BUGCHECK_STR: 0X7E
Microsoft (R) Windows debug 6.2.9200.20512 AMD64 Version
Copyright (c) Microsoft Corporation. All rights reserved.
Command line: C:\Windows\Minidump\Mini081113-01.dmp
Cannot run 'C:\Windows\Minidump\Mini081113-01.dmp', 0n193 error Win32
"%1 is not a valid Win32 application".
Loading dump file [C:\Windows\Minidump\Mini081113-01.dmp]
The mini kernel dump file: only registers and the trace of the stack are available
Symbol search path is: * invalid *.
Use! analyze - v to obtain detailed debugging information. Bugcheck 1000007E, {ffffffffc0000005, fffff800024f5609, fffffa6001bd94d8, fffffa6001bd8eb0} The kernel symbols are FALSE. Correct symbols to do the analysis. *************************************************************************
****************************************************************************
* Loading of the symbol may be unreliable without a symbol search path. *
* Use .symfix to get the debugger to choose a symbol path. *
* After adjusting your path to symbols, use .reload to refresh the locations of symbols. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols cannot be loaded because the path is not initialized. *
* *
* The symbol path can be defined: *.
* using the _NT_SYMBOL_PATH environment variable. *
* with the help of the
* using the .sympath and .sympath + *.
*********************************************************************
Cannot load the image \SystemRoot\system32\ntoskrnl.exe, 0n2 error Win32
WARNING: Unable to verify timestamp for ntoskrnl.exe
ERROR: Module load completed but symbols can be loaded for ntoskrnl.exe
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack2) MP (2 processors) free x 64
Product: WinNt, suite: TerminalServer personal TerminalServer
Computer name:
Kernel base = 0xfffff800 '02257000 PsLoadedModuleList = 0xfffff800' 0241bdd0
The debugging session: Sun Aug 11 21:26:06.348 2013 (UTC - 04:00)
System Uptime: 0 days 0:00:46.144
*********************************************************************
* Symbols cannot be loaded because the path is not initialized. *
* *
* The symbol path can be defined: *.
* using the _NT_SYMBOL_PATH environment variable. *
* with the help of the
* using the .sympath and .sympath + *.
*********************************************************************
Cannot load the image \SystemRoot\system32\ntoskrnl.exe, 0n2 error Win32
WARNING: Unable to verify timestamp for ntoskrnl.exe
ERROR: Module load completed but symbols can be loaded for ntoskrnl.exe
Loading the kernel symbols
...............................................................
................................................................
.....
Loading user symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
Probably caused by: ntoskrnl.exe (nt + 29e609)
Follow-up: MachineOwner
---------
0: kd > g
^ No executable debuggees error in 'g '.
0: kd >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, unhandled exception code
Arg2: fffff800024f5609, the address that the exception occurred at
Arg3: fffffa6001bd94d8, address of Exception report
Arg4: fffffa6001bd8eb0, address of the context record
Debugging information:
------------------
The kernel symbols are FALSE. Correct symbols to do the analysis.
*************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol. Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down. ***
*** ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete. ***
*** ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information. The contact group that *.
you provided with these symbols, if you need this command for *.
work. ***
*** ***
Type referenced: nt! _KPRCB *.
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbols path and of loading symbol.
MODULE_NAME: nt
FAULTING_MODULE: fffff80002257000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 513a94a9
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
FAULTING_IP:
NT + 29e609
fffff800'024f5609 430fb70c11 movzx ecx, word ptr [r9 + r10]
EXCEPTION_RECORD: fffffa6001bd94d8-(.exr 0xfffffa6001bd94d8)
Can not read the Exception record @ fffffa6001bd94d8
CONTEXT: fffffa6001bd8eb0-(.cxr 0xfffffa6001bd8eb0)
Cannot read the context, Win32 error 0n30
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0X7E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800024c885a to fffff800024f5609
STACK_TEXT:
"fffffa60 '01bd9718 fffff800' 024c885a: fffff800'024528 b 0 fffffa80 ' 036 c 8800 00000000 00000000' fffffa80 ' 07b604c0: nt + 0x29e609
"fffffa60 '01bd9720 fffff800' 024528b 0: fffffa80 ' 036 c 8800 00000000 00000000' fffffa80 ' 07b604c0 00000000' 00000000: nt + 0x27185a
fffffa60'01bd9728 fffffa80'036 c 8800: 00000000 00000000' fffffa80 '07b604c0 00000000 00000000' fffffa60' 01bd97f0: nt + 0x1fb8b0
fffffa60'01bd9730 00000000' 00000000: fffffa80'07b604c0 00000000 00000000' fffffa60 '01bd97f0 fffffa60' 02af5b01: 0xfffffa80'036 c 8800
FOLLOWUP_IP:
NT + 29e609
fffff800'024f5609 430fb70c11 movzx ecx, word ptr [r9 + r10]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt + 29e609
FOLLOWUP_NAME: MachineOwner
Nom_image: ntoskrnl.exe
STACK_COMMAND: .cxr 0xfffffa6001bd8eb0; Ko
BUCKET_ID: WRONG_SYMBOLS
Follow-up: MachineOwner
---------
0: kd > .exr 0xfffffa6001bd94d8
Can not read the Exception record @ fffffa6001bd94d8
0: kd > .cxr 0xfffffa6001bd8eb0
Cannot read the context, Win32 error 0n30
0: kd > .cxr 0xfffffa6001bd8eb0
Cannot read the context, Win32 error 0n30
Hello
Please download the dump, as requested by zig - zag file. In the meantime, let us know exactly when you get the error message and also refer to the following article explains the generally why a control bug 0x7E occurs and what can be tried to solve the problem.
http://msdn.Microsoft.com/en-us/library/Windows/hardware/ff559239 (v = VS. 85) .aspx
Hoping to hear from you soon.
Tags: Windows
Similar Questions
-
Intermittent BSOD every day tixhci.sys
Hi all
I HPE h8-1120une desktop PC and crashes every time that a day or two. Mini dump is created and executed an analysis against them and see that there is a product of access on tixhci driver violation.
I checked the drivers HP for the PC and there is only the driver Texas Instruments original USB available for download - is there a version update available?
Is there a workaround or problems known about this pilot and HPE PC?
Bugcheck 1000007E, {ffffffffc0000005, fffff880054dbbbf, fffff880034bb838, fffff880034bb090}
Probably caused by: tixhci.sys (tixhci + 43bbf)
Follow-up: MachineOwner
---------1: kd >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the PIN address of exception
the driver function / who caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
Start/DEBUG system. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, unhandled exception code
Arg2: fffff880054dbbbf, the address that the exception occurred at
Arg3: fffff880034bb838, address of Exception report
Arg4: fffff880034bb090, address of the context recordDebugging information:
------------------EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
FAULTING_IP:
tixhci + 43bbf
fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8]EXCEPTION_RECORD: fffff880034bb838-(.exr 0xfffff880034bb838)
ExceptionAddress: fffff880054dbbbf (tixhci + 0x0000000000043bbf)
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 0000000000000000
Parameter [1]: 0000000000000008
Attempt to read from address 0000000000000008BACKGROUND: fffff880034bb090-(.cxr 0xfffff880034bb090)
Rax = 0000000000000025 rbx = fffffa800aa9a540 = fffffa800aa9a540 rcx
RDX = fffffa80056d4e60 rsi = rdi = fffffa800ae98210 fffffa800aa9a6d0
RIP = fffff880054dbbbf rsp = fffff880034bba70 rbp = fffffa800aa9a540
R8 = fffffa800ae98020 r9 = fffffa800ae98148 = 0000000000000000 r10
R11 = fffffa800ae77de8 r12 = fffffa800ae40002 r13 = 0000000000000001
R14 = 0000000000000001 r15 = fffff800044ab080
iopl = 0 nv up ei ng nz na po nc
CS = 0010 ss = 0018 ds = 002 b 002 b = fs = 0053 gs = 002 b efl = 00010286
tixhci + 0x43bbf:
fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8] ds:002 b: 00000000'00000008 =?
Reset the default scopeCUSTOMER_CRASH_COUNT: 1
Nom_processus: System
CURRENT_IRQL: 0
Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000008
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ecb100
0000000000000008FOLLOWUP_IP:
tixhci + 43bbf
fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8]BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: to fffffa800ae77de8 to fffff880054dbbbf
STACK_TEXT:
fffff880 '034bba70 fffffa80' 0ae77de8: fffffa80 '0aa9ac58 00000000 00000000' fffff880' 054e1100 00000000' 00000000: tixhci + 0x43bbf
fffff880 '034bba78 fffffa80' 0aa9ac58: 00000000 00000000' fffff880 '054e1100 00000000 00000000' fffff880' 054da1d2: 0xfffffa80'0ae77de8
fffff880'034bba80 00000000' 00000000: fffff880'054e1100 00000000 00000000 "fffff880 '054da1d2 fffffa80' 0ae77de8: 0xfffffa80'0aa9ac58SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: tixhci + 43bbf
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tixhci
Nom_image: tixhci.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4db0823b
STACK_COMMAND: .cxr 0xfffff880034bb090; Ko
FAILURE_BUCKET_ID: X64_0x7E_tixhci + 43bbf
BUCKET_ID: X64_0x7E_tixhci + 43bbf
Follow-up: MachineOwner
---------Laptop HP ENVY 17-j005tx, HP ENVY 27 - k001a, HP ProLiant MicroServer Gen8 G2020T, HP MediaSmart EX495 Server tilt, HP MediaVault 2020, HP ENVY 120 AiO PrinterHmmm, impossible to install the fix, get error dialog box popup 259. However, I changed the power options to High Performance and BSOD has not reappeared.
-
How can I use the excpeption address in widows debugging to identify the cause?
Hello
I have a windows xp machine crashes randomly.
I did a debug and wonder how I can identify the driver that is the cause using the exception address.
Dump below:
Microsoft (R) debugging Version of Windows 6.12.0002.633 X 86
Copyright (c) Microsoft Corporation. All rights reserved.Loading dump file [E:\Mini072911-01.dmp]
The mini kernel dump file: only registers and the trace of the stack are availableSymbol search path is: SRV * c:\debug-symboles * http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 processors) free x 86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
By: 2600.xpsp_sp3_gdr.101209 - 1647
Computer name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
The debugging session: 21:08:37.390 Thu Jul 28 2011 (UTC + 01:00)
System Uptime: 1 day 11:05:14.187
Loading the kernel symbols
...............................................................
................................................................
.................................................
Loading user symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************Use! analyze - v to obtain detailed debugging information.
Bugcheck 1000007E, {c0000005, 874551ad, ba557b04, ba557800}
Probably caused by: ntkrpamp.exe (nt! KiSwapContext + 2f)
Follow-up: MachineOwner
---------1: kd >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, the unhandled exception code
Arg2: 874551ad, the address that the exception occurred at
Arg3: ba557b04, address of Exception report
Arg4: ba557800, address of the context recordDebugging information:
------------------EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.
FAULTING_IP:
+ 2f
874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]EXCEPTION_RECORD: ba557b04-(.exr 0xffffffffba557b04)
ExceptionAddress: 874551ad
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 00000001
Parameter [1]: 01000000
Try to write at the address 01000000CONTEXT: ba557800-(.cxr 0xffffffffba557800)
EAX = 00000000 ebx = 875677d ecx 8 = 00000200 edx = 00000000 esi = 8745bb80 edi = 01000000
EIP = 874551ad esp = ba557bcc ebp = ba557bd4 iopl = 0 nv up ei pl nz na po nc
CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00010202
874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]
Reset the default scopeCUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
Nom_processus: System
Error_code: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 01000000
WRITE_ADDRESS: 01000000
FOLLOWUP_IP:
NT! KiSwapContext + 2f
80545a1b 8b2c24 mov ebp, dword ptr [esp]FAILED_INSTRUCTION_ADDRESS:
+ 2de2faf01dadfc0
874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]BUGCHECK_STR: 0X7E
EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction to 874551ad does not read/write in 01000000LAST_CONTROL_TRANSFER: from 87456682 to 874551ad
STACK_TEXT:
WARNING: Frame IP not in any known module. Sequence of images may be wrong.
ba557bd4 87456682 01000000 00000000 00000010 0x874551ad
ba557c00 804ef19f 8ad2dd98 87567768 8ad2dd98 0 x 87456682
ba557c30 80545a1b ba557c88 00000000 00000000 nt! IopfCallDriver + 0 x 31
ba557c34 ba557c88 00000000 00000000 00000000 nt! KiSwapContext + 0x2f
00000000 00000000 00000000 00000000 00000000 0xba557c88SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt! KiSwapContext + 2f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
Nom_image: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4d00d46f
STACK_COMMAND: .cxr 0xffffffffba557800; Ko
FAILURE_BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_nt! KiSwapContext + 2f
BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_nt! KiSwapContext + 2f
Follow-up: MachineOwner
See you soon
KeV
Hi Kev,
The issue of Windows XP, you have posted is related to Windows XP in a domain environment. It is better suited for the IT Pro TechNet public. Please ask your question in the TechNet forums for assistance.
Hope the helps of information.
-
IRQL_NOT_LESS_OR_EQUAL Error with BSOD error
Hello
I get the IRQL_NOT_LESS_OR_EQUAL Error with blue screen when I start the machine.
STOP: 0X0000000A (0X00000000, 0X804DC11D, 0X00000001, 0 X 000000002)I can't that connection in Debugging Mode.winDBG output points to a file PxHelp20.sys, which is a Sonic driver. Is it possible to delete this file? Or is this some kind of virus? (out of winDBG is attached below). There was no new HW SW or recently installed or when this error occurred.
I also tried to run Verifier.exe with the option "Select all drivers installed automatically on this computer" and as soon as I chose this option, another mistake (and cannot change this option), DRIVER_IRQL_NOT_LESS_OR_EQUAL
STOP: 0x000000D1(0x8068329C,0x00000002,0x00000000,0x89E4460A)Thanks in advance,
SRSKoutput in winDbg:
Debug version of Microsoft Windows (R) 6.11.0001.404 X 86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading dump file [C:\WINDOWS\Minidump\Mini102109-01.dmp]
The mini kernel dump file: only registers and the trace of the stack are available
Symbol search path is: SRV * c:\Symbols* http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) PUTS free x 86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
By: 2600.xpsp_sp3_gdr.090206 - 1234
Computer name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
The debugging session: 23:57:36.015 Tue Oct 20, 2009 (GMT-4)
System Uptime: 0 days 9:05:10.605
Loading the kernel symbols
...............................................................
................................................................
.......
Loading user symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************
Use! analyze - v to obtain detailed debugging information.
Bugcheck 1000007E, {c0000005, 8736d01a, f78d9ec4, f78d9bc0}
Could not load the PxHelp20.sys, 0n2 error Win32 image
WARNING: Unable to verify timestamp for PxHelp20.sys
ERROR: Module load completed but symbols can be loaded for PxHelp20.sys
Probably caused by: PxHelp20.sys (PxHelp20 + 59b 7)
Follow-up: MachineOwner
---------
KD >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, the unhandled exception code
Arg2: 8736d01a, the address that the exception occurred at
Arg3: f78d9ec4, address of Exception report
Arg4: f78d9bc0, address of the context record
Debugging information:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.
FAULTING_IP:
+ 59b 7
8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h]
EXCEPTION_RECORD: f78d9ec4-(.exr 0xfffffffff78d9ec4)
ExceptionAddress: 8736d01a
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 00000000
Parameter [1]: 00000014
Attempt to read from address 00000014
CONTEXT: f78d9bc0-(.cxr 0xfffffffff78d9bc0)
EAX = 00000000 ebx = 00000000 ecx = 8a60e910 edx = 00000000 esi = 00000000 edi = 00000000
EIP = 8736d01a esp = f78d9f8c ebp = f78da54c iopl = 0 nv up ei pl zr pe nc
CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00210246
8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h] ds:0023:00000014 is?
Reset the default scope
CUSTOMER_CRASH_COUNT: 1
Nom_processus: System
Error_code: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000014
READ_ADDRESS: 00000014
FOLLOWUP_IP:
PxHelp20 + 59b 7
f766c9b7? ???
FAILED_INSTRUCTION_ADDRESS:
+ 24b952f00f7dfdc
8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h]
BUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 68772073 to 8736d01a
SYMBOL_ON_RAW_STACK: 1
STACK_ADDR_RAW_STACK_SYMBOL: fffffffff78da140
STACK_COMMAND: dds F78DA140-0 x 20; Ko
STACK_TEXT:
f78da120 ffffb905
f78da124 0f66f18a
f78da128 6640c6b6
f78da12c 80d1b60f
f78da130 e2f73fe2
f78da134 edc0cd86
f78da138 0f664106
F766c9b7 f78da13c PxHelp20 + 0x59b7
f78da140 20a366e1
f78da144 41b4c300
f78da148 8a55aabb
f78da14c cd002416
f78da150 810f7213
f78da154 75aa55fb
f78da158 01c1f609
f78da15c 06fe0474
f78da160 66 30014
f78da164 66061e60
f78da168 660010 a-1
f78da16c 001C 0603
f78da170 b 20063, 66
f78da174 3a820f00
f78da178 6a661e00
f78da17c 06506600
f78da180 10686653
f78da184 80000100
0000143e f78da188
f78da18c 000c850f
f78da190 80ffb3e8
0000143e f78da194
f78da198 0061840f
f78da19c 168a42b4
SYMBOL_NAME: PxHelp20 + 59b 7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PxHelp20
Nom_image: PxHelp20.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4679 has 978
FAILURE_BUCKET_ID: 0x7E_BAD_IP_PxHelp20 + 59b 7
BUCKET_ID: 0x7E_BAD_IP_PxHelp20 + 59b 7
Follow-up: MachineOwner
---------
SRSK,
Well I looked around the PxHelp20.sys file and it looks like it is related to things CD\DVD. If it was me... I rename the file to .old or move it to a temporary folder and then restart and see what happens. If you try that bak to view the results. Good luck. QQ learn manage! -
Hi all
I have vista home basic system. It shows blue screen boot, whose code: 0 * 0000007E(0*c0000005, 0*8A6C110C, 0*805E0B3C,0*805E0838)
I tried to recover to an earlier point, but you don't find successful, with error code: 0 * 80070057.
I can use only under safe mode.
Anyone know what's happened and how to fix it?
thx a lot.
Lisa
Hello kunseera,
I had a look at these two landfills, and it seems to be SYMEFA. SYS that is causing this problem.
It is a component of Norton.
My recommendation:
1. download the latest version of your Norton product.
2 uninstall the Norton product.
3 reinstall the latest version.
My analysis of the discharge follows. My ratings are in "BOLD".
The mini kernel dump file: only registers and the trace of the stack are available
Symbol search path is: SRV * c:\websymbols* http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack2) PLACE free x 86 compatible
Product: WinNt, suite: TerminalServer personal TerminalServer
By: 6002.18484.x86fre.vistasp2_gdr.110617 - 0336
Computer name:
Kernel base = 0x8a651000 PsLoadedModuleList = 0x8a768c70
The debugging session: killed Sept 13 03:57:40.845 2011 (UTC - 05:00)
System Uptime: 0 days 0:01:17.735*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************Use! analyze - v to obtain detailed debugging information.
Bugcheck 1000007E, {c0000005, 805d 4838, 8a70210c, 805d4b3c}
WARNING: Unable to verify timestamp for SYMEFA. SYS
ERROR: Module load completed but symbols cannot be loaded for SYMEFA. SYS
Probably caused by: SYMEFA. SYS<-- debugger="" blames="">-->Follow-up: MachineOwner
---------KD >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, the unhandled exception code
Arg2: 8a70210c, the address that the exception occurred at
Arg3: 805d4b3c, address Record of Exception
Arg4: 805d 4838, context address RecordDebugging information:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.FAULTING_IP:
NT! RtlSplay + 14
8a70210c 394204 cmp dword ptr [edx + 4], eaxEXCEPTION_RECORD: 805d4b3c-(.exr 0xffffffff805d4b3c)
ExceptionAddress: 8a70210c (nt! RtlSplay + 0 x 00000014)
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 00000000
Parameter [1]: 00000004
Attempt to read address 00000004CONTEXT: 805d 4838--(.cxr 0xffffffff805d4838)
EAX = 004e0049 ebx = 8a70e233 ecx = 004e0051 edx = 00000000 esi = a77aba80 edi = a77aba80
EIP = 8a70210c esp = 805d4c04 ebp = 805d4c0c iopl = 0 nv in EI ng nz cy ac pe
CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00210297
NT! RtlSplay + 0x14:
8a70210c 394204 cmp dword ptr [edx + 4], eax ds:0023:00000004 is?
Reset the default scopeCUSTOMER_CRASH_COUNT: 1
CURRENT_IRQL: 0
Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000004
READ_ADDRESS: GetPointerFromAddress: cannot read from a 8, 788868
Unable to read the memory of MiSystemVaType to a 8, 768420
00000004FOLLOWUP_IP:
SYMEFA + 1 c 159
8ffd5159? ???BUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 8a70e2a6 to 8a70210c
STACK_TEXT:
805d4c0c 8a70e2a6 004e0049 a77aba74 805d4c3c nt! RtlSplay + 0x14
805d4c1c 8ffd5159 a77aba80 8fb71374 a77aba68 nt! RtlDelete + 0 x 73
WARNING: Information not available stack unwind. Sequence of images may be wrong.
805d4c3c 8ffc8eae 8ffc2b48 8ffc1020 8fb712d8 SYMEFA + 0x1c159
805d4c7c 8ffce729 0fa15d6b 8-695906 8e808b50 SYMEFA + 0xfeae<-- only="" 3rd="" party="">-->
805d4d10 90386ba6 8e808b50 8 d 847738 00000000 SYMEFA + 0 x 15729 on the stack
805d4d44 8a6f6e22 00000000 00000000 8caa32d8 fltmgr! FltpProcessGenericWorkItem + 0 x 38
805d4d7c 8a826fe2 8e808b50 d2f21bc9 00000000 nt! ExpWorkerThread + 0xfd
805d4dc0 8a68fefe 8a6f6d25 00000000 00000000 nt! PspSystemThreadStartup + 0x9d
00000000 00000000 00000000 00000000 00000000 nt! KiThreadStartup + 0x16SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: SYMEFA + 1 c 159
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SYMEFA
NOM_IMAGE: SYMEFA. SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4bcf724c
STACK_COMMAND: .cxr 0xffffffff805d4838; Ko
FAILURE_BUCKET_ID: 0x7E_SYMEFA + 1 c 159
BUCKET_ID: 0x7E_SYMEFA + 1 c 159
Follow-up: MachineOwner
---------KD > lmvm SYMEFA
start end module name
8ffb9000 8ffe6000 SYMEFA T (no symbol)
Loaded symbol image file: SYMEFA. SYS
Image path: \SystemRoot\system32\drivers\NIS\1108000.005\SYMEFA. SYS
Image name: SYMEFA. SYS
Timestamp: Kills Apr 21 16:46:52 2010<-- driver="" is="" from="" 2010="" and="" should="" be="">-->
CheckSum: 000371F6
ImageSize: 0002D 000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4===================================================
===================================================
Let us know if you have any questions about it.
Best regards
Matthew_Ha
-
The analysis of the dump file support
Hello
I have blue screen problems. My laptop would crash and comes up with blue screen randomly somewhere in the few minutes to start and other times, a couple of hours. I made detailed hard disk check, verification of memory as well as re-installed windows just by formatting the hard drive. Always without success.
What I did is now saved *.dmp file. I'm trying to analyze the same, but not really sure what the problem is. Can someone help and suggest the possible issue. I'm trying to cut and paste the file 'debug' below. I think that I made a correct debugging with my experience as a beginner. If anyone wants I can send *.dmp file also.
Thanks in advance.
Amit.
0: kd > .sympath srv * c:\symbols* http://msdl.microsoft.com/download/symbols
Symbol search path is: srv * c:\symbols* http://msdl.microsoft.com/download/symbols
Expanded the symbol search path is: srv * c:\symbols* http://msdl.microsoft.com/download/symbolsSymbol of validation of the path summary *.
Location of response time (ms)
Deferred srv * c:\symbols* http://msdl.microsoft.com/download/symbols
0: kd > .reload!; analyze - v; lmnt; r; kV. logclose; q
Loading the kernel symbols
...............................................................
................................................................
..............................................
Loading user symbols
Loading unloaded module list
........
WARNING: Unable to verify timestamp for iaStor.sys
ERROR: Module load completed but symbols can be loaded for iaStor.sysSummary of the symbol load error *.
Name of the module error
iaStor no data are available: srv * c:\symbols* http://msdl.microsoft.com/download/symbolsYou can solve most symbol related issues by turning the symbol loading diagnostics (! sym noisy) and repeating the command that caused the symbols to load.
You should also check that your symbol search path (.sympath) is correct.
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003. This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG. It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG. This will we will see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, unhandled exception code
Arg2: fffff8800109c6b0, the address that the exception occurred at
Arg3: fffff8800399e868, address of Exception report
Arg4: fffff8800399e0c0, address of the context recordDebugging information:
------------------EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
FAULTING_IP:
iaStor + 496b 0
fffff880'0109c6b0 488b4d40 mov rcx, qword ptr [rbp + h 40]EXCEPTION_RECORD: fffff8800399e868-(.exr 0xfffff8800399e868)
. EXR 0xfffff8800399e868
ExceptionAddress: fffff8800109c6b0 (iaStor + 0x00000000000496b0)
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 0000000000000000
Parameter [1]: 0000000000000040
Attempt to read from address 0000000000000040BACKGROUND: fffff8800399e0c0--(.cxr 0xfffff8800399e0c0; r)
. CXR 0xfffff8800399e0c0; r
Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
R14 = 0000000000000000 r15 = fffff88003304f40
iopl = 0 nv up ei pl zr po nc
CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
iaStor + 0x496b0:
fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
Last set context:
Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
R14 = 0000000000000000 r15 = fffff88003304f40
iopl = 0 nv up ei pl zr po nc
CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
iaStor + 0x496b0:
fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
. CXR
Reset the default scopeCUSTOMER_CRASH_COUNT: 1
Nom_processus: System
CURRENT_IRQL: 0
Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000040
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebb100
GetUlongFromAddress: cannot read fffff80002ebb1c0
0000000000000040 non paged poolFOLLOWUP_IP:
iaStor + 496b 0
fffff880'0109c6b0 488b4d40 mov rcx, qword ptr [rbp + h 40]BUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers (dbg). 150226-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffffa8008631bc0 to fffff8800109c6b0
STACK_TEXT:
fffff880 '0399eaa0 fffffa80' 08631bc0: fffffa80 ' 0b9f8198 fffffa80 '0b9f8180 fffffa80' 07fa61c8 fffff880 ' 010d0bc8: iaStor + 0x496b0
fffff880 '0399eaa8 fffffa80' 0b9f8198: fffffa80'0b9f8180 fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000' 00000000: 0xfffffa80'08631bc0
fffff880 '0399eab0 fffffa80' 0b9f8180: fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000'00000000 00000000'00000000: 0xfffffa80'0b9f8198
fffff880 '0399eab8 fffffa80' 07fa61c8: fffff880 '010d0bc8 00000000'00000000 00000000'00000000 fffff880' 0399eb50: 0xfffffa80'0b9f8180
fffff880 '0399eac0 fffff880' 010d0bc8: 00000000'00000000 00000000'00000000 fffff880 '0399eb50 fffffa80' ffffbdfe: 0xfffffa80'07fa61c8
fffff880 '0399eac8 00000000' 00000000: 00000000 00000000 "fffff880 '0399eb50 fffffa80' ffffbdfe 00000000'00000030: iaStor + 0x7dbc8SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: iaStor + 496b 0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: iaStor
Nom_image: iaStor.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f29d59c
STACK_COMMAND: .cxr 0xfffff8800399e0c0; Ko
FAILURE_BUCKET_ID: X64_0x7E_iaStor + 496b 0
BUCKET_ID: X64_0x7E_iaStor + 496b 0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x7e_iastor + 496 b 0
FAILURE_ID_HASH: {638824e4-df44-4f6b-5214-69c6687e1463}
Follow-up: MachineOwner
---------Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
R14 = 0000000000000000 r15 = fffff88003304f40
iopl = 0 nv up ei pl zr po nc
CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
iaStor + 0x496b0:
fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
Child-SP RetAddr: Args to child: call Site
fffff880 '0399eaa0 fffffa80' 08631bc0: fffffa80 ' 0b9f8198 fffffa80 '0b9f8180 fffffa80' 07fa61c8 fffff880 ' 010d0bc8: iaStor + 0x496b0
fffff880 '0399eaa8 fffffa80' 0b9f8198: fffffa80'0b9f8180 fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000' 00000000: 0xfffffa80'08631bc0
fffff880 '0399eab0 fffffa80' 0b9f8180: fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000'00000000 00000000'00000000: 0xfffffa80'0b9f8198
fffff880 '0399eab8 fffffa80' 07fa61c8: fffff880 '010d0bc8 00000000'00000000 00000000'00000000 fffff880' 0399eb50: 0xfffffa80'0b9f8180
fffff880 '0399eac0 fffff880' 010d0bc8: 00000000'00000000 00000000'00000000 fffff880 '0399eb50 fffffa80' ffffbdfe: 0xfffffa80'07fa61c8
fffff880 '0399eac8 00000000' 00000000: 00000000 00000000 "fffff880 '0399eb50 fffffa80' ffffbdfe 00000000'00000030: iaStor + 0x7dbc8
start end module name
fffff800 '00b9c000 fffff800' 00ba6000 kdcom kdcom.dll Sam Feb 05 10:52:49 2011 (4D4D8061)
fffff800 '02c0c000 fffff800' 031f5000 nt ntkrnlmp.exe Wed Jun 22 21:53:23 2011 (4E02AAA3)
fffff800 '031f5000 fffff800' 0323e000 hal hal.dll Sat Nov 20 07:00:25 2010 (4CE7C669)
"fffff880 ' 00 c 00000 fffff880 ' 00c5c000 volmgrx volmgrx.sys Sat Nov 20 03:20:43 2010 (4CE792EB)
fffff880'00c5c000 fffff880'00 c 76000 mountmgr mountmgr.sys Sat Nov 20 03:19:21 2010 (4CE79299)
"fffff880 ' 00 c 90000 fffff880 ' 00cdf000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 07:03:51 2010 (4CE7C737)
fffff880 '00cdf000 fffff880' 00cf3000 PSHED PSHED.dll Fri Jul 13 20:32:23 2009 (4A5BE027)
fffff880'00cf3000 fffff880'00 d 51000 CLFS CLFS. SYS MON Jul 13 18:19:57 2009 (4A5BC11D)
fffff880 '00 d 51000 fffff880' 00 d 84000 pci pci.sys Sat Nov 20 03:19:11 2010 (4CE7928F)
fffff880 '00 d 84000 fffff880' 00 d 99000 partmgr partmgr.sys Sat Nov 20 03:20 2010 (4CE792C0)
"fffff880 ' 00 d 99000 fffff880 ' 00da5000 BATTC BATTC. SYS MON Jul 13 18:31:01 2009 (4A5BC3B5)
fffff880 '00da5000 fffff880' 00dba000 volmgr volmgr.sys Sat Nov 20 03:19:28 2010 (4CE792A0)
fffff880 '00e01000 fffff880' 00ec1000 CI CI.dll Sat Nov 20 07:12:36 2010 (4CE7C944)
fffff880 '00ec1000 fffff880' 00f65000 Wdf01000 Wdf01000.sys MON Jul 13 18:22:07 2009 (4A5BC19F)
fffff880 '00f65000 fffff880' 00f74000 WDFLDR WDFLDR. SYS MON Jul 13 18:19:54 2009 (4A5BC11A)
fffff880 '00f74000 fffff880' 00fcb000 ACPI ACPI.sys Sat Nov 20 03:19:16 2010 (4CE79294)
fffff880 '00fcb000 fffff880' 00fd4000 WMILIB WMILIB. SYS MON Jul 13 18:19:51 2009 (4A5BC117)
fffff880 '00fd4000 fffff880' 00fde000 msisadrv msisadrv.sys MON Jul 13 18:19:26 2009 (4A5BC0FE)
fffff880'00fde000 fffff880'00 Feb vdrvroot 000 vdrvroot.sys MON Jul 13 19:01:31 2009 (4A5BCADB)
fffff880 Feb 00'000 fffff880'00ff4000 iusb3hcs iusb3hcs.sys Fri Jan 27 03:37:23 2012 (4F227053)
fffff880 '00ff4000 fffff880' 00ffd000 compbatt compbatt.sys Fri Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880 ' 01000000 fffff880' b 0100 000 amdxata amdxata.sys Fri Mar 19 11:18:18 2010 (4BA3A3CA)
fffff880 ' 01053000 fffff880' 013f7000 iaStor, iaStor.sys Wed Feb 01 18:15:24 2012 (4F29D59C)
fffff880 '01400000 fffff880' 01472000 NMC cng.sys Wed Nov 16 22:23:17 2011 (4EC48C35)
fffff880 ' 01472000 fffff880' 014cf000 iusb3hub iusb3hub.sys Fri Jan 27 03:35:25 2012 (4F226FDD)
fffff880 '014ef000 fffff880' 0153b 000 fltmgr fltmgr.sys Sat Nov 20 03:19:24 2010 (4CE7929C)
fffff880 '0153b 000 fffff880' 0154f000 fileinfo fileinfo.sys MON Jul 13 18:34:25 2009 (4A5BC481)
fffff880 '0154f000 fffff880' 015ad000 msrpc msrpc.sys Sat Nov 20 03:21:56 2010 (4CE79334)
fffff880 '01620000 fffff880' 017c 3000 Ntfs Ntfs.sys Thu Mar 10 21:39:39 2011 (4D79997B)
"fffff880 ' 017 c 3000 fffff880 ' 017de000 ksecdd ksecdd.sys Wed Nov 16 21:48:13 2011 (4EC483FD)
fffff880 '017de000 fffff880' 017ef000 pcw pcw.sys MON Jul 13 18:19:27 2009 (4A5BC0FF)
fffff880 '017ef000 fffff880' 017f9000 Fs_Rec Fs_Rec.sys MON Jul 13 18:19:45 2009 (4A5BC111)
fffff880 ' 01800000 fffff880' 01822000 tdx tdx.sys Sat Nov 20 03:21:54 2010 (4CE79332)
fffff880 ' 01822000 fffff880' 01848000 tunnel tunnel.sys Sat Nov 20 04:51:50 2010 (4CE7A846)
fffff880 ' 01875000 fffff880' 01968000 ndis ndis.sys Wed Dec 29 00:16:18 2010 (4D1AD232)
fffff880 '01968000 fffff880' 019c NETIO NETIO 8000. SYS Sat Nov 20 03:23:13 2010 (4CE79381)
"fffff880 ' 019 c 8000 fffff880 ' 019f3000 ksecpkg ksecpkg.sys Wed Nov 16 22:23:44 2011 (4EC48C50)
fffff880 '01 a 00000 fffff880' 01a0d000 TDI TDI. SYS Sat Nov 20 03:22:06 2010 (4CE7933E)
fffff880 '01a0d000 fffff880' 01a1e000 blbdrive blbdrive.sys Fri Jul 13 18:35:59 2009 (4A5BC4DF)
fffff880'01 has 21000 fffff880'01 c 25000 tcpip tcpip.sys Wed Sep 28 22:43:04 2011 (4E83E948)
"fffff880 ' 01 c 25000 fffff880 ' 01c6f000 c:\windows\system32\drivers\fwpkclnt fwpkclnt.sys Sat Nov 20 03:21:37 2010 (4CE79321)
fffff880 '01c6f000 fffff880' 01b 77000 WD wd.sys MON Jul 13 18:19:55 2009 (4A5BC11B)
"fffff880 ' 01 c 77000 fffff880 ' 01cc3000 volsnap volsnap.sys Thu Feb 24 21:38:18 2011 (4D67242A)
fffff880 '01cc3000 fffff880' 01ccb000 spldr spldr.sys Mon May 11 11:56:27 2009 (4A0858BB)
fffff880 '01ccb000 fffff880' 01 05000 rdyboost rdyboost.sys Sat Nov 20 03:43:10 2010 (4CE7982E)
fffff880 '01 d 05000 fffff880' 01 17000 mup mup.sys MON Jul 13 18:23:45 2009 (4A5BC201)
fffff880 '01 d 17000 fffff880' 01 20000 hwpolicy hwpolicy.sys Sat Nov 20 03:18:54 2010 (4CE7927E)
"fffff880 ' 01 d 20000 fffff880 ' 01d2a000 hpdskflt hpdskflt.sys Wed Feb 22 10:30:18 2012 (4F45181A)
fffff880 '01d2a000 fffff880' 01 64000 fvevol fvevol.sys Sat Nov 20 03:24:06 2010 (4CE793B6)
"fffff880 ' 01 d 64000 fffff880 ' 01d7a000 disk disk.sys MON Jul 13 18:19:57 2009 (4A5BC11D)
fffff880 '01d7a000 fffff880' 01daa000 CLASSPNP CLASSPNP. SYS Sat Nov 20 03:19:23 2010 (4CE7929B)
fffff880 '01db8000 fffff880' 01dc8000 dog of guard watchdog.sys MON Jul 13 18:37:35 2009 (4A5BC53F)
fffff880 '01dc8000 fffff880' 01dd1000 RDPCDD system32\drivers\rdpcdd.sys MON Jul 13 19:16:34 2009 (4A5BCE62)
fffff880 '01dd1000 fffff880' 01dda000 rdpencdd rdpencdd.sys Fri Jul 13 19:16:34 2009 (4A5BCE62)
fffff880 '01dda000 fffff880' 01de3000 rdprefmp rdprefmp.sys Fri Jul 13 19:16:35 2009 (4A5BCE63)
fffff880 '01de3000 fffff880' 01dee000 Msfs Msfs.SYS MON Jul 13 18:19:47 2009 (4A5BC113)
fffff880 '01dee000 fffff880' 01dff000 Npfs.SYS NPH MON Jul 13 18:19:48 2009 (4A5BC114)
fffff880'0281 b 000 fffff880'02933000 btwampfl btwampfl.sys Thu Jan 05 17:14:07 2012 (4F062EBF)
fffff880 ' 02933000 fffff880' 0293 b 080 HIDPARSE HIDPARSE. SYS MON Jul 13 19:06:17 2009 (4A5BCBF9)
fffff880 ' 0293 c 000 fffff880' 02954000 BTHUSB BTHUSB.sys Wed Apr 27 22:54:56 2011 (4DB8E510)
fffff880 ' 02954000 fffff880' 029e0000 bthport BTHUSB Device bthport.sys Wed Apr 27 22:55:07 2011 (4DB8E51B)
fffff880 '029e0000 fffff880' 029ee000 monitor monitor.sys MON Jul 13 18:38:52 2009 (4A5BC58C)
fffff880 '029ee000 fffff880' 029fe000 BthEnum BthEnum.sys Fri Jul 13 19:06:52 2009 (4A5BCC1C)
fffff880 '02-00000 fffff880' 02 has 53000 nwifi nwifi.sys Fri Jul 13 19:07:23 2009 (4A5BCC3B)
fffff880 '02-53000 fffff880' 02a 66000 o ndisuio ndisuio.sys Sat Nov 20 04:50:08 2010 (4CE7A7E0)
fffff880 '02-66000 fffff880' 02a7e000 rspndr rspndr.sys Fri Jul 13 19:08:50 2009 (4A5BCC92)
fffff880 '02a8b000 fffff880' 02af3000 btwavdt btwavdt.sys Wed Dec 14 15:30:32 2011 (4EE91578)
fffff880 '02af3000 fffff880' 02b4f000 btwaudio btwaudio.sys Thu Jan 05 18:43:37 2012 (4F0643B9)
fffff880 '02b4f000 fffff880' 02b5d000 btwl2cap btwl2cap.sys Saturday August 27 at 17:58:52 2011 (4E5976AC)
fffff880 '02b5d000 fffff880' 02b 79000 btwdpan btwdpan.sys Fri Sep 16 18:01:54 2011 (4E73D562)
fffff880 '02b 79000 fffff880' 02b7ca00 btwrchid btwrchid.sys Wed Dec 14 15:31:21 2011 (4EE915A9)
fffff880 '02b7d000 fffff880' 02b 96000 HIDCLASS HIDCLASS. SYS sat 20 Nov 04:43:49 2010 (4CE7A665)
fffff880 '02b 96000 fffff880' 02bb9000 luafv luafv.sys Fri Jul 13 18:26:13 2009 (4A5BC295)
fffff880 '02bb9000 fffff880' 02bce000 lltdio lltdio.sys Fri Jul 13 19:08:50 2009 (4A5BCC92)
fffff880 ' 03000000 fffff880' 0300f000 netbios netbios.sys MON Jul 13 19:09:26 2009 (4A5BCCB6)
fffff880 '0300f000 fffff880' 0302a 000 wanarp wanarp.sys Sat Nov 20 04:52:36 2010 (4CE7A874)
fffff880 '0302-000 fffff880' 0303e000 termdd termdd.sys Sat Nov 20 05:03:40 2010 (4CE7AB0C)
fffff880 '0303e000 fffff880' 0308f000 rdbss rdbss.sys Sat Nov 20 03:27:51 2010 (4CE79497)
fffff880 '0308f000 fffff880' 0309b 000 nsiproxy nsiproxy.sys Fri Jul 13 18:21:02 2009 (4A5BC15E)
fffff880 '0309b 000 fffff880' 030a 6000 mssmbios mssmbios.sys Fri Jul 13 10:31:18 2009 (4A5BC3BE)
fffff880 '030-6000 fffff880' 030b 5000 discache discache.sys Fri Jul 13 18:37:18 2009 (4A5BC52E)
fffff880'030 b 5000 fffff880'030 d 3000 dfsc dfsc.sys Sat Nov 20 03:26:31 2010 (4CE79447)
fffff880'030e0000 fffff880'03169000 afd afd.sys Sun Apr 24 21:33:58 2011 (4DB4DD96)
fffff880 ' 03169000 fffff880' 031ae000 netbt netbt.sys Sat Nov 20 03:23:18 2010 (4CE79386)
fffff880 '031ae000 fffff880' 031b 7000 wfplwf wfplwf.sys Fri Jul 13 19:09:26 2009 (4A5BCCB6)
fffff880 '031b 7000 fffff880' 031dd000 pacer pacer.sys Sat Nov 20 04:52:18 2010 (4CE7A862)
fffff880 '031dd000 fffff880' 031f3000 vwififlt vwififlt.sys Fri Jul 13 19:07:22 2009 (4A5BCC3A)
fffff880 '03e00000 fffff880' 03e24000 HDAudBus HDAudBus.sys Sat Nov 20 04:43:42 2010 (4CE7A65E)
fffff880 '03e24000 fffff880' 03e70000 RtsBaStor RtsBaStor.sys Fri Dec 28 00:58:29 2011 (4EFABE15)
fffff880 '03e70000 fffff880' 03e9c000 rfcomm rfcomm.sys MON Jul 13 19:06:56 2009 (4A5BCC20)
fffff880 '03ebb000 fffff880' 03f7f000 iusb3xhc iusb3xhc.sys Fri Jan 27 03:35:28 2012 (4F226FE0)
fffff880 '03f7f000 fffff880' 03f80f00 USBD USBD. SYS sat Nov 04 22:43:53 2011 (4EB4B0F9)
fffff880 '03f81000 fffff880' 03f92000 HECIx64 HECIx64.sys Wed Nov 09 18:52:25 2011 (4EBB2049)
fffff880 '03f92000 fffff880' 03fa3000 usbehci usbehci.sys Fri Nov 04 22:43:56 2011 (4EB4B0FC)
fffff880 '03fa3000 fffff880' 03ff9000 USBPORT USBPORT. SYS sat Nov 04 22:44:03 2011 (4EB4B103)
fffff880 ' 04400000 fffff880' 04409000 Null Null.SYS MON Jul 13 18:19:37 2009 (4A5BC109)
fffff880 ' 04409000 fffff880' 04410000 a Bleep c:\windows\system32\drivers\beep.sys MON Jul 13 19:00:13 2009 (4A5BCA8D)
fffff880 ' 04410000 fffff880' 0441e000 vga vga.sys MON Jul 13 18:38:47 2009 (4A5BC587)
fffff880'0441e000 fffff880'047 c 2000 dump_iaStor dump_iaStor.sys Wed Feb 01 18:15:24 2012 (4F29D59C)
"fffff880 ' 047 d 6000 fffff880 ' 047fb000 VIDEOPRT VIDEOPRT. SYS MON Jul 13 18:38:51 2009 (4A5BC58B)
fffff880 ' 04800000 fffff880' 0481 b 000 raspppoe raspppoe.sys MON Jul 13 19:10:17 2009 (4A5BCCE9)
fffff880'0481 b 000 fffff880'0483 c 000 raspptp raspptp.sys Sat Nov 20 04:52:31 2010 (4CE7A86F)
fffff880 ' 0483 c 000 fffff880' 04856000 rassstp rassstp.sys Fri Jul 13 19:10:25 2009 (4A5BCCF1)
fffff880 ' 04856000 fffff880' 04868000 umbus umbus.sys Sat Nov 20 04:44:37 2010 (4CE7A695)
fffff880 '04868000 fffff880' 048c 2000 usbhub usbhub.sys Fri Nov 04 22:44:27 2011 (4EB4B11B)
fffff880 '048 c 2000 fffff880' 048d 7000 NDProxy NDProxy.SYS Sat Nov 20 04:52:20 2010 (4CE7A864)
fffff880'048f8000 fffff880'04998000 Rt64win7 Rt64win7.sys kills Sep 27 09:50:33 2011 (4E81E2B9)
fffff880 ' 04998000 fffff880' 049bc000 rasl2tp rasl2tp.sys Sat Nov 20 04:52:34 2010 (4CE7A872)
fffff880'049bc000 fffff880'049 c 8000 ndistapi ndistapi.sys MON Jul 13 19:10 2009 (4A5BCCD8)
"fffff880 ' 049 c 8000 fffff880 ' 049f7000 ndiswan ndiswan.sys Sat Nov 20 04:52:32 2010 (4CE7A870)
fffff880 '04-00000 fffff880' 04 has 24000 mrxsmb20 mrxsmb20.sys kills Apr 26 21:39:37 2011 (4DB781E9)
fffff880 '04-76000 fffff880' 04b3f000 HTTP HTTP.sys Sat Nov 20 03:24:30 2010 (4CE793CE)
fffff880 '04b3f000 fffff880' 04b5d000 bowser bowser.sys kills Feb 22 22:55:04 (4 649328) 2011
fffff880 '04b5d000 fffff880' 04b 75000 mpsdrv mpsdrv.sys Fri Jul 13 19:08:25 2009 (4A5BCC79)
fffff880 '04b 75000 fffff880' 04ba2000 mrxsmb mrxsmb.sys kills Apr 26 21:40:38 2011 (4DB78226)
fffff880 '04ba2000 fffff880' 04bf0000 mrxsmb10 mrxsmb10.sys Fri Jul 08 21:46:28 2011 (4E17C104)
"fffff880 ' 04 c 00000 fffff880 ' 04c6e000 SynTP SynTP.sys Thu Mar 01 18:33:26 2012 (4F501556)
fffff880 '04c6e000 fffff880' 04c7d000 mouclass mouclass.sys MON Jul 13 18:19:50 2009 (4A5BC116)
fffff880 '04c7d000 fffff880' 04c 81500 CmBatt CmBatt.sys Fri Jul 13 18:31:03 2009 (4A5BC3B7)
"fffff880 ' 04 c 82000 fffff880 ' 04c8d000 Smb_driver Smb_driver.sys Sat Mar 01 18:34:33 2012 (4F501599)
fffff880 '04c8d000 fffff880' 04c9a000 accelerometer Accelerometer.sys Wed Feb 22 10:30:18 2012 (4F45181A)
fffff880 '04c9a000 fffff880' 04ca 3000 wmiacpi wmiacpi.sys Fri Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880 '04ca 3000 fffff880' 04cb9000 driver intelppm.sys MON Jul 13 18:19:25 2009 (4A5BC0FD)
fffff880 '04cb9000 fffff880' 04cc4000 irstrtdv irstrtdv.sys Wed Jun 15 13:52:49 2011 (4DF8FF81)
fffff880'04cc4000 fffff880'04 cd 4000 CompositeBus CompositeBus.sys Sat Nov 20 04:33:17 2010 (4CE7A3ED)
fffff880 ' 04 cd 4000 fffff880' 04cd9f80 clwvd clwvd.sys kills Jul 27 20:13:47 2010 (4C4F844B)
fffff880 '04cda000 fffff880' 04cdf200 ksthunk ksthunk.sys Fri Jul 13 19:00:19 2009 (4A5BCA93)
fffff880 '04ce0000 fffff880' 04cf6000 AgileVpn AgileVpn.sys Fri Jul 13 19:10:24 2009 (4A5BCCF0)
fffff880 '04cf6000 fffff880' 04cf7480 swenum swenum.sys MON Jul 13 19:00:18 2009 (4A5BCA92)
fffff880'04cf9000 fffff880'05183000 bcmwl664 bcmwl664.sys Wed Sep 26 21:45:09 2011 (4EA8C5B5)
fffff880 ' 05183000 fffff880' 05190000 vwifibus vwifibus.sys Fri Jul 13 19:07:21 2009 (4A5BCC39)
fffff880 ' 05190000 fffff880' 051ae000 i8042prt i8042prt.sys MON Jul 13 18:19:57 2009 (4A5BC11D)
fffff880 '051ae000 fffff880' 051bd000 kbdclass kbdclass.sys MON Jul 13 18:19:50 2009 (4A5BC116)
fffff880'051bd000 fffff880'05200000 ks ks.sys Sat Nov 20 04:33:23 2010 (4CE7A3F3)
fffff880 ' 05600000 fffff880' 05656000 IntcDAud IntcDAud.sys kills Dec 06 05:23:07 2011 (4EDDFB1B)
fffff880 ' 05656000 fffff880' 05662000 Dxapi Dxapi.sys Fri Jul 13 18:38:28 2009 (4A5BC574)
fffff880 ' 05662000 fffff880' 05670000 crashdmp crashdmp.sys Fri Jul 13 19:01:01 2009 (4A5BCABD)
fffff880 ' 05670000 fffff880' 05683000 dump_dumpfve dump_dumpfve.sys Fri Jul 13 18:21:51 2009 (4A5BC18F)
fffff880 ' 05683000 fffff880' 056 a 0000 usbccgp usbccgp.sys Fri Nov 04 22:44:06 2011 (4EB4B106)
fffff880'056 has 0000 fffff880'056 cd 280 usbvideo usbvideo.sys Sat Nov 20 04:44:34 2010 (4CE7A692)
fffff880 '056e6000 fffff880' 0576e000 stwrt64 stwrt64.sys Mon Feb 13 22:26:45 2012 (4F39E285)
fffff880 '0576e000 fffff880' 057ab000 portcls portcls.sys MON Jul 13 19:06:27 2009 (4A5BCC03)
fffff880'057ab000 fffff880'057 cd 000 drmk drmk.sys MON Jul 13 20:01:25 2009 (4A5BD8E5)
fffff880 ' 057 cd 000 fffff880' 057f9000 bcbtums bcbtums.sys Thu Jan 26 12:49:03 2012 (4F21A01F)
fffff880 '05e67000 fffff880' 05f0d000 peauth peauth.sys Fri Jul 13 20:01:19 2009 (4A5BD8DF)
fffff880 '05f0d000 fffff880' 05f18000 secdrv secdrv. SYS kills Sep 13 08:18:38 2006 (4508052E)
fffff880 '05f18000 fffff880' 05f49000 srvnet c:\windows\system32\drivers\srvnet.sys Thu Apr 28 22:05:35 2011 (4DBA2AFF)
fffff880 '05f49000 fffff880' 05f5b000 tcpipreg c:\windows\system32\drivers\tcpipreg.sys Sat Nov 20 04:51:48 2010 (4CE7A844)
fffff880'05f5b000 fffff880'05 fc 4000 srv2 srv2.sys Thu Apr 28 22:05:46 2011 (4DBA2B0A)
fffff880 ' 06069000 fffff880' 06101000 srv srv.sys Thu Apr 28 22:06:06 2011 (4DBA2B1E)
fffff880 ' 06101000 fffff880' 06122000 WudfPf WudfPf.sys Sat Nov 20 04:42:44 2010 (4CE7A624)
fffff880 ' 06122000 fffff880' 06193000 SYMDS64 SYMDS64. SYS Mon May 16 17:15:03 2011 (4DD1A1E7)
fffff880 '06193000 fffff880' 061c 1000 ccSetx64 ccSetx64.sys Fri Nov 04 17:05:25 2011 (4EB461A5)
fffff880 ' 07895000 fffff880' 079 a 6000 SYMEFA64 SYMEFA64. SYS Tue 22 Nov 18:49:28 2011 (4ECC4318)
fffff880 ' 08400000 fffff880' 08431000 Ironx64 Ironx64.SYS Mon Nov 14 20:00:53 2011 (4EC1C7D5)
fffff880 ' 08431000 fffff880' 084e8000 Sftfslh Sftfslh.sys Wed Dec 02 18:55:48 2009 (4B170C94)
fffff880'0853f000 fffff880'08577000 SYMEVENT64x86 SYMEVENT64x86.SYS kills Nov 22 12:30:48 2011 (4ECBEA58)
fffff880 ' 08577000 fffff880' 0858 c 000 SRTSPX64 SRTSPX64. SYS Tue Nov 22 17:52:20 2011 (4ECC35B4)
"fffff880 ' 0858 c 000 fffff880 ' 085f8000 SYMNETS SYMNETS. SYS sat 12 Nov 15:11:53 2011 (4EBEE119)
fffff880 ' 08689000 fffff880' 087 a 8000 BHDrvx64 BHDrvx64.sys Wed Nov 23 13:32:10 2011 (4ECD4A3A)
fffff880 '087-8000 fffff880' 087f5000 Sftplaylh Sftplaylh.sys Wed Dec 02 18:55:40 2009 (4B170C8C)
fffff880 '08-00000 fffff880' 08a7d000 IDSVia64 IDSVia64.sys kills Nov 22 14:23:23 2011 (4ECC04BB)
fffff880 '08ac9000 fffff880' 08ad4000 Sftvollh Sftvollh.sys Wed Dec 02 18:55:23 2009 (4B170C7B)
fffff880 '08ad4000 fffff880' 08adf000 Sftredirlh Sftredirlh.sys Wed Dec 02 18:55:52 2009 (4B170C98)
fffff880 '08af3000 fffff880' 08bb2000 SRTSP64 SRTSP64. SYS Tue Nov 22 17:52:13 2011 (4ECC35AD)
fffff880 '08bb2000 fffff880' 08bd2000 ENG64 ENG64. SYS Fri Jul 29 08:17:51 2011 (4E32B2FF)
"fffff880 ' 08 c 04000 fffff880 ' 08dfc000 EX64 EX64. SYS Fri Jul 29 08:15:11 2011 (4E32B25F)
fffff880 '0f452000 fffff880' 10254f80 igdkmd64 igdkmd64.sys kills Feb 14 12:47:30 2012 (4F3AAC42)
fffff880 ' 10255000 fffff880' 1028 b 000 fastfat fastfat. SYS MON Jul 13 18:23:28 2009 (4A5BC1F0)
fffff880'1028 b 000 fffff880'10380000 dxgkrnl dxgkrnl.sys Mon Aug 22 21:54:11 2011 (4E531653)
fffff880 '10380000 fffff880' 103c 6000 dxgmms1 dxgmms1.sys Mon Aug 22 21:53:14 2011 (4E53161A)
fffff960 '000e0000 fffff960' 003f4000 win32k win32k.sys unavailable (00000000)
fffff960 ' 00470000 fffff960' a 0047, 000 TSDDD TSDDD.dll unavailable (00000000)
fffff960 ' 00700000 fffff960' 00727000 cdd c:\windows\system32\cdd.dll unavailable (00000000)Unloaded modules:
fffff880 '08-98000 fffff880' 08ac9000 WUDFRd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00031000
fffff880 '08a7d000 fffff880' 08a 98000 USBSTOR. SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001 B 000
fffff880 ' 07824000 fffff880' 07895000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00071000
"fffff880 ' 084 c 2000 fffff880 ' 0853f000 IDSVia64.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0007D 000
fffff880 '01daa000 fffff880' 01db8000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880'0441f000 fffff880'047 c 3000 dump_iaStor.
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 003A 4000
fffff880 '047 c 3000 fffff880' 047d 6000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
fffff880 ' 047 d 6000 fffff880' 04800000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002A, 000Hi Vijya Kumari / Gary / other.
UPDATE
I gave up watching the issue myself. I ended up taking the computer to the tech shop where the person changed the hard drive. Its been a few days now and it seems to work very well so the problem was the hard drive in this case!
Anyone reading the post... FYI, I did through hard drive check 3 times (it took 2-3 hours each time) and my hard drive had the control each time. I asked the tech shop person and he mentioned that it is sometimes possible that the hard drive would be to control but is faulty. It is a little advice for those who are the rescue disk problem devices in my case being given the hard drive passed the test I have excluded hard and ended up paying $ 100 hard disk $ 40: (.)
Thank you
Amit
-
Hello
I just start getting some BSOD. Sometimes after that I have spend monitors using the Windows + P shortcut. I start here her connect / disconnect sound over and over, then the BSOD.
I have an ASUS HD 7970 graphics cardI use the Windows + shortcut P to switch from a connected DisplayPort Samsung 27 "monitor LED series 8 SyncMaster [S27A850T]
a connected HDMI Samsung Plasma TV.
What would someone mind checking the Minidump files to help me work out what is the cause.
I tried to restore my PC Windows 7 64 bit to a point before the BSOD occurred.
I have the latest graphics card driver.
There is an update of the firmware available for your Samsung monitor - did you apply it? Here is the link: http://www.samsung.com/au/support/newsalert/view?spp_news_seq=36090
You have a connected Applian/Appliand device. I asked questions with this device back with another poster several months ago and never received a feedback (so I don't know if there is a problem with the drivers of this company). I suggest you uninstall it until the system is stable again.
There are a few known issues with SSD and old storage controller drivers. Please ensure that your Kingston SSD has the latest firmware installed - and the storage controllers of your motherboard with the latest drivers available from the manufacturer of storage controller. The Intel controller drivers so your Marvell date from 2011. Please don't forget to use connections to the Intel controller, once the drivers are updated (update the Marvell even if you don't use it).
As a side note, the GEARAspiWDM.sys has been updated. I was under the impression that there were not updated available for this purpose (it is usually a part of iTunes). Have you updated your iTunes between the 2 BSOD?
Video drivers and pilots antivirus date 2011 - these two must be updated to the latest version available (video drivers from ATI and the site of AVG antivirus site
I've never used OEM drivers for one of my monitors in the past - but I wonder if this can help your situation. Unfortunately I'm unable to locate the drivers for the monitor on the Samsung website. I suggest that you contact their technical support for information about drivers (they can be integrated into Windows).
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BSOD BUGCHECK SUMMARY
The debugging session: Sat Sep 15 2012 05:16:48.258 (UTC - 04:00)
Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\091512-39187-01.dmp]
By: 7601.17835.amd64fre.win7sp1_gdr.120503 - 2030
System Uptime: 0 days 4:08:40.195
WARNING: Unable to verify timestamp for atikmdag.sys
ERROR: Module load completed but symbols can be loaded for atikmdag.sys
Bugcheck 1000007E, {ffffffffc0000005, fffff8800784eebf, fffff8800e3beb88, fffff8800e3be3e0}
Probably caused by: atikmdag.sys (atikmdag + 1e3ebf)
Bugcheck 1000007E code
Arguments ffffffff 'c0000005 fffff880' 0784eebf fffff880 '0e3beb88 fffff880' 0e3be3e0
Nom_processus: csrss.exe
BUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
FAILURE_BUCKET_ID: X64_0x7E_atikmdag + 1e3ebf
MaxSpeed: 3330
CurrentSpeed: 3340
BiosVersion = 0803
BiosReleaseDate = 06/08/2012
SystemManufacturer = system manufacturer
SystemProductName = system product name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
The debugging session: Fri Sep 14 06:31:34.007 2012 (UTC - 04:00)
Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\091412-39125-01.dmp]
By: 7601.17835.amd64fre.win7sp1_gdr.120503 - 2030
System Uptime: 0 days 11:58:26.944
WARNING: Unable to verify timestamp for atikmdag.sys
ERROR: Module load completed but symbols can be loaded for atikmdag.sys
Bugcheck 1000007E, {ffffffffc0000005, fffff88007882ebf, fffff8800c819b88, fffff8800c8193e0}
Probably caused by: atikmdag.sys (atikmdag + 1e3ebf)
Bugcheck 1000007E code
Arguments ffffffff 'c0000005 fffff880' 07882ebf fffff880 '0c819b88 fffff880' 0c8193e0
Nom_processus: csrss.exe
BUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
FAILURE_BUCKET_ID: X64_0x7E_atikmdag + 1e3ebf
MaxSpeed: 3330
CurrentSpeed: 3340
BiosVersion = 0803
BiosReleaseDate = 06/08/2012
SystemManufacturer = system manufacturer
SystemProductName = system product name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` -
BSOD after Logo Windows at startup: bad driver, AutoFailover
I get BSOD after Windows Logo at startup. Said Startup Repair: bad driver, AutoFailover.
Two weeks ago, that I was getting the same BSOD after logo, but only with the bad driver. I not did something to fix it (or Startup Repair), it's just dissapeard after a few days. Also, the last day that I was getting BSOD, the night when I started my pc, it remained 2 minutes at Intel Boot Agent initialization and also 30 seconds to the black screen that follows (before the windows logo). When this situation occurs I get more BSOD. I tried to restart my pc but I stayed another 2 minutes to the Intel Boot Agent initialization. This problem has been fixed in the next morning, when I started my PC, even once, I don't know how, I did nothing. I remember that it is sometimes used to stay 2 minutes Intel Boot Agent, even when I was on Windows Vista, and it also sets automatically.I upgraded my BIOS a few weeks before getting the BSOD, but I don't think that's the problem. In addition, there was no new driver installed before getting the BSOD, drivers have been installed after the first BSOD (even if the event viewer and the reliability monitor do not mention the first BSOD, only those who have followed the installation of the driver I know there's a BSOD before, I'm sure.)My system: HP Compaq 8510w (Original with windows vista bussines, did a clean install of 7 ultimate)BIOS version: F.20C: drive has only 10% free space - 15% free space is optimal for Windows
Please visit the site Web of the manufacturer of the PC and download/install all drivers. These are devices that lack the drivers:
*******
Controller of communication Simple PCI PCI VEN_8086 & DEV_2A04 & SUBSYS_30C5103C & REV_0C\3 & 21436425 & 0 & 18 that the drivers for this device are not installed.Serial port PCI PCI VEN_8086 & DEV_2A07 & SUBSYS_30C5103C & REV_0C\3 & 21436425 & 0 & 1 b, that the drivers for this device are not installed.
No available ACPI\HPQ0006\2 & DABA3FF & 2, the drivers for this device are not installed.Base system device PCI VEN_1180 & DEV_0843 & SUBSYS_30C5103C & REV_10\4 & 118B1C9 & 0 & 34F0 the drivers for this device are not installed.
Fingerprint Sensor USB\VID_08FF & PID_2580\5 & 1E4845E3 & 0 & 2, that the drivers for this device are not installed.
RICOH PCMCIA\RICOH-BAY8CONTROLLER-F1B2\1 Bay8Controller the drivers for this device are not installed.
******
Please uninstall ATI Tool - it does not work in Win7 and may be responsible for your BSOD (and its drivers are from 2006). More info here: http://www.carrona.org/drivers/driver.php?id=ATITool.sys¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BSOD BUGCHECK SUMMARY
The debugging session: 05:54:32.426 Fri 31 August 2012 (UTC - 04:00)
Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\083112-17019-01.dmp]
By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
System Uptime: 0 days 0:00:08.455
Bugcheck A, {7bcc, 2, 0, 82afb482}
ERROR: Module load completed but symbols can be loaded for mssmbios.sys
Probably caused by: ntkrpamp.exe (nt! DeleteNodeFromTree + 46)
Error checking code 0000000-a
Arguments 00007bcc ', memory IRQL bitfie 82afb482 00000000' 00000002',' address
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0XA
Nom_processus: System
FAILURE_BUCKET_ID: 0xA_nt! DeleteNodeFromTree + 46
MaxSpeed: 2200
CurrentSpeed: 2194
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
The debugging session: 04:17:05.296 Thu August 23, 2012 (UTC - 04:00)
Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\082312-17004-01.dmp]
By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
System Uptime: 0 days 0:00:11.356
CD error checking, {8931d 000, 0, 82a271f2, 0}
ERROR: Module load completed but symbols can be loaded for mssmbios.sys
WARNING: Unable to verify timestamp for ATITool.sys
ERROR: Module load completed but symbols can be loaded for ATITool.sys
Probably caused by: ATITool.sys (ATITool + 2017)
000000cD Bugcheck code
Arguments 8931d 000', memory 00000000' 82a271f2 value ', if not 00000000', int Mm
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0XCD
Nom_processus: System
FAILURE_BUCKET_ID: 0xCD_VRF_ATITool + 2017
MaxSpeed: 2200
CurrentSpeed: 2194
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
The debugging session: 04:00:26.646 Thu August 23, 2012 (UTC - 04:00)
Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\082312-21933-01.dmp]
By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
System Uptime: 0 days 0:00:07.675
Bugcheck 1000007E, {c0000005, 82c2e4a4, 80786888, 80786460}
ERROR: Module load completed but symbols can be loaded for mssmbios.sys
Probably caused by: ntkrpamp.exe (nt! ObpLookupDirectoryEntry + 2 b)
Bugcheck 1000007E code
Arguments c0000005", ex-82c2e4a4 ', the 80786888 ad', except 80786460', Contex
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
Nom_processus: System
BUGCHECK_STR: 0X7E
FAILURE_BUCKET_ID: 0x7E_nt! ObpLookupDirectoryEntry + 2 b
MaxSpeed: 2200
CurrentSpeed: 2194
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` -
Ive had problems of BSOD with this as my Dump Win 7 x 64
Looks like it might be the system. is there a fix or should I reinstall?
Microsoft (R) Windows debug 6.2.8400.0 AMD64 Version
Copyright (c) Microsoft Corporation. All rights reserved.Loading dump file [C:\Users\Crux\Desktop\MEMORY. DMP]
The core dump file summary: the single kernel address space is availableSymbol search path is: D:\Symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (12 procs) free x 64
Product: WinNt, suite: TerminalServer SingleUserTS
By: 7600.16385.amd64fre.win7_rtm.090713 - 1255
Computer name:
Kernel base = 0xfffff800 '03068000 PsLoadedModuleList = 0xfffff800' 032a5e50
The debugging session: 16:15:23.014 Sam August 11, 2012 (UTC - 05:00)
System Uptime: 0 days 0:00:12.370
Loading the kernel symbols
...............................................................
..............................
Loading user symbolsLoading unloaded module list
.
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************Use! analyze - v to obtain detailed debugging information.
The 7th, {ffffffffc0000005, fffff88006e9a75d, fffff88006538c68, fffff880065384c0}
Probably caused by: NETIO. SYS (NETIO! NmrClientAttachProvider + 65)
Follow-up: MachineOwner
---------4: kd >! analyze - v
*******************************************************************************
* *
* Bugcheck analysis *.
* *
*******************************************************************************(7th) SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
It is a very common bugcheck. Usually the PIN address of exception
the driver/function that caused the problem. Always note this address
and the date of the picture link / driver that contains this address.
Arguments:
Arg1: ffffffffc0000005, unhandled exception code
Arg2: fffff88006e9a75d, the address that the exception occurred at
Arg3: fffff88006538c68, address of Exception report
Arg4: fffff880065384c0, address of the context recordDebugging information:
------------------EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
FAULTING_IP:
AFD! WskTdiInit + dd
fffff880'06e9a75d 48c7442020c8000000 mov qword ptr [rax + 20 h], 0C8hEXCEPTION_RECORD: fffff88006538c68-(.exr 0xfffff88006538c68)
ExceptionAddress: fffff88006e9a75d (afd! WskTdiInit + 0x00000000000000dd)
ExceptionCode: c0000005 (access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter [0]: 0000000000000001
Parameter [1]: 0000000000000020
Try to write at the address 0000000000000020CONTEXT: fffff880065384c0-(.cxr 0xfffff880065384c0)
Rax = 0000000000000000 rbx = 0000000000000000 rcx = fffff88006e7d580
RDX = 0000000000000000 rsi = 0000000000000000 rdi = fffff88007b2b320
RIP = fffff88006e9a75d rsp = fffff88006538ea0 rbp = fffff88007b2b348
R8 = 0000000000000000 r9 = 0000000000000000 r10 = fffff80003267888
R11 = 0000000000000000 r12 = fffffa800c5fa98e r13 = ffffffff800001dc
R14 = fffffa800c5c6560 r15 = 000000000000001c
iopl = 0 nv up ei pl zr po nc
CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
AFD! WskTdiInit + 0xdd:
fffff880'06e9a75d 48c7442020c8000000 mov qword ptr [rax + 20 h], 0C8h, ds:002 b: 00000000'00000020 =?
Reset the default scopeNom_processus: System
CURRENT_IRQL: 0
Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000020
WRITE_ADDRESS: 0000000000000020
FOLLOWUP_IP:
NETIO! NmrClientAttachProvider + 65
fffff880'04427ea5 85 c 0 test eax, eaxBUGCHECK_STR: 0X7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LOCK_ADDRESS: fffff800032dc400-(! fffff800032dc400 of locks)
Resource @ nt! PiEngineLock (0xfffff800032dc400) the exclusive property
Argument Count = 1
NumberOfExclusiveWaiters = 1
Discussions: fffffa8006a2f680-01<*>
Threads waiting on exclusive access:
fffffa8006a2e0401 total locks, 1 locks currently held
PNP_TRIAGE:
Lock the address: 0xfffff800032dc400
Thread Count: 1
Feed address: 0xfffffa8006a2f680
Queue: 0 x 318LAST_CONTROL_TRANSFER: from fffff80003448824 to fffff800030d9f00
STACK_TEXT:
fffff880 '06538ea0 fffff880' 06e72950: fffffa80 ' 0c5fd6f0 fffffa80 '0c5fd6f0 fffff880' 07b2b348 fffff880 ' 07b2b348: afd! WskTdiInit + 0xdd
"fffff880 '06538ef0 fffff880' 06e72b7c: fffffa80 ' fffff880 00000262 '07b2b348 fffffa80' 0c5fd6f0 fffffa80 ' 0c4d2ee0: afd! AfdWskInit + 0 x 30
fffff880 '06538f30 fffff880' 04427ea5: fffff880 ' 07b2b348 fffffa80 '0c4d2ee0 fffffa80' 0c5fa940 fffffa80 ' 0c4d2ee0: afd! AfdWskNotifyAttachClient + 0x12c
fffff880 '06538f80 fffff880' 07b 27173: fffffa80 '0c5fa98c 00000000 00000001' fffffa80' 0c5fcd70 00000000' 000007ff: NETIO! NmrClientAttachProvider + 0 x 65
fffff880'06538fd0 fffff880'04430833: fffffa80' 771d7db4 fffffa80 '43820eee 0c5fcd70' c 336420 00000001'00000018 0: rasl2tp! WskNotifyAttachProvider + 0 x 73
fffff880 ' 06539010 fffff880' 04431cbd: fffffa80 '0 c 336420 fffffa80' 07406820 fffff880' 06539120 00000000 00000000': NETIO! NmrpProposeAttachment + 0 x 53
fffff880 ' 06539060 fffff880' 04432dde: fffffa80'0c5fcd70 00000000' fffff880'06539120 00000000 00000000 00000000': NETIO! NmrpAttachArray + 0x3d
fffff880 '06539090 fffff880' 044340d 2: fffff880'07b2b300 00000000'00000000 00000000'00000001 00000000'00000000: NETIO! NmrpRegisterModule + 0x6e
fffff880 '065390f0 fffff880' 07b4004c: fffffa80' 00000000 00000010 '0 c 547820 fffffa80' 0c 00000000'00000018 634000: NETIO! NmrRegisterClient + 0 x 52
"fffff880 ' 06539120 fffff880' 07 b 45050: 00000000'746 c 6600 fffff880 ' 06539210 fffff880 ' 065391 b 0 fffff800'03267880: rasl2tp! WskStartClientModule + 0x3c
fffff880 '06539150 fffff800' c 034 1477: fffffa80 '0 c 547820 fffffa80' 0c 547820 00000000 00000000' fffffa80'0 c 634000: rasl2tp! DriverEntry + 0x40
fffff880 ' 06539240 fffff800' 03554780: fffff880 00000000'00000001 00000000'00000000 ' 065397e8 ffffffff 8000014 c: nt! IopLoadDriver + 0xa07
fffff880 ' 06539510 fffff800' 03392cdc: fffff880'06539820 00000000 '00000000 00000000' c0000023 00000000' 00000000: nt! PipCallDriverAddDeviceQueryRoutine + 0 x 390
"fffff880 ' 06539610 fffff800' 03392fea: 00000000'00000000 00000000'00000000 fffff880 ' 06539820 fffff880 ' 065397e8: nt! RtlpCallQueryRegistryRoutine + 0xf4
fffff880 ' 06539690 fffff800' 034c472c: fffffa80 '06a7b010 00000000'00000000 00000000' c0000034 fffff880' 065397e8: nt! RtlQueryRegistryValues + 0x17e
fffff880 ' 06539760 fffff800' 034c5ec2: fffffa80 '06a7a6b0 fffffa80' 06a7b010 00000000 00000001' fffff8a0'0000004 c: nt! PipCallDriverAddDevice + 0x45c
fffff880 ' 06539910 fffff800' 034c635c: fffff800 '032d9d80 00000000'00000000 00000000'00000001 fffff800 0334671' c: nt! PipProcessDevNodeTree + 0x2b2
"fffff880 '06539b 80 fffff800' 031da322: 00000001 0327d5f8 ' 00000003 fffff800 ' 00000000'00000001 00000000'00000000: nt! PiProcessStartSystemDevices + 0x7c
fffff880 '06539bd0 fffff800' 030e7161: fffff800'031da020 fffff880 '04169e01 fffffa80' 06a2f600 00000000' 00000000: nt! PnpDeviceActionWorker + 0 x 302
fffff880 ' 06539 c 70 fffff800 '0337 d 166:95259525' fb2ffb2f fffffa80 '06a2f680 00000000 00000080' fffffa80' 06a15b30: nt! ExpWorkerThread + 0 x 111
"fffff880 ' 06539 d 00 fffff800 ' 030b 8486: fffff880 ' 0633f180 fffffa80 '06a2f680 fffff880' 0634a1c0 b83fb83f ' 6a116a11: nt! PspSystemThreadStartup + 0x5a
fffff880'06539 d 40 00000000 00000000': fffff880'0653 has 000 fffff880 '06534000 fffff880' 06537780 00000000 00000000': nt! KiStartSystemThread + 0x16SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: NETIO! NmrClientAttachProvider + 65
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NETIO
NOM_IMAGE: NETIO. SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc18a
STACK_COMMAND: .cxr 0xfffff880065384c0; Ko
FAILURE_BUCKET_ID: X64_0x7E_NETIO! NmrClientAttachProvider + 65*>
BUCKET_ID: X64_0x7E_NETIO! NmrClientAttachProvider + 65
Follow-up: MachineOwner
---------Hi, I took a glance at the attached image file.
It is a C5: DRIVER_CORRUPTED_EXPOOL error checking, which means that a device driver has a bug that has attempted to access a memory either non-existent memory or it is not allowed access.
The driver failed in the dump is kbdclass.sys is a general Windows driver, which is probably not the real cause of the accident-, but something other driven in kbdclass.sys Fault, probably another 3rd driver we need to activate Driver Verifier catch.
First, if Service Pack 1 is not installed - know how to install this here.
Driver Verifier:
What is the driver verifier?
Driver Verifier is included in Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP and Windows Server 2003 to promote stability and reliability; You can use this tool to troubleshoot driver problems. Components in kernel mode Windows can cause the corruption of system or failures in the system due to a poorly written driver, as a previous version of a driver Windows Driver Model (WDM).
Essentially, if there is a 3rd driver left supposedly involved, activation of the driver verifier will help flush out the rogue driver by marking and origin of your system to BSOD.
Before you enable Driver Verifier, it is recommended to create a System Restore Point:
Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | Select "create a Restore Point.
How to enable the driver verifier:
Start > type "auditor" without quotes > select the following options.
1. Select - create a custom settings (for code developers).
2. Select - "select individual settings from a list."
3. check the following boxes-
-Special pool
-Pool management
-Force IRQL control
-Detection of blockages
-Security controls (Windows 7)
-Concurrentcy (Windows 8) stress test
-DDI compliance review (Windows 8)
-Cheques
4. Select - "select the driver names from a list.
5. click on the tab 'supplier '. This will cause the sorting of all drivers by the provider.
6. EACH box that is NOT provided by Microsoft / Microsoft Corporation.
7. click on finish.
8 restart.
Important information about driver verifier:
-If the Driver Verifier finds a violation, the system will search BSOD.
-After activation of the auditor of drivers and restart the system, according to the guilty, will it be
example, that the pilot is started, you may not be able to return to normal Windows
Because Driver Verifier it will report and as shown above, which will cause / force a BSOD.
If this happens, do [b] not [/ b] panic, follow these steps:
-Start in Safe Mode by pressing repeatedly F8 key during boot to the top.
-Once in Mode safe - start > type "System Restore" without the quotes.
-Select the previously created restore point.
If you have not set up a restore point, don't worry, you can always turn off Driver Verifier for
in normal windows:
-Start > Search > type "cmd" without the quotes.
-To disable the Driver Verifier feature, type cmd ' auditor/Reset"without the quotes.
-Reboot and start Windows normally.
How long can I keep the compatible driver verifier for?
It varies, many experts and analysts have different recommendations. Personally, I recommend
keep it turned on for at least 36 to 48 hours. If you do not BSOD right there, turn off Driver Verifier.
My BSOD system would be, where can find the dumps?
They are in C:\Windows\Minidump
For any other question can most likely be answered by this article:
http://support.Microsoft.com/kb/244617
Kind regards
Patrick
-
Issue of standby, power code: 0x7E - Satellite U300 - 14 p
I just bought my Satellite U300 - 14 p and installed windows XP SP3 0.5508 (deletion of Vista that comes with it), with a custom Windows XP, boot disk made with nLite 1.4.1 (to include the SATA driver and set up my preferences, such as themes, etc.).
I followed the instructions (installation order) that are on the Drivers Toshiba Download Page and everything goes well until installing "TOSHIBA Power Saver"(v7.03.07Q)".
The installation seemed to go very well, but at the end of it, the "critical stop" sound error of windows rang and after go to the control panel and try to open TOSHIBA Power Saver, I get the message:"CANNOT be opened because you do not have access rights to use 'TOSHIBA Power Saver'."
I am the only user of the computer and admin, so I don't get this message.
I tried to uninstall it but I get the message: "a fatal error has occurred. The program will end. "Code: 0x7E.
Any help?
EDIT: I forgot to mention that, now, every time I start windows, the "critical stop" sound games and he started that after I installed energy-saving
Post edited by: Cinetyk
Great! Thanks for this detailed!
-
Satellite L30-106: Power Saver 0x7E error
Hi all
I own a Toshiba Satellite L30-106. I got it from Windows Vista to Windows XP pro, I installed all the Xp drivers provided by the Toshiba site.Everything is going well except for the Toshiba Power Saver utility, I can't install it, it still gives this error: error Power Saver 0x7E. Same thing happens when I want to uninstall it. How can I solve this problem?
Thanks in advanceHello
I hope that you have installed the power saver right!
The laptop is one of the series PSL33E. Therefore, you should choose the drivers and tools for this series!In addition it is very important to install the driver Toshiba and utilities in the right order!
Then open the installation instructions and follow the lines of this guide!Please make sure that you have already installed "TOSHIBA common Modules or / and TOSHIBA Hotkey Utility" ahead!
-
Satellite M40-107: cannot re - install Powersaver - Code 0x7E
Recently, I had to re - install Windows Xp on my Satellite M40-107 (PSM40E). Everything went well. Finally, I wanted to install the powersaver and I downloaded the latest version for my machine from the Toshiba web site. Installation fine until I press the complete installation (kerncentrale).
A pop-up window appears with the message: fatal error, this programme will be completed. Code 0x7E.
After restarting the same message appears until the powersaver is removed from the Board to run.
Who can help?
concerning
@bHello
It seems that there is no general solution for this problem.
I found and read a few comments on the similar problem, and it seems that the Toshiba recovery CD installation will eliminate this error message popup. -
Satellite P30-128: installation power management error Code: 0x7E
Hello, I formatted my laptop yesterday, and I could not install power management software correctly. When the installation is complete, I get "fatal error. Program will be closed. "Code: 0x7E.
Can someone help me please?
Hi Simone
In this forum, you will find many topics on this energy-saving error. Try using the advanced search.
This product usually mistake it the user does not use the Toshiba Recovery CD but only the original Microsoft OS.
But according to other topics, there is no explicit solution.
It is very important that you need to install the drivers of Toshiba in the right order.
See the installation instructions on the page of the Toshiba driver. -
TOSHIBA Power Saver 0x7E error
Hello.
It's the short history of XP on my Satellite A200 - 14 d:
I can't stand Vista, therefore 2 or 3 days after the purchase of my laptop and try Vista, I decided to install my WinXP Pro. At first, it was REALLY hard for me to find drivers. I even installed some Tohiba not who, by the way worked just fine. Then Toshiba began to publish its own non-experimental pilots and I was happy. Everything worked well. After almost a year I was "forced" to reinstall my OS (once again: WinXP Pro). Everything went according to plan, and after 30 minutes, I was greated by the Windows XP Welcome screen. The first task was to install the appropriate drivers.
Well, very well. I downloaded the latest drivers before reinstalling and kept them on another partition, I was ready to go. I opened the file TXT "new facility" and began to install everything on this list (which of course I downloaded from the Toshiba site). I installed all the drivers in the line, they must be installed (although I don't really know what that some of them may be of no use to me, like a fingerprint, since I have no such thing, but fine - I can't live without a few megabytes :)) until the famouse "Power Saver Utility" has come.) I read in many forums here on this problem, but I never found a solution :(:(:(
When I tried to install the utility, it spits out an error message with code 0x7E (?). Whenever I boot my OS, this triumph of message on my desk ruin my mood :( I tried to uninstall it (although it is not completely installed - the only thing that shows something on this subject is an icon of the control panel which, pressing on, says that I don't have sufficient rights to access the file (even IF I'm in administrative Mode) and registry keys, which does nothing (I removed it and always appear the messages that I mentioned above)).
I tried to remove it, but once again with error 0x7E message at the beginning of uninstallation. I even REINSTALLED my OS again and again by installing Power Saver mistakes occur :(:(:( This surprises me a lot, because I've never had such a problem before even the fact that I have not followed the installation instructions. I really need a solution to this. I want to install Vista and the recovery disc. I would if I knew there was no average athor, but I'm sure there is because of the fact that I had no problems before.
Yes, everyone throws - help. Because without energy saver, my laptop is like your desktop PC, that is--needs to stay connected with alternating current :( And it is not appropriate for a laptop.
PS: I forgot to mention - no change in the BIOS has been done, although I don't think that this has nothing to do with my problem.
Hello
Have you tried two versions of power saver on the Toshiba download page?
-
Hey, I removed the windows OEM pre-installed and installed my windows, I downloaded all the drivers and software on the site of Toshiba, it all works except the energy saver. When it is installed and want to start, I got the error 0x7E. When I want to remove to install another version, I also got this error.
Does anyone know a solution? Thank youHi Bjorn
On this forum I found a few topics with similar theme, but unfortunately there is no universal solution. Obviously a registry entry is wrong and reinstalling doesn't help at all.
I noticed that the problem has been resolved after the reinstallation of the operating system with recovery media. On this way the unit has again factory settings and should not have problems again. I'm sure other applications installed on your device may be an advertisement influence on the sleep feature power.
It's really not easy to say why this is happening.
Maybe you are looking for
-
My yahoo password has been reset on my phone. Yahoo mail not received the Mac Air. What should I do? I won't change the password again. Thank you
-
Dear everybody I buy an android phone from Lenovo S560 idea a few days ago. When I connect the phone via USB to my desktop it it shows only as USB storage device. But in this phone there is no visible attachment option. For this reason, I am unable t
-
Some graphs showing the color white or invisible while playing games
Hello I juz hv bought a new pc with Windows 7, 64 bit. Graphics card is MSI hawk 1 G. However, while playing the game, some of the graphic is of white color and part is invisible. 2 same items side by side, 1 with a normal image, the other is white.
-
Im having trouble connecting my wireless laptop but the hard line is fine suggestions
Anyone know what I need to do?
-
How to post pictures in a messageboard
photo display How to post pictures in the net messageboards?