Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021611-25958-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02800000 PsLoadedModuleList = 0xfffff800`02a3de50
Debug session time: Wed Feb 16 14:38:51.130 2011 (UTC - 5:00)
System Uptime: 1 days 6:51:22.738
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa80020ce680, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80020ce680
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800028e3f9e to fffff80002870740
STACK_TEXT:
fffff880`029f8718 fffff800`028e3f9e : 00000000`0000001a 00000000`00041790 fffffa80`020ce680 00000000`0000ffff : nt!KeBugCheckEx
fffff880`029f8720 fffff800`02843c13 : ffffffff`00000000 00000000`10120fff fffffa80`00000000 fffffa80`05bbb930 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`029f88e0 fffff800`02b53abf : fffff8a0`02666060 fffff880`029f8be0 00000000`00000000 fffffa80`05bbb930 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`029f8930 fffff800`02b2d735 : 00000000`40010004 00000000`40010001 000007ff`fffdb000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`029f89f0 fffff800`0284d1cb : 00000000`00000100 fffffa80`05bbb9f0 00000000`00000001 fffff800`02877b9d : nt!PsExitSpecialApc+0x1d
fffff880`029f8a20 fffff800`0284d610 : 00000000`00000000 fffff880`029f8aa0 fffff800`02b2d84c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`029f8aa0 fffff800`0286fa37 : fffffa80`05bbb930 00000000`ffffffff 00000000`00000000 fffffa80`0532a160 : nt!KiInitiateUserApc+0x70
fffff880`029f8be0 00000000`77a8f6fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`01dcf418 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a8f6fa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33906
fffff800`028e3f9e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33906
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021711-20373-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02817000 PsLoadedModuleList = 0xfffff800`02a54e50
Debug session time: Thu Feb 17 14:44:41.393 2011 (UTC - 5:00)
System Uptime: 0 days 0:02:42.001
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 34, {50830, fffff880060414d8, fffff88006040d40, fffff80002875a45}
Probably caused by : memory_corruption ( nt!MiFlushSectionInternal+b1c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880060414d8
Arg3: fffff88006040d40
Arg4: fffff80002875a45
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880060414d8 -- (.exr 0xfffff880060414d8)
ExceptionAddress: fffff80002875a45 (nt!MiFlushSectionInternal+0x0000000000000b1c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88006040d40 -- (.cxr 0xfffff88006040d40)
rax=0000000000000002 rbx=017ffa8001e99b70 rcx=fffff80002a01e80
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000048
rip=fffff80002875a45 rsp=fffff88006041710 rbp=fffff88006041878
r8=0000058000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff80002a01e80 r12=0000000000000000 r13=0000000000000001
r14=fffff88006041880 r15=fffff8a0034203b0
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!MiFlushSectionInternal+0xb1c:
fffff800`02875a45 f00fba6b1000 lock bts dword ptr [rbx+10h],0 ds:002b:017ffa80`01e99b80=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002abf0e0
ffffffffffffffff
FOLLOWUP_IP:
nt!MiFlushSectionInternal+b1c
fffff800`02875a45 f00fba6b1000 lock bts dword ptr [rbx+10h],0
FAULTING_IP:
nt!MiFlushSectionInternal+b1c
fffff800`02875a45 f00fba6b1000 lock bts dword ptr [rbx+10h],0
BUGCHECK_STR: 0x34
LAST_CONTROL_TRANSFER: from fffff80002873804 to fffff80002875a45
STACK_TEXT:
fffff880`06041710 fffff800`02873804 : fffff8a0`034203a0 fffff8a0`034203b0 fffffa80`04b2fa90 fffffa80`04b2fa90 : nt!MiFlushSectionInternal+0xb1c
fffff880`06041950 fffff800`02873259 : 00000000`00002896 00000000`00000000 00000000`00002000 00000000`00000000 : nt!MmFlushSection+0xa4
fffff880`06041a10 fffff800`0287a94b : fffffa80`0620fb28 fffff800`00000001 00000000`00000001 fffffa80`00002000 : nt!CcFlushCache+0x5e9
fffff880`06041b10 fffff800`0287b520 : fffff880`03b44d00 fffff880`06041c18 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x1eb
fffff880`06041bc0 fffff800`02894961 : fffffa80`03a08190 fffff800`02b81920 fffff800`02a8e140 fffffa80`06330220 : nt!CcWorkerThread+0x1c8
fffff880`06041c70 fffff800`02b2a7c6 : 00000000`00000000 fffffa80`04db7660 00000000`00000080 fffffa80`0396d890 : nt!ExpWorkerThread+0x111
fffff880`06041d00 fffff800`02865c26 : fffff800`02a01e80 fffffa80`04db7660 fffffa80`039e0b60 fffff880`01212534 : nt!PspSystemThreadStartup+0x5a
fffff880`06041d40 00000000`00000000 : fffff880`06042000 fffff880`0603c000 fffff880`06040ce0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiFlushSectionInternal+b1c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
STACK_COMMAND: .cxr 0xfffff88006040d40 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x34_nt!MiFlushSectionInternal+b1c
BUCKET_ID: X64_0x34_nt!MiFlushSectionInternal+b1c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021711-13696-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02803000 PsLoadedModuleList = 0xfffff800`02a40e50
Debug session time: Thu Feb 17 13:55:06.282 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:14.890
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88002fcb598, fffff88002fcae00, fffff80002856cbf}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+108 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002fcb598
Arg3: fffff88002fcae00
Arg4: fffff80002856cbf
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88002fcb598 -- (.exr 0xfffff88002fcb598)
ExceptionAddress: fffff80002856cbf (nt!RtlDeleteNoSplay+0x0000000000000093)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88002fcae00 -- (.cxr 0xfffff88002fcae00)
rax=fffff8a00207e1d8 rbx=fffffa8006599a90 rcx=0008000000000000
rdx=fffffa8006599a90 rsi=ffffffffffffffff rdi=0000000000000000
rip=fffff80002856cbf rsp=fffff88002fcb7d0 rbp=fffffa8006599a90
r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff800029f7280
r11=fffff8a00207e1d8 r12=0000000000000705 r13=0000000000000000
r14=fffffa8006599a48 r15=fffff8a001d8fed8
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!RtlDeleteNoSplay+0x93:
fffff800`02856cbf 488909 mov qword ptr [rcx],rcx ds:002b:00080000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aab0e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsDeleteScb+108
fffff880`012aebcc 488b03 mov rax,qword ptr [rbx]
FAULTING_IP:
nt!RtlDeleteNoSplay+93
fffff800`02856cbf 488909 mov qword ptr [rcx],rcx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880010f7373 to fffff80002856cbf
STACK_TEXT:
fffff880`02fcb7d0 fffff880`010f7373 : fffffa80`04ad3668 fffffa80`05a106a0 fffffa80`05a10700 ffffffff`ffffffff : nt!RtlDeleteNoSplay+0x93
fffff880`02fcb800 fffff880`010f3238 : ffffffff`ffffffff fffff8a0`018873f0 fffffa80`6e664d46 fffff880`010fc66e : fltmgr!TreeUnlinkNoBalance+0x13
fffff880`02fcb830 fffff880`0111135c : 00000000`00000130 fffff8a0`01d8f700 00000000`000007ff 00000000`00000040 : fltmgr!TreeUnlinkMulti+0x148
fffff880`02fcb880 fffff880`01113bc1 : fffffa80`04ad3010 00000000`00000130 fffff8a0`01d8fc70 fffff8a0`01d8fc70 : fltmgr!FltpDeleteContextList+0x3c
fffff880`02fcb8b0 fffff880`01113b7b : fffffa80`04ad3010 fffff8a0`01d8fed8 fffffa80`04ad3010 fffff800`02849c0a : fltmgr!CleanupStreamListCtrl+0x21
fffff880`02fcb8e0 fffff800`02b605a6 : 00000000`00000001 fffff880`012af0b8 fffff8a0`01d8fda0 fffff880`012226e1 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`02fcb910 fffff880`012aebcc : fffff8a0`01d8fc70 fffffa80`039e0040 fffff880`02fcb9e8 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`02fcb960 fffff880`012ae8d5 : fffff800`01010000 00000000`00000000 fffff800`02a18500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`02fcb9a0 fffff880`01221cb4 : fffff8a0`01d8fb70 fffff8a0`01d8fc70 fffff800`02a18500 fffff880`02fcbb12 : Ntfs!NtfsRemoveScb+0x61
fffff880`02fcb9e0 fffff880`012ac2dc : fffff8a0`01d8fb40 fffff800`02a185a0 fffff880`02fcbb12 fffffa80`05b58c60 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`02fcba10 fffff880`0122a882 : fffffa80`05b58c60 fffffa80`05b58c60 fffff8a0`01d8fb40 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`02fcba90 fffff880`012c3813 : fffffa80`05b58c60 fffff800`02a185a0 fffff8a0`01d8fb40 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`02fcbad0 fffff880`0129d38f : fffffa80`05b58c60 fffff8a0`01d8fc70 fffff8a0`01d8fb40 fffffa80`04919180 : Ntfs!NtfsCommonClose+0x353
fffff880`02fcbba0 fffff800`02880961 : 00000000`00000000 fffff880`0129d200 fffffa80`039e0001 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`02fcbc70 fffff800`02b167c6 : 00000000`00000000 fffffa80`039e0040 00000000`00000080 fffffa80`0396d890 : nt!ExpWorkerThread+0x111
fffff880`02fcbd00 fffff800`02851c26 : fffff880`009e8180 fffffa80`039e0040 fffff880`009f2f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fcbd40 00000000`00000000 : fffff880`02fcc000 fffff880`02fc6000 fffff880`02fcb9b0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: Ntfs!NtfsDeleteScb+108
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88002fcae00 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
Followup: MachineOwner
---------