042912-32729-01.dmp -------------------------------------------- Microsoft ® Windows Debugger Version 6.11.0001.404 AMD64 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Mars\Desktop\minidump\042912-32729-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Users\Mars\Desktop\minidump*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505 Machine Name: Kernel base = 0xfffff800`0305b000 PsLoadedModuleList = 0xfffff800`0329f650 Debug session time: Sun Apr 29 16:22:31.946 2012 (GMT+2) System Uptime: 0 days 0:08:11.242 Loading Kernel Symbols ............................................................... ................................................................ ................................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {41790, fffffa8006044400, ffff, 0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+355d4 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, The subtype of the bugcheck. Arg2: fffffa8006044400 Arg3: 000000000000ffff Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0x1a_41790 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: avgntdumpa.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80003146510 to fffff800030d7c80 STACK_TEXT: fffff880`10caf4e8 fffff800`03146510 : 00000000`0000001a 00000000`00041790 fffffa80`06044400 00000000`0000ffff : nt!KeBugCheckEx fffff880`10caf4f0 fffff800`030c44bf : fffffa80`00000000 00000000`0069ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x355d4 fffff880`10caf6b0 fffff800`030d6f13 : ffffffff`ffffffff fffff880`10caf988 fffff880`10caf998 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f fffff880`10caf7b0 fffff800`030d34d0 : fffff800`033ac8ca fffffa80`0ed3e310 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 fffff880`10caf948 fffff800`033ac8ca : fffffa80`0ed3e310 00000000`00000000 00000000`00000000 00000000`00000030 : nt!KiServiceLinkage fffff880`10caf950 fffff800`033acc4d : fffff880`00000000 00000000`0069fe00 000007ff`fffdc000 00000000`00000000 : nt!PspExitThread+0x5ba fffff880`10cafa50 fffff800`033acd55 : fffffa80`0ed3e310 00000000`00000000 fffffa80`0ed3e310 00000000`00000000 : nt!PspTerminateThreadByPointer+0x4d fffff880`10cafaa0 fffff800`030d6f13 : 00000000`00000000 fffff880`10cafb60 00000000`00000000 00000000`00000000 : nt!NtTerminateThread+0x45 fffff880`10cafae0 00000000`77a7184a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0069fe88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a7184a STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+355d4 fffff800`03146510 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+355d4 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55 FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4 BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4 Followup: MachineOwner --------- --------------------------------------------- 040512-32354-01.dmp -------------------------------------------- Microsoft ® Windows Debugger Version 6.11.0001.404 AMD64 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Mars\Desktop\minidump\040512-32354-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Users\Mars\Desktop\minidump*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03068000 PsLoadedModuleList = 0xfffff800`032ac650 Debug session time: Thu Apr 5 07:37:43.725 2012 (GMT+2) System Uptime: 0 days 13:01:57.021 Loading Kernel Symbols ............................................................... ................................................................ .................................... Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000009F, {4, 258, fffffa8006704680, fffff80000b9c3d0} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_POWER_STATE_FAILURE (9f) A driver is causing an inconsistent power state. Arguments: Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp subsystem. Arg2: 0000000000000258, Timeout in seconds. Arg3: fffffa8006704680, The thread currently holding on to the Pnp lock. Arg4: fffff80000b9c3d0 Debugging Details: ------------------ DRVPOWERSTATE_SUBCODE: 4 FAULTING_THREAD: fffffa8006704680 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x9F PROCESS_NAME: System CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff800030da6c2 to fffff800030e7c8a STACK_TEXT: fffff880`033a1060 fffff800`030da6c2 : fffffa80`06704680 fffffa80`06704680 fffff800`03513910 00000000`0000000c : nt!KiSwapContext+0x7a fffff880`033a11a0 fffff800`030ebbaf : fffffa80`096ae5f8 00000000`00000001 00000000`00000000 fffffa80`096ae5f8 : nt!KiCommitThreadWait+0x1d2 fffff880`033a1230 fffff880`01ad8194 : 00000000`0dbea500 fffff800`00000000 00000000`00000000 00000000`00000000 : nt!KeWaitForSingleObject+0x19f fffff880`033a12d0 fffff880`01af4207 : 00000000`00000000 00000000`00008000 fffffa80`0bbeb8e0 00000000`00000000 : volsnap!VspAcquire+0x24 fffff880`033a1310 fffff880`01ac08f9 : fffffa80`096ae301 ffffffff`80001ca4 fffffa80`096ae83c fffff880`033a192c : volsnap!VspOpenAndValidateDiffAreaFiles+0x497 fffff880`033a13f0 fffff800`0334e87c : fffff8a0`048e9100 fffff8a0`048e9200 fffff880`033a1950 fffff800`00000000 : volsnap! ?? ::FNODOBFM::`string'+0xdc5 fffff880`033a1860 fffff800`0334d153 : fffff8a0`180abda0 fffff880`033a1928 fffff800`0321d518 00000000`00000000 : nt!PnpNotifyDriverCallback+0x5c fffff880`033a18f0 fffff800`0355dab4 : 00000000`00000000 fffff8a0`1f1b6310 fffffa80`0c06002e fffff8a0`00000004 : nt!PnpNotifyTargetDeviceChange+0x16b fffff880`033a19a0 fffff800`0355e29c : fffff880`00000000 fffffa80`090b5100 fffffa80`06704600 fffffa80`00000006 : nt!PnpProcessQueryRemoveAndEject+0xaa4 fffff880`033a1ae0 fffff800`0344756e : 00000000`00000000 fffffa80`090b5170 fffff8a0`15d56860 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0x4c fffff880`033a1b10 fffff800`030ee471 : fffff800`0334d958 fffff8a0`1f1b6310 fffff800`032842b8 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x5aeab fffff880`033a1b70 fffff800`0337ef7a : 00000000`00000000 fffffa80`06704680 00000000`00000080 fffffa80`066ee6f0 : nt!ExpWorkerThread+0x111 fffff880`033a1c00 fffff800`030d59c6 : fffff880`031d7180 fffffa80`06704680 fffff880`031e1fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`033a1c40 00000000`00000000 : fffff880`033a2000 fffff880`0339c000 fffff880`10be44d0 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: .thread 0xfffffa8006704680 ; kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff800030e7fb3 - nt!SwapContext_PatchXSave+2 [ 01:21 ] 1 error : !nt (fffff800030e7fb3) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption --------- -------------------------------------------- 050112-29530.dmp ------------------------------------------- Microsoft ® Windows Debugger Version 6.11.0001.404 AMD64 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Mars\Desktop\minidump\050112-29530-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Users\Mars\Desktop\minidump*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505 Machine Name: Kernel base = 0xfffff800`03067000 PsLoadedModuleList = 0xfffff800`032ab650 Debug session time: Tue May 1 20:43:45.294 2012 (GMT+2) System Uptime: 0 days 1:00:08.589 Loading Kernel Symbols ............................................................... ................................................................ ............................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck DE, {2, fffff8a024ac7010, fffff8a00f2be073, 205c18c0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2ce51 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* POOL_CORRUPTION_IN_FILE_AREA (de) A driver corrupted pool memory used for holding pages destined for disk. This was discovered by the memory manager when dereferencing the file. Arguments: Arg1: 0000000000000002 Arg2: fffff8a024ac7010 Arg3: fffff8a00f2be073 Arg4: 00000000205c18c0 Debugging Details: ------------------ CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xDE PROCESS_NAME: cmdagent.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff8000309984d to fffff800030e3c80 STACK_TEXT: fffff880`0ec65738 fffff800`0309984d : 00000000`000000de 00000000`00000002 fffff8a0`24ac7010 fffff8a0`0f2be073 : nt!KeBugCheckEx fffff880`0ec65740 fffff800`030b1902 : 00000000`00000000 fffffa80`0e488500 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2ce51 fffff880`0ec65830 fffff880`0148051b : fffffa80`0f96d918 00000000`00000000 fffff8a0`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172 fffff880`0ec658a0 fffff880`014a1033 : fffff880`0efd45f0 fffff8a0`24612010 fffff8a0`077c4140 fffff880`0ec65ba8 : Ntfs!NtfsDeleteFile+0x57b fffff880`0ec65b20 fffff880`0140fcc9 : fffffa80`0e425630 fffffa80`11ee2c60 fffff880`0efd4550 fffffa80`09278060 : Ntfs!NtfsCommonCleanup+0x1653 fffff880`0ec65f30 fffff800`030db777 : fffff880`0efd4550 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19 fffff880`0ec65f60 fffff800`030db738 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27 fffff880`0efd4420 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+2ce51 fffff800`0309984d cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2ce51 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55 FAILURE_BUCKET_ID: X64_0xDE_nt!_??_::FNODOBFM::_string_+2ce51 BUCKET_ID: X64_0xDE_nt!_??_::FNODOBFM::_string_+2ce51 Followup: MachineOwner --------- ------------------------------------------- 050312-25880-01.dmp --------------------------------------------- Microsoft ® Windows Debugger Version 6.11.0001.404 AMD64 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Mars\Desktop\minidump\050312-25880-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Users\Mars\Desktop\minidump*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505 Machine Name: Kernel base = 0xfffff800`03253000 PsLoadedModuleList = 0xfffff800`03497650 Debug session time: Thu May 3 15:18:03.931 2012 (GMT+2) System Uptime: 0 days 2:04:06.227 Loading Kernel Symbols ............................................................... ................................................................ .............................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {41790, fffffa8006044430, ffff, 0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+355d4 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, The subtype of the bugcheck. Arg2: fffffa8006044430 Arg3: 000000000000ffff Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0x1a_41790 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: rundll32.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff8000333e510 to fffff800032cfc80 STACK_TEXT: fffff880`107d06e8 fffff800`0333e510 : 00000000`0000001a 00000000`00041790 fffffa80`06044430 00000000`0000ffff : nt!KeBugCheckEx fffff880`107d06f0 fffff800`033029c9 : 00000000`00000000 00000000`75227fff fffffa80`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x355d4 fffff880`107d08b0 fffff800`035e6001 : fffffa80`06f91550 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9 fffff880`107d09d0 fffff800`035e6403 : 00000000`00000000 00000000`75220000 fffffa80`00000001 fffffa80`0dd57ea0 : nt!MiUnmapViewOfSection+0x1b1 fffff880`107d0a90 fffff800`032cef13 : fffffa80`06892850 fffff880`107d0b60 fffffa80`0ba28060 00000000`00000026 : nt!NtUnmapViewOfSection+0x5f fffff880`107d0ae0 00000000`77a915ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`001bb7e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a915ba STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+355d4 fffff800`0333e510 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+355d4 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55 FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4 BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355d4 Followup: MachineOwner ---------