jan 19 06:33:56 2008 (479199D4)
fffffa60`03170000 fffffa60`031b6000   USBPORT  USBPORT.SYS  Sat Jan 19 06:34:00 2008 (479199D8)
fffffa60`031b6000 fffffa60`031c7000   usbehci  usbehci.sys  Sat Jan 19 06:33:57 2008 (479199D5)
fffffa60`031c7000 fffffa60`031e3000   cdrom    cdrom.sys    Sat Jan 19 06:29:04 2008 (479198B0)
fffffa60`031e3000 fffffa60`031ee000   GEARAspiWDM GEARAspiWDM.sys Thu Mar 19 15:34:13 2009 (49C265F5)
fffffa60`03208000 fffffa60`03240000   msiscsi  msiscsi.sys  Sat Jan 19 06:30:31 2008 (47919907)
fffffa60`03240000 fffffa60`0324d000   TDI      TDI.SYS      Sat Jan 19 06:38:11 2008 (47919AD3)
fffffa60`0324d000 fffffa60`03270000   rasl2tp  rasl2tp.sys  Sat Jan 19 06:37:33 2008 (47919AAD)
fffffa60`03270000 fffffa60`0327c000   ndistapi ndistapi.sys Sat Jan 19 06:37:22 2008 (47919AA2)
fffffa60`0327c000 fffffa60`032ad000   ndiswan  ndiswan.sys  Sat Jan 19 06:37:33 2008 (47919AAD)
fffffa60`032ad000 fffffa60`032bd000   raspppoe raspppoe.sys Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`032bd000 fffffa60`032db000   raspptp  raspptp.sys  Sat Jan 19 06:37:34 2008 (47919AAE)
fffffa60`032db000 fffffa60`032f3000   rassstp  rassstp.sys  Sat Jan 19 06:37:42 2008 (47919AB6)
fffffa60`032f3000 fffffa60`03305000   termdd   termdd.sys   Sat Jan 19 06:42:03 2008 (47919BBB)
fffffa60`03305000 fffffa60`03311000   mouclass mouclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`03311000 fffffa60`03312480   swenum   swenum.sys   Thu Nov 02 09:37:33 2006 (4549BC5D)
fffffa60`03313000 fffffa60`03347000   ks       ks.sys       Sat Jan 19 06:28:24 2008 (47919888)
fffffa60`03347000 fffffa60`03352000   mssmbios mssmbios.sys Sat Jan 19 06:02:54 2008 (4791928E)
fffffa60`03352000 fffffa60`03362000   umbus    umbus.sys    Sat Jan 19 06:34:16 2008 (479199E8)
fffffa60`03362000 fffffa60`033a9000   usbhub   usbhub.sys   Sat Jan 19 06:34:13 2008 (479199E5)
fffffa60`033a9000 fffffa60`033b4000   flpydisk flpydisk.sys unavailable (FFFFFFFE)
fffffa60`033b4000 fffffa60`033c8000   NDProxy  NDProxy.SYS  Sat Jan 19 06:37:26 2008 (47919AA6)
fffffa60`033c8000 fffffa60`033eb000   drmk     drmk.sys     Sat Jan 19 07:20:04 2008 (4791A4A4)
fffffa60`03406000 fffffa60`035a6680   RTKVHD64 RTKVHD64.sys Tue Feb 17 08:52:52 2009 (499A7AE4)
fffffa60`035a7000 fffffa60`035e2000   portcls  portcls.sys  Sat Jan 19 06:33:58 2008 (479199D6)
fffffa60`035e2000 fffffa60`035e7180   ksthunk  ksthunk.sys  Sat Jan 19 06:28:14 2008 (4791987E)
fffffa60`035e8000 fffffa60`035fb000   monitor  monitor.sys  Sat Jan 19 06:32:34 2008 (47919982)
fffffa60`03603000 fffffa60`03627000   savonaccess savonaccess.sys Mon Jan 05 11:44:09 2009 (4961F289)
fffffa60`03627000 fffffa60`03631000   Fs_Rec   Fs_Rec.SYS   unavailable (FFFFFFFE)
fffffa60`03631000 fffffa60`0363a000   Null     Null.SYS     unavailable (FFFFFFFE)
fffffa60`03644000 fffffa60`0364bb80   HIDPARSE HIDPARSE.SYS Sat Jan 19 06:33:51 2008 (479199CF)
fffffa60`0364c000 fffffa60`0365a000   vga      vga.sys      Sat Jan 19 06:32:21 2008 (47919975)
fffffa60`0365a000 fffffa60`0367f000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 06:32:25 2008 (47919979)
fffffa60`0367f000 fffffa60`03688000   RDPCDD   RDPCDD.sys   Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`03688000 fffffa60`03691000   rdpencdd rdpencdd.sys Sat Jan 19 06:42:03 2008 (47919BBB)
fffffa60`03691000 fffffa60`0369c000   Msfs     Msfs.SYS     unavailable (FFFFFFFE)
fffffa60`0369c000 fffffa60`036ad000   Npfs     Npfs.SYS     Sat Jan 19 05:53:57 2008 (47919075)
fffffa60`036ad000 fffffa60`036b6000   rasacd   rasacd.sys   Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`036b6000 fffffa60`036d3000   tdx      tdx.sys      Sat Jan 19 06:36:53 2008 (47919A85)
fffffa60`036d3000 fffffa60`036ee000   smb      smb.sys      Sat Jan 19 06:36:17 2008 (47919A61)
fffffa60`036ee000 fffffa60`0375b000   afd      afd.sys      Sat Jan 19 06:38:15 2008 (47919AD7)
fffffa60`0375b000 fffffa60`0379f000   netbt    netbt.sys    Sat Jan 19 06:36:24 2008 (47919A68)
fffffa60`0379f000 fffffa60`037aa000   ws2ifsl  ws2ifsl.sys  Sat Jan 19 06:37:46 2008 (47919ABA)
fffffa60`037aa000 fffffa60`037c8000   pacer    pacer.sys    Sat Apr 05 02:55:46 2008 (47F6DC22)
fffffa60`037c8000 fffffa60`037d7000   netbios  netbios.sys  Sat Jan 19 06:36:35 2008 (47919A73)
fffffa60`037d7000 fffffa60`037f2000   wanarp   wanarp.sys   Sat Jan 19 06:37:35 2008 (47919AAF)
fffffa60`03806000 fffffa60`03854000   rdbss    rdbss.sys    Sat Jan 19 05:55:09 2008 (479190BD)
fffffa60`03854000 fffffa60`03860000   nsiproxy nsiproxy.sys Sat Jan 19 06:36:45 2008 (47919A7D)
fffffa60`03860000 fffffa60`0387c000   ISODrv64 ISODrv64.sys Sat Nov 03 03:21:18 2007 (472BE92E)
fffffa60`0387c000 fffffa60`0391b000   netr7364 netr7364.sys Fri Feb 27 08:50:39 2009 (49A7A95F)
fffffa60`0391b000 fffffa60`0391ce00   USBD     USBD.SYS     Sat Jan 19 06:33:53 2008 (479199D1)
fffffa60`0391d000 fffffa60`0393a000   dfsc     dfsc.sys     Sat Jan 19 05:54:16 2008 (47919088)
fffffa60`0393a000 fffffa60`03943000   hidusb   hidusb.sys   Sat Jan 19 06:33:54 2008 (479199D2)
fffffa60`03943000 fffffa60`03955000   HIDCLASS HIDCLASS.SYS Sat Jan 19 06:33:52 2008 (479199D0)
fffffa60`03955000 fffffa60`03960000   mouhid   mouhid.sys   Sat Jan 19 06:28:10 2008 (4791987A)
fffffa60`03960000 fffffa60`0397c000   cdfs     cdfs.sys     Sat Jan 19 05:53:45 2008 (47919069)
fffffa60`0397c000 fffffa60`039ca000   udfs     udfs.sys     Sat Jan 19 05:53:53 2008 (47919071)
fffffa60`039ca000 fffffa60`039d8000   crashdmp crashdmp.sys Sat Jan 19 06:28:59 2008 (479198AB)
fffffa60`039d8000 fffffa60`039e2000   dump_diskdump dump_diskdump.sys Sat Jan 19 06:28:58 2008 (479198AA)
fffffa60`039e2000 fffffa60`039ee000   Dxapi    Dxapi.sys    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`09c01000 fffffa60`09c9b000   spsys    spsys.sys    Fri Jun 22 02:02:05 2007 (467B1F8D)
fffffa60`09c9b000 fffffa60`09ca6000   asyncmac asyncmac.sys Sat Jan 19 06:37:27 2008 (47919AA7)
fffffa60`09ca6000 fffffa60`09cba000   lltdio   lltdio.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`09cba000 fffffa60`09cee000   nwifi    nwifi.sys    Tue May 20 03:33:46 2008 (4832388A)
fffffa60`09cee000 fffffa60`09cf9000   ndisuio  ndisuio.sys  Sat Jan 19 06:36:29 2008 (47919A6D)
fffffa60`09cf9000 fffffa60`09d11000   rspndr   rspndr.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`09d11000 fffffa60`09dac000   HTTP     HTTP.sys     Sat Jan 19 06:36:22 2008 (47919A66)
fffffa60`09dac000 fffffa60`09dd4000   srvnet   srvnet.sys   Sat Jan 19 05:56:38 2008 (47919116)
fffffa60`09dd4000 fffffa60`09df2000   bowser   bowser.sys   Sat Jan 19 05:54:51 2008 (479190AB)
fffffa60`0a80d000 fffffa60`0a827000   mpsdrv   mpsdrv.sys   Sat Jan 19 06:35:28 2008 (47919A30)
fffffa60`0a827000 fffffa60`0a84e000   mrxdav   mrxdav.sys   Sat Jan 19 05:55:28 2008 (479190D0)
fffffa60`0a84e000 fffffa60`0a876000   mrxsmb   mrxsmb.sys   Sat Jan 19 05:55:21 2008 (479190C9)
fffffa60`0a876000 fffffa60`0a8bf000   mrxsmb10 mrxsmb10.sys Wed Aug 27 02:26:08 2008 (48B4AD30)
fffffa60`0a8bf000 fffffa60`0a8de000   mrxsmb20 mrxsmb20.sys Sat Jan 19 05:55:19 2008 (479190C7)
fffffa60`0a8de000 fffffa60`0a90f000   srv2     srv2.sys     Sat Jan 19 05:56:40 2008 (47919118)
fffffa60`0a90f000 fffffa60`0a9a3000   srv      srv.sys      Tue Dec 16 03:42:00 2008 (49472388)
fffffa60`0ae00000 fffffa60`0aeb6000   peauth   peauth.sys   Mon Oct 23 12:57:00 2006 (453CAE0C)
fffffa60`0aeb6000 fffffa60`0aec1000   secdrv   secdrv.SYS   Wed Sep 13 14:18:38 2006 (4508052E)
fffffa60`0aec1000 fffffa60`0aed0000   tcpipreg tcpipreg.sys Sat Jan 19 06:37:01 2008 (47919A8D)
fffffa60`0aed0000 fffffa60`0aefe4e0   WinVd32  WinVd32.sys  Tue Feb 03 11:45:12 2009 (49882E48)

Unloaded modules:
fffffa60`00ebc000 fffffa60`00eca000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`01200000 fffffa60`0120a000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`00eca000 fffffa60`00ef6000   dump_nvstor64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`0363a000 fffffa60`03644000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
start             end                 module name
fffffa60`008f7000 fffffa60`0094d000   acpi     acpi.sys     Sat Jan 19 06:02:45 2008 (47919285)
fffffa60`036ee000 fffffa60`0375b000   afd      afd.sys      Sat Jan 19 06:38:15 2008 (47919AD7)
fffffa60`09c9b000 fffffa60`09ca6000   asyncmac asyncmac.sys Sat Jan 19 06:37:27 2008 (47919AA7)
fffffa60`00a43000 fffffa60`00a4b000   atapi    atapi.sys    Sat Jan 19 06:28:49 2008 (479198A1)
fffffa60`00a4b000 fffffa60`00a6f000   ataport  ataport.SYS  Sat Jan 19 06:28:52 2008 (479198A4)
fffff960`00890000 fffff960`008f1000   ATMFD    ATMFD.DLL    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`09dd4000 fffffa60`09df2000   bowser   bowser.sys   Sat Jan 19 05:54:51 2008 (479190AB)
fffff960`00610000 fffff960`00621000   cdd      cdd.dll      Sat Aug 02 04:40:21 2008 (4893D725)
fffffa60`03960000 fffffa60`0397c000   cdfs     cdfs.sys     Sat Jan 19 05:53:45 2008 (47919069)
fffffa60`031c7000 fffffa60`031e3000   cdrom    cdrom.sys    Sat Jan 19 06:29:04 2008 (479198B0)
fffffa60`006b3000 fffffa60`00765000   CI       CI.dll       Fri Feb 22 05:20:54 2008 (47BE5BB6)
fffffa60`007cb000 fffffa60`007f7000   CLASSPNP CLASSPNP.SYS Sat Jan 19 06:28:53 2008 (479198A5)
fffffa60`00656000 fffffa60`006b3000   CLFS     CLFS.SYS     Sat Jan 19 05:53:58 2008 (47919076)
fffffa60`039ca000 fffffa60`039d8000   crashdmp crashdmp.sys Sat Jan 19 06:28:59 2008 (479198AB)
fffffa60`013ee000 fffffa60`013f8000   crcdisk  crcdisk.sys  Sat Jan 19 06:30:12 2008 (479198F4)
fffffa60`0391d000 fffffa60`0393a000   dfsc     dfsc.sys     Sat Jan 19 05:54:16 2008 (47919088)
fffffa60`00ea8000 fffffa60`00ebc000   disk     disk.sys     Sat Jan 19 06:29:02 2008 (479198AE)
fffffa60`033c8000 fffffa60`033eb000   drmk     drmk.sys     Sat Jan 19 07:20:04 2008 (4791A4A4)
fffffa60`039d8000 fffffa60`039e2000   dump_diskdump dump_diskdump.sys Sat Jan 19 06:28:58 2008 (479198AA)
fffffa60`00ebc000 fffffa60`00ee8000   dump_nvstor64 dump_nvstor64.sys Thu Nov 13 00:57:58 2008 (491B7B96)
fffffa60`039e2000 fffffa60`039ee000   Dxapi    Dxapi.sys    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`00f1e000 fffffa60`00ffd000   dxgkrnl  dxgkrnl.sys  Sat Aug 02 02:19:59 2008 (4893B63F)
fffffa60`011d3000 fffffa60`011ff000   ecache   ecache.sys   Sat Jan 19 06:30:39 2008 (4791990F)
fffffa60`0237a000 fffffa60`02387000   fdc      fdc.sys      unavailable (FFFFFFFE)
fffffa60`00b4e000 fffffa60`00b62000   fileinfo fileinfo.sys Sat Jan 19 06:05:23 2008 (47919323)
fffffa60`033a9000 fffffa60`033b4000   flpydisk flpydisk.sys unavailable (FFFFFFFE)
fffffa60`00b08000 fffffa60`00b4e000   fltmgr   fltmgr.sys   Sat Jan 19 05:54:10 2008 (47919082)
fffffa60`03627000 fffffa60`03631000   Fs_Rec   Fs_Rec.SYS   unavailable (FFFFFFFE)
fffffa60`01174000 fffffa60`011a0000   fwpkclnt fwpkclnt.sys Sat Jan 19 06:36:43 2008 (47919A7B)
fffffa60`031e3000 fffffa60`031ee000   GEARAspiWDM GEARAspiWDM.sys Thu Mar 19 15:34:13 2009 (49C265F5)
fffff800`0200b000 fffff800`02051000   hal      hal.dll      Sat Jan 19 07:55:25 2008 (4791ACED)
fffffa60`00dcb000 fffffa60`00dde000   HDAudBus HDAudBus.sys Tue Nov 27 23:24:06 2007 (474CA716)
fffffa60`03943000 fffffa60`03955000   HIDCLASS HIDCLASS.SYS Sat Jan 19 06:33:52 2008 (479199D0)
fffffa60`03644000 fffffa60`0364bb80   HIDPARSE HIDPARSE.SYS Sat Jan 19 06:33:51 2008 (479199CF)
fffffa60`0393a000 fffffa60`03943000   hidusb   hidusb.sys   Sat Jan 19 06:33:54 2008 (479199D2)
fffffa60`09d11000 fffffa60`09dac000   HTTP     HTTP.sys     Sat Jan 19 06:36:22 2008 (47919A66)
fffffa60`023cc000 fffffa60`023e2000   i8042prt i8042prt.sys Sat Jan 19 06:28:08 2008 (47919878)
fffffa60`00f0b000 fffffa60`00f1e000   intelppm intelppm.sys Sat Jan 19 05:52:45 2008 (4791902D)
fffffa60`03860000 fffffa60`0387c000   ISODrv64 ISODrv64.sys Sat Nov 03 03:21:18 2007 (472BE92E)
fffffa60`023e2000 fffffa60`023f0000   kbdclass kbdclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`0060b000 fffffa60`00615000   kdcom    kdcom.dll    Sat Jan 19 07:58:25 2008 (4791ADA1)
fffffa60`03313000 fffffa60`03347000   ks       ks.sys       Sat Jan 19 06:28:24 2008 (47919888)
fffffa60`00b6e000 fffffa60`00bf3000   ksecdd   ksecdd.sys   Sat Jan 19 06:16:38 2008 (479195C6)
fffffa60`035e2000 fffffa60`035e7180   ksthunk  ksthunk.sys  Sat Jan 19 06:28:14 2008 (4791987E)
fffffa60`09ca6000 fffffa60`09cba000   lltdio   lltdio.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`00dde000 fffffa60`00e00000   luafv    luafv.sys    Sat Jan 19 05:59:06 2008 (479191AA)
fffffa60`00615000 fffffa60`00642000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Jan 19 07:56:17 2008 (4791AD21)
fffffa60`035e8000 fffffa60`035fb000   monitor  monitor.sys  Sat Jan 19 06:32:34 2008 (47919982)
fffffa60`03305000 fffffa60`03311000   mouclass mouclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`03955000 fffffa60`03960000   mouhid   mouhid.sys   Sat Jan 19 06:28:10 2008 (4791987A)
fffffa60`00a30000 fffffa60`00a43000   mountmgr mountmgr.sys Sat Jan 19 06:28:01 2008 (47919871)
fffffa60`0a80d000 fffffa60`0a827000   mpsdrv   mpsdrv.sys   Sat Jan 19 06:35:28 2008 (47919A30)
fffffa60`0a827000 fffffa60`0a84e000   mrxdav   mrxdav.sys   Sat Jan 19 05:55:28 2008 (479190D0)
fffffa60`0a84e000 fffffa60`0a876000   mrxsmb   mrxsmb.sys   Sat Jan 19 05:55:21 2008 (479190C9)
fffffa60`0a876000 fffffa60`0a8bf000   mrxsmb10 mrxsmb10.sys Wed Aug 27 02:26:08 2008 (48B4AD30)
fffffa60`0a8bf000 fffffa60`0a8de000   mrxsmb20 mrxsmb20.sys Sat Jan 19 05:55:19 2008 (479190C7)
fffffa60`03691000 fffffa60`0369c000   Msfs     Msfs.SYS     unavailable (FFFFFFFE)
fffffa60`00956000 fffffa60`00960000   msisadrv msisadrv.sys Sat Jan 19 06:02:50 2008 (4791928A)
fffffa60`03208000 fffffa60`03240000   msiscsi  msiscsi.sys  Sat Jan 19 06:30:31 2008 (47919907)
fffffa60`00e00000 fffffa60`00e50000   msrpc    msrpc.sys    unavailable (FFFFFFFE)
fffffa60`03347000 fffffa60`03352000   mssmbios mssmbios.sys Sat Jan 19 06:02:54 2008 (4791928E)
fffffa60`013dc000 fffffa60`013ee000   mup      mup.sys      Sat Jan 19 05:54:18 2008 (4791908A)
fffffa60`00c08000 fffffa60`00dcb000   ndis     ndis.sys     Sat Jan 19 06:37:13 2008 (47919A99)
fffffa60`03270000 fffffa60`0327c000   ndistapi ndistapi.sys Sat Jan 19 06:37:22 2008 (47919AA2)
fffffa60`09cee000 fffffa60`09cf9000   ndisuio  ndisuio.sys  Sat Jan 19 06:36:29 2008 (47919A6D)
fffffa60`0327c000 fffffa60`032ad000   ndiswan  ndiswan.sys  Sat Jan 19 06:37:33 2008 (47919AAD)
fffffa60`033b4000 fffffa60`033c8000   NDProxy  NDProxy.SYS  Sat Jan 19 06:37:26 2008 (47919AA6)
fffffa60`037c8000 fffffa60`037d7000   netbios  netbios.sys  Sat Jan 19 06:36:35 2008 (47919A73)
fffffa60`0375b000 fffffa60`0379f000   netbt    netbt.sys    Sat Jan 19 06:36:24 2008 (47919A68)
fffffa60`00e50000 fffffa60`00ea8000   NETIO    NETIO.SYS    Sat Jan 19 06:37:27 2008 (47919AA7)
fffffa60`0387c000 fffffa60`0391b000   netr7364 netr7364.sys Fri Feb 27 08:50:39 2009 (49A7A95F)
fffffa60`0369c000 fffffa60`036ad000   Npfs     Npfs.SYS     Sat Jan 19 05:53:57 2008 (47919075)
fffffa60`03854000 fffffa60`03860000   nsiproxy nsiproxy.sys Sat Jan 19 06:36:45 2008 (47919A7D)
fffff800`02051000 fffff800`02569000   nt       ntkrnlmp.exe Tue Mar 03 02:20:17 2009 (49AC93E1)
fffffa60`0120c000 fffffa60`01390000   Ntfs     Ntfs.sys     Sat Jan 19 05:55:29 2008 (479190D1)
fffffa60`03631000 fffffa60`0363a000   Null     Null.SYS     unavailable (FFFFFFFE)
fffffa60`03154000 fffffa60`03155400   nvBridge nvBridge.kmd Wed Nov 12 23:27:47 2008 (491B6673)
fffffa60`02806000 fffffa60`03153c80   nvlddmkm nvlddmkm.sys Thu Nov 13 00:22:43 2008 (491B7353)
fffffa60`0220d000 fffffa60`02379180   nvmfdx64 nvmfdx64.sys Fri Aug 01 19:38:28 2008 (48935824)
fffffa60`009d0000 fffffa60`009f3000   nvraid   nvraid.sys   Wed Jun 06 21:34:01 2007 (46671A39)
fffffa60`00a07000 fffffa60`00a30000   nvrd64   nvrd64.sys   Sat Dec 23 04:07:29 2006 (458CAB81)
fffffa60`00a6f000 fffffa60`00a7f000   nvstor   nvstor.sys   Wed Jun 06 21:34:00 2007 (46671A38)
fffffa60`00adc000 fffffa60`00b08000   nvstor64 nvstor64.sys Thu Nov 13 00:57:58 2008 (491B7B96)
fffffa60`09cba000 fffffa60`09cee000   nwifi    nwifi.sys    Tue May 20 03:33:46 2008 (4832388A)
fffffa60`037aa000 fffffa60`037c8000   pacer    pacer.sys    Sat Apr 05 02:55:46 2008 (47F6DC22)
fffffa60`023b0000 fffffa60`023cc000   parport  parport.sys  Sat Jan 19 06:28:36 2008 (47919894)
fffffa60`00990000 fffffa60`009a5000   partmgr  partmgr.sys  Sat Jan 19 06:29:14 2008 (479198BA)
fffffa60`00960000 fffffa60`00990000   pci      pci.sys      Sat Jan 19 06:02:57 2008 (47919291)
fffffa60`009b9000 fffffa60`009c0000   pciide   pciide.sys   Thu Nov 02 09:38:14 2006 (4549BC86)
fffffa60`009c0000 fffffa60`009d0000   PCIIDEX  PCIIDEX.SYS  Sat Jan 19 06:28:53 2008 (479198A5)
fffffa60`0ae00000 fffffa60`0aeb6000   peauth   peauth.sys   Mon Oct 23 12:57:00 2006 (453CAE0C)
fffffa60`035a7000 fffffa60`035e2000   portcls  portcls.sys  Sat Jan 19 06:33:58 2008 (479199D6)
fffffa60`00642000 fffffa60`00656000   PSHED    PSHED.dll    Sat Jan 19 07:58:13 2008 (4791AD95)
fffffa60`00b62000 fffffa60`00b6d700   PxHlpa64 PxHlpa64.sys Wed Oct 17 19:25:02 2007 (4716537E)
fffffa60`036ad000 fffffa60`036b6000   rasacd   rasacd.sys   Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`0324d000 fffffa60`03270000   rasl2tp  rasl2tp.sys  Sat Jan 19 06:37:33 2008 (47919AAD)
fffffa60`032ad000 fffffa60`032bd000   raspppoe raspppoe.sys Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`032bd000 fffffa60`032db000   raspptp  raspptp.sys  Sat Jan 19 06:37:34 2008 (47919AAE)
fffffa60`032db000 fffffa60`032f3000   rassstp  rassstp.sys  Sat Jan 19 06:37:42 2008 (47919AB6)
fffffa60`03806000 fffffa60`03854000   rdbss    rdbss.sys    Sat Jan 19 05:55:09 2008 (479190BD)
fffffa60`0367f000 fffffa60`03688000   RDPCDD   RDPCDD.sys   Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`03688000 fffffa60`03691000   rdpencdd rdpencdd.sys Sat Jan 19 06:42:03 2008 (47919BBB)
fffffa60`09cf9000 fffffa60`09d11000   rspndr   rspndr.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`03406000 fffffa60`035a6680   RTKVHD64 RTKVHD64.sys Tue Feb 17 08:52:52 2009 (499A7AE4)
fffffa60`03603000 fffffa60`03627000   savonaccess savonaccess.sys Mon Jan 05 11:44:09 2009 (4961F289)
fffffa60`0aeb6000 fffffa60`0aec1000   secdrv   secdrv.SYS   Wed Sep 13 14:18:38 2006 (4508052E)
fffffa60`023a4000 fffffa60`023b0000   serenum  serenum.sys  Sat Jan 19 06:28:36 2008 (47919894)
fffffa60`02387000 fffffa60`023a4000   serial   serial.sys   Sat Jan 19 06:28:41 2008 (47919899)
fffffa60`036d3000 fffffa60`036ee000   smb      smb.sys      Sat Jan 19 06:36:17 2008 (47919A61)
fffffa60`011a0000 fffffa60`011d3000   snapman  snapman.sys  Fri Oct 06 14:43:53 2006 (45265D99)
fffffa60`013d4000 fffffa60`013dc000   spldr    spldr.sys    Fri Jun 22 01:57:56 2007 (467B1E94)
fffffa60`09c01000 fffffa60`09c9b000   spsys    spsys.sys    Fri Jun 22 02:02:05 2007 (467B1F8D)
fffffa60`0a90f000 fffffa60`0a9a3000   srv      srv.sys      Tue Dec 16 03:42:00 2008 (49472388)
fffffa60`0a8de000 fffffa60`0a90f000   srv2     srv2.sys     Sat Jan 19 05:56:40 2008 (47919118)
fffffa60`09dac000 fffffa60`09dd4000   srvnet   srvnet.sys   Sat Jan 19 05:56:38 2008 (47919116)
fffffa60`00a7f000 fffffa60`00adc000   storport storport.sys Sat Jan 19 06:29:09 2008 (479198B5)
fffffa60`03311000 fffffa60`03312480   swenum   swenum.sys   Thu Nov 02 09:37:33 2006 (4549BC5D)
fffffa60`01000000 fffffa60`01174000   tcpip    tcpip.sys    Sat Apr 26 07:33:23 2008 (4812CCB3)
fffffa60`0aec1000 fffffa60`0aed0000   tcpipreg tcpipreg.sys Sat Jan 19 06:37:01 2008 (47919A8D)
fffffa60`03240000 fffffa60`0324d000   TDI      TDI.SYS      Sat Jan 19 06:38:11 2008 (47919AD3)
fffffa60`036b6000 fffffa60`036d3000   tdx      tdx.sys      Sat Jan 19 06:36:53 2008 (47919A85)
fffffa60`032f3000 fffffa60`03305000   termdd   termdd.sys   Sat Jan 19 06:42:03 2008 (47919BBB)
fffff960`00440000 fffff960`0044a000   TSDDD    TSDDD.dll    Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`00f02000 fffffa60`00f0b000   tunmp    tunmp.sys    Sat Jan 19 06:36:30 2008 (47919A6E)
fffffa60`00ef6000 fffffa60`00f02000   tunnel   tunnel.sys   Sat Jan 19 06:36:44 2008 (47919A7C)
fffffa60`0397c000 fffffa60`039ca000   udfs     udfs.sys     Sat Jan 19 05:53:53 2008 (47919071)
fffffa60`03352000 fffffa60`03362000   umbus    umbus.sys    Sat Jan 19 06:34:16 2008 (479199E8)
fffffa60`0391b000 fffffa60`0391ce00   USBD     USBD.SYS     Sat Jan 19 06:33:53 2008 (479199D1)
fffffa60`031b6000 fffffa60`031c7000   usbehci  usbehci.sys  Sat Jan 19 06:33:57 2008 (479199D5)
fffffa60`03362000 fffffa60`033a9000   usbhub   usbhub.sys   Sat Jan 19 06:34:13 2008 (479199E5)
fffffa60`03165000 fffffa60`03170000   usbohci  usbohci.sys  Sat Jan 19 06:33:56 2008 (479199D4)
fffffa60`03170000 fffffa60`031b6000   USBPORT  USBPORT.SYS  Sat Jan 19 06:34:00 2008 (479199D8)
fffffa60`0364c000 fffffa60`0365a000   vga      vga.sys      Sat Jan 19 06:32:21 2008 (47919975)
fffffa60`0365a000 fffffa60`0367f000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 06:32:25 2008 (47919979)
fffffa60`009a5000 fffffa60`009b9000   volmgr   volmgr.sys   Sat Jan 19 06:29:12 2008 (479198B8)
fffffa60`00765000 fffffa60`007cb000   volmgrx  volmgrx.sys  Sat Jan 19 06:29:45 2008 (479198D9)
fffffa60`01390000 fffffa60`013d4000   volsnap  volsnap.sys  Sat Jan 19 06:29:47 2008 (479198DB)
fffffa60`037d7000 fffffa60`037f2000   wanarp   wanarp.sys   Sat Jan 19 06:37:35 2008 (47919AAF)
fffffa60`03156000 fffffa60`03165000   watchdog watchdog.sys Sat Jan 19 06:07:23 2008 (4791939B)
fffffa60`0080f000 fffffa60`008e9000   Wdf01000 Wdf01000.sys Sat Jan 19 06:33:27 2008 (479199B7)
fffffa60`008e9000 fffffa60`008f7000   WDFLDR   WDFLDR.SYS   Sat Jan 19 06:32:33 2008 (47919981)
fffff960`00010000 fffff960`002c1000   win32k   win32k.sys   Mon Feb 09 03:30:51 2009 (498FA36B)
fffffa60`0aed0000 fffffa60`0aefe4e0   WinVd32  WinVd32.sys  Tue Feb 03 11:45:12 2009 (49882E48)
fffffa60`0094d000 fffffa60`00956000   WMILIB   WMILIB.SYS   Sat Jan 19 06:33:45 2008 (479199C9)
fffffa60`0379f000 fffffa60`037aa000   ws2ifsl  ws2ifsl.sys  Sat Jan 19 06:37:46 2008 (47919ABA)

Unloaded modules:
fffffa60`00ebc000 fffffa60`00eca000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`01200000 fffffa60`0120a000   dump_storport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`00eca000 fffffa60`00ef6000   dump_nvstor64.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`0363a000 fffffa60`03644000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

I have looked in the minidump folder but can not see any mini kernel dumps.

I also ran the driver verifier for a good while as suggested and i did not get a BSOD.

I hope this analysis contains the more detailed information that you require.

Thank you again for your help.

wally15 · 05-05-2009, 06:08 AM

Sorry to bump, but if anyone could have a look at this. It'd be appreciated.

Thanks

wally15 · 05-10-2009, 04:42 PM

Sorry to bump, but if anyone could have a look at this. It'd be appreciated.

Thanks

usasma · 05-12-2009, 01:17 PM

Continue to run the Driver Verifier until you get a BSOD. It's that BSOD that will have the most information (since the verifier was running when it happened).

While waiting for others to respond, I'd suggest updating your nVidia chipset drivers as they appear to be very old (there are also others, but those would be the most suspect IMO).

Also, as the errors are caused when accessing memory, it'd be a good idea to run the built in Memory Diagnostic just to be sure that it's not a hardware issue. Here's instructions: http://www.bleepingcomputer.com/tuto...torial146.html

wally15 · 05-13-2009, 02:20 AM

Thank you usasma I shall have a look into those, later at some point.

I have run that memory diagnostic tool previously and it found no error.

04-29-2009, 03:13 PM	#1 (permalink)
wally15 Registered User Join Date: Apr 2009 Location: UK Posts: 6 OS: Windows Vista 64bit	BSOD STOP errors on Vista Hi all, Since building my system a year ago I've been getting intermittent blue-screens. It doesn't seem to occur at any specific point, i.e. I'm not always running games or certain apps when it crashes. My system: Vista 64bit Mobo: Gigabyte Technology GA-N650SLI-DS4L Graphics cards: 2x NVIDIA GeForce 9600 GT in Sli format RAM: 4gb DDR2 Cpu: Intel(R) Core(TM)2 Quad CPU Q9300 @ 2.50GHz (4 CPUs), ~23.7GHz HDD: Western Digital 500Gb SATA2 I’ve tried taking out one of my graphics cards and tested each stick of ram by running my comp on them separately. It seems that my system is more stable with 3gb rather than 4gb, but STOP errors are just more infrequent, not none existent. I’ve ran RAM testing utilities and HDD testing utilities to no avail. I installed the latest beta of windows 7 and it blue screened within half an hour. I have the latest drivers for everything I can think of. It blue screens roughly once a week at the moment on vista with 3gb of ram in. Any ideas? I've got a memory.dmp file from my system root, which I'll upload if its needed, but its 300mb so I'm presuming I'm missing a trick here? Hope someone can help. Thanks.

04-30-2009, 11:18 PM	#4 (permalink)
jcgriff2 Moderator, Microsoft Supp Join Date: Sep 2007 Location: The Great State of New Jersey - away from the gross corruption of the Riverside County, CA, SO office. SHAMEFUL ! Posts: 10,113 OS: Windows 7, Vista Ultimate My System	Re: BSOD STOP errors on Vista Hi - Not enough info in dbug logs. Use !analyze -v;r;kv;lmtn;lmtsmn at kd> command line and re-post dbug logs. I see exception codes 0xc0000005 (memory access violation) and 0xc000001d (illegal instruction. For info, those are full kernel dumps. You should also have mini kernel dumps in c:\windows\minidump. Run the driver verifier to help flush out the culprit, assuming software is the cause. D/V instructions can be found HERE. Regards. . . jcgriff2 . __________________ . . . . . . . . BSOD Posting Instructions B Expecting a reply and waiting > 36 hours ? Send a PM to me containing a link to your thread Glad to be home in the Great State of New Jersey ! !

05-05-2009, 06:08 AM	#6 (permalink)
wally15 Registered User Join Date: Apr 2009 Location: UK Posts: 6 OS: Windows Vista 64bit	Re: BSOD STOP errors on Vista Sorry to bump, but if anyone could have a look at this. It'd be appreciated. Thanks

05-10-2009, 04:42 PM	#7 (permalink)
wally15 Registered User Join Date: Apr 2009 Location: UK Posts: 6 OS: Windows Vista 64bit	Re: BSOD STOP errors on Vista Sorry to bump, but if anyone could have a look at this. It'd be appreciated. Thanks

05-12-2009, 01:17 PM	#8 (permalink)
usasma Tech Hardware Team Join Date: Apr 2009 Location: Southeastern CT, USA Posts: 1,632 OS: Vista (x64); Win7 (x32 & x64)	Re: BSOD STOP errors on Vista Continue to run the Driver Verifier until you get a BSOD. It's that BSOD that will have the most information (since the verifier was running when it happened). While waiting for others to respond, I'd suggest updating your nVidia chipset drivers as they appear to be very old (there are also others, but those would be the most suspect IMO). Also, as the errors are caused when accessing memory, it'd be a good idea to run the built in Memory Diagnostic just to be sure that it's not a hardware issue. Here's instructions: http://www.bleepingcomputer.com/tuto...torial146.html __________________ aka John MVP Windows - Desktop Experience "There are very few problems in life that can't be fixed by the proper application of high explosives" If I haven't replied in 48 hours, please send me a PM.

05-13-2009, 02:20 AM	#9 (permalink)
wally15 Registered User Join Date: Apr 2009 Location: UK Posts: 6 OS: Windows Vista 64bit	Re: BSOD STOP errors on Vista Thank you usasma I shall have a look into those, later at some point. I have run that memory diagnostic tool previously and it found no error.