BUGCHECK_STR: 0X7E

Microsoft (R) Windows debug 6.2.9200.20512 AMD64 Version
Copyright (c) Microsoft Corporation. All rights reserved.

Command line: C:\Windows\Minidump\Mini081113-01.dmp
Cannot run 'C:\Windows\Minidump\Mini081113-01.dmp', 0n193 error Win32
"%1 is not a valid Win32 application".

Loading dump file [C:\Windows\Minidump\Mini081113-01.dmp]
The mini kernel dump file: only registers and the trace of the stack are available

Symbol search path is: * invalid *.
****************************************************************************
* Loading of the symbol may be unreliable without a symbol search path.           *
* Use .symfix to get the debugger to choose a symbol path.                   *
* After adjusting your path to symbols, use .reload to refresh the locations of symbols. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols cannot be loaded because the path is not initialized. *
*                                                                   *
* The symbol path can be defined: *.
* using the _NT_SYMBOL_PATH environment variable.                 *
* with the help of the there when you start the debugger argument. *.
* using the .sympath and .sympath + *.
*********************************************************************
Cannot load the image \SystemRoot\system32\ntoskrnl.exe, 0n2 error Win32
WARNING: Unable to verify timestamp for ntoskrnl.exe
ERROR: Module load completed but symbols can be loaded for ntoskrnl.exe
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack2) MP (2 processors) free x 64
Product: WinNt, suite: TerminalServer personal TerminalServer
Computer name:
Kernel base = 0xfffff800 '02257000 PsLoadedModuleList = 0xfffff800' 0241bdd0
The debugging session: Sun Aug 11 21:26:06.348 2013 (UTC - 04:00)
System Uptime: 0 days 0:00:46.144
*********************************************************************
* Symbols cannot be loaded because the path is not initialized. *
*                                                                   *
* The symbol path can be defined: *.
* using the _NT_SYMBOL_PATH environment variable.                 *
* with the help of the there when you start the debugger argument. *.
* using the .sympath and .sympath + *.
*********************************************************************
Cannot load the image \SystemRoot\system32\ntoskrnl.exe, 0n2 error Win32
WARNING: Unable to verify timestamp for ntoskrnl.exe
ERROR: Module load completed but symbols can be loaded for ntoskrnl.exe
Loading the kernel symbols
...............................................................
................................................................
.....
Loading user symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
* Bugcheck analysis *.
*                                                                             *
*******************************************************************************

Use! analyze - v to obtain detailed debugging information.

Bugcheck 1000007E, {ffffffffc0000005, fffff800024f5609, fffffa6001bd94d8, fffffa6001bd8eb0}

The kernel symbols are FALSE. Correct symbols to do the analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************
Probably caused by: ntoskrnl.exe (nt + 29e609)

Follow-up: MachineOwner
---------

0: kd > g
^ No executable debuggees error in 'g '.
0: kd >! analyze - v
*******************************************************************************
*                                                                             *
* Bugcheck analysis *.
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
It is a very common bugcheck.  Usually the PIN address of exception
the driver/function that caused the problem.  Always note this address
and the date of the picture link / driver that contains this address.
Some common problems are the exception code 0 x 80000003.  This means a hard
coded breakpoint or assertion was hit, but this system has been started
/ /NODEBUG.  It is not supposed to happen as developers should never have
breakpoints coded hard in retail code, but...
In this case, make sure a debugger must be connected and the
system startup/DEBUG.  This will we will see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, unhandled exception code
Arg2: fffff800024f5609, the address that the exception occurred at
Arg3: fffffa6001bd94d8, address of Exception report
Arg4: fffffa6001bd8eb0, address of the context record

Debugging information:
------------------

The kernel symbols are FALSE. Correct symbols to do the analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
Either you have specified an absolute symbol, or your debugger *.
has no information complete symbol.  Absolute symbol *.
resolution is disabled by default. Please specify a *.
complete symbol module! NomSymbole, or activate the resolution *.
symbols unskilled by typing '.symopt 100 '. Note that *.
allowing unqualified symbol with the network symbol resolution *.
shares of server in the symbol path can cause the debugger to *.
appear to hang for long periods of time when an incorrect *.
symbol name is typed or the symbol of the network server is down.     ***
***                                                                   ***
For some commands work properly, your symbol path *.
should point to .pdb files have the type information complete.      ***
***                                                                   ***
Some (such as the public OS symbols) .pdb files are not *.
contain the required information.  The contact group that *.
you provided with these symbols, if you need this command for *.
work.                                                          ***
***                                                                   ***
Type referenced: nt! _KPRCB *.
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbols path and of loading symbol.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002257000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 513a94a9

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

FAULTING_IP:
NT + 29e609
fffff800'024f5609 430fb70c11 movzx ecx, word ptr [r9 + r10]

EXCEPTION_RECORD: fffffa6001bd94d8-(.exr 0xfffffa6001bd94d8)
Can not read the Exception record @ fffffa6001bd94d8

CONTEXT: fffffa6001bd8eb0-(.cxr 0xfffffa6001bd8eb0)
Cannot read the context, Win32 error 0n30

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0X7E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800024c885a to fffff800024f5609

STACK_TEXT:
"fffffa60 '01bd9718 fffff800' 024c885a: fffff800'024528 b 0 fffffa80 ' 036 c 8800 00000000 00000000' fffffa80 ' 07b604c0: nt + 0x29e609
"fffffa60 '01bd9720 fffff800' 024528b 0: fffffa80 ' 036 c 8800 00000000 00000000' fffffa80 ' 07b604c0 00000000' 00000000: nt + 0x27185a
fffffa60'01bd9728 fffffa80'036 c 8800: 00000000 00000000' fffffa80 '07b604c0 00000000 00000000' fffffa60' 01bd97f0: nt + 0x1fb8b0
fffffa60'01bd9730 00000000' 00000000: fffffa80'07b604c0 00000000 00000000' fffffa60 '01bd97f0 fffffa60' 02af5b01: 0xfffffa80'036 c 8800

FOLLOWUP_IP:
NT + 29e609
fffff800'024f5609 430fb70c11 movzx ecx, word ptr [r9 + r10]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt + 29e609

FOLLOWUP_NAME: MachineOwner

Nom_image: ntoskrnl.exe

STACK_COMMAND: .cxr 0xfffffa6001bd8eb0; Ko

BUCKET_ID: WRONG_SYMBOLS

Follow-up: MachineOwner
---------

0: kd > .exr 0xfffffa6001bd94d8
Can not read the Exception record @ fffffa6001bd94d8
0: kd > .cxr 0xfffffa6001bd8eb0
Cannot read the context, Win32 error 0n30
0: kd > .cxr 0xfffffa6001bd8eb0
Cannot read the context, Win32 error 0n30

Hello

Please download the dump, as requested by zig - zag file. In the meantime, let us know exactly when you get the error message and also refer to the following article explains the generally why a control bug 0x7E occurs and what can be tried to solve the problem.

http://msdn.Microsoft.com/en-us/library/Windows/hardware/ff559239 (v = VS. 85) .aspx

Hoping to hear from you soon.

Tags: Windows

Similar Questions

  • Intermittent BSOD every day tixhci.sys

    Hi all

    I HPE h8-1120une desktop PC and crashes every time that a day or two.  Mini dump is created and executed an analysis against them and see that there is a product of access on tixhci driver violation.

    I checked the drivers HP for the PC and there is only the driver Texas Instruments original USB available for download - is there a version update available?

    Is there a workaround or problems known about this pilot and HPE PC?

    Bugcheck 1000007E, {ffffffffc0000005, fffff880054dbbbf, fffff880034bb838, fffff880034bb090}

    Probably caused by: tixhci.sys (tixhci + 43bbf)

    Follow-up: MachineOwner
    ---------

    1: kd >! analyze - v
    *******************************************************************************
    * *
    * Bugcheck analysis *.
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the PIN address of exception
    the driver function / who caused the problem. Always note this address
    and the date of the picture link / driver that contains this address.
    Some common problems are the exception code 0 x 80000003. This means a hard
    coded breakpoint or assertion was hit, but this system has been started
    / /NODEBUG. It is not supposed to happen as developers should never have
    breakpoints coded hard in retail code, but...
    In this case, make sure a debugger must be connected and the
    Start/DEBUG system. This will we will see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, unhandled exception code
    Arg2: fffff880054dbbbf, the address that the exception occurred at
    Arg3: fffff880034bb838, address of Exception report
    Arg4: fffff880034bb090, address of the context record

    Debugging information:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    FAULTING_IP:
    tixhci + 43bbf
    fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8]

    EXCEPTION_RECORD: fffff880034bb838-(.exr 0xfffff880034bb838)
    ExceptionAddress: fffff880054dbbbf (tixhci + 0x0000000000043bbf)
    ExceptionCode: c0000005 (access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter [0]: 0000000000000000
    Parameter [1]: 0000000000000008
    Attempt to read from address 0000000000000008

    BACKGROUND: fffff880034bb090-(.cxr 0xfffff880034bb090)
    Rax = 0000000000000025 rbx = fffffa800aa9a540 = fffffa800aa9a540 rcx
    RDX = fffffa80056d4e60 rsi = rdi = fffffa800ae98210 fffffa800aa9a6d0
    RIP = fffff880054dbbbf rsp = fffff880034bba70 rbp = fffffa800aa9a540
    R8 = fffffa800ae98020 r9 = fffffa800ae98148 = 0000000000000000 r10
    R11 = fffffa800ae77de8 r12 = fffffa800ae40002 r13 = 0000000000000001
    R14 = 0000000000000001 r15 = fffff800044ab080
    iopl = 0 nv up ei ng nz na po nc
    CS = 0010 ss = 0018 ds = 002 b 002 b = fs = 0053 gs = 002 b efl = 00010286
    tixhci + 0x43bbf:
    fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8] ds:002 b: 00000000'00000008 =?
    Reset the default scope

    CUSTOMER_CRASH_COUNT: 1

    Nom_processus: System

    CURRENT_IRQL: 0

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 0000000000000000

    EXCEPTION_PARAMETER2: 0000000000000008

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ecb100
    0000000000000008

    FOLLOWUP_IP:
    tixhci + 43bbf
    fffff880'054dbbbf b 498, 4208 mov rax, qword ptr [r10 + 8]

    BUGCHECK_STR: 0x7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: to fffffa800ae77de8 to fffff880054dbbbf

    STACK_TEXT:
    fffff880 '034bba70 fffffa80' 0ae77de8: fffffa80 '0aa9ac58 00000000 00000000' fffff880' 054e1100 00000000' 00000000: tixhci + 0x43bbf


    fffff880 '034bba78 fffffa80' 0aa9ac58: 00000000 00000000' fffff880 '054e1100 00000000 00000000' fffff880' 054da1d2: 0xfffffa80'0ae77de8
    fffff880'034bba80 00000000' 00000000: fffff880'054e1100 00000000 00000000 "fffff880 '054da1d2 fffffa80' 0ae77de8: 0xfffffa80'0aa9ac58

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: tixhci + 43bbf

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: tixhci

    Nom_image: tixhci.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4db0823b

    STACK_COMMAND: .cxr 0xfffff880034bb090; Ko

    FAILURE_BUCKET_ID: X64_0x7E_tixhci + 43bbf

    BUCKET_ID: X64_0x7E_tixhci + 43bbf

    Follow-up: MachineOwner
    ---------

    Laptop HP ENVY 17-j005tx, HP ENVY 27 - k001a, HP ProLiant MicroServer Gen8 G2020T, HP MediaSmart EX495 Server tilt, HP MediaVault 2020, HP ENVY 120 AiO Printer

    Hmmm, impossible to install the fix, get error dialog box popup 259. However, I changed the power options to High Performance and BSOD has not reappeared.

  • How can I use the excpeption address in widows debugging to identify the cause?

    Hello

    I have a windows xp machine crashes randomly.

    I did a debug and wonder how I can identify the driver that is the cause using the exception address.

    Dump below:

    Microsoft (R) debugging Version of Windows 6.12.0002.633 X 86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading dump file [E:\Mini072911-01.dmp]
    The mini kernel dump file: only registers and the trace of the stack are available

    Symbol search path is: SRV * c:\debug-symboles * http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 processors) free x 86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    By: 2600.xpsp_sp3_gdr.101209 - 1647
    Computer name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    The debugging session: 21:08:37.390 Thu Jul 28 2011 (UTC + 01:00)
    System Uptime: 1 day 11:05:14.187
    Loading the kernel symbols
    ...............................................................
    ................................................................
    .................................................
    Loading user symbols
    Loading unloaded module list
    ..................................................
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    Use! analyze - v to obtain detailed debugging information.

    Bugcheck 1000007E, {c0000005, 874551ad, ba557b04, ba557800}

    Probably caused by: ntkrpamp.exe (nt! KiSwapContext + 2f)

    Follow-up: MachineOwner
    ---------

    1: kd >! analyze - v
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    It is a very common bugcheck.  Usually the PIN address of exception
    the driver/function that caused the problem.  Always note this address
    and the date of the picture link / driver that contains this address.
    Some common problems are the exception code 0 x 80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system has been started
    / /NODEBUG.  It is not supposed to happen as developers should never have
    breakpoints coded hard in retail code, but...
    In this case, make sure a debugger must be connected and the
    system startup/DEBUG.  This will we will see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, the unhandled exception code
    Arg2: 874551ad, the address that the exception occurred at
    Arg3: ba557b04, address of Exception report
    Arg4: ba557800, address of the context record

    Debugging information:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.

    FAULTING_IP:
    + 2f
    874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]

    EXCEPTION_RECORD: ba557b04-(.exr 0xffffffffba557b04)
    ExceptionAddress: 874551ad
    ExceptionCode: c0000005 (access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter [0]: 00000001
    Parameter [1]: 01000000
    Try to write at the address 01000000

    CONTEXT: ba557800-(.cxr 0xffffffffba557800)
    EAX = 00000000 ebx = 875677d ecx 8 = 00000200 edx = 00000000 esi = 8745bb80 edi = 01000000
    EIP = 874551ad esp = ba557bcc ebp = ba557bd4 iopl = 0 nv up ei pl nz na po nc
    CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00010202
    874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]
    Reset the default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    Nom_processus: System

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.

    EXCEPTION_PARAMETER1: 00000001

    EXCEPTION_PARAMETER2: 01000000

    WRITE_ADDRESS: 01000000

    FOLLOWUP_IP:
    NT! KiSwapContext + 2f
    80545a1b 8b2c24 mov ebp, dword ptr [esp]

    FAILED_INSTRUCTION_ADDRESS:
    + 2de2faf01dadfc0
    874551ad f3a4 MOV byte ptr rep are: [edi], byte ptr [esi]

    BUGCHECK_STR: 0X7E

    EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
    Instruction to 874551ad does not read/write in 01000000

    LAST_CONTROL_TRANSFER: from 87456682 to 874551ad

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Sequence of images may be wrong.
    ba557bd4 87456682 01000000 00000000 00000010 0x874551ad
    ba557c00 804ef19f 8ad2dd98 87567768 8ad2dd98 0 x 87456682
    ba557c30 80545a1b ba557c88 00000000 00000000 nt! IopfCallDriver + 0 x 31
    ba557c34 ba557c88 00000000 00000000 00000000 nt! KiSwapContext + 0x2f
    00000000 00000000 00000000 00000000 00000000 0xba557c88

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: nt! KiSwapContext + 2f

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    Nom_image: ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4d00d46f

    STACK_COMMAND: .cxr 0xffffffffba557800; Ko

    FAILURE_BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_nt! KiSwapContext + 2f

    BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_nt! KiSwapContext + 2f

    Follow-up: MachineOwner

    See you soon

    KeV

    Hi Kev,

    The issue of Windows XP, you have posted is related to Windows XP in a domain environment. It is better suited for the IT Pro TechNet public. Please ask your question in the TechNet forums for assistance.

    Hope the helps of information.

  • IRQL_NOT_LESS_OR_EQUAL Error with BSOD error

    Hello

    I get the IRQL_NOT_LESS_OR_EQUAL Error with blue screen when I start the machine.
    STOP: 0X0000000A (0X00000000, 0X804DC11D, 0X00000001, 0 X 000000002)

    I can't that connection in Debugging Mode.winDBG output points to a file PxHelp20.sys, which is a Sonic driver. Is it possible to delete this file? Or is this some kind of virus? (out of winDBG is attached below). There was no new HW SW or recently installed or when this error occurred.

    I also tried to run Verifier.exe with the option "Select all drivers installed automatically on this computer" and as soon as I chose this option, another mistake (and cannot change this option), DRIVER_IRQL_NOT_LESS_OR_EQUAL
    STOP: 0x000000D1(0x8068329C,0x00000002,0x00000000,0x89E4460A)

    Thanks in advance,
    SRSK

    output in winDbg:

    Debug version of Microsoft Windows (R) 6.11.0001.404 X 86

    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading dump file [C:\WINDOWS\Minidump\Mini102109-01.dmp]

    The mini kernel dump file: only registers and the trace of the stack are available

    Symbol search path is: SRV * c:\Symbols* http://msdl.microsoft.com/download/symbols

    Executable search path is:

    Windows XP Kernel Version 2600 (Service Pack 3) PUTS free x 86 compatible

    Product: WinNt, suite: TerminalServer SingleUserTS

    By: 2600.xpsp_sp3_gdr.090206 - 1234

    Computer name:

    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0

    The debugging session: 23:57:36.015 Tue Oct 20, 2009 (GMT-4)

    System Uptime: 0 days 9:05:10.605

    Loading the kernel symbols

    ...............................................................

    ................................................................

    .......

    Loading user symbols

    Loading unloaded module list

    ..................

    *******************************************************************************

    *                                                                             *

    * Bugcheck analysis *.

    *                                                                             *

    *******************************************************************************

    Use! analyze - v to obtain detailed debugging information.

    Bugcheck 1000007E, {c0000005, 8736d01a, f78d9ec4, f78d9bc0}

    Could not load the PxHelp20.sys, 0n2 error Win32 image

    WARNING: Unable to verify timestamp for PxHelp20.sys

    ERROR: Module load completed but symbols can be loaded for PxHelp20.sys

    Probably caused by: PxHelp20.sys (PxHelp20 + 59b 7)

    Follow-up: MachineOwner

    ---------

    KD >! analyze - v

    *******************************************************************************

    *                                                                             *

    * Bugcheck analysis *.

    *                                                                             *

    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

    It is a very common bugcheck.  Usually the PIN address of exception

    the driver/function that caused the problem.  Always note this address

    and the date of the picture link / driver that contains this address.

    Some common problems are the exception code 0 x 80000003.  This means a hard

    coded breakpoint or assertion was hit, but this system has been started

    / /NODEBUG.  It is not supposed to happen as developers should never have

    breakpoints coded hard in retail code, but...

    In this case, make sure a debugger must be connected and the

    system startup/DEBUG.  This will we will see why this breakpoint is

    happening.

    Arguments:

    Arg1: c0000005, the unhandled exception code

    Arg2: 8736d01a, the address that the exception occurred at

    Arg3: f78d9ec4, address of Exception report

    Arg4: f78d9bc0, address of the context record

    Debugging information:

    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.

    FAULTING_IP:

    + 59b 7

    8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h]

    EXCEPTION_RECORD: f78d9ec4-(.exr 0xfffffffff78d9ec4)

    ExceptionAddress: 8736d01a

    ExceptionCode: c0000005 (access violation)

    ExceptionFlags: 00000000

    NumberParameters: 2

    Parameter [0]: 00000000

    Parameter [1]: 00000014

    Attempt to read from address 00000014

    CONTEXT: f78d9bc0-(.cxr 0xfffffffff78d9bc0)

    EAX = 00000000 ebx = 00000000 ecx = 8a60e910 edx = 00000000 esi = 00000000 edi = 00000000

    EIP = 8736d01a esp = f78d9f8c ebp = f78da54c iopl = 0 nv up ei pl zr pe nc

    CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00210246

    8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h] ds:0023:00000014 is?

    Reset the default scope

    CUSTOMER_CRASH_COUNT: 1

    Nom_processus: System

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at "0 x % lx 08" referenced memory at "0 x % 08 lx. The memory could not be '%s '.

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 00000014

    READ_ADDRESS: 00000014

    FOLLOWUP_IP:

    PxHelp20 + 59b 7

    f766c9b7?              ???

    FAILED_INSTRUCTION_ADDRESS:

    + 24b952f00f7dfdc

    8736d01a 0fb74714 movzx eax, word ptr [edi + 14 h]

    BUGCHECK_STR: 0X7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: from 68772073 to 8736d01a

    SYMBOL_ON_RAW_STACK: 1

    STACK_ADDR_RAW_STACK_SYMBOL: fffffffff78da140

    STACK_COMMAND: dds F78DA140-0 x 20; Ko

    STACK_TEXT:

    f78da120 ffffb905

    f78da124 0f66f18a

    f78da128 6640c6b6

    f78da12c 80d1b60f

    f78da130 e2f73fe2

    f78da134 edc0cd86

    f78da138 0f664106

    F766c9b7 f78da13c PxHelp20 + 0x59b7

    f78da140 20a366e1

    f78da144 41b4c300

    f78da148 8a55aabb

    f78da14c cd002416

    f78da150 810f7213

    f78da154 75aa55fb

    f78da158 01c1f609

    f78da15c 06fe0474

    f78da160 66 30014

    f78da164 66061e60

    f78da168 660010 a-1

    f78da16c 001C 0603

    f78da170 b 20063, 66

    f78da174 3a820f00

    f78da178 6a661e00

    f78da17c 06506600

    f78da180 10686653

    f78da184 80000100

    0000143e f78da188

    f78da18c 000c850f

    f78da190 80ffb3e8

    0000143e f78da194

    f78da198 0061840f

    f78da19c 168a42b4

    SYMBOL_NAME: PxHelp20 + 59b 7

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: PxHelp20

    Nom_image: PxHelp20.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4679 has 978

    FAILURE_BUCKET_ID: 0x7E_BAD_IP_PxHelp20 + 59b 7

    BUCKET_ID: 0x7E_BAD_IP_PxHelp20 + 59b 7

    Follow-up: MachineOwner

    ---------

    SRSK,
    Well I looked around the PxHelp20.sys file and it looks like it is related to things CD\DVD.  If it was me...   I rename the file to .old or move it to a temporary folder and then restart and see what happens.  If you try that bak to view the results.  Good luck. QQ learn manage!

  • Bluescreen stop 0x0000007E

    Hi all

    I have vista home basic system. It shows blue screen boot, whose code: 0 * 0000007E(0*c0000005, 0*8A6C110C, 0*805E0B3C,0*805E0838)

    I tried to recover to an earlier point, but you don't find successful, with error code: 0 * 80070057.

    I can use only under safe mode.

    Anyone know what's happened and how to fix it?

    thx a lot.

    Lisa

    Hello kunseera,

    I had a look at these two landfills, and it seems to be SYMEFA. SYS that is causing this problem.

    It is a component of Norton.

    My recommendation:

    1. download the latest version of your Norton product.

    2 uninstall the Norton product.

    3 reinstall the latest version.

    My analysis of the discharge follows.  My ratings are in "BOLD".

    The mini kernel dump file: only registers and the trace of the stack are available

    Symbol search path is: SRV * c:\websymbols* http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack2) PLACE free x 86 compatible
    Product: WinNt, suite: TerminalServer personal TerminalServer
    By: 6002.18484.x86fre.vistasp2_gdr.110617 - 0336
    Computer name:
    Kernel base = 0x8a651000 PsLoadedModuleList = 0x8a768c70
    The debugging session: killed Sept 13 03:57:40.845 2011 (UTC - 05:00)
    System Uptime: 0 days 0:01:17.735

    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    Use! analyze - v to obtain detailed debugging information.

    Bugcheck 1000007E, {c0000005, 805d 4838, 8a70210c, 805d4b3c}

    WARNING: Unable to verify timestamp for SYMEFA. SYS
    ERROR: Module load completed but symbols cannot be loaded for SYMEFA. SYS
    Probably caused by: SYMEFA. SYS<-- debugger="" blames="">

    Follow-up: MachineOwner
    ---------

    KD >! analyze - v
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    It is a very common bugcheck.  Usually the PIN address of exception
    the driver/function that caused the problem.  Always note this address
    and the date of the picture link / driver that contains this address.
    Some common problems are the exception code 0 x 80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system has been started
    / /NODEBUG.  It is not supposed to happen as developers should never have
    breakpoints coded hard in retail code, but...
    In this case, make sure a debugger must be connected and the
    system startup/DEBUG.  This will we will see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, the unhandled exception code
    Arg2: 8a70210c, the address that the exception occurred at
    Arg3: 805d4b3c, address Record of Exception
    Arg4: 805d 4838, context address Record

    Debugging information:
    ------------------
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    FAULTING_IP:
    NT! RtlSplay + 14
    8a70210c 394204 cmp dword ptr [edx + 4], eax

    EXCEPTION_RECORD: 805d4b3c-(.exr 0xffffffff805d4b3c)
    ExceptionAddress: 8a70210c (nt! RtlSplay + 0 x 00000014)
    ExceptionCode: c0000005 (access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter [0]: 00000000
    Parameter [1]: 00000004
    Attempt to read address 00000004

    CONTEXT: 805d 4838--(.cxr 0xffffffff805d4838)
    EAX = 004e0049 ebx = 8a70e233 ecx = 004e0051 edx = 00000000 esi = a77aba80 edi = a77aba80
    EIP = 8a70210c esp = 805d4c04 ebp = 805d4c0c iopl = 0 nv in EI ng nz cy ac pe
    CS = 0008 ss = 0010 ds = 0023're = 0023 fs = 0030 gs = 0000 efl = 00210297
    NT! RtlSplay + 0x14:
    8a70210c 394204 cmp dword ptr [edx + 4], eax ds:0023:00000004 is?
    Reset the default scope

    CUSTOMER_CRASH_COUNT: 1

    CURRENT_IRQL: 0

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 00000004

    READ_ADDRESS: GetPointerFromAddress: cannot read from a 8, 788868
    Unable to read the memory of MiSystemVaType to a 8, 768420
    00000004

    FOLLOWUP_IP:
    SYMEFA + 1 c 159
    8ffd5159?              ???

    BUGCHECK_STR: 0X7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: from 8a70e2a6 to 8a70210c

    STACK_TEXT:
    805d4c0c 8a70e2a6 004e0049 a77aba74 805d4c3c nt! RtlSplay + 0x14
    805d4c1c 8ffd5159 a77aba80 8fb71374 a77aba68 nt! RtlDelete + 0 x 73
    WARNING: Information not available stack unwind. Sequence of images may be wrong.
    805d4c3c 8ffc8eae 8ffc2b48 8ffc1020 8fb712d8 SYMEFA + 0x1c159
    805d4c7c 8ffce729 0fa15d6b 8-695906 8e808b50 SYMEFA + 0xfeae<-- only="" 3rd="" party="">
    805d4d10 90386ba6 8e808b50 8 d 847738 00000000 SYMEFA + 0 x 15729 on the stack
    805d4d44 8a6f6e22 00000000 00000000 8caa32d8 fltmgr! FltpProcessGenericWorkItem + 0 x 38
    805d4d7c 8a826fe2 8e808b50 d2f21bc9 00000000 nt! ExpWorkerThread + 0xfd
    805d4dc0 8a68fefe 8a6f6d25 00000000 00000000 nt! PspSystemThreadStartup + 0x9d
    00000000 00000000 00000000 00000000 00000000 nt! KiThreadStartup + 0x16

    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: SYMEFA + 1 c 159

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: SYMEFA

    NOM_IMAGE: SYMEFA. SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4bcf724c

    STACK_COMMAND: .cxr 0xffffffff805d4838; Ko

    FAILURE_BUCKET_ID: 0x7E_SYMEFA + 1 c 159

    BUCKET_ID: 0x7E_SYMEFA + 1 c 159

    Follow-up: MachineOwner
    ---------

    KD > lmvm SYMEFA
    start end module name
    8ffb9000 8ffe6000 SYMEFA T (no symbol)
    Loaded symbol image file: SYMEFA. SYS
    Image path: \SystemRoot\system32\drivers\NIS\1108000.005\SYMEFA. SYS
    Image name: SYMEFA. SYS
    Timestamp: Kills Apr 21 16:46:52 2010<-- driver="" is="" from="" 2010="" and="" should="" be="">
    CheckSum: 000371F6
    ImageSize: 0002D 000
    Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

    ===================================================

    ===================================================

    Let us know if you have any questions about it.

    Best regards

    Matthew_Ha

  • The analysis of the dump file support

    Hello

    I have blue screen problems. My laptop would crash and comes up with blue screen randomly somewhere in the few minutes to start and other times, a couple of hours. I made detailed hard disk check, verification of memory as well as re-installed windows just by formatting the hard drive. Always without success.

    What I did is now saved *.dmp file. I'm trying to analyze the same, but not really sure what the problem is. Can someone help and suggest the possible issue. I'm trying to cut and paste the file 'debug' below. I think that I made a correct debugging with my experience as a beginner. If anyone wants I can send *.dmp file also.

    Thanks in advance.

    Amit.

    0: kd > .sympath srv * c:\symbols* http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv * c:\symbols* http://msdl.microsoft.com/download/symbols
    Expanded the symbol search path is: srv * c:\symbols* http://msdl.microsoft.com/download/symbols

    Symbol of validation of the path summary *.
    Location of response time (ms)
    Deferred srv * c:\symbols* http://msdl.microsoft.com/download/symbols
    0: kd > .reload!; analyze - v; lmnt; r; kV. logclose; q
    Loading the kernel symbols
    ...............................................................
    ................................................................
    ..............................................
    Loading user symbols
    Loading unloaded module list
    ........
    WARNING: Unable to verify timestamp for iaStor.sys
    ERROR: Module load completed but symbols can be loaded for iaStor.sys

    Summary of the symbol load error *.
    Name of the module error
    iaStor no data are available: srv * c:\symbols* http://msdl.microsoft.com/download/symbols

    You can solve most symbol related issues by turning the symbol loading diagnostics (! sym noisy) and repeating the command that caused the symbols to load.
    You should also check that your symbol search path (.sympath) is correct.
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    It is a very common bugcheck.  Usually the PIN address of exception
    the driver/function that caused the problem.  Always note this address
    and the date of the picture link / driver that contains this address.
    Some common problems are the exception code 0 x 80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system has been started
    / /NODEBUG.  It is not supposed to happen as developers should never have
    breakpoints coded hard in retail code, but...
    In this case, make sure a debugger must be connected and the
    system startup/DEBUG.  This will we will see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, unhandled exception code
    Arg2: fffff8800109c6b0, the address that the exception occurred at
    Arg3: fffff8800399e868, address of Exception report
    Arg4: fffff8800399e0c0, address of the context record

    Debugging information:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    FAULTING_IP:
    iaStor + 496b 0
    fffff880'0109c6b0 488b4d40 mov rcx, qword ptr [rbp + h 40]

    EXCEPTION_RECORD: fffff8800399e868-(.exr 0xfffff8800399e868)
    . EXR 0xfffff8800399e868
    ExceptionAddress: fffff8800109c6b0 (iaStor + 0x00000000000496b0)
    ExceptionCode: c0000005 (access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter [0]: 0000000000000000
    Parameter [1]: 0000000000000040
    Attempt to read from address 0000000000000040

    BACKGROUND: fffff8800399e0c0--(.cxr 0xfffff8800399e0c0; r)
    . CXR 0xfffff8800399e0c0; r
    Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
    RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
    RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
    R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
    R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
    R14 = 0000000000000000 r15 = fffff88003304f40
    iopl = 0 nv up ei pl zr po nc
    CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
    iaStor + 0x496b0:
    fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
    Last set context:
    Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
    RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
    RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
    R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
    R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
    R14 = 0000000000000000 r15 = fffff88003304f40
    iopl = 0 nv up ei pl zr po nc
    CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
    iaStor + 0x496b0:
    fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
    . CXR
    Reset the default scope

    CUSTOMER_CRASH_COUNT: 1

    Nom_processus: System

    CURRENT_IRQL: 0

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 0000000000000000

    EXCEPTION_PARAMETER2: 0000000000000040

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebb100
    GetUlongFromAddress: cannot read fffff80002ebb1c0
    0000000000000040 non paged pool

    FOLLOWUP_IP:
    iaStor + 496b 0
    fffff880'0109c6b0 488b4d40 mov rcx, qword ptr [rbp + h 40]

    BUGCHECK_STR: 0X7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    ANALYSIS_VERSION: 6.3.9600.17336 (debuggers (dbg). 150226-1500) amd64fre

    LAST_CONTROL_TRANSFER: from fffffa8008631bc0 to fffff8800109c6b0

    STACK_TEXT:
    fffff880 '0399eaa0 fffffa80' 08631bc0: fffffa80 ' 0b9f8198 fffffa80 '0b9f8180 fffffa80' 07fa61c8 fffff880 ' 010d0bc8: iaStor + 0x496b0
    fffff880 '0399eaa8 fffffa80' 0b9f8198: fffffa80'0b9f8180 fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000' 00000000: 0xfffffa80'08631bc0
    fffff880 '0399eab0 fffffa80' 0b9f8180: fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000'00000000 00000000'00000000: 0xfffffa80'0b9f8198
    fffff880 '0399eab8 fffffa80' 07fa61c8: fffff880 '010d0bc8 00000000'00000000 00000000'00000000 fffff880' 0399eb50: 0xfffffa80'0b9f8180
    fffff880 '0399eac0 fffff880' 010d0bc8: 00000000'00000000 00000000'00000000 fffff880 '0399eb50 fffffa80' ffffbdfe: 0xfffffa80'07fa61c8
    fffff880 '0399eac8 00000000' 00000000: 00000000 00000000 "fffff880 '0399eb50 fffffa80' ffffbdfe 00000000'00000030: iaStor + 0x7dbc8

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: iaStor + 496b 0

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: iaStor

    Nom_image: iaStor.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4f29d59c

    STACK_COMMAND: .cxr 0xfffff8800399e0c0; Ko

    FAILURE_BUCKET_ID: X64_0x7E_iaStor + 496b 0

    BUCKET_ID: X64_0x7E_iaStor + 496b 0

    ANALYSIS_SOURCE: KM

    FAILURE_ID_HASH_STRING: km:x64_0x7e_iastor + 496 b 0

    FAILURE_ID_HASH: {638824e4-df44-4f6b-5214-69c6687e1463}

    Follow-up: MachineOwner
    ---------

    Rax = 00000000ffffbdfe rbx = fffffa8008c69728 rcx = 0000000000000000
    RDX = fffff8800399eac0 rsi = rdi = fffffa8008631bc0 fffffa800b9f8198
    RIP = fffff8800109c6b0 rsp = fffff8800399eaa0 rbp = 0000000000000000
    R8 = fffffa8008c681c8 r9 = 0000000000000040 r10 = 0000000000004212
    R11 = fffff8800399eaf8 r12 = fffffa8006fd20a0 r13 = fffff88001077d38
    R14 = 0000000000000000 r15 = fffff88003304f40
    iopl = 0 nv up ei pl zr po nc
    CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
    iaStor + 0x496b0:
    fffff880 '0109c6b0 488b4d40 mov rcx, qword ptr [rbp + 40 h] ss:0018:00000000' 00000040 =?
    Child-SP RetAddr: Args to child: call Site
    fffff880 '0399eaa0 fffffa80' 08631bc0: fffffa80 ' 0b9f8198 fffffa80 '0b9f8180 fffffa80' 07fa61c8 fffff880 ' 010d0bc8: iaStor + 0x496b0
    fffff880 '0399eaa8 fffffa80' 0b9f8198: fffffa80'0b9f8180 fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000' 00000000: 0xfffffa80'08631bc0
    fffff880 '0399eab0 fffffa80' 0b9f8180: fffffa80 '07fa61c8 fffff880' 010d0bc8 00000000'00000000 00000000'00000000: 0xfffffa80'0b9f8198
    fffff880 '0399eab8 fffffa80' 07fa61c8: fffff880 '010d0bc8 00000000'00000000 00000000'00000000 fffff880' 0399eb50: 0xfffffa80'0b9f8180
    fffff880 '0399eac0 fffff880' 010d0bc8: 00000000'00000000 00000000'00000000 fffff880 '0399eb50 fffffa80' ffffbdfe: 0xfffffa80'07fa61c8
    fffff880 '0399eac8 00000000' 00000000: 00000000 00000000 "fffff880 '0399eb50 fffffa80' ffffbdfe 00000000'00000030: iaStor + 0x7dbc8
    start end module name
    fffff800 '00b9c000 fffff800' 00ba6000 kdcom kdcom.dll Sam Feb 05 10:52:49 2011 (4D4D8061)
    fffff800 '02c0c000 fffff800' 031f5000 nt ntkrnlmp.exe Wed Jun 22 21:53:23 2011 (4E02AAA3)
    fffff800 '031f5000 fffff800' 0323e000 hal hal.dll Sat Nov 20 07:00:25 2010 (4CE7C669)
    "fffff880 ' 00 c 00000 fffff880 ' 00c5c000 volmgrx volmgrx.sys Sat Nov 20 03:20:43 2010 (4CE792EB)
    fffff880'00c5c000 fffff880'00 c 76000 mountmgr mountmgr.sys Sat Nov 20 03:19:21 2010 (4CE79299)
    "fffff880 ' 00 c 90000 fffff880 ' 00cdf000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 07:03:51 2010 (4CE7C737)
    fffff880 '00cdf000 fffff880' 00cf3000 PSHED PSHED.dll Fri Jul 13 20:32:23 2009 (4A5BE027)
    fffff880'00cf3000 fffff880'00 d 51000 CLFS CLFS. SYS MON Jul 13 18:19:57 2009 (4A5BC11D)
    fffff880 '00 d 51000 fffff880' 00 d 84000 pci pci.sys Sat Nov 20 03:19:11 2010 (4CE7928F)
    fffff880 '00 d 84000 fffff880' 00 d 99000 partmgr partmgr.sys Sat Nov 20 03:20 2010 (4CE792C0)
    "fffff880 ' 00 d 99000 fffff880 ' 00da5000 BATTC BATTC. SYS MON Jul 13 18:31:01 2009 (4A5BC3B5)
    fffff880 '00da5000 fffff880' 00dba000 volmgr volmgr.sys Sat Nov 20 03:19:28 2010 (4CE792A0)
    fffff880 '00e01000 fffff880' 00ec1000 CI CI.dll Sat Nov 20 07:12:36 2010 (4CE7C944)
    fffff880 '00ec1000 fffff880' 00f65000 Wdf01000 Wdf01000.sys MON Jul 13 18:22:07 2009 (4A5BC19F)
    fffff880 '00f65000 fffff880' 00f74000 WDFLDR WDFLDR. SYS MON Jul 13 18:19:54 2009 (4A5BC11A)
    fffff880 '00f74000 fffff880' 00fcb000 ACPI ACPI.sys Sat Nov 20 03:19:16 2010 (4CE79294)
    fffff880 '00fcb000 fffff880' 00fd4000 WMILIB WMILIB. SYS MON Jul 13 18:19:51 2009 (4A5BC117)
    fffff880 '00fd4000 fffff880' 00fde000 msisadrv msisadrv.sys MON Jul 13 18:19:26 2009 (4A5BC0FE)
    fffff880'00fde000 fffff880'00 Feb vdrvroot 000 vdrvroot.sys MON Jul 13 19:01:31 2009 (4A5BCADB)
    fffff880 Feb 00'000 fffff880'00ff4000 iusb3hcs iusb3hcs.sys Fri Jan 27 03:37:23 2012 (4F227053)
    fffff880 '00ff4000 fffff880' 00ffd000 compbatt compbatt.sys Fri Jul 13 18:31:02 2009 (4A5BC3B6)
    fffff880 ' 01000000 fffff880' b 0100 000 amdxata amdxata.sys Fri Mar 19 11:18:18 2010 (4BA3A3CA)
    fffff880 ' 01053000 fffff880' 013f7000 iaStor, iaStor.sys Wed Feb 01 18:15:24 2012 (4F29D59C)
    fffff880 '01400000 fffff880' 01472000 NMC cng.sys Wed Nov 16 22:23:17 2011 (4EC48C35)
    fffff880 ' 01472000 fffff880' 014cf000 iusb3hub iusb3hub.sys Fri Jan 27 03:35:25 2012 (4F226FDD)
    fffff880 '014ef000 fffff880' 0153b 000 fltmgr fltmgr.sys Sat Nov 20 03:19:24 2010 (4CE7929C)
    fffff880 '0153b 000 fffff880' 0154f000 fileinfo fileinfo.sys MON Jul 13 18:34:25 2009 (4A5BC481)
    fffff880 '0154f000 fffff880' 015ad000 msrpc msrpc.sys Sat Nov 20 03:21:56 2010 (4CE79334)
    fffff880 '01620000 fffff880' 017c 3000 Ntfs Ntfs.sys Thu Mar 10 21:39:39 2011 (4D79997B)
    "fffff880 ' 017 c 3000 fffff880 ' 017de000 ksecdd ksecdd.sys Wed Nov 16 21:48:13 2011 (4EC483FD)
    fffff880 '017de000 fffff880' 017ef000 pcw pcw.sys MON Jul 13 18:19:27 2009 (4A5BC0FF)
    fffff880 '017ef000 fffff880' 017f9000 Fs_Rec Fs_Rec.sys MON Jul 13 18:19:45 2009 (4A5BC111)
    fffff880 ' 01800000 fffff880' 01822000 tdx tdx.sys Sat Nov 20 03:21:54 2010 (4CE79332)
    fffff880 ' 01822000 fffff880' 01848000 tunnel tunnel.sys Sat Nov 20 04:51:50 2010 (4CE7A846)
    fffff880 ' 01875000 fffff880' 01968000 ndis ndis.sys Wed Dec 29 00:16:18 2010 (4D1AD232)
    fffff880 '01968000 fffff880' 019c NETIO NETIO 8000. SYS Sat Nov 20 03:23:13 2010 (4CE79381)
    "fffff880 ' 019 c 8000 fffff880 ' 019f3000 ksecpkg ksecpkg.sys Wed Nov 16 22:23:44 2011 (4EC48C50)
    fffff880 '01 a 00000 fffff880' 01a0d000 TDI TDI. SYS Sat Nov 20 03:22:06 2010 (4CE7933E)
    fffff880 '01a0d000 fffff880' 01a1e000 blbdrive blbdrive.sys Fri Jul 13 18:35:59 2009 (4A5BC4DF)
    fffff880'01 has 21000 fffff880'01 c 25000 tcpip tcpip.sys Wed Sep 28 22:43:04 2011 (4E83E948)
    "fffff880 ' 01 c 25000 fffff880 ' 01c6f000 c:\windows\system32\drivers\fwpkclnt fwpkclnt.sys Sat Nov 20 03:21:37 2010 (4CE79321)
    fffff880 '01c6f000 fffff880' 01b 77000 WD wd.sys MON Jul 13 18:19:55 2009 (4A5BC11B)
    "fffff880 ' 01 c 77000 fffff880 ' 01cc3000 volsnap volsnap.sys Thu Feb 24 21:38:18 2011 (4D67242A)
    fffff880 '01cc3000 fffff880' 01ccb000 spldr spldr.sys Mon May 11 11:56:27 2009 (4A0858BB)
    fffff880 '01ccb000 fffff880' 01 05000 rdyboost rdyboost.sys Sat Nov 20 03:43:10 2010 (4CE7982E)
    fffff880 '01 d 05000 fffff880' 01 17000 mup mup.sys MON Jul 13 18:23:45 2009 (4A5BC201)
    fffff880 '01 d 17000 fffff880' 01 20000 hwpolicy hwpolicy.sys Sat Nov 20 03:18:54 2010 (4CE7927E)
    "fffff880 ' 01 d 20000 fffff880 ' 01d2a000 hpdskflt hpdskflt.sys Wed Feb 22 10:30:18 2012 (4F45181A)
    fffff880 '01d2a000 fffff880' 01 64000 fvevol fvevol.sys Sat Nov 20 03:24:06 2010 (4CE793B6)
    "fffff880 ' 01 d 64000 fffff880 ' 01d7a000 disk disk.sys MON Jul 13 18:19:57 2009 (4A5BC11D)
    fffff880 '01d7a000 fffff880' 01daa000 CLASSPNP CLASSPNP. SYS Sat Nov 20 03:19:23 2010 (4CE7929B)
    fffff880 '01db8000 fffff880' 01dc8000 dog of guard watchdog.sys MON Jul 13 18:37:35 2009 (4A5BC53F)
    fffff880 '01dc8000 fffff880' 01dd1000 RDPCDD system32\drivers\rdpcdd.sys MON Jul 13 19:16:34 2009 (4A5BCE62)
    fffff880 '01dd1000 fffff880' 01dda000 rdpencdd rdpencdd.sys Fri Jul 13 19:16:34 2009 (4A5BCE62)
    fffff880 '01dda000 fffff880' 01de3000 rdprefmp rdprefmp.sys Fri Jul 13 19:16:35 2009 (4A5BCE63)
    fffff880 '01de3000 fffff880' 01dee000 Msfs Msfs.SYS MON Jul 13 18:19:47 2009 (4A5BC113)
    fffff880 '01dee000 fffff880' 01dff000 Npfs.SYS NPH MON Jul 13 18:19:48 2009 (4A5BC114)
    fffff880'0281 b 000 fffff880'02933000 btwampfl btwampfl.sys Thu Jan 05 17:14:07 2012 (4F062EBF)
    fffff880 ' 02933000 fffff880' 0293 b 080 HIDPARSE HIDPARSE. SYS MON Jul 13 19:06:17 2009 (4A5BCBF9)
    fffff880 ' 0293 c 000 fffff880' 02954000 BTHUSB BTHUSB.sys Wed Apr 27 22:54:56 2011 (4DB8E510)
    fffff880 ' 02954000 fffff880' 029e0000 bthport BTHUSB Device bthport.sys Wed Apr 27 22:55:07 2011 (4DB8E51B)
    fffff880 '029e0000 fffff880' 029ee000 monitor monitor.sys MON Jul 13 18:38:52 2009 (4A5BC58C)
    fffff880 '029ee000 fffff880' 029fe000 BthEnum BthEnum.sys Fri Jul 13 19:06:52 2009 (4A5BCC1C)
    fffff880 '02-00000 fffff880' 02 has 53000 nwifi nwifi.sys Fri Jul 13 19:07:23 2009 (4A5BCC3B)
    fffff880 '02-53000 fffff880' 02a 66000 o ndisuio ndisuio.sys Sat Nov 20 04:50:08 2010 (4CE7A7E0)
    fffff880 '02-66000 fffff880' 02a7e000 rspndr rspndr.sys Fri Jul 13 19:08:50 2009 (4A5BCC92)
    fffff880 '02a8b000 fffff880' 02af3000 btwavdt btwavdt.sys Wed Dec 14 15:30:32 2011 (4EE91578)
    fffff880 '02af3000 fffff880' 02b4f000 btwaudio btwaudio.sys Thu Jan 05 18:43:37 2012 (4F0643B9)
    fffff880 '02b4f000 fffff880' 02b5d000 btwl2cap btwl2cap.sys Saturday August 27 at 17:58:52 2011 (4E5976AC)
    fffff880 '02b5d000 fffff880' 02b 79000 btwdpan btwdpan.sys Fri Sep 16 18:01:54 2011 (4E73D562)
    fffff880 '02b 79000 fffff880' 02b7ca00 btwrchid btwrchid.sys Wed Dec 14 15:31:21 2011 (4EE915A9)
    fffff880 '02b7d000 fffff880' 02b 96000 HIDCLASS HIDCLASS. SYS sat 20 Nov 04:43:49 2010 (4CE7A665)
    fffff880 '02b 96000 fffff880' 02bb9000 luafv luafv.sys Fri Jul 13 18:26:13 2009 (4A5BC295)
    fffff880 '02bb9000 fffff880' 02bce000 lltdio lltdio.sys Fri Jul 13 19:08:50 2009 (4A5BCC92)
    fffff880 ' 03000000 fffff880' 0300f000 netbios netbios.sys MON Jul 13 19:09:26 2009 (4A5BCCB6)
    fffff880 '0300f000 fffff880' 0302a 000 wanarp wanarp.sys Sat Nov 20 04:52:36 2010 (4CE7A874)
    fffff880 '0302-000 fffff880' 0303e000 termdd termdd.sys Sat Nov 20 05:03:40 2010 (4CE7AB0C)
    fffff880 '0303e000 fffff880' 0308f000 rdbss rdbss.sys Sat Nov 20 03:27:51 2010 (4CE79497)
    fffff880 '0308f000 fffff880' 0309b 000 nsiproxy nsiproxy.sys Fri Jul 13 18:21:02 2009 (4A5BC15E)
    fffff880 '0309b 000 fffff880' 030a 6000 mssmbios mssmbios.sys Fri Jul 13 10:31:18 2009 (4A5BC3BE)
    fffff880 '030-6000 fffff880' 030b 5000 discache discache.sys Fri Jul 13 18:37:18 2009 (4A5BC52E)
    fffff880'030 b 5000 fffff880'030 d 3000 dfsc dfsc.sys Sat Nov 20 03:26:31 2010 (4CE79447)
    fffff880'030e0000 fffff880'03169000 afd afd.sys Sun Apr 24 21:33:58 2011 (4DB4DD96)
    fffff880 ' 03169000 fffff880' 031ae000 netbt netbt.sys Sat Nov 20 03:23:18 2010 (4CE79386)
    fffff880 '031ae000 fffff880' 031b 7000 wfplwf wfplwf.sys Fri Jul 13 19:09:26 2009 (4A5BCCB6)
    fffff880 '031b 7000 fffff880' 031dd000 pacer pacer.sys Sat Nov 20 04:52:18 2010 (4CE7A862)
    fffff880 '031dd000 fffff880' 031f3000 vwififlt vwififlt.sys Fri Jul 13 19:07:22 2009 (4A5BCC3A)
    fffff880 '03e00000 fffff880' 03e24000 HDAudBus HDAudBus.sys Sat Nov 20 04:43:42 2010 (4CE7A65E)
    fffff880 '03e24000 fffff880' 03e70000 RtsBaStor RtsBaStor.sys Fri Dec 28 00:58:29 2011 (4EFABE15)
    fffff880 '03e70000 fffff880' 03e9c000 rfcomm rfcomm.sys MON Jul 13 19:06:56 2009 (4A5BCC20)
    fffff880 '03ebb000 fffff880' 03f7f000 iusb3xhc iusb3xhc.sys Fri Jan 27 03:35:28 2012 (4F226FE0)
    fffff880 '03f7f000 fffff880' 03f80f00 USBD USBD. SYS sat Nov 04 22:43:53 2011 (4EB4B0F9)
    fffff880 '03f81000 fffff880' 03f92000 HECIx64 HECIx64.sys Wed Nov 09 18:52:25 2011 (4EBB2049)
    fffff880 '03f92000 fffff880' 03fa3000 usbehci usbehci.sys Fri Nov 04 22:43:56 2011 (4EB4B0FC)
    fffff880 '03fa3000 fffff880' 03ff9000 USBPORT USBPORT. SYS sat Nov 04 22:44:03 2011 (4EB4B103)
    fffff880 ' 04400000 fffff880' 04409000 Null Null.SYS MON Jul 13 18:19:37 2009 (4A5BC109)
    fffff880 ' 04409000 fffff880' 04410000 a Bleep c:\windows\system32\drivers\beep.sys MON Jul 13 19:00:13 2009 (4A5BCA8D)
    fffff880 ' 04410000 fffff880' 0441e000 vga vga.sys MON Jul 13 18:38:47 2009 (4A5BC587)
    fffff880'0441e000 fffff880'047 c 2000 dump_iaStor dump_iaStor.sys Wed Feb 01 18:15:24 2012 (4F29D59C)
    "fffff880 ' 047 d 6000 fffff880 ' 047fb000 VIDEOPRT VIDEOPRT. SYS MON Jul 13 18:38:51 2009 (4A5BC58B)
    fffff880 ' 04800000 fffff880' 0481 b 000 raspppoe raspppoe.sys MON Jul 13 19:10:17 2009 (4A5BCCE9)
    fffff880'0481 b 000 fffff880'0483 c 000 raspptp raspptp.sys Sat Nov 20 04:52:31 2010 (4CE7A86F)
    fffff880 ' 0483 c 000 fffff880' 04856000 rassstp rassstp.sys Fri Jul 13 19:10:25 2009 (4A5BCCF1)
    fffff880 ' 04856000 fffff880' 04868000 umbus umbus.sys Sat Nov 20 04:44:37 2010 (4CE7A695)
    fffff880 '04868000 fffff880' 048c 2000 usbhub usbhub.sys Fri Nov 04 22:44:27 2011 (4EB4B11B)
    fffff880 '048 c 2000 fffff880' 048d 7000 NDProxy NDProxy.SYS Sat Nov 20 04:52:20 2010 (4CE7A864)
    fffff880'048f8000 fffff880'04998000 Rt64win7 Rt64win7.sys kills Sep 27 09:50:33 2011 (4E81E2B9)
    fffff880 ' 04998000 fffff880' 049bc000 rasl2tp rasl2tp.sys Sat Nov 20 04:52:34 2010 (4CE7A872)
    fffff880'049bc000 fffff880'049 c 8000 ndistapi ndistapi.sys MON Jul 13 19:10 2009 (4A5BCCD8)
    "fffff880 ' 049 c 8000 fffff880 ' 049f7000 ndiswan ndiswan.sys Sat Nov 20 04:52:32 2010 (4CE7A870)
    fffff880 '04-00000 fffff880' 04 has 24000 mrxsmb20 mrxsmb20.sys kills Apr 26 21:39:37 2011 (4DB781E9)
    fffff880 '04-76000 fffff880' 04b3f000 HTTP HTTP.sys Sat Nov 20 03:24:30 2010 (4CE793CE)
    fffff880 '04b3f000 fffff880' 04b5d000 bowser bowser.sys kills Feb 22 22:55:04 (4 649328) 2011
    fffff880 '04b5d000 fffff880' 04b 75000 mpsdrv mpsdrv.sys Fri Jul 13 19:08:25 2009 (4A5BCC79)
    fffff880 '04b 75000 fffff880' 04ba2000 mrxsmb mrxsmb.sys kills Apr 26 21:40:38 2011 (4DB78226)
    fffff880 '04ba2000 fffff880' 04bf0000 mrxsmb10 mrxsmb10.sys Fri Jul 08 21:46:28 2011 (4E17C104)
    "fffff880 ' 04 c 00000 fffff880 ' 04c6e000 SynTP SynTP.sys Thu Mar 01 18:33:26 2012 (4F501556)
    fffff880 '04c6e000 fffff880' 04c7d000 mouclass mouclass.sys MON Jul 13 18:19:50 2009 (4A5BC116)
    fffff880 '04c7d000 fffff880' 04c 81500 CmBatt CmBatt.sys Fri Jul 13 18:31:03 2009 (4A5BC3B7)
    "fffff880 ' 04 c 82000 fffff880 ' 04c8d000 Smb_driver Smb_driver.sys Sat Mar 01 18:34:33 2012 (4F501599)
    fffff880 '04c8d000 fffff880' 04c9a000 accelerometer Accelerometer.sys Wed Feb 22 10:30:18 2012 (4F45181A)
    fffff880 '04c9a000 fffff880' 04ca 3000 wmiacpi wmiacpi.sys Fri Jul 13 18:31:02 2009 (4A5BC3B6)
    fffff880 '04ca 3000 fffff880' 04cb9000 driver intelppm.sys MON Jul 13 18:19:25 2009 (4A5BC0FD)
    fffff880 '04cb9000 fffff880' 04cc4000 irstrtdv irstrtdv.sys Wed Jun 15 13:52:49 2011 (4DF8FF81)
    fffff880'04cc4000 fffff880'04 cd 4000 CompositeBus CompositeBus.sys Sat Nov 20 04:33:17 2010 (4CE7A3ED)
    fffff880 ' 04 cd 4000 fffff880' 04cd9f80 clwvd clwvd.sys kills Jul 27 20:13:47 2010 (4C4F844B)
    fffff880 '04cda000 fffff880' 04cdf200 ksthunk ksthunk.sys Fri Jul 13 19:00:19 2009 (4A5BCA93)
    fffff880 '04ce0000 fffff880' 04cf6000 AgileVpn AgileVpn.sys Fri Jul 13 19:10:24 2009 (4A5BCCF0)
    fffff880 '04cf6000 fffff880' 04cf7480 swenum swenum.sys MON Jul 13 19:00:18 2009 (4A5BCA92)
    fffff880'04cf9000 fffff880'05183000 bcmwl664 bcmwl664.sys Wed Sep 26 21:45:09 2011 (4EA8C5B5)
    fffff880 ' 05183000 fffff880' 05190000 vwifibus vwifibus.sys Fri Jul 13 19:07:21 2009 (4A5BCC39)
    fffff880 ' 05190000 fffff880' 051ae000 i8042prt i8042prt.sys MON Jul 13 18:19:57 2009 (4A5BC11D)
    fffff880 '051ae000 fffff880' 051bd000 kbdclass kbdclass.sys MON Jul 13 18:19:50 2009 (4A5BC116)
    fffff880'051bd000 fffff880'05200000 ks ks.sys Sat Nov 20 04:33:23 2010 (4CE7A3F3)
    fffff880 ' 05600000 fffff880' 05656000 IntcDAud IntcDAud.sys kills Dec 06 05:23:07 2011 (4EDDFB1B)
    fffff880 ' 05656000 fffff880' 05662000 Dxapi Dxapi.sys Fri Jul 13 18:38:28 2009 (4A5BC574)
    fffff880 ' 05662000 fffff880' 05670000 crashdmp crashdmp.sys Fri Jul 13 19:01:01 2009 (4A5BCABD)
    fffff880 ' 05670000 fffff880' 05683000 dump_dumpfve dump_dumpfve.sys Fri Jul 13 18:21:51 2009 (4A5BC18F)
    fffff880 ' 05683000 fffff880' 056 a 0000 usbccgp usbccgp.sys Fri Nov 04 22:44:06 2011 (4EB4B106)
    fffff880'056 has 0000 fffff880'056 cd 280 usbvideo usbvideo.sys Sat Nov 20 04:44:34 2010 (4CE7A692)
    fffff880 '056e6000 fffff880' 0576e000 stwrt64 stwrt64.sys Mon Feb 13 22:26:45 2012 (4F39E285)
    fffff880 '0576e000 fffff880' 057ab000 portcls portcls.sys MON Jul 13 19:06:27 2009 (4A5BCC03)
    fffff880'057ab000 fffff880'057 cd 000 drmk drmk.sys MON Jul 13 20:01:25 2009 (4A5BD8E5)
    fffff880 ' 057 cd 000 fffff880' 057f9000 bcbtums bcbtums.sys Thu Jan 26 12:49:03 2012 (4F21A01F)
    fffff880 '05e67000 fffff880' 05f0d000 peauth peauth.sys Fri Jul 13 20:01:19 2009 (4A5BD8DF)
    fffff880 '05f0d000 fffff880' 05f18000 secdrv secdrv. SYS kills Sep 13 08:18:38 2006 (4508052E)
    fffff880 '05f18000 fffff880' 05f49000 srvnet c:\windows\system32\drivers\srvnet.sys Thu Apr 28 22:05:35 2011 (4DBA2AFF)
    fffff880 '05f49000 fffff880' 05f5b000 tcpipreg c:\windows\system32\drivers\tcpipreg.sys Sat Nov 20 04:51:48 2010 (4CE7A844)
    fffff880'05f5b000 fffff880'05 fc 4000 srv2 srv2.sys Thu Apr 28 22:05:46 2011 (4DBA2B0A)
    fffff880 ' 06069000 fffff880' 06101000 srv srv.sys Thu Apr 28 22:06:06 2011 (4DBA2B1E)
    fffff880 ' 06101000 fffff880' 06122000 WudfPf WudfPf.sys Sat Nov 20 04:42:44 2010 (4CE7A624)
    fffff880 ' 06122000 fffff880' 06193000 SYMDS64 SYMDS64. SYS Mon May 16 17:15:03 2011 (4DD1A1E7)
    fffff880 '06193000 fffff880' 061c 1000 ccSetx64 ccSetx64.sys Fri Nov 04 17:05:25 2011 (4EB461A5)
    fffff880 ' 07895000 fffff880' 079 a 6000 SYMEFA64 SYMEFA64. SYS Tue 22 Nov 18:49:28 2011 (4ECC4318)
    fffff880 ' 08400000 fffff880' 08431000 Ironx64 Ironx64.SYS Mon Nov 14 20:00:53 2011 (4EC1C7D5)
    fffff880 ' 08431000 fffff880' 084e8000 Sftfslh Sftfslh.sys Wed Dec 02 18:55:48 2009 (4B170C94)
    fffff880'0853f000 fffff880'08577000 SYMEVENT64x86 SYMEVENT64x86.SYS kills Nov 22 12:30:48 2011 (4ECBEA58)
    fffff880 ' 08577000 fffff880' 0858 c 000 SRTSPX64 SRTSPX64. SYS Tue Nov 22 17:52:20 2011 (4ECC35B4)
    "fffff880 ' 0858 c 000 fffff880 ' 085f8000 SYMNETS SYMNETS. SYS sat 12 Nov 15:11:53 2011 (4EBEE119)
    fffff880 ' 08689000 fffff880' 087 a 8000 BHDrvx64 BHDrvx64.sys Wed Nov 23 13:32:10 2011 (4ECD4A3A)
    fffff880 '087-8000 fffff880' 087f5000 Sftplaylh Sftplaylh.sys Wed Dec 02 18:55:40 2009 (4B170C8C)
    fffff880 '08-00000 fffff880' 08a7d000 IDSVia64 IDSVia64.sys kills Nov 22 14:23:23 2011 (4ECC04BB)
    fffff880 '08ac9000 fffff880' 08ad4000 Sftvollh Sftvollh.sys Wed Dec 02 18:55:23 2009 (4B170C7B)
    fffff880 '08ad4000 fffff880' 08adf000 Sftredirlh Sftredirlh.sys Wed Dec 02 18:55:52 2009 (4B170C98)
    fffff880 '08af3000 fffff880' 08bb2000 SRTSP64 SRTSP64. SYS Tue Nov 22 17:52:13 2011 (4ECC35AD)
    fffff880 '08bb2000 fffff880' 08bd2000 ENG64 ENG64. SYS Fri Jul 29 08:17:51 2011 (4E32B2FF)
    "fffff880 ' 08 c 04000 fffff880 ' 08dfc000 EX64 EX64. SYS Fri Jul 29 08:15:11 2011 (4E32B25F)
    fffff880 '0f452000 fffff880' 10254f80 igdkmd64 igdkmd64.sys kills Feb 14 12:47:30 2012 (4F3AAC42)
    fffff880 ' 10255000 fffff880' 1028 b 000 fastfat fastfat. SYS MON Jul 13 18:23:28 2009 (4A5BC1F0)
    fffff880'1028 b 000 fffff880'10380000 dxgkrnl dxgkrnl.sys Mon Aug 22 21:54:11 2011 (4E531653)
    fffff880 '10380000 fffff880' 103c 6000 dxgmms1 dxgmms1.sys Mon Aug 22 21:53:14 2011 (4E53161A)
    fffff960 '000e0000 fffff960' 003f4000 win32k win32k.sys unavailable (00000000)
    fffff960 ' 00470000 fffff960' a 0047, 000 TSDDD TSDDD.dll unavailable (00000000)
    fffff960 ' 00700000 fffff960' 00727000 cdd c:\windows\system32\cdd.dll unavailable (00000000)

    Unloaded modules:
    fffff880 '08-98000 fffff880' 08ac9000 WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 00031000
    fffff880 '08a7d000 fffff880' 08a 98000 USBSTOR. SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 0001 B 000
    fffff880 ' 07824000 fffff880' 07895000 spsys.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 00071000
    "fffff880 ' 084 c 2000 fffff880 ' 0853f000 IDSVia64.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 0007D 000
    fffff880 '01daa000 fffff880' 01db8000 crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 0000E000
    fffff880'0441f000 fffff880'047 c 3000 dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 003A 4000
    fffff880 '047 c 3000 fffff880' 047d 6000 dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 00013000
    fffff880 ' 047 d 6000 fffff880' 04800000 cdrom.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    ImageSize: 0002A, 000

    Hi Vijya Kumari / Gary / other.

    UPDATE

    I gave up watching the issue myself. I ended up taking the computer to the tech shop where the person changed the hard drive. Its been a few days now and it seems to work very well so the problem was the hard drive in this case!

    Anyone reading the post... FYI, I did through hard drive check 3 times (it took 2-3 hours each time) and my hard drive had the control each time. I asked the tech shop person and he mentioned that it is sometimes possible that the hard drive would be to control but is faulty. It is a little advice for those who are the rescue disk problem devices in my case being given the hard drive passed the test I have excluded hard and ended up paying $ 100 hard disk $ 40: (.)

    Thank you

    Amit

  • BSOD after monitors

    Hello

    I just start getting some BSOD. Sometimes after that I have spend monitors using the Windows + P shortcut. I start here her connect / disconnect sound over and over, then the BSOD.

    I have an ASUS HD 7970 graphics card

    I use the Windows + shortcut P to switch from a connected DisplayPort Samsung 27 "monitor LED series 8 SyncMaster [S27A850T]

    a connected HDMI Samsung Plasma TV.

    What would someone mind checking the Minidump files to help me work out what is the cause.

    I tried to restore my PC Windows 7 64 bit to a point before the BSOD occurred.

    I have the latest graphics card driver.

    There is an update of the firmware available for your Samsung monitor - did you apply it?  Here is the link: http://www.samsung.com/au/support/newsalert/view?spp_news_seq=36090

    You have a connected Applian/Appliand device.  I asked questions with this device back with another poster several months ago and never received a feedback (so I don't know if there is a problem with the drivers of this company).  I suggest you uninstall it until the system is stable again.

    There are a few known issues with SSD and old storage controller drivers.  Please ensure that your Kingston SSD has the latest firmware installed - and the storage controllers of your motherboard with the latest drivers available from the manufacturer of storage controller.  The Intel controller drivers so your Marvell date from 2011. Please don't forget to use connections to the Intel controller, once the drivers are updated (update the Marvell even if you don't use it).

    As a side note, the GEARAspiWDM.sys has been updated.  I was under the impression that there were not updated available for this purpose (it is usually a part of iTunes).  Have you updated your iTunes between the 2 BSOD?

    Video drivers and pilots antivirus date 2011 - these two must be updated to the latest version available (video drivers from ATI and the site of AVG antivirus site

    I've never used OEM drivers for one of my monitors in the past - but I wonder if this can help your situation.  Unfortunately I'm unable to locate the drivers for the monitor on the Samsung website.  I suggest that you contact their technical support for information about drivers (they can be integrated into Windows).

    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    BSOD BUGCHECK SUMMARY
    The debugging session: Sat Sep 15 2012 05:16:48.258 (UTC - 04:00)
    Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\091512-39187-01.dmp]
    By: 7601.17835.amd64fre.win7sp1_gdr.120503 - 2030
    System Uptime: 0 days 4:08:40.195
    WARNING: Unable to verify timestamp for atikmdag.sys
    ERROR: Module load completed but symbols can be loaded for atikmdag.sys
    Bugcheck 1000007E, {ffffffffc0000005, fffff8800784eebf, fffff8800e3beb88, fffff8800e3be3e0}
    Probably caused by: atikmdag.sys (atikmdag + 1e3ebf)
    Bugcheck 1000007E code
    Arguments ffffffff 'c0000005 fffff880' 0784eebf fffff880 '0e3beb88 fffff880' 0e3be3e0
    Nom_processus: csrss.exe
    BUGCHECK_STR: 0X7E
    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
    FAILURE_BUCKET_ID: X64_0x7E_atikmdag + 1e3ebf
    MaxSpeed: 3330
    CurrentSpeed: 3340
    BiosVersion = 0803
    BiosReleaseDate = 06/08/2012
    SystemManufacturer = system manufacturer
    SystemProductName = system product name
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    The debugging session: Fri Sep 14 06:31:34.007 2012 (UTC - 04:00)
    Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\091412-39125-01.dmp]
    By: 7601.17835.amd64fre.win7sp1_gdr.120503 - 2030
    System Uptime: 0 days 11:58:26.944
    WARNING: Unable to verify timestamp for atikmdag.sys
    ERROR: Module load completed but symbols can be loaded for atikmdag.sys
    Bugcheck 1000007E, {ffffffffc0000005, fffff88007882ebf, fffff8800c819b88, fffff8800c8193e0}
    Probably caused by: atikmdag.sys (atikmdag + 1e3ebf)
    Bugcheck 1000007E code
    Arguments ffffffff 'c0000005 fffff880' 07882ebf fffff880 '0c819b88 fffff880' 0c8193e0
    Nom_processus: csrss.exe
    BUGCHECK_STR: 0X7E
    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
    FAILURE_BUCKET_ID: X64_0x7E_atikmdag + 1e3ebf
    MaxSpeed: 3330
    CurrentSpeed: 3340
    BiosVersion = 0803
    BiosReleaseDate = 06/08/2012
    SystemManufacturer = system manufacturer
    SystemProductName = system product name
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

  • BSOD after Logo Windows at startup: bad driver, AutoFailover

    I get BSOD after Windows Logo at startup. Said Startup Repair: bad driver, AutoFailover.

    Two weeks ago, that I was getting the same BSOD after logo, but only with the bad driver. I not did something to fix it (or Startup Repair), it's just dissapeard after a few days. Also, the last day that I was getting BSOD, the night when I started my pc, it remained 2 minutes at Intel Boot Agent initialization and also 30 seconds to the black screen that follows (before the windows logo). When this situation occurs I get more BSOD. I tried to restart my pc but I stayed another 2 minutes to the Intel Boot Agent initialization. This problem has been fixed in the next morning, when I started my PC, even once, I don't know how, I did nothing. I remember that it is sometimes used to stay 2 minutes Intel Boot Agent, even when I was on Windows Vista, and it also sets automatically.
    I upgraded my BIOS a few weeks before getting the BSOD, but I don't think that's the problem. In addition, there was no new driver installed before getting the BSOD, drivers have been installed after the first BSOD (even if the event viewer and the reliability monitor do not mention the first BSOD, only those who have followed the installation of the driver I know there's a BSOD before, I'm sure.)
    My system: HP Compaq 8510w (Original with windows vista bussines, did a clean install of 7 ultimate)
    BIOS version: F.20

    C: drive has only 10% free space - 15% free space is optimal for Windows

    Please visit the site Web of the manufacturer of the PC and download/install all drivers.  These are devices that lack the drivers:
    *******
    Controller of communication Simple PCI PCI VEN_8086 & DEV_2A04 & SUBSYS_30C5103C & REV_0C\3 & 21436425 & 0 & 18 that the drivers for this device are not installed.

    Serial port PCI PCI VEN_8086 & DEV_2A07 & SUBSYS_30C5103C & REV_0C\3 & 21436425 & 0 & 1 b, that the drivers for this device are not installed.
    No available ACPI\HPQ0006\2 & DABA3FF & 2, the drivers for this device are not installed.

    Base system device PCI VEN_1180 & DEV_0843 & SUBSYS_30C5103C & REV_10\4 & 118B1C9 & 0 & 34F0 the drivers for this device are not installed.

    Fingerprint Sensor USB\VID_08FF & PID_2580\5 & 1E4845E3 & 0 & 2, that the drivers for this device are not installed.

    RICOH PCMCIA\RICOH-BAY8CONTROLLER-F1B2\1 Bay8Controller the drivers for this device are not installed.
    ******
    Please uninstall ATI Tool - it does not work in Win7 and may be responsible for your BSOD (and its drivers are from 2006).  More info here: http://www.carrona.org/drivers/driver.php?id=ATITool.sys

    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    BSOD BUGCHECK SUMMARY
    The debugging session: 05:54:32.426 Fri 31 August 2012 (UTC - 04:00)
    Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\083112-17019-01.dmp]
    By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
    System Uptime: 0 days 0:00:08.455
    Bugcheck A, {7bcc, 2, 0, 82afb482}
    ERROR: Module load completed but symbols can be loaded for mssmbios.sys
    Probably caused by: ntkrpamp.exe (nt! DeleteNodeFromTree + 46)
    Error checking code 0000000-a
    Arguments 00007bcc ', memory IRQL bitfie 82afb482 00000000' 00000002',' address
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    BUGCHECK_STR: 0XA
    Nom_processus: System
    FAILURE_BUCKET_ID: 0xA_nt! DeleteNodeFromTree + 46
    MaxSpeed: 2200
    CurrentSpeed: 2194
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    The debugging session: 04:17:05.296 Thu August 23, 2012 (UTC - 04:00)
    Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\082312-17004-01.dmp]
    By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
    System Uptime: 0 days 0:00:11.356
    CD error checking, {8931d 000, 0, 82a271f2, 0}
    ERROR: Module load completed but symbols can be loaded for mssmbios.sys
    WARNING: Unable to verify timestamp for ATITool.sys
    ERROR: Module load completed but symbols can be loaded for ATITool.sys
    Probably caused by: ATITool.sys (ATITool + 2017)
    000000cD Bugcheck code
    Arguments 8931d 000', memory 00000000' 82a271f2 value ', if not 00000000', int Mm
    DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
    BUGCHECK_STR: 0XCD
    Nom_processus: System
    FAILURE_BUCKET_ID: 0xCD_VRF_ATITool + 2017
    MaxSpeed: 2200
    CurrentSpeed: 2194
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    The debugging session: 04:00:26.646 Thu August 23, 2012 (UTC - 04:00)
    Loading dump file [C:\Users\John\_jcgriff2_\dbug\__Kernel__\082312-21933-01.dmp]
    By: 7601.17803.x86fre.win7sp1_gdr.120330 - 1504
    System Uptime: 0 days 0:00:07.675
    Bugcheck 1000007E, {c0000005, 82c2e4a4, 80786888, 80786460}
    ERROR: Module load completed but symbols can be loaded for mssmbios.sys
    Probably caused by: ntkrpamp.exe (nt! ObpLookupDirectoryEntry + 2 b)
    Bugcheck 1000007E code
    Arguments c0000005", ex-82c2e4a4 ', the 80786888 ad', except 80786460', Contex
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    Nom_processus: System
    BUGCHECK_STR: 0X7E
    FAILURE_BUCKET_ID: 0x7E_nt! ObpLookupDirectoryEntry + 2 b
    MaxSpeed: 2200
    CurrentSpeed: 2194
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

  • Ive had problems of BSOD with this as my Dump Win 7 x 64

    Looks like it might be the system. is there a fix or should I reinstall?

    Microsoft (R) Windows debug 6.2.8400.0 AMD64 Version
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading dump file [C:\Users\Crux\Desktop\MEMORY. DMP]
    The core dump file summary: the single kernel address space is available

    Symbol search path is: D:\Symbols
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (12 procs) free x 64
    Product: WinNt, suite: TerminalServer SingleUserTS
    By: 7600.16385.amd64fre.win7_rtm.090713 - 1255
    Computer name:
    Kernel base = 0xfffff800 '03068000 PsLoadedModuleList = 0xfffff800' 032a5e50
    The debugging session: 16:15:23.014 Sam August 11, 2012 (UTC - 05:00)
    System Uptime: 0 days 0:00:12.370
    Loading the kernel symbols
    ...............................................................
    ..............................
    Loading user symbols

    Loading unloaded module list
    .
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    Use! analyze - v to obtain detailed debugging information.

    The 7th, {ffffffffc0000005, fffff88006e9a75d, fffff88006538c68, fffff880065384c0}

    Probably caused by: NETIO. SYS (NETIO! NmrClientAttachProvider + 65)

    Follow-up: MachineOwner
    ---------

    4: kd >! analyze - v
    *******************************************************************************
    *                                                                             *
    * Bugcheck analysis *.
    *                                                                             *
    *******************************************************************************

    (7th) SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
    It is a very common bugcheck.  Usually the PIN address of exception
    the driver/function that caused the problem.  Always note this address
    and the date of the picture link / driver that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, unhandled exception code
    Arg2: fffff88006e9a75d, the address that the exception occurred at
    Arg3: fffff88006538c68, address of Exception report
    Arg4: fffff880065384c0, address of the context record

    Debugging information:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    FAULTING_IP:
    AFD! WskTdiInit + dd
    fffff880'06e9a75d 48c7442020c8000000 mov qword ptr [rax + 20 h], 0C8h

    EXCEPTION_RECORD: fffff88006538c68-(.exr 0xfffff88006538c68)
    ExceptionAddress: fffff88006e9a75d (afd! WskTdiInit + 0x00000000000000dd)
    ExceptionCode: c0000005 (access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter [0]: 0000000000000001
    Parameter [1]: 0000000000000020
    Try to write at the address 0000000000000020

    CONTEXT: fffff880065384c0-(.cxr 0xfffff880065384c0)
    Rax = 0000000000000000 rbx = 0000000000000000 rcx = fffff88006e7d580
    RDX = 0000000000000000 rsi = 0000000000000000 rdi = fffff88007b2b320
    RIP = fffff88006e9a75d rsp = fffff88006538ea0 rbp = fffff88007b2b348
    R8 = 0000000000000000 r9 = 0000000000000000 r10 = fffff80003267888
    R11 = 0000000000000000 r12 = fffffa800c5fa98e r13 = ffffffff800001dc
    R14 = fffffa800c5c6560 r15 = 000000000000001c
    iopl = 0 nv up ei pl zr po nc
    CS = 0010 ss = 0018 ds = 002 b're = 002 b fs = 0053 gs = 002 b efl = 00010246
    AFD! WskTdiInit + 0xdd:
    fffff880'06e9a75d 48c7442020c8000000 mov qword ptr [rax + 20 h], 0C8h, ds:002 b: 00000000'00000020 =?
    Reset the default scope

    Nom_processus: System

    CURRENT_IRQL: 0

    Error_code: (NTSTATUS) 0xc0000005 - the instruction at 0 x % lx 08 referenced memory at 0 x % 08 lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 0000000000000001

    EXCEPTION_PARAMETER2: 0000000000000020

    WRITE_ADDRESS: 0000000000000020

    FOLLOWUP_IP:
    NETIO! NmrClientAttachProvider + 65
    fffff880'04427ea5 85 c 0 test eax, eax

    BUGCHECK_STR: 0X7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LOCK_ADDRESS: fffff800032dc400-(! fffff800032dc400 of locks)

    Resource @ nt! PiEngineLock (0xfffff800032dc400) the exclusive property
    Argument Count = 1
    NumberOfExclusiveWaiters = 1
    Discussions: fffffa8006a2f680-01<*>
    Threads waiting on exclusive access:
    fffffa8006a2e040

    1 total locks, 1 locks currently held

    PNP_TRIAGE:
    Lock the address: 0xfffff800032dc400
    Thread Count: 1
    Feed address: 0xfffffa8006a2f680
    Queue: 0 x 318

    LAST_CONTROL_TRANSFER: from fffff80003448824 to fffff800030d9f00

    STACK_TEXT:
    fffff880 '06538ea0 fffff880' 06e72950: fffffa80 ' 0c5fd6f0 fffffa80 '0c5fd6f0 fffff880' 07b2b348 fffff880 ' 07b2b348: afd! WskTdiInit + 0xdd
    "fffff880 '06538ef0 fffff880' 06e72b7c: fffffa80 ' fffff880 00000262 '07b2b348 fffffa80' 0c5fd6f0 fffffa80 ' 0c4d2ee0: afd! AfdWskInit + 0 x 30
    fffff880 '06538f30 fffff880' 04427ea5: fffff880 ' 07b2b348 fffffa80 '0c4d2ee0 fffffa80' 0c5fa940 fffffa80 ' 0c4d2ee0: afd! AfdWskNotifyAttachClient + 0x12c
    fffff880 '06538f80 fffff880' 07b 27173: fffffa80 '0c5fa98c 00000000 00000001' fffffa80' 0c5fcd70 00000000' 000007ff: NETIO! NmrClientAttachProvider + 0 x 65
    fffff880'06538fd0 fffff880'04430833: fffffa80' 771d7db4 fffffa80 '43820eee 0c5fcd70' c 336420 00000001'00000018 0: rasl2tp! WskNotifyAttachProvider + 0 x 73
    fffff880 ' 06539010 fffff880' 04431cbd: fffffa80 '0 c 336420 fffffa80' 07406820 fffff880' 06539120 00000000 00000000': NETIO! NmrpProposeAttachment + 0 x 53
    fffff880 ' 06539060 fffff880' 04432dde: fffffa80'0c5fcd70 00000000' fffff880'06539120 00000000 00000000 00000000': NETIO! NmrpAttachArray + 0x3d
    fffff880 '06539090 fffff880' 044340d 2: fffff880'07b2b300 00000000'00000000 00000000'00000001 00000000'00000000: NETIO! NmrpRegisterModule + 0x6e
    fffff880 '065390f0 fffff880' 07b4004c: fffffa80' 00000000 00000010 '0 c 547820 fffffa80' 0c 00000000'00000018 634000: NETIO! NmrRegisterClient + 0 x 52
    "fffff880 ' 06539120 fffff880' 07 b 45050: 00000000'746 c 6600 fffff880 ' 06539210 fffff880 ' 065391 b 0 fffff800'03267880: rasl2tp! WskStartClientModule + 0x3c
    fffff880 '06539150 fffff800' c 034 1477: fffffa80 '0 c 547820 fffffa80' 0c 547820 00000000 00000000' fffffa80'0 c 634000: rasl2tp! DriverEntry + 0x40
    fffff880 ' 06539240 fffff800' 03554780: fffff880 00000000'00000001 00000000'00000000 ' 065397e8 ffffffff 8000014 c: nt! IopLoadDriver + 0xa07
    fffff880 ' 06539510 fffff800' 03392cdc: fffff880'06539820 00000000 '00000000 00000000' c0000023 00000000' 00000000: nt! PipCallDriverAddDeviceQueryRoutine + 0 x 390
    "fffff880 ' 06539610 fffff800' 03392fea: 00000000'00000000 00000000'00000000 fffff880 ' 06539820 fffff880 ' 065397e8: nt! RtlpCallQueryRegistryRoutine + 0xf4
    fffff880 ' 06539690 fffff800' 034c472c: fffffa80 '06a7b010 00000000'00000000 00000000' c0000034 fffff880' 065397e8: nt! RtlQueryRegistryValues + 0x17e
    fffff880 ' 06539760 fffff800' 034c5ec2: fffffa80 '06a7a6b0 fffffa80' 06a7b010 00000000 00000001' fffff8a0'0000004 c: nt! PipCallDriverAddDevice + 0x45c
    fffff880 ' 06539910 fffff800' 034c635c: fffff800 '032d9d80 00000000'00000000 00000000'00000001 fffff800 0334671' c: nt! PipProcessDevNodeTree + 0x2b2
    "fffff880 '06539b 80 fffff800' 031da322: 00000001 0327d5f8 ' 00000003 fffff800 ' 00000000'00000001 00000000'00000000: nt! PiProcessStartSystemDevices + 0x7c
    fffff880 '06539bd0 fffff800' 030e7161: fffff800'031da020 fffff880 '04169e01 fffffa80' 06a2f600 00000000' 00000000: nt! PnpDeviceActionWorker + 0 x 302
    fffff880 ' 06539 c 70 fffff800 '0337 d 166:95259525' fb2ffb2f fffffa80 '06a2f680 00000000 00000080' fffffa80' 06a15b30: nt! ExpWorkerThread + 0 x 111
    "fffff880 ' 06539 d 00 fffff800 ' 030b 8486: fffff880 ' 0633f180 fffffa80 '06a2f680 fffff880' 0634a1c0 b83fb83f ' 6a116a11: nt! PspSystemThreadStartup + 0x5a
    fffff880'06539 d 40 00000000 00000000': fffff880'0653 has 000 fffff880 '06534000 fffff880' 06537780 00000000 00000000': nt! KiStartSystemThread + 0x16

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: NETIO! NmrClientAttachProvider + 65

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: NETIO

    NOM_IMAGE: NETIO. SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc18a

    STACK_COMMAND: .cxr 0xfffff880065384c0; Ko

    FAILURE_BUCKET_ID: X64_0x7E_NETIO! NmrClientAttachProvider + 65

    BUCKET_ID: X64_0x7E_NETIO! NmrClientAttachProvider + 65

    Follow-up: MachineOwner
    ---------

    Hi, I took a glance at the attached image file.

    It is a C5: DRIVER_CORRUPTED_EXPOOL error checking, which means that a device driver has a bug that has attempted to access a memory either non-existent memory or it is not allowed access.

    The driver failed in the dump is kbdclass.sys is a general Windows driver, which is probably not the real cause of the accident-, but something other driven in kbdclass.sys Fault, probably another 3rd driver we need to activate Driver Verifier catch.

    First, if Service Pack 1 is not installed - know how to install this here.

    Driver Verifier:


    What is the driver verifier?

    Driver Verifier is included in Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP and Windows Server 2003 to promote stability and reliability; You can use this tool to troubleshoot driver problems. Components in kernel mode Windows can cause the corruption of system or failures in the system due to a poorly written driver, as a previous version of a driver Windows Driver Model (WDM).

    Essentially, if there is a 3rd driver left supposedly involved, activation of the driver verifier will help flush out the rogue driver by marking and origin of your system to BSOD.

    Before you enable Driver Verifier, it is recommended to create a System Restore Point:

    Vista - START | type rstrui - create a restore point

    Windows 7 - START | type create | Select "create a Restore Point.

    How to enable the driver verifier:

    Start > type "auditor" without quotes > select the following options.

    1. Select - create a custom settings (for code developers).

    2. Select - "select individual settings from a list."

    3. check the following boxes-

    -Special pool

    -Pool management

    -Force IRQL control

    -Detection of blockages

    -Security controls (Windows 7)

    -Concurrentcy (Windows 8) stress test

    -DDI compliance review (Windows 8)

    -Cheques

    4. Select - "select the driver names from a list.

    5. click on the tab 'supplier '. This will cause the sorting of all drivers by the provider.

    6. EACH box that is NOT provided by Microsoft / Microsoft Corporation.

    7. click on finish.

    8 restart.

    Important information about driver verifier:

    -If the Driver Verifier finds a violation, the system will search BSOD.

    -After activation of the auditor of drivers and restart the system, according to the guilty, will it be

    example, that the pilot is started, you may not be able to return to normal Windows

    Because Driver Verifier it will report and as shown above, which will cause / force a BSOD.

    If this happens, do [b] not [/ b] panic, follow these steps:

    -Start in Safe Mode by pressing repeatedly F8 key during boot to the top.

    -Once in Mode safe - start > type "System Restore" without the quotes.

    -Select the previously created restore point.

    If you have not set up a restore point, don't worry, you can always turn off Driver Verifier for

    in normal windows:

    -Start > Search > type "cmd" without the quotes.

    -To disable the Driver Verifier feature, type cmd ' auditor/Reset"without the quotes.

    -Reboot and start Windows normally.

    How long can I keep the compatible driver verifier for?

    It varies, many experts and analysts have different recommendations. Personally, I recommend

    keep it turned on for at least 36 to 48 hours. If you do not BSOD right there, turn off Driver Verifier.

    My BSOD system would be, where can find the dumps?

    They are in C:\Windows\Minidump

    For any other question can most likely be answered by this article:

    http://support.Microsoft.com/kb/244617

    Kind regards

    Patrick

  • Issue of standby, power code: 0x7E - Satellite U300 - 14 p

    I just bought my Satellite U300 - 14 p and installed windows XP SP3 0.5508 (deletion of Vista that comes with it), with a custom Windows XP, boot disk made with nLite 1.4.1 (to include the SATA driver and set up my preferences, such as themes, etc.).

    I followed the instructions (installation order) that are on the Drivers Toshiba Download Page and everything goes well until installing "TOSHIBA Power Saver"(v7.03.07Q)".
    The installation seemed to go very well, but at the end of it, the "critical stop" sound error of windows rang and after go to the control panel and try to open TOSHIBA Power Saver, I get the message:

    "CANNOT be opened because you do not have access rights to use 'TOSHIBA Power Saver'."

    I am the only user of the computer and admin, so I don't get this message.

    I tried to uninstall it but I get the message: "a fatal error has occurred. The program will end. "Code: 0x7E.

    Any help?

    EDIT: I forgot to mention that, now, every time I start windows, the "critical stop" sound games and he started that after I installed energy-saving

    Post edited by: Cinetyk

    Great! Thanks for this detailed!

  • Satellite L30-106: Power Saver 0x7E error

    Hi all
    I own a Toshiba Satellite L30-106. I got it from Windows Vista to Windows XP pro, I installed all the Xp drivers provided by the Toshiba site.

    Everything is going well except for the Toshiba Power Saver utility, I can't install it, it still gives this error: error Power Saver 0x7E. Same thing happens when I want to uninstall it. How can I solve this problem?
    Thanks in advance

    Hello

    I hope that you have installed the power saver right!
    The laptop is one of the series PSL33E. Therefore, you should choose the drivers and tools for this series!

    In addition it is very important to install the driver Toshiba and utilities in the right order!
    Then open the installation instructions and follow the lines of this guide!

    Please make sure that you have already installed "TOSHIBA common Modules or / and TOSHIBA Hotkey Utility" ahead!

  • Satellite M40-107: cannot re - install Powersaver - Code 0x7E

    Recently, I had to re - install Windows Xp on my Satellite M40-107 (PSM40E). Everything went well. Finally, I wanted to install the powersaver and I downloaded the latest version for my machine from the Toshiba web site. Installation fine until I press the complete installation (kerncentrale).

    A pop-up window appears with the message: fatal error, this programme will be completed. Code 0x7E.

    After restarting the same message appears until the powersaver is removed from the Board to run.

    Who can help?

    concerning
    @b

    Hello

    It seems that there is no general solution for this problem.
    I found and read a few comments on the similar problem, and it seems that the Toshiba recovery CD installation will eliminate this error message popup.

  • Satellite P30-128: installation power management error Code: 0x7E

    Hello, I formatted my laptop yesterday, and I could not install power management software correctly. When the installation is complete, I get "fatal error. Program will be closed. "Code: 0x7E.

    Can someone help me please?

    Hi Simone

    In this forum, you will find many topics on this energy-saving error. Try using the advanced search.
    This product usually mistake it the user does not use the Toshiba Recovery CD but only the original Microsoft OS.
    But according to other topics, there is no explicit solution.
    It is very important that you need to install the drivers of Toshiba in the right order.
    See the installation instructions on the page of the Toshiba driver.

  • TOSHIBA Power Saver 0x7E error

    Hello.

    It's the short history of XP on my Satellite A200 - 14 d:

    I can't stand Vista, therefore 2 or 3 days after the purchase of my laptop and try Vista, I decided to install my WinXP Pro. At first, it was REALLY hard for me to find drivers. I even installed some Tohiba not who, by the way worked just fine. Then Toshiba began to publish its own non-experimental pilots and I was happy. Everything worked well. After almost a year I was "forced" to reinstall my OS (once again: WinXP Pro). Everything went according to plan, and after 30 minutes, I was greated by the Windows XP Welcome screen. The first task was to install the appropriate drivers.

    Well, very well. I downloaded the latest drivers before reinstalling and kept them on another partition, I was ready to go. I opened the file TXT "new facility" and began to install everything on this list (which of course I downloaded from the Toshiba site). I installed all the drivers in the line, they must be installed (although I don't really know what that some of them may be of no use to me, like a fingerprint, since I have no such thing, but fine - I can't live without a few megabytes :)) until the famouse "Power Saver Utility" has come.) I read in many forums here on this problem, but I never found a solution :(:(:(

    When I tried to install the utility, it spits out an error message with code 0x7E (?). Whenever I boot my OS, this triumph of message on my desk ruin my mood :( I tried to uninstall it (although it is not completely installed - the only thing that shows something on this subject is an icon of the control panel which, pressing on, says that I don't have sufficient rights to access the file (even IF I'm in administrative Mode) and registry keys, which does nothing (I removed it and always appear the messages that I mentioned above)).

    I tried to remove it, but once again with error 0x7E message at the beginning of uninstallation. I even REINSTALLED my OS again and again by installing Power Saver mistakes occur :(:(:( This surprises me a lot, because I've never had such a problem before even the fact that I have not followed the installation instructions. I really need a solution to this. I want to install Vista and the recovery disc. I would if I knew there was no average athor, but I'm sure there is because of the fact that I had no problems before.

    Yes, everyone throws - help. Because without energy saver, my laptop is like your desktop PC, that is--needs to stay connected with alternating current :( And it is not appropriate for a laptop.

    PS: I forgot to mention - no change in the BIOS has been done, although I don't think that this has nothing to do with my problem.

    Hello

    Have you tried two versions of power saver on the Toshiba download page?

  • Power Saver 0x7E error

    Hey, I removed the windows OEM pre-installed and installed my windows, I downloaded all the drivers and software on the site of Toshiba, it all works except the energy saver. When it is installed and want to start, I got the error 0x7E. When I want to remove to install another version, I also got this error.
    Does anyone know a solution? Thank you

    Hi Bjorn

    On this forum I found a few topics with similar theme, but unfortunately there is no universal solution. Obviously a registry entry is wrong and reinstalling doesn't help at all.

    I noticed that the problem has been resolved after the reinstallation of the operating system with recovery media. On this way the unit has again factory settings and should not have problems again. I'm sure other applications installed on your device may be an advertisement influence on the sleep feature power.

    It's really not easy to say why this is happening.

Maybe you are looking for