minidump please help

rs232

New Member
After today's windows update I've been experiencing many blue screen, especially after the reboot. I don;t get any in safe mode so I guess it's a driver problem. This is the minidump created on my system. I have 7 of them and they all seem to be the same.
Any help?

Regards
rs232


Code:
ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: fffff80001c1b000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  0

EXCEPTION_RECORD:  fffffa600b2e29b8 -- (.exr 0xfffffa600b2e29b8)
ExceptionAddress: fffff80001ea9660 (nt+0x000000000028e660)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000000002c00519b
Attempt to write to address 000000002c00519b

CONTEXT:  fffffa600b2e2390 -- (.cxr 0xfffffa600b2e2390)
rax=fffffa800a295990 rbx=fffffa600b2e3450 rcx=fffff8800ff01300
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa80099fe8b0
rip=fffff80001ea9660 rsp=fffffa600b2e2bf8 rbp=fffffa800a1d7490
 r8=fffff8800ff01010  r9=fffffa600b2e31d0 r10=000000000000000b
r11=fffffa600b2e2bd0 r12=fffffa600b2e31d0 r13=fffff8800ff01010
r14=fffffa80099fe510 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt+0x28e660:
fffff800`01ea9660 00989b51000f    add     byte ptr [rax+0F00519Bh],bl ds:002b:fffffa80`1929ab2b=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  7

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt+28e660
fffff800`01ea9660 00989b51000f    add     byte ptr [rax+0F00519Bh],bl

LAST_CONTROL_TRANSFER:  from fffffa60012c0508 to fffff80001ea9660

STACK_TEXT:  
fffffa60`0b2e2bf8 fffffa60`012c0508 : fffffa80`0a1d7490 fffff880`0ff01010 fffffa60`0b2e3450 00000000`00000000 : nt+0x28e660
fffffa60`0b2e2c00 fffffa60`012c0058 : fffffa60`0b2e33e0 fffffa80`099fe510 00000000`00000002 fffffa60`00b873ee : Ntfs!NtfsBreakBatchOplock+0xc8
fffffa60`0b2e2c80 fffffa60`012bd830 : fffffa60`0b2e33e0 00000000`00000000 fffffa80`0a1d7490 fffff880`0000001a : Ntfs!NtfsOpenExistingAttr+0x1a8
fffffa60`0b2e2d30 fffffa60`012bc8a0 : fffffa80`0a1d7490 fffffa80`099fe510 fffff880`0ff01398 fffffa60`0000001a : Ntfs!NtfsOpenAttributeInExistingFile+0x5a0
fffffa60`0b2e2ec0 fffffa60`012d0662 : fffffa80`0a1d7490 fffffa80`099fe510 fffff880`0ff01398 00000000`00000703 : Ntfs!NtfsOpenExistingPrefixFcb+0x1f0
fffffa60`0b2e2fb0 fffffa60`012cdad3 : fffffa80`0a1d7490 fffffa80`099fe510 fffffa60`0b2e3180 fffffa60`0b2e31d0 : Ntfs!NtfsFindStartingNode+0x5f2
fffffa60`0b2e3080 fffffa60`01227bbd : fffffa80`0a1d7490 fffffa80`099fe510 fffffa60`0b2e33e0 fffffa80`0731ff00 : Ntfs!NtfsCommonCreate+0x3a3
fffffa60`0b2e3270 fffff800`01c86de2 : fffffa60`0b2e3350 fffffa60`00b923af fffff880`0fa35d10 fffff880`0fa0d218 : Ntfs!NtfsCommonCreateCallout+0x1d
fffffa60`0b2e32a0 fffffa60`0b2e3350 : fffffa60`00b923af fffff880`0fa35d10 fffff880`0fa0d218 fffffa80`0757fe7c : nt+0x6bde2
fffffa60`0b2e32a8 fffffa60`00b923af : fffff880`0fa35d10 fffff880`0fa0d218 fffffa80`0757fe7c fffffa80`08268920 : 0xfffffa60`0b2e3350
fffffa60`0b2e32b0 fffffa80`07205810 : fffffa80`0731ff10 00000000`00000016 fffffa60`0b2e34b8 00000000`00000001 : fltmgr!HandleStreamListNotSupported+0x17f
fffffa60`0b2e32f0 fffffa80`0731ff10 : 00000000`00000016 fffffa60`0b2e34b8 00000000`00000001 00000000`00000001 : 0xfffffa80`07205810
fffffa60`0b2e32f8 00000000`00000016 : fffffa60`0b2e34b8 00000000`00000001 00000000`00000001 fffffa60`01227c3a : 0xfffffa80`0731ff10
fffffa60`0b2e3300 fffffa60`0b2e34b8 : 00000000`00000001 00000000`00000001 fffffa60`01227c3a fffffa80`0a1d7490 : 0x16
fffffa60`0b2e3308 00000000`00000001 : 00000000`00000001 fffffa60`01227c3a fffffa80`0a1d7490 fffffa80`099fe510 : 0xfffffa60`0b2e34b8
fffffa60`0b2e3310 00000000`00000001 : fffffa60`01227c3a fffffa80`0a1d7490 fffffa80`099fe510 fffffa80`099fe510 : 0x1
fffffa60`0b2e3318 fffffa60`01227c3a : fffffa80`0a1d7490 fffffa80`099fe510 fffffa80`099fe510 00000000`00000000 : 0x1
fffffa60`0b2e3320 fffffa60`012da291 : 00000000`00000000 fffffa60`0b2e33e0 fffffa80`099fe510 fffffa80`099fe510 : Ntfs!NtfsCommonCreateOnNewStack+0x4a
fffffa60`0b2e3380 fffffa60`00b85e91 : fffffa80`07571030 fffffa80`099fe510 fffffa80`0a295900 fffffa80`099fe501 : Ntfs!NtfsFsdCreate+0x1b1
fffffa60`0b2e3520 fffffa60`00ba226c : fffffa80`0757f040 fffffa80`0757f8d0 fffffa80`099fe500 fffffa60`0b2e35e0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x211
fffffa60`0b2e3590 fffffa60`00bdf036 : fffffa80`070e2be0 fffffa80`0a1b7b10 00000000`0012019f 00000000`00000000 : fltmgr!FltpCreate+0x25d
fffffa60`0b2e3640 fffffa80`070e2be0 : fffffa80`0a1b7b10 00000000`0012019f 00000000`00000000 00000000`00000801 : SiWinAcc+0x1036
fffffa60`0b2e3648 fffffa80`0a1b7b10 : 00000000`0012019f 00000000`00000000 00000000`00000801 fffffa60`00bdfd3b : 0xfffffa80`070e2be0
fffffa60`0b2e3650 00000000`0012019f : 00000000`00000000 00000000`00000801 fffffa60`00bdfd3b 00000000`00000000 : 0xfffffa80`0a1b7b10
fffffa60`0b2e3658 00000000`00000000 : 00000000`00000801 fffffa60`00bdfd3b 00000000`00000000 fffffa80`09bfd700 : 0x12019f


FOLLOWUP_IP: 
Ntfs!NtfsBreakBatchOplock+c8
fffffa60`012c0508 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsBreakBatchOplock+c8

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

STACK_COMMAND:  .cxr 0xfffffa600b2e2390 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------
 

My Computer

This doesn't appear to be a complete analysis.
That being said, the error is with the NTFS file system that organizes the files on your hard drive.

The first thing to try would be to run Startup Repair from your installation DVD. That will, in addition to other things, attempt to repair the NTFS file system with chkdsk /r

I would also run a bootable hard drive diagnostic to ensure that the hard drive isn't starting to fail on you. Instructions are here: Bootable Hard Drive Diagnostics - Vox
 

My Computer

Following the advice I did run a scandisk but the blue screen still apprear.
This time I had a sligly different error, not sure this is related to the checkdisk or not.
I did install the symbols for my system but the debugger still complain about them.
Anyways this time I seem to understand it's really a driver problem, how can I find out which driver though?

Thanks again for the help!

Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini061109-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Windows\Symbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`01c54000 PsLoadedModuleList = 0xfffff800`01e18dd0
Debug session time: Thu Jun 11 12:27:38.993 2009 (GMT+1)
System Uptime: 0 days 0:22:26.729
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, 2, 8, 2}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+5a450 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000002, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000002, Parameter 1 of the exception

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80001c54000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  49e0237f

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
00000000`00000002 ??              ???

EXCEPTION_PARAMETER1:  0000000000000008

EXCEPTION_PARAMETER2:  0000000000000002

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 0000000000000002 

CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001c90a87 to fffff80001cae450

STACK_TEXT:  
fffffa60`0bf51fe8 fffff800`01c90a87 : 00000000`0000001e ffffffff`c0000005 00000000`00000002 00000000`00000008 : nt+0x5a450
fffffa60`0bf51ff0 00000000`0000001e : ffffffff`c0000005 00000000`00000002 00000000`00000008 00000000`00000002 : nt+0x3ca87
fffffa60`0bf51ff8 ffffffff`c0000005 : 00000000`00000002 00000000`00000008 00000000`00000002 00000000`00000001 : 0x1e
fffffa60`0bf52000 00000000`00000002 : 00000000`00000008 00000000`00000002 00000000`00000001 00000000`00000000 : 0xffffffff`c0000005
fffffa60`0bf52008 00000000`00000008 : 00000000`00000002 00000000`00000001 00000000`00000000 fffff800`01de4260 : 0x2
fffffa60`0bf52010 00000000`00000002 : 00000000`00000001 00000000`00000000 fffff800`01de4260 fffffa80`045f0040 : 0x8
fffffa60`0bf52018 00000000`00000001 : 00000000`00000000 fffff800`01de4260 fffffa80`045f0040 00000000`00000519 : 0x2
fffffa60`0bf52020 00000000`00000000 : fffff800`01de4260 fffffa80`045f0040 00000000`00000519 00000000`00000501 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+5a450
fffff800`01cae450 48894c2408      mov     qword ptr [rsp+8],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+5a450

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------
 

My Computer

You don't have the proper symbol store for your system.
It's much easier to use the Microsoft online symbol server if you're connected to the internet.
As this is a very common bugcheck, the symbols are necessary to get additional information on the crash.

Go to File...Symbol File Path and enter this string (copy and paste it):

Code:
[B]SRV*c:\symbols*http://msdl.microsoft.com/download/symbols[/B][B][/B]
The first time that WinDbg ask if you want to save the workspace, select Yes. After that don't save it again (in case something has damaged the symbol path).

FWIW - there's more detailed instructions here: Diagnosing Bsod's (originally posted 02Oct08) - Vox
 

My Computer

That helps, thanks! This is the new output now, I still don't see any driver name or reference to it. I'm pretty sure this is not an HW failure as vista in safe mode works properly, same with linux on a livecd...

Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini061109-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18005.amd64fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0xfffff800`01c07000 PsLoadedModuleList = 0xfffff800`01dcbdd0
Debug session time: Thu Jun 11 16:18:28.501 2009 (GMT+1)
System Uptime: 0 days 0:01:34.360
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80001e6c1b4, fffffa600ca123b0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001e6c1b4, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600ca123b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtCreateTimer+0
fffff800`01e6c1b4 004849          add     byte ptr [rax+49h],cl

CONTEXT:  fffffa600ca123b0 -- (.cxr 0xfffffa600ca123b0)
rax=0000000000000000 rbx=fffffa8009c7dbb0 rcx=000000000030b0d0
rdx=00000000001f0003 rsi=00000000001cd018 rdi=0000000000000000
rip=fffff80001e6c1b4 rsp=fffffa600ca12c18 rbp=fffffa600ca12ca0
 r8=0000000000000000  r9=0000000000000001 r10=fffff80001e6c1b4
r11=000000000020a1b4 r12=00000000772827f8 r13=0000000000000000
r14=0000000000000000 r15=000000000031b930
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!NtCreateTimer:
fffff800`01e6c1b4 004849          add     byte ptr [rax+49h],cl ds:002b:00000000`00000049=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  drvinst.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001c60ef3 to fffff80001e6c1b4

STACK_TEXT:  
fffffa60`0ca12c18 fffff800`01c60ef3 : fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!NtCreateTimer
fffffa60`0ca12c20 00000000`771b77aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001ccef8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b77aa


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80001e6c000-fffff80001e6c037  56 bytes - nt!EtwpGetSidExtendedHeaderItem+8c
    [ 45 74 77 50 44 0f b6 60:00 8d ee 51 00 2e e7 51 ]
    fffff80001e6c039-fffff80001e6c063  43 bytes - nt!EtwpGetSidExtendedHeaderItem+c5 (+0x39)
    [ 66 83 60 04 00 48 8d 53:91 d8 51 00 6e e4 51 00 ]
    fffff80001e6c065-fffff80001e6c078  20 bytes - nt!EtwpGetSidExtendedHeaderItem+f1 (+0x2c)
    [ 49 89 3e 48 85 db 74 0a:00 80 51 00 11 bd 51 00 ]
    fffff80001e6c07a-fffff80001e6c0a3  42 bytes - nt!EtwpGetSidExtendedHeaderItem+106 (+0x15)
    [ 83 c4 20 41 5e 41 5d 41:2e 51 00 1f 6f 51 00 7c ]
    fffff80001e6c0a5-fffff80001e6c0b3  15 bytes - nt!PsCreateSystemThread+15 (+0x2b)
    [ 00 00 4d 85 c9 8b f2 48:cd 4c 51 00 3e 18 51 00 ]
    fffff80001e6c0b5-fffff80001e6c0bf  11 bytes - nt!PsCreateSystemThread+25 (+0x10)
    [ 49 8b d9 33 ff 4d 85 c0:71 fd 51 00 a6 03 51 00 ]
    fffff80001e6c0c1-fffff80001e6c0c7  7 bytes - nt!PsCreateSystemThread+31 (+0x0c)
    [ 00 00 4c 21 84 24 88:32 80 51 00 59 81 51 ]
    fffff80001e6c0ca-fffff80001e6c0cf  6 bytes - nt!PsCreateSystemThread+3a (+0x09)
    [ 00 4c 21 84 24 90:a5 51 00 00 80 51 ]
    fffff80001e6c0d1-fffff80001e6c0d7  7 bytes - nt!PsCreateSystemThread+41 (+0x07)
    [ 00 00 4c 21 84 24 a0:cb d6 51 00 f3 3a 51 ]
    fffff80001e6c0d9-fffff80001e6c0df  7 bytes - nt!PsCreateSystemThread+49 (+0x08)
    [ 00 00 4c 21 84 24 a8:9b 5e 51 00 e7 16 51 ]
    fffff80001e6c0e1-fffff80001e6c0e7  7 bytes - nt!PsCreateSystemThread+51 (+0x08)
    [ 00 00 c7 84 24 80 00:3a e9 51 00 dc 4a 51 ]
    fffff80001e6c0e9-fffff80001e6c0eb  3 bytes - nt!PsCreateSystemThread+59 (+0x08)
    [ 00 30 00:dd ed 51 ]
    fffff80001e6c0ed-fffff80001e6c0f3  7 bytes - nt!PsCreateSystemThread+5d (+0x04)
    [ 00 c7 84 24 98 00 00:e4 9d 51 00 43 2f 51 ]
    fffff80001e6c0f5-fffff80001e6c0f7  3 bytes - nt!PsCreateSystemThread+65 (+0x08)
    [ 00 02 00:93 e0 51 ]
    fffff80001e6c0f9-fffff80001e6c103  11 bytes - nt!PsCreateSystemThread+69 (+0x04)
    [ 48 83 64 24 70 00 48 83:7e fe 51 00 42 73 51 00 ]
    fffff80001e6c105-fffff80001e6c10d  9 bytes - nt!PsCreateSystemThread+75 (+0x0c)
    [ 48 83 64 24 60 00 48 8b:e6 4d 51 00 44 20 51 00 ]
    fffff80001e6c10f - nt!PsCreateSystemThread+7f (+0x0a)
    [ f0:51 ]
    fffff80001e6c111-fffff80001e6c117  7 bytes - nt!PsCreateSystemThread+81 (+0x02)
    [ 00 00 4c 8d 84 24 80:c6 05 51 00 ae a0 51 ]
    fffff80001e6c119-fffff80001e6c127  15 bytes - nt!PsCreateSystemThread+89 (+0x08)
    [ 00 00 4c 8b cb 48 89 44:53 a3 51 00 b4 18 51 00 ]
    fffff80001e6c129-fffff80001e6c13b  19 bytes - nt!PsCreateSystemThread+99 (+0x10)
    [ 00 00 8b d6 48 89 44 24:6b d9 51 00 7d 23 51 00 ]
    fffff80001e6c13d-fffff80001e6c147  11 bytes - nt!PsCreateSystemThread+ad (+0x14)
    [ 48 83 64 24 38 00 48 8b:77 91 51 00 9c 0c 51 00 ]
    fffff80001e6c149-fffff80001e6c157  15 bytes - nt!PsCreateSystemThread+b9 (+0x0c)
    [ 00 00 48 8b cd 48 89 44:9a f2 51 00 01 c7 51 00 ]
    fffff80001e6c159-fffff80001e6c167  15 bytes - nt!PsCreateSystemThread+c9 (+0x10)
    [ 48 89 7c 24 20 e8 9d 29:3e e3 51 00 f9 28 51 00 ]
    fffff80001e6c169-fffff80001e6c193  43 bytes - nt!PsCreateSystemThread+d9 (+0x10)
    [ 00 00 49 8b 5b 10 49 8b:81 26 51 00 cb 1f 51 00 ]
    fffff80001e6c195-fffff80001e6c197  3 bytes - nt!PsCreateSystemThread+105 (+0x2c)
    [ 41 b8 30:47 9d 51 ]
    fffff80001e6c199-fffff80001e6c1df  71 bytes - nt!PsCreateSystemThread+109 (+0x04)
    [ 00 00 e8 40 cb de ff 0f:ff 7f 51 00 fb df 51 00 ]
    fffff80001e6c1e1-fffff80001e6c1e7  7 bytes - nt!NtCreateTimer+2d (+0x48)
    [ 65 48 8b 04 25 88 01:00 80 51 00 01 af 51 ]
    fffff80001e6c1e9-fffff80001e6c1ef  7 bytes - nt!NtCreateTimer+35 (+0x08)
    [ 00 40 8a b8 53 01 00:bc bd 51 00 7b e2 51 ]
    fffff80001e6c1f1-fffff80001e6c20f  31 bytes - nt!NtCreateTimer+3d (+0x08)
    [ 40 84 ff 74 1b 48 8b 05:7b 37 51 00 07 cf 51 00 ]
    fffff80001e6c211-fffff80001e6c223  19 bytes - nt!NtCreateTimer+5d (+0x20)
    [ 48 8d 44 24 58 48 89 44:e1 e7 51 00 00 80 51 00 ]
    fffff80001e6c225-fffff80001e6c22b  7 bytes - nt!NtCreateTimer+71 (+0x14)
    [ c7 44 24 28 08 01 00:8d 26 51 00 92 d5 51 ]
    fffff80001e6c22d-fffff80001e6c243  23 bytes - nt!NtCreateTimer+79 (+0x08)
    [ 48 83 64 24 20 00 44 8a:27 09 51 00 ef 70 51 00 ]
    fffff80001e6c245-fffff80001e6c249  5 bytes - nt!NtCreateTimer+91 (+0x18)
    [ 44 8b d8 48 8b:ff 7f 51 00 a4 ]
    fffff80001e6c24b-fffff80001e6c257  13 bytes - nt!NtCreateTimer+97 (+0x06)
    [ 24 58 48 89 4c 24 60 85:51 00 2c 75 51 00 77 65 ]
    fffff80001e6c259-fffff80001e6c263  11 bytes - nt!NtCreateTimer+a5 (+0x0e)
    [ 00 c6 81 98 00 00 00 13:1b d9 51 00 80 ea 51 00 ]
    fffff80001e6c266-fffff80001e6c26b  6 bytes - nt!NtCreateTimer+b2 (+0x0d)
    [ 00 01 66 c7 81 9a:80 51 00 41 e2 51 ]
    fffff80001e6c26d-fffff80001e6c26f  3 bytes - nt!NtCreateTimer+b9 (+0x07)
    [ 00 00 00:d0 05 51 ]
    fffff80001e6c271-fffff80001e6c273  3 bytes - nt!NtCreateTimer+bd (+0x04)
    [ 48 8d 05:15 19 51 ]
    fffff80001e6c275-fffff80001e6c27b  7 bytes - nt!NtCreateTimer+c1 (+0x04)
    [ 12 e4 ff 48 89 81 b0:e4 19 51 00 96 9a 51 ]
    fffff80001e6c27d-fffff80001e6c283  7 bytes - nt!NtCreateTimer+c9 (+0x08)
    [ 00 00 48 89 89 b8 00:80 e8 51 00 70 b7 51 ]
    fffff80001e6c285-fffff80001e6c28b  7 bytes - nt!NtCreateTimer+d1 (+0x08)
    [ 00 48 83 a1 d0 00 00:dc ce 51 00 a4 b5 51 ]
    fffff80001e6c28d-fffff80001e6c29b  15 bytes - nt!NtCreateTimer+d9 (+0x08)
    [ 00 8b d6 e8 c3 aa db ff:1b c0 51 00 59 91 51 00 ]
    fffff80001e6c29d-fffff80001e6c29f  3 bytes - nt!NtCreateTimer+e9 (+0x10)
    [ c6 81 f4:20 d1 51 ]
    fffff80001e6c2a1-fffff80001e6c2a7  7 bytes - nt!NtCreateTimer+ed (+0x04)
    [ 00 00 00 c6 81 f5 00:12 f4 51 00 37 ed 51 ]
    fffff80001e6c2a9-fffff80001e6c2af  7 bytes - nt!NtCreateTimer+f5 (+0x08)
    [ 00 00 48 83 a1 f8 00:df 2b 51 00 87 dd 51 ]
    fffff80001e6c2b1-fffff80001e6c2c0  16 bytes - nt!NtCreateTimer+fd (+0x08)
    [ 00 00 48 8d 44 24 50 48:12 fa 51 00 c9 91 51 00 ]
    fffff80001e6c2c2-fffff80001e6c2d7  22 bytes - nt!NtCreateTimer+10e (+0x11)
    [ 00 45 33 c9 45 8b c4 33:17 51 00 ff 7f 51 00 ab ]
    fffff80001e6c2d9-fffff80001e6c2f7  31 bytes - nt!NtCreateTimer+125 (+0x17)
    [ 00 85 c0 78 1b 40 84 ff:16 4c 51 00 e6 ad 51 00 ]
    fffff80001e6c2f9-fffff80001e6c32b  51 bytes - nt!NtCreateTimer+145 (+0x20)
    [ 41 8b c3 4c 8d 5c 24 70:5d f3 51 00 9a 3b 51 00 ]
    fffff80001e6c32d-fffff80001e6c353  39 bytes - nt!NtQueryFullAttributesFile+11 (+0x34)
    [ 00 48 8b 05 fb df f0 ff:97 cc 51 00 68 8b 51 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
1962 errors : !nt (fffff80001e6c000-fffff80001e6c7ff)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .cxr 0xfffffa600ca123b0 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
 

My Computer

Please run the following command in the debugger and post the output here.

!thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck
 

My Computer

Here you go:


Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini061109-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18005.amd64fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0xfffff800`01c07000 PsLoadedModuleList = 0xfffff800`01dcbdd0
Debug session time: Thu Jun 11 16:18:28.501 2009 (GMT+1)
System Uptime: 0 days 0:01:34.360
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80001e6c1b4, fffffa600ca123b0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck
GetPointerFromAddress: unable to read from fffff80001e2e000
THREAD fffffa8009c7dbb0  Cid 0d48.0d4c  Teb: 000007fffffdc000 Win32Thread: fffff900c1e73010 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from fffff80001dadc00
Owning Process            fffffa8009bb5040       Image:         drvinst.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      6048         
Context Switch Count      3667                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00000000ffdcc1a4
Stack Init fffffa600ca12db0 Current fffffa600ca121f0
Base fffffa600ca13000 Limit fffffa600ca0a000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`0ca119f8 fffff800`01c611ee : 00000000`0000003b 00000000`c0000005 fffff800`01e6c1b4 fffffa60`0ca123b0 : nt!KeBugCheckEx
fffffa60`0ca11a00 fffff800`01c60bbc : fffffa60`0ca1c011 fffffa60`0ca11b40 fffffa80`09feab80 fffff800`001fffff : nt!KiBugCheckDispatch+0x6e
fffffa60`0ca11b40 fffff800`01c8cdcd : 00000000`00000000 fffff800`01c07000 fffffa60`0ca13000 fffff800`01e0a49c : nt!KiSystemServiceHandler+0x7c
fffffa60`0ca11b80 fffff800`01c8d08f : fffffa60`00000001 00000000`00000001 00000000`00000000 fffffa60`0ca12c20 : nt!RtlpExecuteHandlerForException+0xd
fffffa60`0ca11bb0 fffff800`01c9a706 : fffffa60`0ca129d8 fffffa60`0ca123b0 fffffa60`00000000 00000000`00000000 : nt!RtlDispatchException+0x22f
fffffa60`0ca122a0 fffff800`01c612a9 : fffffa60`0ca129d8 fffffa80`09c7dbb0 fffffa60`0ca12a80 00000000`001cd018 : nt!KiDispatchException+0xc2
fffffa60`0ca128a0 fffff800`01c600a5 : 00000000`00000001 fffff800`01ecb314 fffff880`00001d00 fffffa80`09c7dbb0 : nt!KiExceptionDispatch+0xa9
fffffa60`0ca12a80 fffff800`01e6c1b4 : fffff800`01c60ef3 fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x1e5 (TrapFrame @ fffffa60`0ca12a80)
fffffa60`0ca12c18 fffff800`01c60ef3 : fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!NtCreateTimer
fffffa60`0ca12c20 00000000`771b77aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`0ca12c20)
00000000`001ccef8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b77aa

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001e6c1b4, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa600ca123b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtCreateTimer+0
fffff800`01e6c1b4 004849          add     byte ptr [rax+49h],cl

CONTEXT:  fffffa600ca123b0 -- (.cxr 0xfffffa600ca123b0)
rax=0000000000000000 rbx=fffffa8009c7dbb0 rcx=000000000030b0d0
rdx=00000000001f0003 rsi=00000000001cd018 rdi=0000000000000000
rip=fffff80001e6c1b4 rsp=fffffa600ca12c18 rbp=fffffa600ca12ca0
 r8=0000000000000000  r9=0000000000000001 r10=fffff80001e6c1b4
r11=000000000020a1b4 r12=00000000772827f8 r13=0000000000000000
r14=0000000000000000 r15=000000000031b930
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!NtCreateTimer:
fffff800`01e6c1b4 004849          add     byte ptr [rax+49h],cl ds:002b:00000000`00000049=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  drvinst.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001c60ef3 to fffff80001e6c1b4

STACK_TEXT:  
fffffa60`0ca12c18 fffff800`01c60ef3 : fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!NtCreateTimer
fffffa60`0ca12c20 00000000`771b77aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001ccef8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b77aa


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80001e6c000-fffff80001e6c037  56 bytes - nt!EtwpGetSidExtendedHeaderItem+8c
    [ 45 74 77 50 44 0f b6 60:00 8d ee 51 00 2e e7 51 ]
    fffff80001e6c039-fffff80001e6c063  43 bytes - nt!EtwpGetSidExtendedHeaderItem+c5 (+0x39)
    [ 66 83 60 04 00 48 8d 53:91 d8 51 00 6e e4 51 00 ]
    fffff80001e6c065-fffff80001e6c078  20 bytes - nt!EtwpGetSidExtendedHeaderItem+f1 (+0x2c)
    [ 49 89 3e 48 85 db 74 0a:00 80 51 00 11 bd 51 00 ]
    fffff80001e6c07a-fffff80001e6c0a3  42 bytes - nt!EtwpGetSidExtendedHeaderItem+106 (+0x15)
    [ 83 c4 20 41 5e 41 5d 41:2e 51 00 1f 6f 51 00 7c ]
    fffff80001e6c0a5-fffff80001e6c0b3  15 bytes - nt!PsCreateSystemThread+15 (+0x2b)
    [ 00 00 4d 85 c9 8b f2 48:cd 4c 51 00 3e 18 51 00 ]
    fffff80001e6c0b5-fffff80001e6c0bf  11 bytes - nt!PsCreateSystemThread+25 (+0x10)
    [ 49 8b d9 33 ff 4d 85 c0:71 fd 51 00 a6 03 51 00 ]
    fffff80001e6c0c1-fffff80001e6c0c7  7 bytes - nt!PsCreateSystemThread+31 (+0x0c)
    [ 00 00 4c 21 84 24 88:32 80 51 00 59 81 51 ]
    fffff80001e6c0ca-fffff80001e6c0cf  6 bytes - nt!PsCreateSystemThread+3a (+0x09)
    [ 00 4c 21 84 24 90:a5 51 00 00 80 51 ]
    fffff80001e6c0d1-fffff80001e6c0d7  7 bytes - nt!PsCreateSystemThread+41 (+0x07)
    [ 00 00 4c 21 84 24 a0:cb d6 51 00 f3 3a 51 ]
    fffff80001e6c0d9-fffff80001e6c0df  7 bytes - nt!PsCreateSystemThread+49 (+0x08)
    [ 00 00 4c 21 84 24 a8:9b 5e 51 00 e7 16 51 ]
    fffff80001e6c0e1-fffff80001e6c0e7  7 bytes - nt!PsCreateSystemThread+51 (+0x08)
    [ 00 00 c7 84 24 80 00:3a e9 51 00 dc 4a 51 ]
    fffff80001e6c0e9-fffff80001e6c0eb  3 bytes - nt!PsCreateSystemThread+59 (+0x08)
    [ 00 30 00:dd ed 51 ]
    fffff80001e6c0ed-fffff80001e6c0f3  7 bytes - nt!PsCreateSystemThread+5d (+0x04)
    [ 00 c7 84 24 98 00 00:e4 9d 51 00 43 2f 51 ]
    fffff80001e6c0f5-fffff80001e6c0f7  3 bytes - nt!PsCreateSystemThread+65 (+0x08)
    [ 00 02 00:93 e0 51 ]
    fffff80001e6c0f9-fffff80001e6c103  11 bytes - nt!PsCreateSystemThread+69 (+0x04)
    [ 48 83 64 24 70 00 48 83:7e fe 51 00 42 73 51 00 ]
    fffff80001e6c105-fffff80001e6c10d  9 bytes - nt!PsCreateSystemThread+75 (+0x0c)
    [ 48 83 64 24 60 00 48 8b:e6 4d 51 00 44 20 51 00 ]
    fffff80001e6c10f - nt!PsCreateSystemThread+7f (+0x0a)
    [ f0:51 ]
    fffff80001e6c111-fffff80001e6c117  7 bytes - nt!PsCreateSystemThread+81 (+0x02)
    [ 00 00 4c 8d 84 24 80:c6 05 51 00 ae a0 51 ]
    fffff80001e6c119-fffff80001e6c127  15 bytes - nt!PsCreateSystemThread+89 (+0x08)
    [ 00 00 4c 8b cb 48 89 44:53 a3 51 00 b4 18 51 00 ]
    fffff80001e6c129-fffff80001e6c13b  19 bytes - nt!PsCreateSystemThread+99 (+0x10)
    [ 00 00 8b d6 48 89 44 24:6b d9 51 00 7d 23 51 00 ]
    fffff80001e6c13d-fffff80001e6c147  11 bytes - nt!PsCreateSystemThread+ad (+0x14)
    [ 48 83 64 24 38 00 48 8b:77 91 51 00 9c 0c 51 00 ]
    fffff80001e6c149-fffff80001e6c157  15 bytes - nt!PsCreateSystemThread+b9 (+0x0c)
    [ 00 00 48 8b cd 48 89 44:9a f2 51 00 01 c7 51 00 ]
    fffff80001e6c159-fffff80001e6c167  15 bytes - nt!PsCreateSystemThread+c9 (+0x10)
    [ 48 89 7c 24 20 e8 9d 29:3e e3 51 00 f9 28 51 00 ]
    fffff80001e6c169-fffff80001e6c193  43 bytes - nt!PsCreateSystemThread+d9 (+0x10)
    [ 00 00 49 8b 5b 10 49 8b:81 26 51 00 cb 1f 51 00 ]
    fffff80001e6c195-fffff80001e6c197  3 bytes - nt!PsCreateSystemThread+105 (+0x2c)
    [ 41 b8 30:47 9d 51 ]
    fffff80001e6c199-fffff80001e6c1df  71 bytes - nt!PsCreateSystemThread+109 (+0x04)
    [ 00 00 e8 40 cb de ff 0f:ff 7f 51 00 fb df 51 00 ]
    fffff80001e6c1e1-fffff80001e6c1e7  7 bytes - nt!NtCreateTimer+2d (+0x48)
    [ 65 48 8b 04 25 88 01:00 80 51 00 01 af 51 ]
    fffff80001e6c1e9-fffff80001e6c1ef  7 bytes - nt!NtCreateTimer+35 (+0x08)
    [ 00 40 8a b8 53 01 00:bc bd 51 00 7b e2 51 ]
    fffff80001e6c1f1-fffff80001e6c20f  31 bytes - nt!NtCreateTimer+3d (+0x08)
    [ 40 84 ff 74 1b 48 8b 05:7b 37 51 00 07 cf 51 00 ]
    fffff80001e6c211-fffff80001e6c223  19 bytes - nt!NtCreateTimer+5d (+0x20)
    [ 48 8d 44 24 58 48 89 44:e1 e7 51 00 00 80 51 00 ]
    fffff80001e6c225-fffff80001e6c22b  7 bytes - nt!NtCreateTimer+71 (+0x14)
    [ c7 44 24 28 08 01 00:8d 26 51 00 92 d5 51 ]
    fffff80001e6c22d-fffff80001e6c243  23 bytes - nt!NtCreateTimer+79 (+0x08)
    [ 48 83 64 24 20 00 44 8a:27 09 51 00 ef 70 51 00 ]
    fffff80001e6c245-fffff80001e6c249  5 bytes - nt!NtCreateTimer+91 (+0x18)
    [ 44 8b d8 48 8b:ff 7f 51 00 a4 ]
    fffff80001e6c24b-fffff80001e6c257  13 bytes - nt!NtCreateTimer+97 (+0x06)
    [ 24 58 48 89 4c 24 60 85:51 00 2c 75 51 00 77 65 ]
    fffff80001e6c259-fffff80001e6c263  11 bytes - nt!NtCreateTimer+a5 (+0x0e)
    [ 00 c6 81 98 00 00 00 13:1b d9 51 00 80 ea 51 00 ]
    fffff80001e6c266-fffff80001e6c26b  6 bytes - nt!NtCreateTimer+b2 (+0x0d)
    [ 00 01 66 c7 81 9a:80 51 00 41 e2 51 ]
    fffff80001e6c26d-fffff80001e6c26f  3 bytes - nt!NtCreateTimer+b9 (+0x07)
    [ 00 00 00:d0 05 51 ]
    fffff80001e6c271-fffff80001e6c273  3 bytes - nt!NtCreateTimer+bd (+0x04)
    [ 48 8d 05:15 19 51 ]
    fffff80001e6c275-fffff80001e6c27b  7 bytes - nt!NtCreateTimer+c1 (+0x04)
    [ 12 e4 ff 48 89 81 b0:e4 19 51 00 96 9a 51 ]
    fffff80001e6c27d-fffff80001e6c283  7 bytes - nt!NtCreateTimer+c9 (+0x08)
    [ 00 00 48 89 89 b8 00:80 e8 51 00 70 b7 51 ]
    fffff80001e6c285-fffff80001e6c28b  7 bytes - nt!NtCreateTimer+d1 (+0x08)
    [ 00 48 83 a1 d0 00 00:dc ce 51 00 a4 b5 51 ]
    fffff80001e6c28d-fffff80001e6c29b  15 bytes - nt!NtCreateTimer+d9 (+0x08)
    [ 00 8b d6 e8 c3 aa db ff:1b c0 51 00 59 91 51 00 ]
    fffff80001e6c29d-fffff80001e6c29f  3 bytes - nt!NtCreateTimer+e9 (+0x10)
    [ c6 81 f4:20 d1 51 ]
    fffff80001e6c2a1-fffff80001e6c2a7  7 bytes - nt!NtCreateTimer+ed (+0x04)
    [ 00 00 00 c6 81 f5 00:12 f4 51 00 37 ed 51 ]
    fffff80001e6c2a9-fffff80001e6c2af  7 bytes - nt!NtCreateTimer+f5 (+0x08)
    [ 00 00 48 83 a1 f8 00:df 2b 51 00 87 dd 51 ]
    fffff80001e6c2b1-fffff80001e6c2c0  16 bytes - nt!NtCreateTimer+fd (+0x08)
    [ 00 00 48 8d 44 24 50 48:12 fa 51 00 c9 91 51 00 ]
    fffff80001e6c2c2-fffff80001e6c2d7  22 bytes - nt!NtCreateTimer+10e (+0x11)
    [ 00 45 33 c9 45 8b c4 33:17 51 00 ff 7f 51 00 ab ]
    fffff80001e6c2d9-fffff80001e6c2f7  31 bytes - nt!NtCreateTimer+125 (+0x17)
    [ 00 85 c0 78 1b 40 84 ff:16 4c 51 00 e6 ad 51 00 ]
    fffff80001e6c2f9-fffff80001e6c32b  51 bytes - nt!NtCreateTimer+145 (+0x20)
    [ 41 8b c3 4c 8d 5c 24 70:5d f3 51 00 9a 3b 51 00 ]
    fffff80001e6c32d-fffff80001e6c353  39 bytes - nt!NtQueryFullAttributesFile+11 (+0x34)
    [ 00 48 8b 05 fb df f0 ff:97 cc 51 00 68 8b 51 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
1962 errors : !nt (fffff80001e6c000-fffff80001e6c7ff)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .cxr 0xfffffa600ca123b0 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

rax=fffffa600ca11b00 rbx=fffffa600ca12c20 rcx=000000000000003b
rdx=00000000c0000005 rsi=fffff80001c60ef3 rdi=fffff80001e0a49c
rip=fffff80001c61450 rsp=fffffa600ca119f8 rbp=fffffa600ca129d8
 r8=fffff80001e6c1b4  r9=fffffa600ca123b0 r10=0000000000000000
r11=0000000000000001 r12=fffffa600ca0a000 r13=fffffa600ca13000
r14=fffff80001c07000 r15=fffff80001d54fc4
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!KeBugCheckEx:
fffff800`01c61450 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffa60`0ca11a00=000000000000003b
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`0ca119f8 fffff800`01c611ee : 00000000`0000003b 00000000`c0000005 fffff800`01e6c1b4 fffffa60`0ca123b0 : nt!KeBugCheckEx
fffffa60`0ca11a00 fffff800`01c60bbc : fffffa60`0ca1c011 fffffa60`0ca11b40 fffffa80`09feab80 fffff800`001fffff : nt!KiBugCheckDispatch+0x6e
fffffa60`0ca11b40 fffff800`01c8cdcd : 00000000`00000000 fffff800`01c07000 fffffa60`0ca13000 fffff800`01e0a49c : nt!KiSystemServiceHandler+0x7c
fffffa60`0ca11b80 fffff800`01c8d08f : fffffa60`00000001 00000000`00000001 00000000`00000000 fffffa60`0ca12c20 : nt!RtlpExecuteHandlerForException+0xd
fffffa60`0ca11bb0 fffff800`01c9a706 : fffffa60`0ca129d8 fffffa60`0ca123b0 fffffa60`00000000 00000000`00000000 : nt!RtlDispatchException+0x22f
fffffa60`0ca122a0 fffff800`01c612a9 : fffffa60`0ca129d8 fffffa80`09c7dbb0 fffffa60`0ca12a80 00000000`001cd018 : nt!KiDispatchException+0xc2
fffffa60`0ca128a0 fffff800`01c600a5 : 00000000`00000001 fffff800`01ecb314 fffff880`00001d00 fffffa80`09c7dbb0 : nt!KiExceptionDispatch+0xa9
fffffa60`0ca12a80 fffff800`01e6c1b4 : fffff800`01c60ef3 fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x1e5 (TrapFrame @ fffffa60`0ca12a80)
fffffa60`0ca12c18 fffff800`01c60ef3 : fffffa80`09c7dbb0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!NtCreateTimer
fffffa60`0ca12c20 00000000`771b77aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffffa60`0ca12c20)
00000000`001ccef8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771b77aa
start             end                 module name
fffff800`01c07000 fffff800`0211f000   nt       ntkrnlmp.exe Sat Apr 11 05:58:39 2009 (49E0237F)
fffff800`0211f000 fffff800`02165000   hal      hal.dll      Sat Apr 11 08:04:56 2009 (49E04118)
fffff960`00080000 fffff960`00331000   win32k   win32k.sys   Sat Apr 11 06:11:29 2009 (49E02681)
fffff960`004a0000 fffff960`004aa000   TSDDD    TSDDD.dll    Sat Jan 19 06:42:04 2008 (47919BBC)
fffff960`006a0000 fffff960`006b1000   cdd      cdd.dll      Sat Apr 11 08:03:49 2009 (49E040D5)
fffffa60`00600000 fffffa60`0060a000   kdcom    kdcom.dll    Sat Apr 11 08:07:57 2009 (49E041CD)
fffffa60`0060a000 fffffa60`00645000   mcupdate mcupdate.dll Sat Apr 11 08:05:41 2009 (49E04145)
fffffa60`00645000 fffffa60`00659000   PSHED    PSHED.dll    Sat Apr 11 08:08:17 2009 (49E041E1)
fffffa60`00659000 fffffa60`006b6000   CLFS     CLFS.SYS     Sat Apr 11 05:54:21 2009 (49E0227D)
fffffa60`006b6000 fffffa60`00768000   CI       CI.dll       Sat Apr 11 08:08:09 2009 (49E041D9)
fffffa60`00768000 fffffa60`007ce000   volmgrx  volmgrx.sys  Sat Apr 11 06:35:14 2009 (49E02C12)
fffffa60`0080b000 fffffa60`008e5000   Wdf01000 Wdf01000.sys Sat Jan 19 06:33:27 2008 (479199B7)
fffffa60`008e5000 fffffa60`008f3000   WDFLDR   WDFLDR.SYS   Sat Jan 19 06:32:33 2008 (47919981)
fffffa60`008f3000 fffffa60`00949000   acpi     acpi.sys     Sat Apr 11 06:03:26 2009 (49E0249E)
fffffa60`00949000 fffffa60`00952000   WMILIB   WMILIB.SYS   Sat Jan 19 06:33:45 2008 (479199C9)
fffffa60`00952000 fffffa60`0095c000   msisadrv msisadrv.sys Sat Jan 19 06:02:50 2008 (4791928A)
fffffa60`0095c000 fffffa60`0098c000   pci      pci.sys      Sat Apr 11 06:03:33 2009 (49E024A5)
fffffa60`0098c000 fffffa60`009a1000   partmgr  partmgr.sys  Sat Apr 11 06:34:51 2009 (49E02BFB)
fffffa60`009a1000 fffffa60`009a4400   compbatt compbatt.sys Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`009a5000 fffffa60`009b1000   BATTC    BATTC.SYS    Sat Jan 19 06:02:38 2008 (4791927E)
fffffa60`009b1000 fffffa60`009c5000   volmgr   volmgr.sys   Sat Apr 11 06:34:49 2009 (49E02BF9)
fffffa60`009c5000 fffffa60`009cd000   intelide intelide.sys Sat Jan 19 06:28:56 2008 (479198A8)
fffffa60`009cd000 fffffa60`009dd000   PCIIDEX  PCIIDEX.SYS  Sat Apr 11 06:34:22 2009 (49E02BDE)
fffffa60`009dd000 fffffa60`009f0000   mountmgr mountmgr.sys Sat Jan 19 06:28:01 2008 (47919871)
fffffa60`00a0e000 fffffa60`00ad5000   iastorv  iastorv.sys  Fri Sep 28 19:32:10 2007 (46FD48AA)
fffffa60`00ad5000 fffffa60`00add000   atapi    atapi.sys    Sat Apr 11 06:34:19 2009 (49E02BDB)
fffffa60`00add000 fffffa60`00b01000   ataport  ataport.SYS  Sat Apr 11 06:34:25 2009 (49E02BE1)
fffffa60`00b01000 fffffa60`00b54000   Si3531   Si3531.sys   Mon Feb 09 00:58:27 2009 (498F7FB3)
fffffa60`00b54000 fffffa60`00b82000   SCSIPORT SCSIPORT.SYS Sat Jan 19 06:28:52 2008 (479198A4)
fffffa60`00b82000 fffffa60`00bc9000   fltmgr   fltmgr.sys   Sat Apr 11 05:54:38 2009 (49E0228E)
fffffa60`00bc9000 fffffa60`00bdd000   fileinfo fileinfo.sys Sat Jan 19 06:05:23 2008 (47919323)
fffffa60`00bdd000 fffffa60`00be7000   SiWinAcc SiWinAcc.sys Mon Nov 01 19:23:29 2004 (41868D31)
fffffa60`00c02000 fffffa60`00c88000   ksecdd   ksecdd.sys   Sat Apr 11 06:21:49 2009 (49E028ED)
fffffa60`00c88000 fffffa60`00cd8000   msrpc    msrpc.sys    Sat Apr 11 06:32:13 2009 (49E02B5D)
fffffa60`00cd8000 fffffa60`00d31000   NETIO    NETIO.SYS    Sat Apr 11 06:43:34 2009 (49E02E06)
fffffa60`00d31000 fffffa60`00d5d000   CLASSPNP CLASSPNP.SYS Sat Apr 11 06:34:15 2009 (49E02BD7)
fffffa60`00d5d000 fffffa60`00da3000   USBPORT  USBPORT.SYS  Sat Apr 11 06:39:39 2009 (49E02D1B)
fffffa60`00da3000 fffffa60`00dd7000   ks       ks.sys       Sat Apr 11 06:33:51 2009 (49E02BBF)
fffffa60`00dd7000 fffffa60`00de7000   umbus    umbus.sys    Sat Jan 19 06:34:16 2008 (479199E8)
fffffa60`00e0a000 fffffa60`00fcd000   ndis     ndis.sys     Sat Apr 11 06:43:15 2009 (49E02DF3)
fffffa60`00fcd000 fffffa60`00ff6000   fvevol   fvevol.sys   Sat Apr 11 05:52:54 2009 (49E02226)
fffffa60`0100c000 fffffa60`01181000   tcpip    tcpip.sys    Sat Apr 11 06:44:47 2009 (49E02E4F)
fffffa60`01181000 fffffa60`011ad000   fwpkclnt fwpkclnt.sys Sat Apr 11 06:42:44 2009 (49E02DD4)
fffffa60`011ad000 fffffa60`011d9000   ecache   ecache.sys   Sat Apr 11 06:36:18 2009 (49E02C52)
fffffa60`011d9000 fffffa60`011ed000   disk     disk.sys     Sat Apr 11 06:34:38 2009 (49E02BEE)
fffffa60`01208000 fffffa60`01388000   Ntfs     Ntfs.sys     Sat Apr 11 05:55:38 2009 (49E022CA)
fffffa60`01388000 fffffa60`013cc000   volsnap  volsnap.sys  Sat Apr 11 06:35:33 2009 (49E02C25)
fffffa60`013cc000 fffffa60`013d4000   spldr    spldr.sys    Mon Jan 12 21:51:29 2009 (496BBB61)
fffffa60`013d4000 fffffa60`013dc000   SiRemFil SiRemFil.sys Wed Oct 18 23:20:39 2006 (4536A8B7)
fffffa60`013dc000 fffffa60`013ee000   mup      mup.sys      Sat Apr 11 05:54:47 2009 (49E02297)
fffffa60`013ee000 fffffa60`013f8000   crcdisk  crcdisk.sys  Thu Nov 02 09:39:40 2006 (4549BCDC)
fffffa60`02400000 fffffa60`02434000   nwifi    nwifi.sys    Sat Apr 11 06:40:19 2009 (49E02D43)
fffffa60`02434000 fffffa60`024ce000   spsys    spsys.sys    Tue Mar 10 17:16:43 2009 (49B6A07B)
fffffa60`024e4000 fffffa60`024f0000   tunnel   tunnel.sys   Sat Jan 19 06:36:44 2008 (47919A7C)
fffffa60`024f0000 fffffa60`024f9000   tunmp    tunmp.sys    Sat Jan 19 06:36:30 2008 (47919A6E)
fffffa60`024f9000 fffffa60`0250c000   intelppm intelppm.sys Sat Jan 19 05:52:45 2008 (4791902D)
fffffa60`0250c000 fffffa60`02515000   wmiacpi  wmiacpi.sys  Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`02515000 fffffa60`025f6000   dxgkrnl  dxgkrnl.sys  Sat Apr 11 06:10:13 2009 (49E02635)
fffffa60`025f6000 fffffa60`02600000   VMNET    VMNET.SYS    Thu May 22 11:33:54 2008 (48354C12)
fffffa60`02600000 fffffa60`02608000   vmnetadapter vmnetadapter.sys Thu May 22 11:33:57 2008 (48354C15)
fffffa60`0260b000 fffffa60`02fbcd00   nvlddmkm nvlddmkm.sys Thu Nov 15 20:13:23 2007 (473CA863)
fffffa60`02fbd000 fffffa60`02fcd000   watchdog watchdog.sys Sat Apr 11 06:09:16 2009 (49E025FC)
fffffa60`02fcd000 fffffa60`02fd9000   usbuhci  usbuhci.sys  Sat Jan 19 06:33:56 2008 (479199D4)
fffffa60`02fd9000 fffffa60`02fea000   usbehci  usbehci.sys  Sat Apr 11 06:39:36 2009 (49E02D18)
fffffa60`02fea000 fffffa60`02ffd000   termdd   termdd.sys   Sat Apr 11 06:48:13 2009 (49E02F1D)
fffffa60`03001000 fffffa60`030ee000   HDAudBus HDAudBus.sys Sat Apr 11 06:39:38 2009 (49E02D1A)
fffffa60`030ee000 fffffa60`0311f000   ndiswan  ndiswan.sys  Sat Apr 11 06:43:39 2009 (49E02E0B)
fffffa60`0311f000 fffffa60`0313d000   raspptp  raspptp.sys  Sat Apr 11 06:43:38 2009 (49E02E0A)
fffffa60`0313d000 fffffa60`03155000   rassstp  rassstp.sys  Sat Apr 11 06:43:46 2009 (49E02E12)
fffffa60`03155000 fffffa60`031ef000   rdpdr    rdpdr.sys    Sat Apr 11 06:49:54 2009 (49E02F82)
fffffa60`031ef000 fffffa60`031fa000   mssmbios mssmbios.sys Sat Jan 19 06:02:54 2008 (4791928E)
fffffa60`03207000 fffffa60`03699000   NETw5v64 NETw5v64.sys Mon Nov 17 15:50:25 2008 (492192C1)
fffffa60`03699000 fffffa60`036aab00   ohci1394 ohci1394.sys Sat Apr 11 06:39:49 2009 (49E02D25)
fffffa60`036ab000 fffffa60`036baf00   1394BUS  1394BUS.SYS  Sat Jan 19 06:34:04 2008 (479199DC)
fffffa60`036bb000 fffffa60`036bf580   CmBatt   CmBatt.sys   Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`036c0000 fffffa60`036d6000   i8042prt i8042prt.sys Sat Jan 19 06:28:08 2008 (47919878)
fffffa60`036d6000 fffffa60`036e4000   kbdclass kbdclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`036e4000 fffffa60`036ef000   VMkbd    VMkbd.sys    Fri Mar 27 03:59:55 2009 (49CC4F3B)
fffffa60`036ef000 fffffa60`036fb000   mouclass mouclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`036fb000 fffffa60`03717000   cdrom    cdrom.sys    Sat Apr 11 06:34:39 2009 (49E02BEF)
fffffa60`03717000 fffffa60`03750000   msiscsi  msiscsi.sys  Sat Apr 11 06:36:09 2009 (49E02C49)
fffffa60`03750000 fffffa60`037ad000   storport storport.sys Sat Apr 11 06:34:45 2009 (49E02BF5)
fffffa60`037ad000 fffffa60`037ba000   TDI      TDI.SYS      Sat Apr 11 06:44:14 2009 (49E02E2E)
fffffa60`037ba000 fffffa60`037dd000   rasl2tp  rasl2tp.sys  Sat Apr 11 06:43:37 2009 (49E02E09)
fffffa60`037dd000 fffffa60`037e9000   ndistapi ndistapi.sys Sat Jan 19 06:37:22 2008 (47919AA2)
fffffa60`037e9000 fffffa60`037f9000   raspppoe raspppoe.sys Sat Apr 11 06:43:33 2009 (49E02E05)
fffffa60`037f9000 fffffa60`037fa480   swenum   swenum.sys   Thu Nov 02 09:37:33 2006 (4549BC5D)
fffffa60`03a0b000 fffffa60`03a53000   usbhub   usbhub.sys   Sat Apr 11 06:39:52 2009 (49E02D28)
fffffa60`03a53000 fffffa60`03a67000   NDProxy  NDProxy.SYS  Sat Jan 19 06:37:26 2008 (47919AA6)
fffffa60`03a67000 fffffa60`03ba3000   agrsm64  agrsm64.sys  Tue Oct 30 21:07:57 2007 (47279D2D)
fffffa60`03ba3000 fffffa60`03ba4e00   USBD     USBD.SYS     Sat Jan 19 06:33:53 2008 (479199D1)
fffffa60`03ba5000 fffffa60`03bb4000   modem    modem.sys    Sat Jan 19 06:38:17 2008 (47919AD9)
fffffa60`03bb4000 fffffa60`03bfd000   HdAudio  HdAudio.sys  Sat Apr 11 06:39:51 2009 (49E02D27)
fffffa60`0620f000 fffffa60`0624a000   portcls  portcls.sys  Sat Apr 11 06:39:36 2009 (49E02D18)
fffffa60`0624a000 fffffa60`0626d000   drmk     drmk.sys     Sat Jan 19 07:20:04 2008 (4791A4A4)
fffffa60`0626d000 fffffa60`06272180   ksthunk  ksthunk.sys  Sat Jan 19 06:28:14 2008 (4791987E)
fffffa60`06273000 fffffa60`062e6000   SRTSP64  SRTSP64.SYS  Tue Jan 22 05:16:07 2008 (47957C17)
fffffa60`062e6000 fffffa60`062f8000   HIDCLASS HIDCLASS.SYS Sat Apr 11 06:39:32 2009 (49E02D14)
fffffa60`062f8000 fffffa60`0630e000   RTSTOR64 RTSTOR64.SYS Thu Mar 26 08:00:14 2009 (49CB360E)
fffffa60`0630e000 fffffa60`06316000   moufiltr moufiltr.sys Tue Dec 26 02:27:18 2006 (45908886)
fffffa60`06316000 fffffa60`0632a000   SRTSPX64 SRTSPX64.SYS Tue Jan 22 05:17:58 2008 (47957C86)
fffffa60`0632a000 fffffa60`06334000   Fs_Rec   Fs_Rec.SYS   Sat Jan 19 05:53:41 2008 (47919065)
fffffa60`06334000 fffffa60`0633d000   Null     Null.SYS     Thu Nov 02 09:37:15 2006 (4549BC4B)
fffffa60`0633d000 fffffa60`0634b000   vga      vga.sys      Sat Jan 19 06:32:21 2008 (47919975)
fffffa60`0634b000 fffffa60`06370000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 06:32:25 2008 (47919979)
fffffa60`06370000 fffffa60`06379000   RDPCDD   RDPCDD.sys   Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`06379000 fffffa60`06382000   rdpencdd rdpencdd.sys Sat Jan 19 06:42:03 2008 (47919BBB)
fffffa60`06382000 fffffa60`0638d000   Msfs     Msfs.SYS     Sat Jan 19 05:53:55 2008 (47919073)
fffffa60`0638d000 fffffa60`0639e000   Npfs     Npfs.SYS     Sat Apr 11 05:54:22 2009 (49E0227E)
fffffa60`0639e000 fffffa60`063a7000   rasacd   rasacd.sys   Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`063a7000 fffffa60`063c4000   tdx      tdx.sys      Sat Apr 11 06:43:00 2009 (49E02DE4)
fffffa60`063c4000 fffffa60`063df000   smb      smb.sys      Sat Apr 11 06:42:19 2009 (49E02DBB)
fffffa60`063df000 fffffa60`063f7000   rspndr   rspndr.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`06400000 fffffa60`0640b000   mouhid   mouhid.sys   Sat Jan 19 06:28:10 2008 (4791987A)
fffffa60`0640b000 fffffa60`06574000   EX64     EX64.SYS     Thu Feb 12 23:43:23 2009 (4994B41B)
fffffa60`06574000 fffffa60`06599000   ENG64    ENG64.SYS    Thu Feb 12 23:41:48 2009 (4994B3BC)
fffffa60`06599000 fffffa60`065b5000   usbccgp  usbccgp.sys  Sat Jan 19 06:34:04 2008 (479199DC)
fffffa60`065b5000 fffffa60`065be000   UVCFTR_S UVCFTR_S.SYS Wed May 23 10:23:16 2007 (46540804)
fffffa60`065be000 fffffa60`065e7300   usbvideo usbvideo.sys Sat Jan 19 06:34:14 2008 (479199E6)
fffffa60`065e8000 fffffa60`065f1000   hidusb   hidusb.sys   Sat Apr 11 06:39:32 2009 (49E02D14)
fffffa60`065f1000 fffffa60`065f8b80   HIDPARSE HIDPARSE.SYS Sat Jan 19 06:33:51 2008 (479199CF)
fffffa60`06601000 fffffa60`0666c000   afd      afd.sys      Sat Apr 11 06:44:21 2009 (49E02E35)
fffffa60`0666c000 fffffa60`066b0000   netbt    netbt.sys    Sat Apr 11 06:42:31 2009 (49E02DC7)
fffffa60`066b0000 fffffa60`066bb000   ws2ifsl  ws2ifsl.sys  Sat Jan 19 06:37:46 2008 (47919ABA)
fffffa60`066bb000 fffffa60`066d9000   pacer    pacer.sys    Sat Apr 11 06:42:56 2009 (49E02DE0)
fffffa60`066d9000 fffffa60`066e8000   netbios  netbios.sys  Sat Jan 19 06:36:35 2008 (47919A73)
fffffa60`066e8000 fffffa60`06703000   wanarp   wanarp.sys   Sat Apr 11 06:43:38 2009 (49E02E0A)
fffffa60`06703000 fffffa60`06750000   rdbss    rdbss.sys    Sat Apr 11 05:55:21 2009 (49E022B9)
fffffa60`06750000 fffffa60`0675c000   nsiproxy nsiproxy.sys Sat Jan 19 06:36:45 2008 (47919A7D)
fffffa60`0675c000 fffffa60`0677a000   ISODrv64 ISODrv64.sys Tue Feb 10 09:22:18 2009 (4991474A)
fffffa60`0677a000 fffffa60`067f0000   eeCtrl64 eeCtrl64.sys Fri Feb 06 19:39:27 2009 (498C91EF)
fffffa60`06800000 fffffa60`06876000   csc      csc.sys      Sat Apr 11 05:56:24 2009 (49E022F8)
fffffa60`06876000 fffffa60`06893000   dfsc     dfsc.sys     Sat Apr 11 05:54:44 2009 (49E02294)
fffffa60`06893000 fffffa60`068a1000   crashdmp crashdmp.sys Sat Apr 11 06:34:31 2009 (49E02BE7)
fffffa60`068a1000 fffffa60`06968000   dump_iaStorV dump_iaStorV.sys Fri Sep 28 19:32:10 2007 (46FD48AA)
fffffa60`06968000 fffffa60`0697b000   dump_dumpfve dump_dumpfve.sys Sat Jan 19 05:52:25 2008 (47919019)
fffffa60`0697b000 fffffa60`06987000   Dxapi    Dxapi.sys    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`06987000 fffffa60`0699a000   monitor  monitor.sys  Sat Jan 19 06:32:34 2008 (47919982)
fffffa60`0699a000 fffffa60`069bc000   luafv    luafv.sys    Sat Jan 19 05:59:06 2008 (479191AA)
fffffa60`069c5000 fffffa60`069d1000   vmnetbridge vmnetbridge.sys Thu May 22 11:34:05 2008 (48354C1D)
fffffa60`069d1000 fffffa60`069e5000   lltdio   lltdio.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`069e5000 fffffa60`069f0000   ndisuio  ndisuio.sys  Sat Jan 19 06:36:29 2008 (47919A6D)
fffffa60`09c03000 fffffa60`09ca2000   HTTP     HTTP.sys     Sat Apr 11 06:42:20 2009 (49E02DBC)
fffffa60`09ca2000 fffffa60`09ccb000   srvnet   srvnet.sys   Sat Apr 11 05:57:28 2009 (49E02338)
fffffa60`09ccb000 fffffa60`09ce9000   bowser   bowser.sys   Sat Jan 19 05:54:51 2008 (479190AB)
fffffa60`09ce9000 fffffa60`09d03000   mpsdrv   mpsdrv.sys   Sat Jan 19 06:35:28 2008 (47919A30)
fffffa60`09d03000 fffffa60`09d2a000   mrxdav   mrxdav.sys   Sat Apr 11 05:55:42 2009 (49E022CE)
fffffa60`09d2a000 fffffa60`09d53000   mrxsmb   mrxsmb.sys   Sat Apr 11 05:55:33 2009 (49E022C5)
fffffa60`09d53000 fffffa60`09d9c000   mrxsmb10 mrxsmb10.sys Sat Apr 11 05:55:23 2009 (49E022BB)
fffffa60`09d9c000 fffffa60`09dbb000   mrxsmb20 mrxsmb20.sys Sat Apr 11 05:55:26 2009 (49E022BE)
fffffa60`09dbb000 fffffa60`09ded000   srv2     srv2.sys     Sat Apr 11 05:57:35 2009 (49E0233F)
fffffa60`0a006000 fffffa60`0a097000   srv      srv.sys      Sat Apr 11 05:57:52 2009 (49E02350)
fffffa60`0a097000 fffffa60`0a098a00   MSPQM    MSPQM.sys    Thu Nov 02 09:37:30 2006 (4549BC5A)
fffffa60`0a099000 fffffa60`0a0a5000   hcmon    hcmon.sys    Fri Mar 27 01:52:03 2009 (49CC3143)
fffffa60`0a0a5000 fffffa60`0a0b9000   vmci     vmci.sys     Fri Mar 27 01:21:48 2009 (49CC2A2C)
fffffa60`0a0b9000 fffffa60`0a191000   vmx86    vmx86.sys    Fri Mar 27 04:28:08 2009 (49CC55D8)
fffffa60`0a60a000 fffffa60`0a6c0000   peauth   peauth.sys   Mon Oct 23 12:57:00 2006 (453CAE0C)
fffffa60`0a6c0000 fffffa60`0a6cb000   secdrv   secdrv.SYS   Wed Sep 13 14:18:38 2006 (4508052E)
fffffa60`0a6cb000 fffffa60`0a6db000   tcpipreg tcpipreg.sys Sat Apr 11 06:43:04 2009 (49E02DE8)
fffffa60`0a6db000 fffffa60`0a6e5000   vmnetuserif vmnetuserif.sys Fri Mar 27 02:06:58 2009 (49CC34C2)
fffffa60`0a6e5000 fffffa60`0a6f1000   vstor2_ws60 vstor2-ws60.sys Mon Dec 01 19:26:32 2008 (49343A68)
fffffa60`0a6f1000 fffffa60`0a70d000   cdfs     cdfs.sys     Sat Jan 19 05:53:45 2008 (47919069)
fffffa60`0a70d000 fffffa60`0a731000   EraserUtilDrv10910 EraserUtilDrv10910.sys Fri Feb 06 19:39:27 2009 (498C91EF)
fffffa60`0a731000 fffffa60`0a767000   SYMEVENT64x86 SYMEVENT64x86.SYS Mon Jan 14 23:32:19 2008 (478BF103)

Unloaded modules:
fffffa60`069bc000 fffffa60`069c5000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`011ed000 fffffa60`011fb000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`0240a000 fffffa60`024d1000   dump_iaStorV
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`024d1000 fffffa60`024e4000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
start             end                 module name
fffffa60`036ab000 fffffa60`036baf00   1394BUS  1394BUS.SYS  Sat Jan 19 06:34:04 2008 (479199DC)
fffffa60`008f3000 fffffa60`00949000   acpi     acpi.sys     Sat Apr 11 06:03:26 2009 (49E0249E)
fffffa60`06601000 fffffa60`0666c000   afd      afd.sys      Sat Apr 11 06:44:21 2009 (49E02E35)
fffffa60`03a67000 fffffa60`03ba3000   agrsm64  agrsm64.sys  Tue Oct 30 21:07:57 2007 (47279D2D)
fffffa60`00ad5000 fffffa60`00add000   atapi    atapi.sys    Sat Apr 11 06:34:19 2009 (49E02BDB)
fffffa60`00add000 fffffa60`00b01000   ataport  ataport.SYS  Sat Apr 11 06:34:25 2009 (49E02BE1)
fffffa60`009a5000 fffffa60`009b1000   BATTC    BATTC.SYS    Sat Jan 19 06:02:38 2008 (4791927E)
fffffa60`09ccb000 fffffa60`09ce9000   bowser   bowser.sys   Sat Jan 19 05:54:51 2008 (479190AB)
fffff960`006a0000 fffff960`006b1000   cdd      cdd.dll      Sat Apr 11 08:03:49 2009 (49E040D5)
fffffa60`0a6f1000 fffffa60`0a70d000   cdfs     cdfs.sys     Sat Jan 19 05:53:45 2008 (47919069)
fffffa60`036fb000 fffffa60`03717000   cdrom    cdrom.sys    Sat Apr 11 06:34:39 2009 (49E02BEF)
fffffa60`006b6000 fffffa60`00768000   CI       CI.dll       Sat Apr 11 08:08:09 2009 (49E041D9)
fffffa60`00d31000 fffffa60`00d5d000   CLASSPNP CLASSPNP.SYS Sat Apr 11 06:34:15 2009 (49E02BD7)
fffffa60`00659000 fffffa60`006b6000   CLFS     CLFS.SYS     Sat Apr 11 05:54:21 2009 (49E0227D)
fffffa60`036bb000 fffffa60`036bf580   CmBatt   CmBatt.sys   Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`009a1000 fffffa60`009a4400   compbatt compbatt.sys Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`06893000 fffffa60`068a1000   crashdmp crashdmp.sys Sat Apr 11 06:34:31 2009 (49E02BE7)
fffffa60`013ee000 fffffa60`013f8000   crcdisk  crcdisk.sys  Thu Nov 02 09:39:40 2006 (4549BCDC)
fffffa60`06800000 fffffa60`06876000   csc      csc.sys      Sat Apr 11 05:56:24 2009 (49E022F8)
fffffa60`06876000 fffffa60`06893000   dfsc     dfsc.sys     Sat Apr 11 05:54:44 2009 (49E02294)
fffffa60`011d9000 fffffa60`011ed000   disk     disk.sys     Sat Apr 11 06:34:38 2009 (49E02BEE)
fffffa60`0624a000 fffffa60`0626d000   drmk     drmk.sys     Sat Jan 19 07:20:04 2008 (4791A4A4)
fffffa60`06968000 fffffa60`0697b000   dump_dumpfve dump_dumpfve.sys Sat Jan 19 05:52:25 2008 (47919019)
fffffa60`068a1000 fffffa60`06968000   dump_iaStorV dump_iaStorV.sys Fri Sep 28 19:32:10 2007 (46FD48AA)
fffffa60`0697b000 fffffa60`06987000   Dxapi    Dxapi.sys    Sat Jan 19 06:08:00 2008 (479193C0)
fffffa60`02515000 fffffa60`025f6000   dxgkrnl  dxgkrnl.sys  Sat Apr 11 06:10:13 2009 (49E02635)
fffffa60`011ad000 fffffa60`011d9000   ecache   ecache.sys   Sat Apr 11 06:36:18 2009 (49E02C52)
fffffa60`0677a000 fffffa60`067f0000   eeCtrl64 eeCtrl64.sys Fri Feb 06 19:39:27 2009 (498C91EF)
fffffa60`06574000 fffffa60`06599000   ENG64    ENG64.SYS    Thu Feb 12 23:41:48 2009 (4994B3BC)
fffffa60`0a70d000 fffffa60`0a731000   EraserUtilDrv10910 EraserUtilDrv10910.sys Fri Feb 06 19:39:27 2009 (498C91EF)
fffffa60`0640b000 fffffa60`06574000   EX64     EX64.SYS     Thu Feb 12 23:43:23 2009 (4994B41B)
fffffa60`00bc9000 fffffa60`00bdd000   fileinfo fileinfo.sys Sat Jan 19 06:05:23 2008 (47919323)
fffffa60`00b82000 fffffa60`00bc9000   fltmgr   fltmgr.sys   Sat Apr 11 05:54:38 2009 (49E0228E)
fffffa60`0632a000 fffffa60`06334000   Fs_Rec   Fs_Rec.SYS   Sat Jan 19 05:53:41 2008 (47919065)
fffffa60`00fcd000 fffffa60`00ff6000   fvevol   fvevol.sys   Sat Apr 11 05:52:54 2009 (49E02226)
fffffa60`01181000 fffffa60`011ad000   fwpkclnt fwpkclnt.sys Sat Apr 11 06:42:44 2009 (49E02DD4)
fffff800`0211f000 fffff800`02165000   hal      hal.dll      Sat Apr 11 08:04:56 2009 (49E04118)
fffffa60`0a099000 fffffa60`0a0a5000   hcmon    hcmon.sys    Fri Mar 27 01:52:03 2009 (49CC3143)
fffffa60`03001000 fffffa60`030ee000   HDAudBus HDAudBus.sys Sat Apr 11 06:39:38 2009 (49E02D1A)
fffffa60`03bb4000 fffffa60`03bfd000   HdAudio  HdAudio.sys  Sat Apr 11 06:39:51 2009 (49E02D27)
fffffa60`062e6000 fffffa60`062f8000   HIDCLASS HIDCLASS.SYS Sat Apr 11 06:39:32 2009 (49E02D14)
fffffa60`065f1000 fffffa60`065f8b80   HIDPARSE HIDPARSE.SYS Sat Jan 19 06:33:51 2008 (479199CF)
fffffa60`065e8000 fffffa60`065f1000   hidusb   hidusb.sys   Sat Apr 11 06:39:32 2009 (49E02D14)
fffffa60`09c03000 fffffa60`09ca2000   HTTP     HTTP.sys     Sat Apr 11 06:42:20 2009 (49E02DBC)
fffffa60`036c0000 fffffa60`036d6000   i8042prt i8042prt.sys Sat Jan 19 06:28:08 2008 (47919878)
fffffa60`00a0e000 fffffa60`00ad5000   iastorv  iastorv.sys  Fri Sep 28 19:32:10 2007 (46FD48AA)
fffffa60`009c5000 fffffa60`009cd000   intelide intelide.sys Sat Jan 19 06:28:56 2008 (479198A8)
fffffa60`024f9000 fffffa60`0250c000   intelppm intelppm.sys Sat Jan 19 05:52:45 2008 (4791902D)
fffffa60`0675c000 fffffa60`0677a000   ISODrv64 ISODrv64.sys Tue Feb 10 09:22:18 2009 (4991474A)
fffffa60`036d6000 fffffa60`036e4000   kbdclass kbdclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`00600000 fffffa60`0060a000   kdcom    kdcom.dll    Sat Apr 11 08:07:57 2009 (49E041CD)
fffffa60`00da3000 fffffa60`00dd7000   ks       ks.sys       Sat Apr 11 06:33:51 2009 (49E02BBF)
fffffa60`00c02000 fffffa60`00c88000   ksecdd   ksecdd.sys   Sat Apr 11 06:21:49 2009 (49E028ED)
fffffa60`0626d000 fffffa60`06272180   ksthunk  ksthunk.sys  Sat Jan 19 06:28:14 2008 (4791987E)
fffffa60`069d1000 fffffa60`069e5000   lltdio   lltdio.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`0699a000 fffffa60`069bc000   luafv    luafv.sys    Sat Jan 19 05:59:06 2008 (479191AA)
fffffa60`0060a000 fffffa60`00645000   mcupdate mcupdate.dll Sat Apr 11 08:05:41 2009 (49E04145)
fffffa60`03ba5000 fffffa60`03bb4000   modem    modem.sys    Sat Jan 19 06:38:17 2008 (47919AD9)
fffffa60`06987000 fffffa60`0699a000   monitor  monitor.sys  Sat Jan 19 06:32:34 2008 (47919982)
fffffa60`036ef000 fffffa60`036fb000   mouclass mouclass.sys Sat Jan 19 06:28:05 2008 (47919875)
fffffa60`0630e000 fffffa60`06316000   moufiltr moufiltr.sys Tue Dec 26 02:27:18 2006 (45908886)
fffffa60`06400000 fffffa60`0640b000   mouhid   mouhid.sys   Sat Jan 19 06:28:10 2008 (4791987A)
fffffa60`009dd000 fffffa60`009f0000   mountmgr mountmgr.sys Sat Jan 19 06:28:01 2008 (47919871)
fffffa60`09ce9000 fffffa60`09d03000   mpsdrv   mpsdrv.sys   Sat Jan 19 06:35:28 2008 (47919A30)
fffffa60`09d03000 fffffa60`09d2a000   mrxdav   mrxdav.sys   Sat Apr 11 05:55:42 2009 (49E022CE)
fffffa60`09d2a000 fffffa60`09d53000   mrxsmb   mrxsmb.sys   Sat Apr 11 05:55:33 2009 (49E022C5)
fffffa60`09d53000 fffffa60`09d9c000   mrxsmb10 mrxsmb10.sys Sat Apr 11 05:55:23 2009 (49E022BB)
fffffa60`09d9c000 fffffa60`09dbb000   mrxsmb20 mrxsmb20.sys Sat Apr 11 05:55:26 2009 (49E022BE)
fffffa60`06382000 fffffa60`0638d000   Msfs     Msfs.SYS     Sat Jan 19 05:53:55 2008 (47919073)
fffffa60`00952000 fffffa60`0095c000   msisadrv msisadrv.sys Sat Jan 19 06:02:50 2008 (4791928A)
fffffa60`03717000 fffffa60`03750000   msiscsi  msiscsi.sys  Sat Apr 11 06:36:09 2009 (49E02C49)
fffffa60`0a097000 fffffa60`0a098a00   MSPQM    MSPQM.sys    Thu Nov 02 09:37:30 2006 (4549BC5A)
fffffa60`00c88000 fffffa60`00cd8000   msrpc    msrpc.sys    Sat Apr 11 06:32:13 2009 (49E02B5D)
fffffa60`031ef000 fffffa60`031fa000   mssmbios mssmbios.sys Sat Jan 19 06:02:54 2008 (4791928E)
fffffa60`013dc000 fffffa60`013ee000   mup      mup.sys      Sat Apr 11 05:54:47 2009 (49E02297)
fffffa60`00e0a000 fffffa60`00fcd000   ndis     ndis.sys     Sat Apr 11 06:43:15 2009 (49E02DF3)
fffffa60`037dd000 fffffa60`037e9000   ndistapi ndistapi.sys Sat Jan 19 06:37:22 2008 (47919AA2)
fffffa60`069e5000 fffffa60`069f0000   ndisuio  ndisuio.sys  Sat Jan 19 06:36:29 2008 (47919A6D)
fffffa60`030ee000 fffffa60`0311f000   ndiswan  ndiswan.sys  Sat Apr 11 06:43:39 2009 (49E02E0B)
fffffa60`03a53000 fffffa60`03a67000   NDProxy  NDProxy.SYS  Sat Jan 19 06:37:26 2008 (47919AA6)
fffffa60`066d9000 fffffa60`066e8000   netbios  netbios.sys  Sat Jan 19 06:36:35 2008 (47919A73)
fffffa60`0666c000 fffffa60`066b0000   netbt    netbt.sys    Sat Apr 11 06:42:31 2009 (49E02DC7)
fffffa60`00cd8000 fffffa60`00d31000   NETIO    NETIO.SYS    Sat Apr 11 06:43:34 2009 (49E02E06)
fffffa60`03207000 fffffa60`03699000   NETw5v64 NETw5v64.sys Mon Nov 17 15:50:25 2008 (492192C1)
fffffa60`0638d000 fffffa60`0639e000   Npfs     Npfs.SYS     Sat Apr 11 05:54:22 2009 (49E0227E)
fffffa60`06750000 fffffa60`0675c000   nsiproxy nsiproxy.sys Sat Jan 19 06:36:45 2008 (47919A7D)
fffff800`01c07000 fffff800`0211f000   nt       ntkrnlmp.exe Sat Apr 11 05:58:39 2009 (49E0237F)
fffffa60`01208000 fffffa60`01388000   Ntfs     Ntfs.sys     Sat Apr 11 05:55:38 2009 (49E022CA)
fffffa60`06334000 fffffa60`0633d000   Null     Null.SYS     Thu Nov 02 09:37:15 2006 (4549BC4B)
fffffa60`0260b000 fffffa60`02fbcd00   nvlddmkm nvlddmkm.sys Thu Nov 15 20:13:23 2007 (473CA863)
fffffa60`02400000 fffffa60`02434000   nwifi    nwifi.sys    Sat Apr 11 06:40:19 2009 (49E02D43)
fffffa60`03699000 fffffa60`036aab00   ohci1394 ohci1394.sys Sat Apr 11 06:39:49 2009 (49E02D25)
fffffa60`066bb000 fffffa60`066d9000   pacer    pacer.sys    Sat Apr 11 06:42:56 2009 (49E02DE0)
fffffa60`0098c000 fffffa60`009a1000   partmgr  partmgr.sys  Sat Apr 11 06:34:51 2009 (49E02BFB)
fffffa60`0095c000 fffffa60`0098c000   pci      pci.sys      Sat Apr 11 06:03:33 2009 (49E024A5)
fffffa60`009cd000 fffffa60`009dd000   PCIIDEX  PCIIDEX.SYS  Sat Apr 11 06:34:22 2009 (49E02BDE)
fffffa60`0a60a000 fffffa60`0a6c0000   peauth   peauth.sys   Mon Oct 23 12:57:00 2006 (453CAE0C)
fffffa60`0620f000 fffffa60`0624a000   portcls  portcls.sys  Sat Apr 11 06:39:36 2009 (49E02D18)
fffffa60`00645000 fffffa60`00659000   PSHED    PSHED.dll    Sat Apr 11 08:08:17 2009 (49E041E1)
fffffa60`0639e000 fffffa60`063a7000   rasacd   rasacd.sys   Sat Jan 19 06:37:30 2008 (47919AAA)
fffffa60`037ba000 fffffa60`037dd000   rasl2tp  rasl2tp.sys  Sat Apr 11 06:43:37 2009 (49E02E09)
fffffa60`037e9000 fffffa60`037f9000   raspppoe raspppoe.sys Sat Apr 11 06:43:33 2009 (49E02E05)
fffffa60`0311f000 fffffa60`0313d000   raspptp  raspptp.sys  Sat Apr 11 06:43:38 2009 (49E02E0A)
fffffa60`0313d000 fffffa60`03155000   rassstp  rassstp.sys  Sat Apr 11 06:43:46 2009 (49E02E12)
fffffa60`06703000 fffffa60`06750000   rdbss    rdbss.sys    Sat Apr 11 05:55:21 2009 (49E022B9)
fffffa60`06370000 fffffa60`06379000   RDPCDD   RDPCDD.sys   Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`03155000 fffffa60`031ef000   rdpdr    rdpdr.sys    Sat Apr 11 06:49:54 2009 (49E02F82)
fffffa60`06379000 fffffa60`06382000   rdpencdd rdpencdd.sys Sat Jan 19 06:42:03 2008 (47919BBB)
fffffa60`063df000 fffffa60`063f7000   rspndr   rspndr.sys   Sat Jan 19 06:35:48 2008 (47919A44)
fffffa60`062f8000 fffffa60`0630e000   RTSTOR64 RTSTOR64.SYS Thu Mar 26 08:00:14 2009 (49CB360E)
fffffa60`00b54000 fffffa60`00b82000   SCSIPORT SCSIPORT.SYS Sat Jan 19 06:28:52 2008 (479198A4)
fffffa60`0a6c0000 fffffa60`0a6cb000   secdrv   secdrv.SYS   Wed Sep 13 14:18:38 2006 (4508052E)
fffffa60`00b01000 fffffa60`00b54000   Si3531   Si3531.sys   Mon Feb 09 00:58:27 2009 (498F7FB3)
fffffa60`013d4000 fffffa60`013dc000   SiRemFil SiRemFil.sys Wed Oct 18 23:20:39 2006 (4536A8B7)
fffffa60`00bdd000 fffffa60`00be7000   SiWinAcc SiWinAcc.sys Mon Nov 01 19:23:29 2004 (41868D31)
fffffa60`063c4000 fffffa60`063df000   smb      smb.sys      Sat Apr 11 06:42:19 2009 (49E02DBB)
fffffa60`013cc000 fffffa60`013d4000   spldr    spldr.sys    Mon Jan 12 21:51:29 2009 (496BBB61)
fffffa60`02434000 fffffa60`024ce000   spsys    spsys.sys    Tue Mar 10 17:16:43 2009 (49B6A07B)
fffffa60`06273000 fffffa60`062e6000   SRTSP64  SRTSP64.SYS  Tue Jan 22 05:16:07 2008 (47957C17)
fffffa60`06316000 fffffa60`0632a000   SRTSPX64 SRTSPX64.SYS Tue Jan 22 05:17:58 2008 (47957C86)
fffffa60`0a006000 fffffa60`0a097000   srv      srv.sys      Sat Apr 11 05:57:52 2009 (49E02350)
fffffa60`09dbb000 fffffa60`09ded000   srv2     srv2.sys     Sat Apr 11 05:57:35 2009 (49E0233F)
fffffa60`09ca2000 fffffa60`09ccb000   srvnet   srvnet.sys   Sat Apr 11 05:57:28 2009 (49E02338)
fffffa60`03750000 fffffa60`037ad000   storport storport.sys Sat Apr 11 06:34:45 2009 (49E02BF5)
fffffa60`037f9000 fffffa60`037fa480   swenum   swenum.sys   Thu Nov 02 09:37:33 2006 (4549BC5D)
fffffa60`0a731000 fffffa60`0a767000   SYMEVENT64x86 SYMEVENT64x86.SYS Mon Jan 14 23:32:19 2008 (478BF103)
fffffa60`0100c000 fffffa60`01181000   tcpip    tcpip.sys    Sat Apr 11 06:44:47 2009 (49E02E4F)
fffffa60`0a6cb000 fffffa60`0a6db000   tcpipreg tcpipreg.sys Sat Apr 11 06:43:04 2009 (49E02DE8)
fffffa60`037ad000 fffffa60`037ba000   TDI      TDI.SYS      Sat Apr 11 06:44:14 2009 (49E02E2E)
fffffa60`063a7000 fffffa60`063c4000   tdx      tdx.sys      Sat Apr 11 06:43:00 2009 (49E02DE4)
fffffa60`02fea000 fffffa60`02ffd000   termdd   termdd.sys   Sat Apr 11 06:48:13 2009 (49E02F1D)
fffff960`004a0000 fffff960`004aa000   TSDDD    TSDDD.dll    Sat Jan 19 06:42:04 2008 (47919BBC)
fffffa60`024f0000 fffffa60`024f9000   tunmp    tunmp.sys    Sat Jan 19 06:36:30 2008 (47919A6E)
fffffa60`024e4000 fffffa60`024f0000   tunnel   tunnel.sys   Sat Jan 19 06:36:44 2008 (47919A7C)
fffffa60`00dd7000 fffffa60`00de7000   umbus    umbus.sys    Sat Jan 19 06:34:16 2008 (479199E8)
fffffa60`06599000 fffffa60`065b5000   usbccgp  usbccgp.sys  Sat Jan 19 06:34:04 2008 (479199DC)
fffffa60`03ba3000 fffffa60`03ba4e00   USBD     USBD.SYS     Sat Jan 19 06:33:53 2008 (479199D1)
fffffa60`02fd9000 fffffa60`02fea000   usbehci  usbehci.sys  Sat Apr 11 06:39:36 2009 (49E02D18)
fffffa60`03a0b000 fffffa60`03a53000   usbhub   usbhub.sys   Sat Apr 11 06:39:52 2009 (49E02D28)
fffffa60`00d5d000 fffffa60`00da3000   USBPORT  USBPORT.SYS  Sat Apr 11 06:39:39 2009 (49E02D1B)
fffffa60`02fcd000 fffffa60`02fd9000   usbuhci  usbuhci.sys  Sat Jan 19 06:33:56 2008 (479199D4)
fffffa60`065be000 fffffa60`065e7300   usbvideo usbvideo.sys Sat Jan 19 06:34:14 2008 (479199E6)
fffffa60`065b5000 fffffa60`065be000   UVCFTR_S UVCFTR_S.SYS Wed May 23 10:23:16 2007 (46540804)
fffffa60`0633d000 fffffa60`0634b000   vga      vga.sys      Sat Jan 19 06:32:21 2008 (47919975)
fffffa60`0634b000 fffffa60`06370000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 06:32:25 2008 (47919979)
fffffa60`0a0a5000 fffffa60`0a0b9000   vmci     vmci.sys     Fri Mar 27 01:21:48 2009 (49CC2A2C)
fffffa60`036e4000 fffffa60`036ef000   VMkbd    VMkbd.sys    Fri Mar 27 03:59:55 2009 (49CC4F3B)
fffffa60`025f6000 fffffa60`02600000   VMNET    VMNET.SYS    Thu May 22 11:33:54 2008 (48354C12)
fffffa60`02600000 fffffa60`02608000   vmnetadapter vmnetadapter.sys Thu May 22 11:33:57 2008 (48354C15)
fffffa60`069c5000 fffffa60`069d1000   vmnetbridge vmnetbridge.sys Thu May 22 11:34:05 2008 (48354C1D)
fffffa60`0a6db000 fffffa60`0a6e5000   vmnetuserif vmnetuserif.sys Fri Mar 27 02:06:58 2009 (49CC34C2)
fffffa60`0a0b9000 fffffa60`0a191000   vmx86    vmx86.sys    Fri Mar 27 04:28:08 2009 (49CC55D8)
fffffa60`009b1000 fffffa60`009c5000   volmgr   volmgr.sys   Sat Apr 11 06:34:49 2009 (49E02BF9)
fffffa60`00768000 fffffa60`007ce000   volmgrx  volmgrx.sys  Sat Apr 11 06:35:14 2009 (49E02C12)
fffffa60`01388000 fffffa60`013cc000   volsnap  volsnap.sys  Sat Apr 11 06:35:33 2009 (49E02C25)
fffffa60`0a6e5000 fffffa60`0a6f1000   vstor2_ws60 vstor2-ws60.sys Mon Dec 01 19:26:32 2008 (49343A68)
fffffa60`066e8000 fffffa60`06703000   wanarp   wanarp.sys   Sat Apr 11 06:43:38 2009 (49E02E0A)
fffffa60`02fbd000 fffffa60`02fcd000   watchdog watchdog.sys Sat Apr 11 06:09:16 2009 (49E025FC)
fffffa60`0080b000 fffffa60`008e5000   Wdf01000 Wdf01000.sys Sat Jan 19 06:33:27 2008 (479199B7)
fffffa60`008e5000 fffffa60`008f3000   WDFLDR   WDFLDR.SYS   Sat Jan 19 06:32:33 2008 (47919981)
fffff960`00080000 fffff960`00331000   win32k   win32k.sys   Sat Apr 11 06:11:29 2009 (49E02681)
fffffa60`0250c000 fffffa60`02515000   wmiacpi  wmiacpi.sys  Sat Jan 19 06:02:42 2008 (47919282)
fffffa60`00949000 fffffa60`00952000   WMILIB   WMILIB.SYS   Sat Jan 19 06:33:45 2008 (479199C9)
fffffa60`066b0000 fffffa60`066bb000   ws2ifsl  ws2ifsl.sys  Sat Jan 19 06:37:46 2008 (47919ABA)

Unloaded modules:
fffffa60`069bc000 fffffa60`069c5000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`011ed000 fffffa60`011fb000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`0240a000 fffffa60`024d1000   dump_iaStorV
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffffa60`024d1000 fffffa60`024e4000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`01e6c1b4 fffffa60`0ca123b0 00000000`00000000
 

My Computer

The file drvinst.exe is running on your system. There's many different programs that it could be associated with. Can you search your hard drive for this file and let us know:
- the location(s) of the files
- the Properties of the file (click on the Details tab)
 

My Computer

Back
Top