Minidump Results

wildchild0683 · Sep 6, 2008

Blue Screen Error

I got a blue screen error and restart on my computer. After starting back up the check for solution box popped up. I clicked on details and got this:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033

BCCode: f5
BCP1: 00000068
BCP2: C3E9E598
BCP3: C3E9E5C4
BCP4: 00000000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\Mini090608-01.dmp
C:\Users\Val\AppData\Local\Temp\WER-42713-0.sysdata.xml
C:\Users\Val\AppData\Local\Temp\WERD41F.tmp.version.txt

Novice · Sep 6, 2008

Re: Blue Screen Error

Try this, http://forums.majorgeeks.com/showthread.php?t=35246. Hope this helps.

wildchild0683 · Sep 8, 2008

Re: Blue Screen Error

OK I did that. This is what i got.

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a10000 PsLoadedModuleList = 0x81b27c70
Debug session time: Fri Aug 15 22:01:37.959 2008 (GMT-5)
System Uptime: 0 days 2:38:41.024
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, 9d255b50, 9d25584c, 8b416fde}

Probably caused by : Ntfs.sys ( Ntfs!NtfsReleaseAllResources+23 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904aa
Arg2: 9d255b50
Arg3: 9d25584c
Arg4: 8b416fde

Debugging Details:
------------------

EXCEPTION_RECORD: 9d255b50 -- (.exr 0xffffffff9d255b50)
ExceptionAddress: 8b416fde (Ntfs!NtfsReleaseAllResources+0x00000023)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 10000000
Attempt to read from address 10000000

CONTEXT: 9d25584c -- (.cxr 0xffffffff9d25584c)
eax=867be9f8 ebx=00000000 ecx=87178500 edx=00000000 esi=867be9c0 edi=10000000
eip=8b416fde esp=9d255c18 ebp=9d255c20 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
Ntfs!NtfsReleaseAllResources+0x23:
8b416fde 66813f0207 cmp word ptr [edi],702h ds:0023:10000000=????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

READ_ADDRESS: GetPointerFromAddress: unable to read from 81b47868
Unable to read MiSystemVaType memory at 81b27420
10000000

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 8b4171fb to 8b416fde

STACK_TEXT:
9d255c20 8b4171fb 867be9c0 867bea68 867be9c0 Ntfs!NtfsReleaseAllResources+0x23
9d255c38 8b41804d 867be9c0 00000001 9d255d14 Ntfs!NtfsCleanupIrpContext+0x23
9d255c58 8b49cb9f 867be9c0 00000000 00000000 Ntfs!NtfsExtendedCompleteRequest+0x76
9d255cb0 8b4ab1d4 867be9c0 b5877d80 b5877c90 Ntfs!NtfsCommonClose+0x513
9d255d44 81a4841d 00000000 00000000 86db97f0 Ntfs!NtfsFspClose+0x117
9d255d7c 81be5a1c 00000000 d651726c 00000000 nt!ExpWorkerThread+0xfd
9d255dc0 81a3ea3e 81a48320 80000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
Ntfs!NtfsReleaseAllResources+23
8b416fde 66813f0207 cmp word ptr [edi],702h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsReleaseAllResources+23

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918a96

STACK_COMMAND: .cxr 0xffffffff9d25584c ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsReleaseAllResources+23

BUCKET_ID: 0x24_Ntfs!NtfsReleaseAllResources+23

Followup: MachineOwner
---------

wildchild0683 · Sep 8, 2008

Ran WinDbg and opened all the minidumps and thaes are the results. Please Help. Don't know what to do next. Thanks.:confused

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a10000 PsLoadedModuleList = 0x81b27c70
Debug session time: Fri Aug 15 22:01:37.959 2008 (GMT-5)
System Uptime: 0 days 2:38:41.024
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, 9d255b50, 9d25584c, 8b416fde}

Probably caused by : Ntfs.sys ( Ntfs!NtfsReleaseAllResources+23 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904aa
Arg2: 9d255b50
Arg3: 9d25584c
Arg4: 8b416fde

Debugging Details:
------------------

EXCEPTION_RECORD: 9d255b50 -- (.exr 0xffffffff9d255b50)
ExceptionAddress: 8b416fde (Ntfs!NtfsReleaseAllResources+0x00000023)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 10000000
Attempt to read from address 10000000

CONTEXT: 9d25584c -- (.cxr 0xffffffff9d25584c)
eax=867be9f8 ebx=00000000 ecx=87178500 edx=00000000 esi=867be9c0 edi=10000000
eip=8b416fde esp=9d255c18 ebp=9d255c20 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
Ntfs!NtfsReleaseAllResources+0x23:
8b416fde 66813f0207 cmp word ptr [edi],702h ds:0023:10000000=????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

READ_ADDRESS: GetPointerFromAddress: unable to read from 81b47868
Unable to read MiSystemVaType memory at 81b27420
10000000

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 8b4171fb to 8b416fde

STACK_TEXT:
9d255c20 8b4171fb 867be9c0 867bea68 867be9c0 Ntfs!NtfsReleaseAllResources+0x23
9d255c38 8b41804d 867be9c0 00000001 9d255d14 Ntfs!NtfsCleanupIrpContext+0x23
9d255c58 8b49cb9f 867be9c0 00000000 00000000 Ntfs!NtfsExtendedCompleteRequest+0x76
9d255cb0 8b4ab1d4 867be9c0 b5877d80 b5877c90 Ntfs!NtfsCommonClose+0x513
9d255d44 81a4841d 00000000 00000000 86db97f0 Ntfs!NtfsFspClose+0x117
9d255d7c 81be5a1c 00000000 d651726c 00000000 nt!ExpWorkerThread+0xfd
9d255dc0 81a3ea3e 81a48320 80000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
Ntfs!NtfsReleaseAllResources+23
8b416fde 66813f0207 cmp word ptr [edi],702h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsReleaseAllResources+23

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918a96

STACK_COMMAND: .cxr 0xffffffff9d25584c ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsReleaseAllResources+23

BUCKET_ID: 0x24_Ntfs!NtfsReleaseAllResources+23

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081508-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a3a000 PsLoadedModuleList = 0x81b51c70
Debug session time: Fri Aug 15 22:45:40.859 2008 (GMT-5)
System Uptime: 0 days 0:25:42.297
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c, 2, 0, 81a6f482}

Probably caused by : memory_corruption ( nt!MiIdentifyPfn+64f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81a6f482, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81b71868
Unable to read MiSystemVaType memory at 81b51420
0000000c

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiIdentifyPfn+64f
81a6f482 8b500c mov edx,dword ptr [eax+0Ch]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: 977447e4 -- (.trap 0xffffffff977447e4)
ErrCode = 00000000
eax=00000000 ebx=8618f780 ecx=86a3f8f8 edx=00000002 esi=84a3f960 edi=06000000
eip=81a6f482 esp=97744858 ebp=977448b8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiIdentifyPfn+0x64f:
81a6f482 8b500c mov edx,dword ptr [eax+0Ch] ds:0023:0000000c=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81a6f482 to 81a94d84

STACK_TEXT:
977447e4 81a6f482 badb0d00 00000002 00000000 nt!KiTrap0E+0x2ac
977448b8 81acdd1d 97744864 0218f780 8618f000 nt!MiIdentifyPfn+0x64f
977448ec 81c4ca8f ca9778cb 97744978 00000006 nt!MmQueryPfnList+0x130
97744930 81c67b3e 00000001 ca97785b 00000014 nt!PfpPfnPrioRequest+0xdc
977449a0 81c730ca 00000000 00000001 97744d30 nt!PfQuerySuperfetchInformation+0xea
97744d4c 81a91a7a 0000004f 028cf250 00000014 nt!NtQuerySystemInformation+0x2201
97744d4c 777b9a94 0000004f 028cf250 00000014 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
028cf21c 00000000 00000000 00000000 00000000 0x777b9a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiIdentifyPfn+64f
81a6f482 8b500c mov edx,dword ptr [eax+0Ch]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiIdentifyPfn+64f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 47918b12

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081508-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a3d000 PsLoadedModuleList = 0x81b54c70
Debug session time: Fri Aug 15 23:11:01.642 2008 (GMT-5)
System Uptime: 0 days 0:19:19.248
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, a4231000, 1, 0}

GetPointerFromAddress: unable to read from 81b74868
Unable to read MiSystemVaType memory at 81b54420
Probably caused by : ntkrpamp.exe ( nt!ExpFindAndRemoveTagBigPages+1d5 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000022,
Arg2: a4231000
Arg3: 00000001
Arg4: 00000000

Debugging Details:
------------------

GetPointerFromAddress: unable to read from 81b74868
Unable to read MiSystemVaType memory at 81b54420

BUGCHECK_STR: 0x19_22

POOL_ADDRESS: GetPointerFromAddress: unable to read from 81b74868
Unable to read MiSystemVaType memory at 81b54420
a4231000

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 81a82caf to 81b0a163

STACK_TEXT:
8bf5bb84 81a82caf 00000019 00000022 a4231000 nt!KeBugCheckEx+0x1e
8bf5bbc0 81b2afd2 a4231000 8bf5bc0c 8bf5bbf0 nt!ExpFindAndRemoveTagBigPages+0x1d5
8bf5bc30 81bbbcd3 a4231000 00000000 00000002 nt!ExFreePoolWithTag+0x145
8bf5bd1c 81bbbf81 00000002 81b3f13c 8430f2d8 nt!CmpFlushBackupHive+0x284
8bf5bd40 81bbc05a 81a7541d 00000000 00000000 nt!CmpSyncBackupHives+0x90
8bf5bd44 81a7541d 00000000 00000000 8430f2d8 nt!CmpFirstBackupFlushWorker+0x8
8bf5bd7c 81c12a1c 00000000 70ea1125 00000000 nt!ExpWorkerThread+0xfd
8bf5bdc0 81a6ba3e 81a75320 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExpFindAndRemoveTagBigPages+1d5
81a82caf cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExpFindAndRemoveTagBigPages+1d5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 47918b12

FAILURE_BUCKET_ID: 0x19_22_nt!ExpFindAndRemoveTagBigPages+1d5

BUCKET_ID: 0x19_22_nt!ExpFindAndRemoveTagBigPages+1d5

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a14000 PsLoadedModuleList = 0x81b2bc70
Debug session time: Fri Aug 15 23:56:00.414 2008 (GMT-5)
System Uptime: 0 days 0:12:01.117
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {94df8a00, 2, 0, 8f00ead5}

Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 94df8a00, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8f00ead5, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81b4b868
Unable to read MiSystemVaType memory at 81b2b420
94df8a00

CURRENT_IRQL: 2

FAULTING_IP:
USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd
8f00ead5 ff7618 push dword ptr [esi+18h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: 805ecbfc -- (.trap 0xffffffff805ecbfc)
ErrCode = 00000000
eax=94df89e8 ebx=86f1b0e8 ecx=8753f630 edx=86f1b0e8 esi=94df89e8 edi=86f1b880
eip=8f00ead5 esp=805ecc70 ebp=805ecc88 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
USBPORT!USBPORT_Core_iGetNextPriorityTransfer+0x1cd:
8f00ead5 ff7618 push dword ptr [esi+18h] ds:0023:94df8a00=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8f00ead5 to 81a6ed84

STACK_TEXT:
805ecbfc 8f00ead5 badb0d00 86f1b0e8 86f1bd02 nt!KiTrap0E+0x2ac
805ecc88 8f00df5b 33584e67 94df89e8 81a684f4 USBPORT!USBPORT_Core_iGetNextPriorityTransfer+0x1cd
805eccc0 8f00f274 86f1b028 86f1b880 86f1b002 USBPORT!USBPORT_Core_UsbHcIntDpc_Worker+0x2aa
805ecce8 81aca510 86f1b88c 34776478 00000000 USBPORT!USBPORT_Xdpc_Worker+0x274
805ecd50 81ac8f9d 00000000 0000000e 00610068 nt!KiRetireDpcList+0x147
805ecd54 00000000 0000000e 00610068 00640062 nt!KiIdleLoop+0x49

STACK_COMMAND: kb

FOLLOWUP_IP:
USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd
8f00ead5 ff7618 push dword ptr [esi+18h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: USBPORT

IMAGE_NAME: USBPORT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 47919053

FAILURE_BUCKET_ID: 0xD1_USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd

BUCKET_ID: 0xD1_USBPORT!USBPORT_Core_iGetNextPriorityTransfer+1cd

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081608-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a1f000 PsLoadedModuleList = 0x81b36c70
Debug session time: Sat Aug 16 21:04:34.983 2008 (GMT-5)
System Uptime: 0 days 0:04:18.773
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3d006e00, 1b, 1, 81a58758}

*** WARNING: Unable to verify timestamp for SiWinAcc.sys
*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
Probably caused by : SiWinAcc.sys ( SiWinAcc+325 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 3d006e00, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81a58758, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81b56868
Unable to read MiSystemVaType memory at 81b36420
3d006e00

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KeWaitForGate+126
81a58758 8902 mov dword ptr [edx],eax

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: VSSVC.exe

TRAP_FRAME: 9aeb96cc -- (.trap 0xffffffff9aeb96cc)
ErrCode = 00000002
eax=84cdcc50 ebx=8a319694 ecx=8a31969c edx=3d006e00 esi=84cdcb98 edi=00000000
eip=81a58758 esp=9aeb9740 ebp=9aeb9768 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KeWaitForGate+0x126:
81a58758 8902 mov dword ptr [edx],eax ds:0023:3d006e00=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81a58758 to 81a79d84

STACK_TEXT:
9aeb96cc 81a58758 badb0d00 3d006e00 8e45d1a8 nt!KiTrap0E+0x2ac
9aeb9768 81a53cbf 00000000 9aeb9794 00000000 nt!KeWaitForGate+0x126
9aeb9780 81a5db89 00000000 00000000 9aeb97d0 nt!KiAcquireGuardedMutex+0x53
9aeb9798 8b00bb7f 00000000 854cef08 00000000 nt!FsRtlLookupPerFileObjectContext+0x4b
9aeb97b4 8b0076a6 84b982c8 9aeb97d0 8b0076fb fltmgr!FltpGetStartingCallbackNode+0x3b
9aeb97e8 81a6a1cc 9aeb982c 9aeb9868 86003c20 fltmgr!FltpPreFsFilterOperation+0x5a
9aeb980c 81c4825d 00000001 00000001 9aeb996b nt!FsFilterPerformCallbacks+0xa0
9aeb996c 81a9e2b4 84b982c8 00000000 00000000 nt!FsRtlAcquireFileForCcFlushEx+0xe2
9aeb99b4 81a5eae7 84b991ec 00000000 00000001 nt!MmFlushSection+0xb2
9aeb9a4c 8b4867f7 84b991ec 00000000 00000000 nt!CcFlushCache+0x239
9aeb9aa0 8b480377 01b21d80 a10440f8 00000000 Ntfs!NtfsFlushUserStream+0x7b
9aeb9b3c 8b487f47 84b21d80 873a50d8 00000001 Ntfs!NtfsFlushVolume+0x272
9aeb9bb8 8b48843d 84b21d80 84cdd3c8 11afd790 Ntfs!NtfsCommonFlushBuffers+0x1bc
9aeb9c20 81adb053 873a5020 84cdd3c8 84cdd3c8 Ntfs!NtfsFsdFlushBuffers+0xf4
9aeb9c38 8b007ba7 873d6d38 84cdd3c8 00000000 nt!IofCallDriver+0x63
9aeb9c5c 8b007d64 9aeb9c7c 873d6d38 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x251
9aeb9c94 81adb053 873d6d38 84cdd3c8 873b5550 fltmgr!FltpDispatch+0xc2
9aeb9cac 8b044325 81adb053 873b5550 84cdd3c8 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
9aeb9cc8 81c6b515 84cdd3c8 00000000 84c5f4b0 SiWinAcc+0x325
9aeb9ce8 81c118bb 873b5550 84c5f4b0 00000000 nt!IopSynchronousServiceTail+0x1d9
9aeb9d54 81a76a7a 00000301 034bf7c4 034bf7e8 nt!NtFlushBuffersFile+0x1e6
9aeb9d54 779f9a94 00000301 034bf7c4 034bf7e8 nt!KiFastCallEntry+0x12a
034bf7e8 00000000 00000000 00000000 00000000 0x779f9a94

STACK_COMMAND: kb

FOLLOWUP_IP:
SiWinAcc+325
8b044325 ?? ???

SYMBOL_STACK_INDEX: 12

SYMBOL_NAME: SiWinAcc+325

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SiWinAcc

IMAGE_NAME: SiWinAcc.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41868cbb

FAILURE_BUCKET_ID: 0xA_W_SiWinAcc+325

BUCKET_ID: 0xA_W_SiWinAcc+325

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini081608-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Kernel base = 0x81a50000 PsLoadedModuleList = 0x81b67c70
Debug session time: Sat Aug 16 21:27:28.751 2008 (GMT-5)
System Uptime: 0 days 0:03:37.547
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {99, 87d86fa0, 0, 0}

Probably caused by : CLASSPNP.SYS ( CLASSPNP!ClassCompleteRequest+11 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000099, Attempt to free pool with invalid address (or corruption in pool header)
Arg2: 87d86fa0, Address being freed
Arg3: 00000000, 0
Arg4: 00000000, 0

Debugging Details:
------------------

FAULTING_IP:
nt!IoFreeMdl+73
81a95f52 5e pop esi

BUGCHECK_STR: 0xc2_99

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 81d3a5a7 to 81b1d163

STACK_TEXT:
805ecb38 81d3a5a7 000000c2 00000099 87d86fa0 nt!KeBugCheckEx+0x1e
805ecb58 81b2648d 87d86fa0 00000000 87d86f98 nt!VerifierBugCheckIfAppropriate+0x32
805ecb70 81b3e3c2 87d86fa0 00000ec0 00000001 nt!VerifierFreeTrackedPool+0x24
805ecbe0 81a95f52 87d86fa0 00000000 84bbf8d8 nt!ExFreePoolWithTag+0x534
805ecbfc 81a8a18f 87d86fa0 00000000 84bc6c00 nt!IoFreeMdl+0x73
805ecc28 8b5a4773 805ecc5c 8b5a4d4d 86128598 nt!IopfCompleteRequest+0x1c8
805ecc30 8b5a4d4d 86128598 84bbf8d8 00000001 CLASSPNP!ClassCompleteRequest+0x11
805ecc5c 81a8a0e4 00000000 8844fe28 00bc6c00 CLASSPNP!TransferPktComplete+0x2b6
805ecc94 8af4a047 84bc6cac 805eccd8 8af4d658 nt!IopfCompleteRequest+0x11d
805ecca0 8af4d658 8844fe28 00000001 00000000 storport!RaidCompleteRequestEx+0x1c
805eccd8 8af4a31f 854a1008 805d2b00 805ecd50 storport!RaidUnitCompleteRequest+0x8f
805ecce8 81b06510 850e90a4 850e9030 00000000 storport!RaidpAdapterDpcRoutine+0x28
805ecd50 81b04f9d 00000000 0000000e 005a0070 nt!KiRetireDpcList+0x147
805ecd54 00000000 0000000e 005a0070 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND: kb

FOLLOWUP_IP:
CLASSPNP!ClassCompleteRequest+11
8b5a4773 5d pop ebp

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: CLASSPNP!ClassCompleteRequest+11

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME: CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 47918f70

FAILURE_BUCKET_ID: 0xc2_99_CLASSPNP!ClassCompleteRequest+11

BUCKET_ID: 0xc2_99_CLASSPNP!ClassCompleteRequest+11

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c37000 PsLoadedModuleList = 0x81d4ec70
Debug session time: Tue Sep 2 12:17:49.108 2008 (GMT-5)
System Uptime: 0 days 7:45:20.936
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ee657649, 0, 8f2c0e10, 2}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

Could not read faulting driver name
Probably caused by : nvlddmkm.sys ( nvlddmkm+bee10 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ee657649, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8f2c0e10, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d6e868
Unable to read MiSystemVaType memory at 81d4e420
ee657649

FAULTING_IP:
nvlddmkm+bee10
8f2c0e10 ?? ???

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

TRAP_FRAME: 8dcbc984 -- (.trap 0xffffffff8dcbc984)
ErrCode = 00000000
eax=ee657645 ebx=ff020000 ecx=00000000 edx=81d3977c esi=c1d002a2 edi=000050a0
eip=8f2c0e10 esp=8dcbc9f8 ebp=00000000 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nvlddmkm+0xbee10:
8f2c0e10 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c91bb4 to 81cdc155

STACK_TEXT:
8dcbc96c 81c91bb4 00000000 ee657649 00000000 nt!MmAccessFault+0x10a
8dcbc96c 8f2c0e10 00000000 ee657649 00000000 nt!KiTrap0E+0xdc
WARNING: Stack unwind information not available. Following frames may be wrong.
8dcbc9f4 8f29380f 81d3977c 8dcbca0c 854727c4 nvlddmkm+0xbee10
00000000 00000000 00000000 00000000 00000000 nvlddmkm+0x9180f

STACK_COMMAND: kb

FOLLOWUP_IP:
nvlddmkm+bee10
8f2c0e10 ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nvlddmkm+bee10

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME: nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 46e78227

FAILURE_BUCKET_ID: 0x50_nvlddmkm+bee10

BUCKET_ID: 0x50_nvlddmkm+bee10

Followup: MachineOwner

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c39000 PsLoadedModuleList = 0x81d50c70
Debug session time: Sat Sep 6 09:45:46.186 2008 (GMT-5)
System Uptime: 0 days 22:40:24.027
Loading Kernel Symbols
..............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F5, {68, c3e9e598, c3e9e5c4, 0}

Probably caused by : fltmgr.sys ( fltmgr!FltReleaseFileNameInformation+43 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

FLTMGR_FILE_SYSTEM (f5)
An unrecoverable failure occured inside the filter manager.
Arguments:
Arg1: 00000068, The reason for the failure
Arg2: c3e9e598
Arg3: c3e9e5c4
Arg4: 00000000

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xF5

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 807e9973 to 81d06163

STACK_TEXT:
8c133ad4 807e9973 000000f5 00000068 c3e9e598 nt!KeBugCheckEx+0x1e
8c133af0 807e9d3c c3e9e5c4 88142980 855e4f18 fltmgr!FltReleaseFileNameInformation+0x43
8c133b08 807e9d63 855e4f18 00002000 ffffffff fltmgr!DeleteNameCacheNodes+0xfe
8c133b24 807ed1b1 88142980 855e4f18 855e4f58 fltmgr!FltpFreeNameCacheList+0x17
8c133b40 807ed3b6 855e4f18 eef05d80 00000000 fltmgr!CleanupStreamListCtrl+0x37
8c133b54 81e5fcdc 855e4f1c 765291b9 00000000 fltmgr!DeleteStreamListCtrlCallback+0x5a
8c133b94 8b6b0d9b eef05d80 eef05c90 eef05d80 nt!FsRtlTeardownPerStreamContexts+0x135
8c133bb0 8b69be6c 00000705 eef05cb8 eef05c90 Ntfs!NtfsDeleteScb+0x1f4
8c133bc8 8b62215a ea708808 eef05d80 00000000 Ntfs!NtfsRemoveScb+0xc0
8c133be4 8b69bc55 ea708808 eef05c90 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x59
8c133c28 8b623bde ea708808 eef05d80 eef05f20 Ntfs!NtfsTeardownStructures+0x62
8c133c50 8b6a1b66 ea708808 eef05d80 eef05f20 Ntfs!NtfsDecrementCloseCounts+0xad
8c133cb0 8b6b01d4 ea708808 eef05d80 eef05c90 Ntfs!NtfsCommonClose+0x4da
8c133d44 81c7141d 00000000 00000000 84b07ad0 Ntfs!NtfsFspClose+0x117
8c133d7c 81e0eb18 00000000 765297ed 00000000 nt!ExpWorkerThread+0xfd
8c133dc0 81c67a3e 81c71320 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
fltmgr!FltReleaseFileNameInformation+43
807e9973 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: fltmgr!FltReleaseFileNameInformation+43

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fltmgr

IMAGE_NAME: fltmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918a6a

FAILURE_BUCKET_ID: 0xF5_fltmgr!FltReleaseFileNameInformation+43

BUCKET_ID: 0xF5_fltmgr!FltReleaseFileNameInformation+43

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c0d000 PsLoadedModuleList = 0x81d24c70
Debug session time: Sat Sep 6 13:03:13.551 2008 (GMT-5)
System Uptime: 0 days 0:32:45.389
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, 855e4218, 855e4248, 8060017}

Unable to load image \SystemRoot\system32\drivers\ikfilesec.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for ikfilesec.sys
*** WARNING: Unable to verify timestamp for SiWinAcc.sys
*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
Probably caused by : luafv.sys ( luafv!LuafvNormalizeNameComponentEx+ba )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 855e4218, The pool entry we were looking for within the page.
Arg3: 855e4248, The next pool entry.
Arg4: 08060017, (reserved)

Debugging Details:
------------------

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from 81d44868
Unable to read MiSystemVaType memory at 81d24420
855e4218

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81cfb00c to 81cda163

STACK_TEXT:
9c65b014 81cfb00c 00000019 00000020 855e4218 nt!KeBugCheckEx+0x1e
9c65b088 81e2c1b7 855e4220 00000000 00000000 nt!ExFreePoolWithTag+0x17f
9c65b0d4 81e515e7 854b1560 81fcd110 854b1548 nt!IopDeleteFile+0x20b
9c65b0f0 81c5e89d 854b1560 00000000 8825cc28 nt!ObpRemoveObjectRoutine+0x13d
9c65b118 81e2a4da 8be02fc8 8825cc28 000009b8 nt!ObfDereferenceObject+0xa1
9c65b158 81e2a6d0 8be02fc8 9d4c7370 84ac6910 nt!ObpCloseHandleTableEntry+0x24e
9c65b188 81e2a8f5 84ac6910 00000000 00000000 nt!ObpCloseHandle+0x73
9c65b19c 81c64a7a 800009b8 9c65b25c 81c62449 nt!NtClose+0x20
9c65b19c 81c62449 800009b8 9c65b25c 81c62449 nt!KiFastCallEntry+0x12a
9c65b218 96c29836 800009b8 00000028 00000000 nt!ZwClose+0x11
9c65b25c 828224a4 8a734008 8aa1dc40 800009b8 luafv!LuafvNormalizeNameComponentEx+0xba
9c65b28c 828228ca 8a775ec0 00000000 8a775ec0 fltmgr!FltpCallNormalizeNameComponentHandler+0x4e
9c65b2b8 82823801 01775ec0 00000000 8a775ec0 fltmgr!FltpExpandShortNames+0x138
9c65b2d4 82823f07 8a770000 00000000 868be53c fltmgr!FltpGetNormalizedFileNameWorker+0xab
9c65b2ec 828211a1 8a775ec0 00000000 8a775ec0 fltmgr!FltpGetNormalizedFileName+0x19
9c65b304 8280c1df 8a775ec0 00000000 00000000 fltmgr!FltpCreateFileNameInformation+0x81
9c65b334 8280c654 8a7636c4 9c65b404 00000000 fltmgr!FltpGetFileNameInformation+0x31d
9c65b35c 82847b53 007f7850 00000101 9c65b3b8 fltmgr!FltGetFileNameInformation+0x120
WARNING: Stack unwind information not available. Following frames may be wrong.
9c65b3e0 828060f3 857f7850 9c65b404 85212080 ikfilesec+0x1b53
9c65b444 82809090 007f77f0 00000000 857f77f0 fltmgr!FltpPerformPostCallbacks+0x1f1
9c65b458 828095c6 857f77f0 85804270 9c65b498 fltmgr!FltpProcessIoCompletion+0x10
9c65b468 82809c37 87c21020 85804270 857f77f0 fltmgr!FltpPassThroughCompletion+0x94
9c65b498 8281c643 9c65b4b8 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2e1
9c65b4e4 81cc9053 87c21020 87c21ba8 87c26560 fltmgr!FltpCreate+0x2a1
9c65b4fc 828544ba 9c65b530 82854cc4 87c26560 nt!IofCallDriver+0x63
9c65b504 82854cc4 87c26560 85804270 85804270 SiWinAcc+0x4ba
9c65b530 81cc9053 87c26560 87c21020 8aa1dc9c SiWinAcc+0xcc4
9c65b548 81e2dce5 18c4ce12 8541ac58 8ab987e8 nt!IofCallDriver+0x63
9c65b618 81e36e96 87c26560 00000000 86c87818 nt!IopParseDevice+0xf61
9c65b650 81e52f48 8541ac58 00000000 86c87818 nt!IopParseFile+0x46
9c65b6e0 81e2b0ca 800009e4 9c65b738 00000240 nt!ObpLookupObjectName+0x11e
9c65b740 81e2cbc7 9c65b990 00000000 81c46b00 nt!ObOpenObjectByName+0x13c
9c65b7b4 81e33521 9c65b964 00000081 9c65b990 nt!IopCreateFile+0x63b
9c65b810 8281e7dc 9c65b964 00000081 9c65b990 nt!IoCreateFileEx+0x9d
9c65b894 82840095 860d61b0 00000000 9c65b964 fltmgr!FltCreateFileEx2+0xae
9c65b974 81dcfa5a 00000000 ae4da280 000007ff fileinfo!FIPfInterfaceOpen+0x2a7
9c65b9d8 81dabda3 9c65ba34 800009e4 00000081 nt!PfpOpenHandleCreate+0xc5
9c65ba50 81e99b92 9c65baec ae4ae5c8 00000000 nt!PfpFileBuildReadSupport+0x93
9c65baa8 81dac2fe 9c65baec 00000000 9c65bbe4 nt!PfpPrefetchFiles+0x18e
9c65bb00 81dac574 ae4ae000 18c4c35e 9c65bbf8 nt!PfpPrefetchRequestPerform+0x2bc
9c65bb54 81deb4b2 9c65bbe4 ffffff01 18c4c412 nt!PfpPrefetchRequest+0x16e
9c65bc18 81e04cf3 0290f55c 00000014 ffffff01 nt!PfSetSuperfetchInformation+0x182
9c65bd50 81c64a7a 0000004f 00000000 00000014 nt!NtSetSystemInformation+0x908
9c65bd50 76f09a94 0000004f 00000000 00000014 nt!KiFastCallEntry+0x12a
0290f574 00000000 00000000 00000000 00000000 0x76f09a94

STACK_COMMAND: kb

FOLLOWUP_IP:
luafv!LuafvNormalizeNameComponentEx+ba
96c29836 8bc7 mov eax,edi

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: luafv!LuafvNormalizeNameComponentEx+ba

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: luafv

IMAGE_NAME: luafv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47918afb

FAILURE_BUCKET_ID: 0x19_20_luafv!LuafvNormalizeNameComponentEx+ba

BUCKET_ID: 0x19_20_luafv!LuafvNormalizeNameComponentEx+ba

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c4f000 PsLoadedModuleList = 0x81d66c70
Debug session time: Sat Sep 6 13:09:07.834 2008 (GMT-5)
System Uptime: 0 days 0:04:42.707
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {2, 1b, 1, 81c1fff9}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+2ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000002, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c1fff9, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81d86868
Unable to read MiSystemVaType memory at 81d66420
00000002

CURRENT_IRQL: 1b

FAULTING_IP:
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+29
81c1fff9 8902 mov dword ptr [edx],eax

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: taskeng.exe

TRAP_FRAME: a071cbb4 -- (.trap 0xffffffffa071cbb4)
ErrCode = 00000002
eax=a071cc34 ebx=855e64c0 ecx=855e6518 edx=00000002 esi=0000001c edi=855f1400
eip=81c1fff9 esp=a071cc28 ebp=a071cc40 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29:
81c1fff9 8902 mov dword ptr [edx],eax ds:0023:00000002=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c1fff9 to 81ca9d84

STACK_TEXT:
a071cbb4 81c1fff9 badb0d00 00000002 001f0003 nt!KiTrap0E+0x2ac
a071cc24 81c8bf19 0000001c 028bf750 00000000 hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29
a071cc40 81e6b674 1df11d41 fffffffe 028bf750 nt!KeQueryBasePriorityThread+0x1c
a071cd48 81ca6a7a fffffffe 00000000 028bf750 nt!NtQueryInformationThread+0x31b
a071cd48 77989a94 fffffffe 00000000 028bf750 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
028bf76c 00000000 00000000 00000000 00000000 0x77989a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+2ac
81ca9d84 833d64dcd78100 cmp dword ptr [nt!KiFreezeFlag (81d7dc64)],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+2ac

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

FAILURE_BUCKET_ID: 0xA_W_nt!KiTrap0E+2ac

BUCKET_ID: 0xA_W_nt!KiTrap0E+2ac

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c1b000 PsLoadedModuleList = 0x81d32c70
Debug session time: Sat Sep 6 13:14:52.096 2008 (GMT-5)
System Uptime: 0 days 0:04:32.968
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {0, 2, 1, 81d081c3}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1be )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 81d081c3, address which referenced memory

Debugging Details:
------------------

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1be
81d081c3 891e mov dword ptr [esi],ebx

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

TRAP_FRAME: 97328b44 -- (.trap 0xffffffff97328b44)
ErrCode = 00000002
eax=855e6010 ebx=00000002 ecx=000001ff edx=00000033 esi=00000000 edi=81d1d6e0
eip=81d081c3 esp=97328bb8 ebp=97328bf0 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x1be:
81d081c3 891e mov dword ptr [esi],ebx ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81d081c3 to 81c75d84

STACK_TEXT:
97328b44 81d081c3 badb0d00 00000033 00000001 nt!KiTrap0E+0x2ac
97328bf0 81d096e0 81d1d6e0 00000001 81d1a140 nt!ExDeferredFreePool+0x1be
97328c5c 81c6285d 855e0008 4c456650 855e0008 nt!ExFreePoolWithTag+0x852
97328c70 81e49712 00000001 00000001 97328cc0 nt!PfFbBufferListInsertInFree+0x3c
97328c90 81e493cb c000009a 81d1a080 00000000 nt!PfpFlushEventBuffers+0x7a
97328ce8 81e48a9b 00000000 8a9acd78 00000000 nt!PfpFlushBuffers+0x30
97328d7c 81df0b18 81d1a080 3b7498db 00000000 nt!PfTLoggingWorker+0xaa
97328dc0 81c49a3e 81e489eb 81d1a080 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+1be
81d081c3 891e mov dword ptr [esi],ebx

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+1be

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1be

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1be

Followup: Pool_corruption
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c51000 PsLoadedModuleList = 0x81d68c70
Debug session time: Sat Sep 6 13:26:00.199 2008 (GMT-5)
System Uptime: 0 days 0:09:57.053
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, 855e41d8, 855e41d8, 8000010}

*** WARNING: Unable to verify timestamp for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for ikfilesec.sys
Probably caused by : ikfilesec.sys ( ikfilesec+7861 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 855e41d8, The pool entry we were looking for within the page.
Arg3: 855e41d8, The next pool entry.
Arg4: 08000010, (reserved)

Debugging Details:
------------------

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from 81d88868
Unable to read MiSystemVaType memory at 81d68420
855e41d8

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: pctsSvc.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81d3f00c to 81d1e163

STACK_TEXT:
9c4ea984 81d3f00c 00000019 00000020 855e41d8 nt!KeBugCheckEx+0x1e
9c4ea9f8 81e701b7 855e41e0 00000000 00000000 nt!ExFreePoolWithTag+0x17f
9c4eaa44 81e955e7 85363438 81c25110 85363420 nt!IopDeleteFile+0x20b
9c4eaa60 81ca289d 85363438 00000000 8aaf0928 nt!ObpRemoveObjectRoutine+0x13d
9c4eaa88 81e6e4da 9b362318 8aaf0928 00000d28 nt!ObfDereferenceObject+0xa1
9c4eaacc 81e6e6d0 9b362318 9ef41a50 8a8d2d90 nt!ObpCloseHandleTableEntry+0x24e
9c4eaafc 81e6e8f5 8a8d2d90 00000000 00000000 nt!ObpCloseHandle+0x73
9c4eab10 81ca8a7a 00000d28 9c4eaba0 81ca6449 nt!NtClose+0x20
9c4eab10 81ca6449 00000d28 9c4eaba0 81ca6449 nt!KiFastCallEntry+0x12a
9c4eab8c 823f7861 00000d28 c0000002 8db6fa30 nt!ZwClose+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
9c4eaba0 823f2bb9 adafb100 851168d0 00000000 ikfilesec+0x7861
9c4eabe8 823f2fe8 8db6fa28 1e71cc0c 8a8f7ac0 ikfilesec+0x2bb9
9c4eac2c 81d0d053 868c26c0 851168d0 851168d0 ikfilesec+0x2fe8
9c4eac44 81e9d5e5 8a8f7ac0 851168d0 85116940 nt!IofCallDriver+0x63
9c4eac64 81e9dd8a 868c26c0 8a8f7ac0 014e5a00 nt!IopSynchronousServiceTail+0x1d9
9c4ead00 81e87a61 868c26c0 851168d0 00000000 nt!IopXxxControlFile+0x6b7
9c4ead34 81ca8a7a 000001b4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
9c4ead34 779e9a94 000001b4 00000000 00000000 nt!KiFastCallEntry+0x12a
0d6ff800 00000000 00000000 00000000 00000000 0x779e9a94

STACK_COMMAND: kb

FOLLOWUP_IP:
ikfilesec+7861
823f7861 ?? ???

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: ikfilesec+7861

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ikfilesec

IMAGE_NAME: ikfilesec.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48967d17

FAILURE_BUCKET_ID: 0x19_20_ikfilesec+7861

BUCKET_ID: 0x19_20_ikfilesec+7861

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c15000 PsLoadedModuleList = 0x81d2cc70
Debug session time: Sat Sep 6 13:32:09.854 2008 (GMT-5)
System Uptime: 0 days 0:04:57.695
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 78233863, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041287, The subtype of the bugcheck.
Arg2: 78233863
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_41287

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

TRAP_FRAME: 8c18f99c -- (.trap 0xffffffff8c18f99c)
ErrCode = 00000000
eax=78233847 ebx=00000002 ecx=855e7ff4 edx=00000000 esi=c0022e08 edi=855e7af8
eip=81c5a7b4 esp=8c18fa10 ebp=8c18fa5c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!MiEmptyPageAccessLog+0xc3:
81c5a7b4 8b481c mov ecx,dword ptr [eax+1Ch] ds:0023:78233863=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c6fbb4 to 81cba155

STACK_TEXT:
8c18f984 81c6fbb4 00000000 78233863 00000000 nt!MmAccessFault+0x10a
8c18f984 81c5a7b4 00000000 78233863 00000000 nt!KiTrap0E+0xdc
8c18fa5c 81c5189f 855e7000 c0026590 00000000 nt!MiEmptyPageAccessLog+0xc3
8c18fa78 81c50a29 c080b620 c0026590 77467867 nt!MiAllocateAccessLog+0x5c
8c18fabc 81ca504a c0026590 8a680720 00000000 nt!MiLogPageAccess+0x40
8c18fc44 81ca49af 8a680720 00000001 8c18fc80 nt!MiAgeWorkingSet+0x253
8c18fc98 81ca43e4 00000002 8c18fcb4 00000001 nt!MiProcessWorkingSets+0x1ff
8c18fcd8 81c50612 00000000 84b64990 00000000 nt!MmWorkingSetManager+0x199
8c18fd7c 81deab18 00000000 10930a46 00000000 nt!KeBalanceSetManager+0x12a
8c18fdc0 81c43a3e 81c504e8 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+dc
81c6fbb4 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+dc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

FAILURE_BUCKET_ID: 0x1a_41287_nt!KiTrap0E+dc

BUCKET_ID: 0x1a_41287_nt!KiTrap0E+dc

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c1f000 PsLoadedModuleList = 0x81d36c70
Debug session time: Sat Sep 6 13:38:11.915 2008 (GMT-5)
System Uptime: 0 days 0:04:50.788
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {81f09575, 2, 8, 81f09575}

Probably caused by : Pool_Corruption ( nt!ExFreePool+f )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 81f09575, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81f09575, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d56868
Unable to read MiSystemVaType memory at 81d36420
81f09575

CURRENT_IRQL: 2

FAULTING_IP:
nt!VerifierBugCheckIfAppropriate+0
81f09575 8bff mov edi,edi

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: 805ecaa8 -- (.trap 0xffffffff805ecaa8)
ErrCode = 00000010
eax=000009d0 ebx=000001ff ecx=00000200 edx=00000099 esi=000000c2 edi=00000000
eip=81f09575 esp=805ecb1c ebp=805ecb30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!VerifierBugCheckIfAppropriate:
81f09575 8bff mov edi,edi
Resetting default scope

LAST_CONTROL_TRANSFER: from 81f09575 to 81c79d84

FAILED_INSTRUCTION_ADDRESS:
nt!VerifierBugCheckIfAppropriate+0
81f09575 8bff mov edi,edi

STACK_TEXT:
805ecaa8 81f09575 badb0d00 00000099 00000020 nt!KiTrap0E+0x2ac
805ecb18 81cf548d 853ac2a8 00000000 853ac2a0 nt!VerifierBugCheckIfAppropriate
805ecb30 81d0d3c2 853ac2a8 000009d0 00000000 nt!VerifierFreeTrackedPool+0x24
805ecba0 81d0c3ae 853ac2a8 00000000 805ecbbc nt!ExFreePoolWithTag+0x534
805ecbb0 8b712056 853ac2a8 805ecbd8 8b71c10c nt!ExFreePool+0xf
805ecbbc 8b71c10c 86d09e30 853ac2a8 876d7568 volsnap!ExFreeToNPagedLookasideList+0x1e
805ecbd8 8b713793 86d09c10 853ac2a8 85625f97 volsnap!VspFreeWriteContext+0x50
805ecbf4 81c590e4 876d74b0 85625de0 853ac2a8 volsnap!VspReadCompletionRoutine+0x39
805ecc28 8b7a6773 805ecc5c 8b7a6d4d 874d1ac8 nt!IopfCompleteRequest+0x11d
805ecc30 8b7a6d4d 874d1ac8 85625de0 00000001 CLASSPNP!ClassCompleteRequest+0x11
805ecc5c 81c590e4 00000000 853ea858 013ade40 CLASSPNP!TransferPktComplete+0x2b6
805ecc94 82340047 853adeec 805eccd8 82343658 nt!IopfCompleteRequest+0x11d
805ecca0 82343658 853ea858 00000001 00000000 storport!RaidCompleteRequestEx+0x1c
805eccd8 8234031f 860d4008 805d2b00 805ecd50 storport!RaidUnitCompleteRequest+0x8f
805ecce8 81cd5510 85d059cc 85d05958 00000000 storport!RaidpAdapterDpcRoutine+0x28
805ecd50 81cd3f9d 00000000 0000000e 2bc7ed1a nt!KiRetireDpcList+0x147
805ecd54 00000000 0000000e 2bc7ed1a 01c6fe6b nt!KiIdleLoop+0x49

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePool+f
81d0c3ae 5d pop ebp

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!ExFreePool+f

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xA_CODE_AV_BAD_IP_nt!ExFreePool+f

BUCKET_ID: 0xA_CODE_AV_BAD_IP_nt!ExFreePool+f

Followup: Pool_corruption
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-08.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c1d000 PsLoadedModuleList = 0x81d34c70
Debug session time: Sat Sep 6 13:50:34.112 2008 (GMT-5)
System Uptime: 0 days 0:11:11.969
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8564, 2, 0, 81c52482}

Probably caused by : memory_corruption ( nt!MiIdentifyPfn+64f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00008564, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c52482, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d54868
Unable to read MiSystemVaType memory at 81d34420
00008564

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiIdentifyPfn+64f
81c52482 8b500c mov edx,dword ptr [eax+0Ch]

CUSTOMER_CRASH_COUNT: 8

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: 9ccbb7e4 -- (.trap 0xffffffff9ccbb7e4)
ErrCode = 00000000
eax=00008558 ebx=855124b0 ecx=855e4312 edx=00000002 esi=855e4358 edi=02000000
eip=81c52482 esp=9ccbb858 ebp=9ccbb8b8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!MiIdentifyPfn+0x64f:
81c52482 8b500c mov edx,dword ptr [eax+0Ch] ds:0023:00008564=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c52482 to 81c77d84

STACK_TEXT:
9ccbb7e4 81c52482 badb0d00 00000002 9ccbb81c nt!KiTrap0E+0x2ac
9ccbb8b8 81cb0d1d 9ccbb864 025124b0 85512000 nt!MiIdentifyPfn+0x64f
9ccbb8ec 81e2fb8b 25c15ba4 9ccbb978 00000006 nt!MmQueryPfnList+0x130
9ccbb930 81e4ac1e 00000001 25c15b34 00000014 nt!PfpPfnPrioRequest+0xdc
9ccbb9a0 81e5619d 00000000 00000001 9ccbbd30 nt!PfQuerySuperfetchInformation+0xea
9ccbbd4c 81c74a7a 0000004f 02a3f148 00000014 nt!NtQuerySystemInformation+0x2201
9ccbbd4c 77489a94 0000004f 02a3f148 00000014 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
02a3f114 00000000 00000000 00000000 00000000 0x77489a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiIdentifyPfn+64f
81c52482 8b500c mov edx,dword ptr [eax+0Ch]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiIdentifyPfn+64f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-09.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c3f000 PsLoadedModuleList = 0x81d56c70
Debug session time: Sat Sep 6 13:56:57.558 2008 (GMT-5)
System Uptime: 0 days 0:05:12.397
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c, 2, 0, 81c74482}

Probably caused by : memory_corruption ( nt!MiIdentifyPfn+64f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c74482, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d76868
Unable to read MiSystemVaType memory at 81d56420
0000000c

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiIdentifyPfn+64f
81c74482 8b500c mov edx,dword ptr [eax+0Ch]

CUSTOMER_CRASH_COUNT: 9

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: 80f077e4 -- (.trap 0xffffffff80f077e4)
ErrCode = 00000000
eax=00000000 ebx=855972a0 ecx=855e4f00 edx=00000002 esi=855e4f58 edi=02000000
eip=81c74482 esp=80f07858 ebp=80f078b8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiIdentifyPfn+0x64f:
81c74482 8b500c mov edx,dword ptr [eax+0Ch] ds:0023:0000000c=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c74482 to 81c99d84

STACK_TEXT:
80f077e4 81c74482 badb0d00 00000002 80f0780c nt!KiTrap0E+0x2ac
80f078b8 81cd2d1d 80f07864 025972a0 85597000 nt!MiIdentifyPfn+0x64f
80f078ec 81e51b8b ce8aeeea 80f07978 00000006 nt!MmQueryPfnList+0x130
80f07930 81e6cc1e 8a5f4501 ce8aee7a 00000014 nt!PfpPfnPrioRequest+0xdc
80f079a0 81e7819d 00000000 8a5f4501 80f07d30 nt!PfQuerySuperfetchInformation+0xea
80f07d4c 81c96a7a 0000004f 029af268 00000014 nt!NtQuerySystemInformation+0x2201
80f07d4c 77899a94 0000004f 029af268 00000014 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
029af234 00000000 00000000 00000000 00000000 0x77899a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiIdentifyPfn+64f
81c74482 8b500c mov edx,dword ptr [eax+0Ch]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiIdentifyPfn+64f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-10.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c41000 PsLoadedModuleList = 0x81d58c70
Debug session time: Sat Sep 6 14:03:04.040 2008 (GMT-5)
System Uptime: 0 days 0:04:54.912
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {0, 2, 1, 81d2e218}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+213 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 81d2e218, address which referenced memory

Debugging Details:
------------------

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+213
81d2e218 893b mov dword ptr [ebx],edi

CUSTOMER_CRASH_COUNT: 10

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

TRAP_FRAME: 805ecacc -- (.trap 0xffffffff805ecacc)
ErrCode = 00000002
eax=855e61d8 ebx=00000000 ecx=000001ff edx=00000000 esi=855e6188 edi=00000000
eip=81d2e218 esp=805ecb40 ebp=805ecb78 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x213:
81d2e218 893b mov dword ptr [ebx],edi ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81d2e218 to 81c9bd84

STACK_TEXT:
805ecacc 81d2e218 badb0d00 00000000 805ecbf0 nt!KiTrap0E+0x2ac
805ecb78 81d2f6e0 81d436e0 00000001 00000000 nt!ExDeferredFreePool+0x213
805ecbe0 81c7e194 8563b418 00000000 88162564 nt!ExFreePoolWithTag+0x852
805ecbfc 81c7b31d 8563b418 00000001 853c1c00 nt!IopFreeIrp+0x56
805ecc28 8b7b2773 805ecc5c 8b7b2d4d 86d23ac8 nt!IopfCompleteRequest+0x352
805ecc30 8b7b2d4d 86d23ac8 8563b418 00000001 CLASSPNP!ClassCompleteRequest+0x11
805ecc5c 81c7b0e4 00000000 8a98eb70 013c1c00 CLASSPNP!TransferPktComplete+0x2b6
805ecc94 8234b047 853c1cac 805eccd8 8234e658 nt!IopfCompleteRequest+0x11d
805ecca0 8234e658 8a98eb70 00000001 00000000 storport!RaidCompleteRequestEx+0x1c
805eccd8 8234b31f 860ce008 805d2b00 805ecd50 storport!RaidUnitCompleteRequest+0x8f
805ecce8 81cf7510 85d2e9cc 85d2e958 00000000 storport!RaidpAdapterDpcRoutine+0x28
805ecd50 81cf5f9d 00000000 0000000e 27302931 nt!KiRetireDpcList+0x147
805ecd54 00000000 0000000e 27302931 04550306 nt!KiIdleLoop+0x49

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+213
81d2e218 893b mov dword ptr [ebx],edi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+213

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+213

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+213

Followup: Pool_corruption
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-11.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c4d000 PsLoadedModuleList = 0x81d64c70
Debug session time: Sat Sep 6 14:09:12.835 2008 (GMT-5)
System Uptime: 0 days 0:04:57.707
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 79cc2863, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041287, The subtype of the bugcheck.
Arg2: 79cc2863
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_41287

CUSTOMER_CRASH_COUNT: 11

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

TRAP_FRAME: 8c18f99c -- (.trap 0xffffffff8c18f99c)
ErrCode = 00000000
eax=79cc2847 ebx=00000010 ecx=855e5fbc edx=00000000 esi=c00221f8 edi=855e5f18
eip=81c927b4 esp=8c18fa10 ebp=8c18fa5c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!MiEmptyPageAccessLog+0xc3:
81c927b4 8b481c mov ecx,dword ptr [eax+1Ch] ds:0023:79cc2863=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81ca7bb4 to 81cf2155

STACK_TEXT:
8c18f984 81ca7bb4 00000000 79cc2863 00000000 nt!MmAccessFault+0x10a
8c18f984 81c927b4 00000000 79cc2863 00000000 nt!KiTrap0E+0xdc
8c18fa5c 81c8989f 855e5000 c0023a60 00000000 nt!MiEmptyPageAccessLog+0xc3
8c18fa78 81c88a29 c080b3b8 c0023a60 79965867 nt!MiAllocateAccessLog+0x5c
8c18fabc 81cdd04a c0023a60 8a6c51f0 00000000 nt!MiLogPageAccess+0x40
8c18fc44 81cdc9af 8a6c51f0 00000001 8c18fc80 nt!MiAgeWorkingSet+0x253
8c18fc98 81cdc3e4 00000002 8c18fcb4 00000001 nt!MiProcessWorkingSets+0x1ff
8c18fcd8 81c88612 00000000 84b64990 00000000 nt!MmWorkingSetManager+0x199
8c18fd7c 81e22b18 00000000 fc2dbeac 00000000 nt!KeBalanceSetManager+0x12a
8c18fdc0 81c7ba3e 81c884e8 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+dc
81ca7bb4 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+dc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

FAILURE_BUCKET_ID: 0x1a_41287_nt!KiTrap0E+dc

BUCKET_ID: 0x1a_41287_nt!KiTrap0E+dc

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-12.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c51000 PsLoadedModuleList = 0x81d68c70
Debug session time: Sat Sep 6 14:13:59.647 2008 (GMT-5)
System Uptime: 0 days 0:03:35.519
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 81c8eabc, 9e8cfb04, 0}

Probably caused by : memory_corruption ( nt!MiFindNodeOrParent+5 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81c8eabc, The address that the exception occurred at
Arg3: 9e8cfb04, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MiFindNodeOrParent+5
81c8eabc f7401400ffffff test dword ptr [eax+14h],0FFFFFF00h

TRAP_FRAME: 9e8cfb04 -- (.trap 0xffffffff9e8cfb04)
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=855844e8 edx=00000001 esi=8a290f80 edi=855e61c8
eip=81c8eabc esp=9e8cfb78 ebp=9e8cfb78 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!MiFindNodeOrParent+0x5:
81c8eabc f7401400ffffff test dword ptr [eax+14h],0FFFFFF00h ds:0023:00000014=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 12

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: itype.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81c9f3af to 81c8eabc

STACK_TEXT:
9e8cfb78 81c9f3af 9e8cfb8c 9e8cfbdc 81c96876 nt!MiFindNodeOrParent+0x5
9e8cfb84 81c96876 00000000 73f50002 73f5bfff nt!MiLocateAddressInTree+0x11
9e8cfbdc 81ce2932 855e6000 855844e8 85584720 nt!MiEmptyPageAccessLog+0x185
9e8cfca8 81ce1dc5 855844e8 8a7997b8 85584b48 nt!MiRemoveMappedView+0x5b0
9e8cfcd0 81e75c7d 85584b48 00000000 ffffffff nt!MiRemoveVadAndView+0xe3
9e8cfd34 81e75dce 855844e8 73f50000 00000000 nt!MiUnmapViewOfSection+0x265
9e8cfd54 81ca8a7a ffffffff 73f50000 0012f778 nt!NtUnmapViewOfSection+0x55
9e8cfd54 77939a94 ffffffff 73f50000 0012f778 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f778 00000000 00000000 00000000 00000000 0x77939a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiFindNodeOrParent+5
81c8eabc f7401400ffffff test dword ptr [eax+14h],0FFFFFF00h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiFindNodeOrParent+5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x8E_nt!MiFindNodeOrParent+5

BUCKET_ID: 0x8E_nt!MiFindNodeOrParent+5

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-13.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c1e000 PsLoadedModuleList = 0x81d35c70
Debug session time: Sat Sep 6 16:32:14.899 2008 (GMT-5)
System Uptime: 0 days 2:17:03.772
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 18, {84b10e38, 855e4ff0, 1, 1}

Probably caused by : ntkrpamp.exe ( nt!ObpWaitForMultipleObjects+2b4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 84b10e38, Object type of the object whose reference count is being lowered
Arg2: 855e4ff0, Object whose reference count is being lowered
Arg3: 00000001, Reserved
Arg4: 00000001, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 13

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x18

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81e3701c to 81c6f862

STACK_TEXT:
9b06b990 81e3701c ee83d553 00000030 00000030 nt!ObfDereferenceObject+0x66
9b06bbfc 81e36d23 00000030 00000001 00000001 nt!ObpWaitForMultipleObjects+0x2b4
9b06bd48 81c75a7a 00000030 002abf70 00000001 nt!NtWaitForMultipleObjects+0xcc
9b06bd48 777d9a94 00000030 002abf70 00000001 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0151fb28 00000000 00000000 00000000 00000000 0x777d9a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ObpWaitForMultipleObjects+2b4
81e3701c 85f6 test esi,esi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ObpWaitForMultipleObjects+2b4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

FAILURE_BUCKET_ID: 0x18_nt!ObpWaitForMultipleObjects+2b4

BUCKET_ID: 0x18_nt!ObpWaitForMultipleObjects+2b4

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-14.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c09000 PsLoadedModuleList = 0x81d20c70
Debug session time: Sat Sep 6 16:54:38.012 2008 (GMT-5)
System Uptime: 0 days 0:21:13.725
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c, 2, 0, 81c3e482}

Probably caused by : memory_corruption ( nt!MiIdentifyPfn+64f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c3e482, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 81d40868
Unable to read MiSystemVaType memory at 81d20420
0000000c

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiIdentifyPfn+64f
81c3e482 8b500c mov edx,dword ptr [eax+0Ch]

CUSTOMER_CRASH_COUNT: 14

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: 9d42f7e4 -- (.trap 0xffffffff9d42f7e4)
ErrCode = 00000000
eax=00000000 ebx=8a84c150 ecx=855e4b20 edx=00000002 esi=855e4b78 edi=02000000
eip=81c3e482 esp=9d42f858 ebp=9d42f8b8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiIdentifyPfn+0x64f:
81c3e482 8b500c mov edx,dword ptr [eax+0Ch] ds:0023:0000000c=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c3e482 to 81c63d84

STACK_TEXT:
9d42f7e4 81c3e482 badb0d00 00000002 9d42f80c nt!KiTrap0E+0x2ac
9d42f8b8 81c9cd1d 9d42f864 0284c150 8a84c000 nt!MiIdentifyPfn+0x64f
9d42f8ec 81e1bb8b 9533f192 9d42f978 00000006 nt!MmQueryPfnList+0x130
9d42f930 81e36c1e 00000001 9533f102 00000014 nt!PfpPfnPrioRequest+0xdc
9d42f9a0 81e4219d 00000000 00000001 9d42fd30 nt!PfQuerySuperfetchInformation+0xea
9d42fd4c 81c60a7a 0000004f 01caf544 00000014 nt!NtQuerySystemInformation+0x2201
9d42fd4c 77839a94 0000004f 01caf544 00000014 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01caf510 00000000 00000000 00000000 00000000 0x77839a94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiIdentifyPfn+64f
81c3e482 8b500c mov edx,dword ptr [eax+0Ch]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiIdentifyPfn+64f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

BUCKET_ID: 0xA_nt!MiIdentifyPfn+64f

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini090608-15.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c4d000 PsLoadedModuleList = 0x81d64c70
Debug session time: Sat Sep 6 17:35:08.976 2008 (GMT-5)
System Uptime: 0 days 0:39:20.848
Loading Kernel Symbols
........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 2, 1, 81c1dff9}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+2ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c1dff9, address which referenced memory

Debugging Details:
------------------

WORKER_ROUTINE:
+1
00000001 ?? ???

WORK_ITEM: 81c1dff9

CURRENT_IRQL: 2

CUSTOMER_CRASH_COUNT: 15

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: 8dc3ca48 -- (.trap 0xffffffff8dc3ca48)
ErrCode = 00000002
eax=8dc3cacc ebx=ac2d864c ecx=855e4638 edx=00000001 esi=8a2a1d78 edi=855e4604
eip=81c1dff9 esp=8dc3cabc ebp=8dc3cad8 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29:
81c1dff9 8902 mov dword ptr [edx],eax ds:0023:00000001=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c1dff9 to 81ca7d84

STACK_TEXT:
8dc3ca48 81c1dff9 badb0d00 00000001 ab782260 nt!KiTrap0E+0x2ac
8dc3cab8 81c9ec36 855e4604 85518fa0 ac2d864c hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29
8dc3cad8 807ee381 855e4604 00000001 ac2d8618 nt!ExAcquireResourceExclusiveLite+0x25
8dc3caf0 81e73cdc 85518fa4 14ecdd31 00000000 fltmgr!DeleteStreamListCtrlCallback+0x25
8dc3cb30 8b6a8d9b ac2d8618 ac2d8528 ac2d8618 nt!FsRtlTeardownPerStreamContexts+0x135
8dc3cb4c 8b693e6c 00000703 ac2d8550 00000000 Ntfs!NtfsDeleteScb+0x1f4
8dc3cb64 8b61a15a 8576ce28 ac2d8618 00000000 Ntfs!NtfsRemoveScb+0xc0
8dc3cb80 8b61de61 8576ce28 ac2d8528 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x59
8dc3cbd8 8b693ce0 8576ce28 87d5e0d8 ac2dc008 Ntfs!NtfsTeardownFromLcb+0x29d
8dc3cc28 8b61bbde 8576ce28 ac2dc0f8 012dc298 Ntfs!NtfsTeardownStructures+0xed
8dc3cc50 8b699b66 8576ce28 ac2dc0f8 ac2dc298 Ntfs!NtfsDecrementCloseCounts+0xad
8dc3ccb0 8b6a81d4 8576ce28 ac2dc0f8 ac2dc008 Ntfs!NtfsCommonClose+0x4da
8dc3cd44 81c8541d 00000000 00000000 8a2a1d78 Ntfs!NtfsFspClose+0x117
8dc3cd7c 81e22b18 00000000 14ecdbc1 00000000 nt!ExpWorkerThread+0xfd
8dc3cdc0 81c7ba3e 81c85320 80000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+2ac
81ca7d84 833d64bcd78100 cmp dword ptr [nt!KiFreezeFlag (81d7bc64)],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+2ac

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4812bd71

FAILURE_BUCKET_ID: 0xA_nt!KiTrap0E+2ac

BUCKET_ID: 0xA_nt!KiTrap0E+2ac

Followup: MachineOwner
---------

Lev · Sep 8, 2008

You may find this link helpful in determining the cause of the problem

http://forums.majorgeeks.com/showthread.php?t=35246

wildchild0683 · Sep 9, 2008

I did that. That's how i got these results.

Lev · Sep 9, 2008

Threads merged

Lev · Sep 9, 2008

wildchild0683 said: ↑

I did that. That's how i got these results.
Click to expand...

The link I gave you goes on to show you how to read the mini-dump files you have now succeeded in obtaining. Takes a little time and patience to work through, but it really is an excellent guide.

Cat_w_9_lives · Sep 10, 2008

What are you doing when it crashes?
Have you added or changed any hardware?
Did you change any settings?
Did you install a SP or other software?

I'm not an advanced user and memory dumps are iffy at times. If crashes are random, would look at heat issue...or graphics card then test memory. I would check for dust balls - check your fan.
Depends on what you've done too.

look like a general failure then cascading...but not sure...
nvlddmkm.sys - graphics driver
fltmgr.sys - RAM related maybe
ntkrpamp.exe - not sure, too many options
taskeng.exe - stops, starts manages
luafv.sys - Win. filter driver

Sorry I can't be of more help, but hope it give you somewhere to start.

Log in or Sign up

Minidump Results

wildchild0683 Private E-2

Novice MajorGeek

wildchild0683 Private E-2

wildchild0683 Private E-2

Lev MajorGeek

wildchild0683 Private E-2

Lev MajorGeek

Lev MajorGeek

Cat_w_9_lives Major KittyCat