Interpreting BSOD dump files

OSR_Community_User · May 11, 2007, 10:02am

Is there a tutorial somewhere that gives hints on how to interpret the information from a BSOD? I have included some information from WinDbg below, and from that it looks like a CLI exception that occurs inside NTOSKRNL, but I can’t see how to figure out who called into NTOSKRNL, or if this was all initiated by an interrupt. If anyone could let me know how to do this, or point me to information, or point me to a better mailist list, I’d appreciate it.

Thank you.

Loading Dump File [C:\tmp\tg\saved logs_141\Mini050807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Tue May 8 10:27:42.609 2007 (GMT-7)
System Uptime: 2 days 21:57:25.609
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
…
Loading User Symbols
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80833de3, b75c6cf0, 0}

Probably caused by : hardware ( nt!CcSetDirtyInMask+2a2 )

Followup: MachineOwner

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80833de3, The address that the exception occurred at
Arg3: b75c6cf0, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx” referenced memory at “0x%08lx”. The memory could not be “%s”.

FAULTING_IP:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

TRAP_FRAME: b75c6cf0 – (.trap ffffffffb75c6cf0)
ErrCode = 00000000
eax=00000000 ebx=b75c6d9c ecx=00000001 edx=00000000 esi=00000001 edi=00000003
eip=80833de3 esp=b75c6d64 ebp=b75c6d64 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CcSetDirtyInMask+0x2a2:
80833de3 fa cli
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

CLI_FAULT_INSTR:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

LAST_CONTROL_TRANSFER: from 00000000 to 80833de3

STACK_TEXT:
b75c6d64 00000000 badb0d00 00000000 80a803d9 nt!CcSetDirtyInMask+0x2a2

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CcSetDirtyInMask+2a2

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: CLI_FAULT

BUCKET_ID: CLI_FAULT

Followup: MachineOwner

0: kd> lvm
^ Syntax error in ‘lvm’
0: kd> lmv
start end module name
80800000 80a7a000 nt M (pdb symbols) c:\WINDOWS\Symbols\exe\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Image path: \WINDOWS\system32\ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Fri Feb 16 23:29:03 2007 (45D6A0AF)
CheckSum: 00267A4F
ImageSize: 0027A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
80a7a000 80aa6000 hal (deferred)
Image path: \WINDOWS\system32\hal.dll
Image name: hal.dll
Timestamp: Fri Feb 16 22:48:26 2007 (45D6972A)
CheckSum: 00021C2C
ImageSize: 0002C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b744f000 b7457900 npf (deferred)
Image path: \SystemRoot\system32\drivers\npf.sys
Image name: npf.sys
Timestamp: Thu Jan 25 10:18:17 2007 (45B8E659)
CheckSum: 000195B6
ImageSize: 00008900
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b91bf000 b91ea000 RDPWD (deferred)
Image path: \SystemRoot\System32\Drivers\RDPWD.SYS
Image name: RDPWD.SYS
Timestamp: Fri Feb 16 22:44:38 2007 (45D69646)
CheckSum: 00027066
ImageSize: 0002B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b91ea000 b91ff000 dm3nk (deferred)
Image path: \SystemRoot\system32\DRIVERS\dm3nk.sys
Image name: dm3nk.sys
Timestamp: Wed Feb 15 07:58:04 2006 (43F3417C)
CheckSum: 000377C4
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b99a7000 b9a04000 srv (deferred)
Image path: \SystemRoot\system32\DRIVERS\srv.sys
Image name: srv.sys
Timestamp: Fri Feb 16 23:27:20 2007 (45D6A048)
CheckSum: 0005AEFC
ImageSize: 0005D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9aa4000 b9abc000 mqac (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\mqac.sys
Image name: mqac.sys
Timestamp: Fri Feb 16 22:44:18 2007 (45D69632)
CheckSum: 00023E1E
ImageSize: 00018000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9b34000 b9b84000 HTTP (deferred)
Image path: \SystemRoot\System32\Drivers\HTTP.sys
Image name: HTTP.sys
Timestamp: Fri Feb 16 23:28:12 2007 (45D6A07C)
CheckSum: 00056124
ImageSize: 00050000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9bd4000 b9bdf000 TDTCP (deferred)
Image path: \SystemRoot\System32\Drivers\TDTCP.SYS
Image name: TDTCP.SYS
Timestamp: Fri Feb 16 22:44:32 2007 (45D69640)
CheckSum: 0000F683
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9ccc000 b9cf6000 Fastfat (deferred)
Image path: \SystemRoot\System32\Drivers\Fastfat.SYS
Image name: Fastfat.SYS
Timestamp: Fri Feb 16 23:27:55 2007 (45D6A06B)
CheckSum: 0002CC8F
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9cf6000 b9d9d400 hardlock (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\hardlock.sys
Image name: hardlock.sys
Timestamp: Wed Jul 27 06:08:29 2005 (42E7874D)
CheckSum: 000AAD87
ImageSize: 000A7400
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9e1a000 b9e1d000 smtkstub (deferred)
Image path: \SystemRoot\system32\DRIVERS\smtkstub.dll
Image name: smtkstub.dll
Timestamp: Tue Jul 11 12:17:49 2006 (44B3F95D)
CheckSum: 0000BDC5
ImageSize: 00003000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9e1e000 b9e21700 apicdrv (deferred)
Image path: \SystemRoot\system32\DRIVERS\apicdrv.sys
Image name: apicdrv.sys
Timestamp: Tue Jul 11 12:17:49 2006 (44B3F95D)
CheckSum: 00009B7A
ImageSize: 00003700
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9f2e000 b9f5d000 RMCAST (deferred)
Image path: \SystemRoot\system32\DRIVERS\RMCAST.sys
Image name: RMCAST.sys
Timestamp: Fri Feb 16 22:57:43 2007 (45D69957)
CheckSum: 0002455F
ImageSize: 0002F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba16f000 ba18c000 dump_atapi (deferred)
Image path: \SystemRoot\System32\Drivers\dump_atapi.sys
Image name: dump_atapi.sys
Timestamp: Fri Feb 16 23:07:34 2007 (45D69BA6)
CheckSum: 0001D4C5
ImageSize: 0001D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba18c000 ba1a1000 Cdfs (deferred)
Image path: \SystemRoot\System32\Drivers\Cdfs.SYS
Image name: Cdfs.SYS
Timestamp: Fri Feb 16 23:27:08 2007 (45D6A03C)
CheckSum: 00015D3A
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba1a1000 ba1b2000 Fips (deferred)
Image path: \SystemRoot\System32\Drivers\Fips.SYS
Image name: Fips.SYS
Timestamp: Fri Feb 16 23:26:33 2007 (45D6A019)
CheckSum: 0000B9EB
ImageSize: 00011000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba1b2000 ba228000 mrxsmb (deferred)
Image path: \SystemRoot\system32\DRIVERS\mrxsmb.sys
Image name: mrxsmb.sys
Timestamp: Fri Feb 16 23:28:15 2007 (45D6A07F)
CheckSum: 00074736
ImageSize: 00076000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba250000 ba280000 rdbss (deferred)
Image path: \SystemRoot\system32\DRIVERS\rdbss.sys
Image name: rdbss.sys
Timestamp: Fri Feb 16 23:27:37 2007 (45D6A059)
CheckSum: 000346F8
ImageSize: 00030000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba280000 ba28a000 ndisuio (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndisuio.sys
Image name: ndisuio.sys
Timestamp: Fri Feb 16 22:58:25 2007 (45D69981)
CheckSum: 00004C9B
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba320000 ba34a000 afd (deferred)
Image path: \SystemRoot\System32\drivers\afd.sys
Image name: afd.sys
Timestamp: Fri Feb 16 23:28:16 2007 (45D6A080)
CheckSum: 00025770
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba34a000 ba37b000 netbt (deferred)
Image path: \SystemRoot\system32\DRIVERS\netbt.sys
Image name: netbt.sys
Timestamp: Fri Feb 16 23:28:57 2007 (45D6A0A9)
CheckSum: 0002E9F6
ImageSize: 00031000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba37b000 ba3cb080 akshasp (deferred)
Image path: \SystemRoot\system32\DRIVERS\akshasp.sys
Image name: akshasp.sys
Timestamp: Fri Jun 10 02:24:13 2005 (42A95C3D)
CheckSum: 00059009
ImageSize: 00050080
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba3cc000 ba45c000 tcpip (deferred)
Image path: \SystemRoot\system32\DRIVERS\tcpip.sys
Image name: tcpip.sys
Timestamp: Fri Feb 16 23:28:05 2007 (45D6A075)
CheckSum: 0006B568
ImageSize: 00090000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba45c000 ba475000 ipsec (deferred)
Image path: \SystemRoot\system32\DRIVERS\ipsec.sys
Image name: ipsec.sys
Timestamp: Fri Feb 16 23:29:28 2007 (45D6A0C8)
CheckSum: 0001DA9A
ImageSize: 00019000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba495000 ba4ae880 AKSCLASS (deferred)
Image path: \SystemRoot\system32\DRIVERS\AKSCLASS.SYS
Image name: AKSCLASS.SYS
Timestamp: Fri Jun 10 02:33:43 2005 (42A95E77)
CheckSum: 00022772
ImageSize: 00019880
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba4af000 ba4c7700 aksusb (deferred)
Image path: \SystemRoot\system32\DRIVERS\aksusb.sys
Image name: aksusb.sys
Timestamp: Fri Jun 10 02:37:24 2005 (42A95F54)
CheckSum: 00024D7A
ImageSize: 00018700
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba508000 ba51d000 usbhub (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbhub.sys
Image name: usbhub.sys
Timestamp: Fri Feb 16 23:13:05 2007 (45D69CF1)
CheckSum: 0001E7B9
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba545000 ba58f000 update (deferred)
Image path: \SystemRoot\system32\DRIVERS\update.sys
Image name: update.sys
Timestamp: Fri Feb 16 23:28:59 2007 (45D6A0AB)
CheckSum: 0004D6FA
ImageSize: 0004A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba5f6000 ba62d000 rdpdr (deferred)
Image path: \SystemRoot\system32\DRIVERS\rdpdr.sys
Image name: rdpdr.sys
Timestamp: Fri Feb 16 22:51:00 2007 (45D697C4)
CheckSum: 00031FE4
ImageSize: 00037000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba6ed000 ba6f7000 Dxapi (deferred)
Image path: \SystemRoot\System32\drivers\Dxapi.sys
Image name: Dxapi.sys
Timestamp: Tue Mar 25 00:06:01 2003 (3E7FFFD9)
CheckSum: 0001039A
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba71d000 ba72f000 raspptp (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspptp.sys
Image name: raspptp.sys
Timestamp: Fri Feb 16 23:29:20 2007 (45D6A0C0)
CheckSum: 00013B9A
ImageSize: 00012000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba72f000 ba748000 ndiswan (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndiswan.sys
Image name: ndiswan.sys
Timestamp: Fri Feb 16 23:29:22 2007 (45D6A0C2)
CheckSum: 00021659
ImageSize: 00019000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba748000 ba75c000 rasl2tp (deferred)
Image path: \SystemRoot\system32\DRIVERS\rasl2tp.sys
Image name: rasl2tp.sys
Timestamp: Fri Feb 16 23:29:02 2007 (45D6A0AE)
CheckSum: 0001D4BD
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba75c000 ba775480 dlgcmpd (deferred)
Image path: \SystemRoot\system32\DRIVERS\dlgcmpd.sys
Image name: dlgcmpd.sys
Timestamp: Tue Aug 08 13:19:39 2006 (44D8F1DB)
CheckSum: 0001D5A5
ImageSize: 00019480
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba776000 ba79d000 ks (deferred)
Image path: \SystemRoot\system32\DRIVERS\ks.sys
Image name: ks.sys
Timestamp: Fri Feb 16 23:30:40 2007 (45D6A110)
CheckSum: 0002DD89
ImageSize: 00027000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba79d000 ba7b1000 redbook (deferred)
Image path: \SystemRoot\system32\DRIVERS\redbook.sys
Image name: redbook.sys
Timestamp: Fri Feb 16 23:07:26 2007 (45D69B9E)
CheckSum: 00011CDD
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7b1000 ba7c6000 cdrom (deferred)
Image path: \SystemRoot\system32\DRIVERS\cdrom.sys
Image name: cdrom.sys
Timestamp: Fri Feb 16 23:07:48 2007 (45D69BB4)
CheckSum: 0001CAE1
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7c6000 ba7db000 serial (deferred)
Image path: \SystemRoot\system32\DRIVERS\serial.sys
Image name: serial.sys
Timestamp: Fri Feb 16 23:06:46 2007 (45D69B76)
CheckSum: 0001E1B9
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7db000 ba7ee000 i8042prt (deferred)
Image path: \SystemRoot\system32\DRIVERS\i8042prt.sys
Image name: i8042prt.sys
Timestamp: Fri Feb 16 23:30:40 2007 (45D6A110)
CheckSum: 000184DF
ImageSize: 00013000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7ee000 ba816200 e1000325 (deferred)
Image path: \SystemRoot\system32\DRIVERS\e1000325.sys
Image name: e1000325.sys
Timestamp: Thu Apr 27 09:26:28 2006 (4450F0B4)
CheckSum: 00028670
ImageSize: 00028200
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba817000 ba833000 VIDEOPRT (deferred)
Image path: \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
Image name: VIDEOPRT.SYS
Timestamp: Fri Feb 16 23:10:30 2007 (45D69C56)
CheckSum: 000223AF
ImageSize: 0001C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba833000 ba886d80 ati2mpad (deferred)
Image path: \SystemRoot\system32\DRIVERS\ati2mpad.sys
Image name: ati2mpad.sys
Timestamp: Thu Jul 18 18:13:20 2002 (3D3767B0)
CheckSum: 0006029D
ImageSize: 00053D80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba887000 ba8b1000 USBPORT (deferred)
Image path: \SystemRoot\system32\DRIVERS\USBPORT.SYS
Image name: USBPORT.SYS
Timestamp: Fri Feb 16 23:12:59 2007 (45D69CEB)
CheckSum: 00027A92
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf800000 bf9cf000 win32k (deferred)
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Timestamp: Fri Feb 16 23:31:05 2007 (45D6A129)
CheckSum: 001C50CA
ImageSize: 001CF000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf9cf000 bf9e6000 dxg (deferred)
Image path: \SystemRoot\System32\drivers\dxg.sys
Image name: dxg.sys
Timestamp: Fri Feb 16 23:14:39 2007 (45D69D4F)
CheckSum: 00012550
ImageSize: 00017000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf9e6000 bfa3c680 ati2drad (deferred)
Image path: \SystemRoot\System32\ati2drad.dll
Image name: ati2drad.dll
Timestamp: Sat Feb 17 06:59:26 2007 (45D70A3E)
CheckSum: 0005E694
ImageSize: 00056680
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f70f9000 f7105000 vga (deferred)
Image path: \SystemRoot\System32\drivers\vga.sys
Image name: vga.sys
Timestamp: Fri Feb 16 23:10:30 2007 (45D69C56)
CheckSum: 00014C94
ImageSize: 0000C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7109000 f7112000 watchdog (deferred)
Image path: \SystemRoot\system32\DRIVERS\watchdog.sys
Image name: watchdog.sys
Timestamp: Fri Feb 16 23:11:45 2007 (45D69CA1)
CheckSum: 00009AB6
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7129000 f7132000 raspti (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspti.sys
Image name: raspti.sys
Timestamp: Fri Feb 16 22:59:23 2007 (45D699BB)
CheckSum: 0001246A
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7139000 f7148000 termdd (deferred)
Image path: \SystemRoot\system32\DRIVERS\termdd.sys
Image name: termdd.sys
Timestamp: Fri Feb 16 22:44:32 2007 (45D69640)
CheckSum: 0000ED7D
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7159000 f7167980 dlgcmcd (deferred)
Image path: \SystemRoot\system32\DRIVERS\dlgcmcd.sys
Image name: dlgcmcd.sys
Timestamp: Tue Aug 08 13:19:46 2006 (44D8F1E2)
CheckSum: 000120A1
ImageSize: 0000E980
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7169000 f7171880 SMBios (deferred)
Image path: \SystemRoot\system32\DRIVERS\SMBios.sys
Image name: SMBios.sys
Timestamp: Tue Feb 04 12:33:18 2003 (3E40157E)
CheckSum: 00015915
ImageSize: 00008880
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7179000 f7186000 Npfs (deferred)
Image path: \SystemRoot\System32\Drivers\Npfs.SYS
Image name: Npfs.SYS
Timestamp: Fri Feb 16 22:50:36 2007 (45D697AC)
CheckSum: 00015D8A
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7189000 f7196000 netbios (deferred)
Image path: \SystemRoot\system32\DRIVERS\netbios.sys
Image name: netbios.sys
Timestamp: Fri Feb 16 22:58:29 2007 (45D69985)
CheckSum: 00011592
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7231000 f7250000 Mup (deferred)
Image path: Mup.sys
Image name: Mup.sys
Timestamp: Fri Feb 16 23:27:41 2007 (45D6A05D)
CheckSum: 00023FA8
ImageSize: 0001F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7250000 f728f000 NDIS (deferred)
Image path: NDIS.sys
Image name: NDIS.sys
Timestamp: Fri Feb 16 23:28:49 2007 (45D6A0A1)
CheckSum: 0003CA0F
ImageSize: 0003F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f728f000 f7324000 Ntfs (deferred)
Image path: Ntfs.sys
Image name: Ntfs.sys
Timestamp: Fri Feb 16 23:27:23 2007 (45D6A04B)
CheckSum: 00097DDD
ImageSize: 00095000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7324000 f734a000 KSecDD (deferred)
Image path: KSecDD.sys
Image name: KSecDD.sys
Timestamp: Fri Feb 16 22:46:32 2007 (45D696B8)
CheckSum: 00024591
ImageSize: 00026000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f734a000 f736f000 fltmgr (deferred)
Image path: fltmgr.sys
Image name: fltmgr.sys
Timestamp: Fri Feb 16 22:51:08 2007 (45D697CC)
CheckSum: 00028DAD
ImageSize: 00025000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f736f000 f7382000 CLASSPNP (deferred)
Image path: \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Image name: CLASSPNP.SYS
Timestamp: Fri Feb 16 23:28:16 2007 (45D6A080)
CheckSum: 0000EFB8
ImageSize: 00013000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7382000 f739f000 atapi (deferred)
Image path: atapi.sys
Image name: atapi.sys
Timestamp: Fri Feb 16 23:07:34 2007 (45D69BA6)
CheckSum: 0001D4C5
ImageSize: 0001D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f739f000 f73c9000 volsnap (deferred)
Image path: volsnap.sys
Image name: volsnap.sys
Timestamp: Fri Feb 16 23:08:23 2007 (45D69BD7)
CheckSum: 00029843
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f73c9000 f73f5000 dmio (deferred)
Image path: dmio.sys
Image name: dmio.sys
Timestamp: Fri Feb 16 23:10:44 2007 (45D69C64)
CheckSum: 000270C9
ImageSize: 0002C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f73f5000 f741c000 ftdisk (deferred)
Image path: ftdisk.sys
Image name: ftdisk.sys
Timestamp: Fri Feb 16 23:08:05 2007 (45D69BC5)
CheckSum: 00024F7A
ImageSize: 00027000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f741c000 f7432000 pci (deferred)
Image path: pci.sys
Image name: pci.sys
Timestamp: Fri Feb 16 22:59:03 2007 (45D699A7)
CheckSum: 0001E42B
ImageSize: 00016000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7432000 f7466000 ACPI (deferred)
Image path: ACPI.sys
Image name: ACPI.sys
Timestamp: Fri Feb 16 22:58:47 2007 (45D69997)
CheckSum: 00032E63
ImageSize: 00034000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7487000 f7490000 WMILIB (deferred)
Image path: \WINDOWS\system32\DRIVERS\WMILIB.SYS
Image name: WMILIB.SYS
Timestamp: Tue Mar 25 00:13:00 2003 (3E80017C)
CheckSum: 00004365
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7497000 f74a6000 isapnp (deferred)
Image path: isapnp.sys
Image name: isapnp.sys
Timestamp: Fri Feb 16 22:58:57 2007 (45D699A1)
CheckSum: 0000DC0C
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74a7000 f74b4000 PCIIDEX (deferred)
Image path: \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Image name: PCIIDEX.SYS
Timestamp: Fri Feb 16 23:07:32 2007 (45D69BA4)
CheckSum: 00010ED8
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74b7000 f74c7000 MountMgr (deferred)
Image path: MountMgr.sys
Image name: MountMgr.sys
Timestamp: Fri Feb 16 23:05:35 2007 (45D69B2F)
CheckSum: 00018F39
ImageSize: 00010000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74c7000 f74d2000 PartMgr (deferred)
Image path: PartMgr.sys
Image name: PartMgr.sys
Timestamp: Fri Feb 16 23:29:25 2007 (45D6A0C5)
CheckSum: 0000EE27
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74d7000 f74e7000 disk (deferred)
Image path: disk.sys
Image name: disk.sys
Timestamp: Fri Feb 16 23:07:51 2007 (45D69BB7)
CheckSum: 00017691
ImageSize: 00010000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74e7000 f74f3000 Dfs (deferred)
Image path: Dfs.sys
Image name: Dfs.sys
Timestamp: Fri Feb 16 22:51:17 2007 (45D697D5)
CheckSum: 00016C54
ImageSize: 0000C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74f7000 f7501000 crcdisk (deferred)
Image path: crcdisk.sys
Image name: crcdisk.sys
Timestamp: Fri Feb 16 23:09:50 2007 (45D69C2E)
CheckSum: 0001142A
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7557000 f7566000 intelppm (deferred)
Image path: \SystemRoot\system32\DRIVERS\intelppm.sys
Image name: intelppm.sys
Timestamp: Fri Feb 16 22:48:30 2007 (45D6972E)
CheckSum: 0001690F
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7567000 f7571000 serenum (deferred)
Image path: \SystemRoot\system32\DRIVERS\serenum.sys
Image name: serenum.sys
Timestamp: Fri Feb 16 23:06:44 2007 (45D69B74)
CheckSum: 00009B3C
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7577000 f7580000 ndistapi (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndistapi.sys
Image name: ndistapi.sys
Timestamp: Fri Feb 16 22:59:19 2007 (45D699B7)
CheckSum: 00010072
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7587000 f7592000 TDI (deferred)
Image path: \SystemRoot\system32\DRIVERS\TDI.SYS
Image name: TDI.SYS
Timestamp: Fri Feb 16 23:01:19 2007 (45D69A2F)
CheckSum: 0000C620
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7597000 f75a2000 Msfs (deferred)
Image path: \SystemRoot\System32\Drivers\Msfs.SYS
Image name: Msfs.SYS
Timestamp: Fri Feb 16 22:50:33 2007 (45D697A9)
CheckSum: 000118ED
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75b7000 f75c6000 raspppoe (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspppoe.sys
Image name: raspppoe.sys
Timestamp: Fri Feb 16 22:59:23 2007 (45D699BB)
CheckSum: 0001208D
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75d7000 f75e1000 mouclass (deferred)
Image path: \SystemRoot\system32\DRIVERS\mouclass.sys
Image name: mouclass.sys
Timestamp: Tue Mar 25 00:03:09 2003 (3E7FFF2D)
CheckSum: 000062DB
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75e7000 f75f2000 kbdclass (deferred)
Image path: \SystemRoot\system32\DRIVERS\kbdclass.sys
Image name: kbdclass.sys
Timestamp: Fri Feb 16 23:05:39 2007 (45D69B33)
CheckSum: 00007486
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75f7000 f7605000 NDProxy (deferred)
Image path: \SystemRoot\System32\Drivers\NDProxy.SYS
Image name: NDProxy.SYS
Timestamp: Fri Feb 16 22:59:21 2007 (45D699B9)
CheckSum: 0000EC7F
ImageSize: 0000E000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7617000 f7624000 wanarp (deferred)
Image path: \SystemRoot\system32\DRIVERS\wanarp.sys
Image name: wanarp.sys
Timestamp: Fri Feb 16 22:59:17 2007 (45D699B5)
CheckSum: 0000969A
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7627000 f7630000 mssmbios (deferred)
Image path: \SystemRoot\system32\DRIVERS\mssmbios.sys
Image name: mssmbios.sys
Timestamp: Fri Feb 16 22:59:12 2007 (45D699B0)
CheckSum: 0000C632
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7637000 f7642000 ptilink (deferred)
Image path: \SystemRoot\system32\DRIVERS\ptilink.sys
Image name: ptilink.sys
Timestamp: Fri Feb 16 23:06:38 2007 (45D69B6E)
CheckSum: 0000D201
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7657000 f7665000 msgpc (deferred)
Image path: \SystemRoot\system32\DRIVERS\msgpc.sys
Image name: msgpc.sys
Timestamp: Fri Feb 16 22:58:37 2007 (45D6998D)
CheckSum: 0001679D
ImageSize: 0000E000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7697000 f76a0000 dump_WMILIB (deferred)
Image path: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Image name: dump_WMILIB.SYS
Timestamp: Tue Mar 25 00:13:00 2003 (3E80017C)
CheckSum: 00004365
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f76b7000 f76c2a00 Haspnt (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\Haspnt.sys
Image name: Haspnt.sys
Timestamp: Fri Nov 02 07:31:06 2001 (3BE2AE2A)
CheckSum: 000118F4
ImageSize: 0000BA00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7707000 f770f000 kdcom (deferred)
Image path: \WINDOWS\system32\KDCOM.DLL
Image name: KDCOM.DLL
Timestamp: Tue Mar 25 00:08:00 2003 (3E800050)
CheckSum: 0000E3AA
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f770f000 f7717000 BOOTVID (deferred)
Image path: \WINDOWS\system32\BOOTVID.dll
Image name: BOOTVID.dll
Timestamp: Tue Mar 25 00:07:58 2003 (3E80004E)
CheckSum: 00008BE3
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7717000 f771e000 pciide (deferred)
Image path: pciide.sys
Image name: pciide.sys
Timestamp: Tue Mar 25 00:04:46 2003 (3E7FFF8E)
CheckSum: 00009478
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f771f000 f7726000 intelide (deferred)
Image path: intelide.sys
Image name: intelide.sys
Timestamp: Fri Feb 16 23:07:32 2007 (45D69BA4)
CheckSum: 0000B3A2
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7727000 f772e000 dmload (deferred)
Image path: dmload.sys
Image name: dmload.sys
Timestamp: Tue Mar 25 00:08:08 2003 (3E800058)
CheckSum: 00004F35
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f777f000 f7786000 dxgthk (deferred)
Image path: \SystemRoot\System32\drivers\dxgthk.sys
Image name: dxgthk.sys
Timestamp: Tue Mar 25 00:05:52 2003 (3E7FFFD0)
CheckSum: 000019C5
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f779f000 f77a4180 usbuhci (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbuhci.sys
Image name: usbuhci.sys
Timestamp: Fri Feb 16 23:13:02 2007 (45D69CEE)
CheckSum: 0000FDE1
ImageSize: 00005180
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77a7000 f77adb80 usbehci (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbehci.sys
Image name: usbehci.sys
Timestamp: Fri Feb 16 23:12:56 2007 (45D69CE8)
CheckSum: 00016935
ImageSize: 00006B80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77af000 f77b3480 sspIntf (deferred)
Image path: \SystemRoot\system32\DRIVERS\sspIntf.SYS
Image name: sspIntf.SYS
Timestamp: Tue Aug 08 13:19:24 2006 (44D8F1CC)
CheckSum: 00007631
ImageSize: 00004480
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77b7000 f77bf000 audstub (deferred)
Image path: \SystemRoot\system32\DRIVERS\audstub.sys
Image name: audstub.sys
Timestamp: Tue Mar 25 00:09:12 2003 (3E800098)
CheckSum: 00005AA7
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77e7000 f77ef000 Fs_Rec (deferred)
Image path: \SystemRoot\System32\Drivers\Fs_Rec.SYS
Image name: Fs_Rec.SYS
Timestamp: Tue Mar 25 00:08:36 2003 (3E800074)
CheckSum: 0000F5E9
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77ef000 f77f6000 Null (deferred)
Image path: \SystemRoot\System32\Drivers\Null.SYS
Image name: Null.SYS
Timestamp: Tue Mar 25 00:03:05 2003 (3E7FFF29)
CheckSum: 0000C34A
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77f7000 f77fe000 Beep (deferred)
Image path: \SystemRoot\System32\Drivers\Beep.SYS
Image name: Beep.SYS
Timestamp: Tue Mar 25 00:03:04 2003 (3E7FFF28)
CheckSum: 0000B82F
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77ff000 f7805300 HIDPARSE (deferred)
Image path: \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
Image name: HIDPARSE.SYS
Timestamp: Fri Feb 16 23:12:35 2007 (45D69CD3)
CheckSum: 000156D7
ImageSize: 00006300
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f780f000 f7817000 mnmdd (deferred)
Image path: \SystemRoot\System32\Drivers\mnmdd.SYS
Image name: mnmdd.SYS
Timestamp: Tue Mar 25 00:07:53 2003 (3E800049)
CheckSum: 0000B73B
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7817000 f781f000 RDPCDD (deferred)
Image path: \SystemRoot\System32\DRIVERS\RDPCDD.sys
Image name: RDPCDD.sys
Timestamp: Tue Mar 25 00:03:05 2003 (3E7FFF29)
CheckSum: 00008EDA
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f781f000 f7827000 rasacd (deferred)
Image path: \SystemRoot\system32\DRIVERS\rasacd.sys
Image name: rasacd.sys
Timestamp: Tue Mar 25 00:11:50 2003 (3E800136)
CheckSum: 000067ED
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f799f000 f79a0280 swenum (deferred)
Image path: \SystemRoot\system32\DRIVERS\swenum.sys
Image name: swenum.sys
Timestamp: Fri Feb 16 23:05:56 2007 (45D69B44)
CheckSum: 00006FC6
ImageSize: 00001280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f79a9000 f79aa580 USBD (deferred)
Image path: \SystemRoot\system32\DRIVERS\USBD.SYS
Image name: USBD.SYS
Timestamp: Tue Mar 25 00:10:39 2003 (3E8000EF)
CheckSum: 0000A359
ImageSize: 00001580
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

Unloaded modules:
f7607000 f7615000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7537000 f7540000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77df000 f77e7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

OSR_Community_User · May 11, 2007, 11:59am

Mark:

There really isn’t much to go on here. You either need a more complete
dump file than this to have any chance of identifying the problem, or,
ideally, to have WinDbg connected while it occurs. If you’re interested
in doing the former, enable a kernel memory dump via “System Properties
-> Advanced -> Startup and Recovery” in control panel.

Is this the first time this occurred? If not, can you reproduce it? I
can’t say that I have seen a CLI_FAULT issue before, and it sounds like
bad hardware, but there isn’t enough information here, for me, at least,
to say anything reliable.

mm

>> xxxxx@cox.net 2007-05-11 10:01 >>>
Is there a tutorial somewhere that gives hints on how to interpret the
information from a BSOD? I have included some information from WinDbg
below, and from that it looks like a CLI exception that occurs inside
NTOSKRNL, but I can’t see how to figure out who called into NTOSKRNL, or
if this was all initiated by an interrupt. If anyone could let me know
how to do this, or point me to information, or point me to a better
mailist list, I’d appreciate it.

Thank you.

Loading Dump File [C:\tmp\tg\saved logs_141\Mini050807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs)
Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af9c8
Debug session time: Tue May 8 10:27:42.609 2007 (GMT-7)
System Uptime: 2 days 21:57:25.609
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
…

Loading User Symbols
Loading unloaded module list
…
*******************************************************************************

*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80833de3, b75c6cf0, 0}

Probably caused by : hardware ( nt!CcSetDirtyInMask+2a2 )

Followup: MachineOwner

0: kd> !analyze -v
*******************************************************************************

*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this
address.
Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never
have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80833de3, The address that the exception occurred at
Arg3: b75c6cf0, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
referenced memory at “0x%08lx”. The memory could not be “%s”.

FAULTING_IP:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

TRAP_FRAME: b75c6cf0 – (.trap ffffffffb75c6cf0)
ErrCode = 00000000
eax=00000000 ebx=b75c6d9c ecx=00000001 edx=00000000 esi=00000001
edi=00000003
eip=80833de3 esp=b75c6d64 ebp=b75c6d64 iopl=0 nv up ei pl zr na
pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!CcSetDirtyInMask+0x2a2:
80833de3 fa cli
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

CLI_FAULT_INSTR:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

LAST_CONTROL_TRANSFER: from 00000000 to 80833de3

STACK_TEXT:
b75c6d64 00000000 badb0d00 00000000 80a803d9 nt!CcSetDirtyInMask+0x2a2

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcSetDirtyInMask+2a2
80833de3 fa cli

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CcSetDirtyInMask+2a2

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: CLI_FAULT

BUCKET_ID: CLI_FAULT

Followup: MachineOwner

0: kd> lvm
^ Syntax error in ‘lvm’
0: kd> lmv
start end module name
80800000 80a7a000 nt M (pdb symbols)
c:\WINDOWS\Symbols\exe\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Image path: \WINDOWS\system32\ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Fri Feb 16 23:29:03 2007 (45D6A0AF)
CheckSum: 00267A4F
ImageSize: 0027A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
80a7a000 80aa6000 hal (deferred)
Image path: \WINDOWS\system32\hal.dll
Image name: hal.dll
Timestamp: Fri Feb 16 22:48:26 2007 (45D6972A)
CheckSum: 00021C2C
ImageSize: 0002C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b744f000 b7457900 npf (deferred)
Image path: \SystemRoot\system32\drivers\npf.sys
Image name: npf.sys
Timestamp: Thu Jan 25 10:18:17 2007 (45B8E659)
CheckSum: 000195B6
ImageSize: 00008900
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b91bf000 b91ea000 RDPWD (deferred)
Image path: \SystemRoot\System32\Drivers\RDPWD.SYS
Image name: RDPWD.SYS
Timestamp: Fri Feb 16 22:44:38 2007 (45D69646)
CheckSum: 00027066
ImageSize: 0002B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b91ea000 b91ff000 dm3nk (deferred)
Image path: \SystemRoot\system32\DRIVERS\dm3nk.sys
Image name: dm3nk.sys
Timestamp: Wed Feb 15 07:58:04 2006 (43F3417C)
CheckSum: 000377C4
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b99a7000 b9a04000 srv (deferred)
Image path: \SystemRoot\system32\DRIVERS\srv.sys
Image name: srv.sys
Timestamp: Fri Feb 16 23:27:20 2007 (45D6A048)
CheckSum: 0005AEFC
ImageSize: 0005D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9aa4000 b9abc000 mqac (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\mqac.sys
Image name: mqac.sys
Timestamp: Fri Feb 16 22:44:18 2007 (45D69632)
CheckSum: 00023E1E
ImageSize: 00018000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9b34000 b9b84000 HTTP (deferred)
Image path: \SystemRoot\System32\Drivers\HTTP.sys
Image name: HTTP.sys
Timestamp: Fri Feb 16 23:28:12 2007 (45D6A07C)
CheckSum: 00056124
ImageSize: 00050000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9bd4000 b9bdf000 TDTCP (deferred)
Image path: \SystemRoot\System32\Drivers\TDTCP.SYS
Image name: TDTCP.SYS
Timestamp: Fri Feb 16 22:44:32 2007 (45D69640)
CheckSum: 0000F683
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9ccc000 b9cf6000 Fastfat (deferred)
Image path: \SystemRoot\System32\Drivers\Fastfat.SYS
Image name: Fastfat.SYS
Timestamp: Fri Feb 16 23:27:55 2007 (45D6A06B)
CheckSum: 0002CC8F
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9cf6000 b9d9d400 hardlock (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\hardlock.sys
Image name: hardlock.sys
Timestamp: Wed Jul 27 06:08:29 2005 (42E7874D)
CheckSum: 000AAD87
ImageSize: 000A7400
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9e1a000 b9e1d000 smtkstub (deferred)
Image path: \SystemRoot\system32\DRIVERS\smtkstub.dll
Image name: smtkstub.dll
Timestamp: Tue Jul 11 12:17:49 2006 (44B3F95D)
CheckSum: 0000BDC5
ImageSize: 00003000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9e1e000 b9e21700 apicdrv (deferred)
Image path: \SystemRoot\system32\DRIVERS\apicdrv.sys
Image name: apicdrv.sys
Timestamp: Tue Jul 11 12:17:49 2006 (44B3F95D)
CheckSum: 00009B7A
ImageSize: 00003700
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
b9f2e000 b9f5d000 RMCAST (deferred)
Image path: \SystemRoot\system32\DRIVERS\RMCAST.sys
Image name: RMCAST.sys
Timestamp: Fri Feb 16 22:57:43 2007 (45D69957)
CheckSum: 0002455F
ImageSize: 0002F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba16f000 ba18c000 dump_atapi (deferred)
Image path: \SystemRoot\System32\Drivers\dump_atapi.sys
Image name: dump_atapi.sys
Timestamp: Fri Feb 16 23:07:34 2007 (45D69BA6)
CheckSum: 0001D4C5
ImageSize: 0001D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba18c000 ba1a1000 Cdfs (deferred)
Image path: \SystemRoot\System32\Drivers\Cdfs.SYS
Image name: Cdfs.SYS
Timestamp: Fri Feb 16 23:27:08 2007 (45D6A03C)
CheckSum: 00015D3A
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba1a1000 ba1b2000 Fips (deferred)
Image path: \SystemRoot\System32\Drivers\Fips.SYS
Image name: Fips.SYS
Timestamp: Fri Feb 16 23:26:33 2007 (45D6A019)
CheckSum: 0000B9EB
ImageSize: 00011000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba1b2000 ba228000 mrxsmb (deferred)
Image path: \SystemRoot\system32\DRIVERS\mrxsmb.sys
Image name: mrxsmb.sys
Timestamp: Fri Feb 16 23:28:15 2007 (45D6A07F)
CheckSum: 00074736
ImageSize: 00076000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba250000 ba280000 rdbss (deferred)
Image path: \SystemRoot\system32\DRIVERS\rdbss.sys
Image name: rdbss.sys
Timestamp: Fri Feb 16 23:27:37 2007 (45D6A059)
CheckSum: 000346F8
ImageSize: 00030000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba280000 ba28a000 ndisuio (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndisuio.sys
Image name: ndisuio.sys
Timestamp: Fri Feb 16 22:58:25 2007 (45D69981)
CheckSum: 00004C9B
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba320000 ba34a000 afd (deferred)
Image path: \SystemRoot\System32\drivers\afd.sys
Image name: afd.sys
Timestamp: Fri Feb 16 23:28:16 2007 (45D6A080)
CheckSum: 00025770
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba34a000 ba37b000 netbt (deferred)
Image path: \SystemRoot\system32\DRIVERS\netbt.sys
Image name: netbt.sys
Timestamp: Fri Feb 16 23:28:57 2007 (45D6A0A9)
CheckSum: 0002E9F6
ImageSize: 00031000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba37b000 ba3cb080 akshasp (deferred)
Image path: \SystemRoot\system32\DRIVERS\akshasp.sys
Image name: akshasp.sys
Timestamp: Fri Jun 10 02:24:13 2005 (42A95C3D)
CheckSum: 00059009
ImageSize: 00050080
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba3cc000 ba45c000 tcpip (deferred)
Image path: \SystemRoot\system32\DRIVERS\tcpip.sys
Image name: tcpip.sys
Timestamp: Fri Feb 16 23:28:05 2007 (45D6A075)
CheckSum: 0006B568
ImageSize: 00090000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba45c000 ba475000 ipsec (deferred)
Image path: \SystemRoot\system32\DRIVERS\ipsec.sys
Image name: ipsec.sys
Timestamp: Fri Feb 16 23:29:28 2007 (45D6A0C8)
CheckSum: 0001DA9A
ImageSize: 00019000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba495000 ba4ae880 AKSCLASS (deferred)
Image path: \SystemRoot\system32\DRIVERS\AKSCLASS.SYS
Image name: AKSCLASS.SYS
Timestamp: Fri Jun 10 02:33:43 2005 (42A95E77)
CheckSum: 00022772
ImageSize: 00019880
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba4af000 ba4c7700 aksusb (deferred)
Image path: \SystemRoot\system32\DRIVERS\aksusb.sys
Image name: aksusb.sys
Timestamp: Fri Jun 10 02:37:24 2005 (42A95F54)
CheckSum: 00024D7A
ImageSize: 00018700
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba508000 ba51d000 usbhub (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbhub.sys
Image name: usbhub.sys
Timestamp: Fri Feb 16 23:13:05 2007 (45D69CF1)
CheckSum: 0001E7B9
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba545000 ba58f000 update (deferred)
Image path: \SystemRoot\system32\DRIVERS\update.sys
Image name: update.sys
Timestamp: Fri Feb 16 23:28:59 2007 (45D6A0AB)
CheckSum: 0004D6FA
ImageSize: 0004A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba5f6000 ba62d000 rdpdr (deferred)
Image path: \SystemRoot\system32\DRIVERS\rdpdr.sys
Image name: rdpdr.sys
Timestamp: Fri Feb 16 22:51:00 2007 (45D697C4)
CheckSum: 00031FE4
ImageSize: 00037000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba6ed000 ba6f7000 Dxapi (deferred)
Image path: \SystemRoot\System32\drivers\Dxapi.sys
Image name: Dxapi.sys
Timestamp: Tue Mar 25 00:06:01 2003 (3E7FFFD9)
CheckSum: 0001039A
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba71d000 ba72f000 raspptp (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspptp.sys
Image name: raspptp.sys
Timestamp: Fri Feb 16 23:29:20 2007 (45D6A0C0)
CheckSum: 00013B9A
ImageSize: 00012000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba72f000 ba748000 ndiswan (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndiswan.sys
Image name: ndiswan.sys
Timestamp: Fri Feb 16 23:29:22 2007 (45D6A0C2)
CheckSum: 00021659
ImageSize: 00019000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba748000 ba75c000 rasl2tp (deferred)
Image path: \SystemRoot\system32\DRIVERS\rasl2tp.sys
Image name: rasl2tp.sys
Timestamp: Fri Feb 16 23:29:02 2007 (45D6A0AE)
CheckSum: 0001D4BD
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba75c000 ba775480 dlgcmpd (deferred)
Image path: \SystemRoot\system32\DRIVERS\dlgcmpd.sys
Image name: dlgcmpd.sys
Timestamp: Tue Aug 08 13:19:39 2006 (44D8F1DB)
CheckSum: 0001D5A5
ImageSize: 00019480
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba776000 ba79d000 ks (deferred)
Image path: \SystemRoot\system32\DRIVERS\ks.sys
Image name: ks.sys
Timestamp: Fri Feb 16 23:30:40 2007 (45D6A110)
CheckSum: 0002DD89
ImageSize: 00027000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba79d000 ba7b1000 redbook (deferred)
Image path: \SystemRoot\system32\DRIVERS\redbook.sys
Image name: redbook.sys
Timestamp: Fri Feb 16 23:07:26 2007 (45D69B9E)
CheckSum: 00011CDD
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7b1000 ba7c6000 cdrom (deferred)
Image path: \SystemRoot\system32\DRIVERS\cdrom.sys
Image name: cdrom.sys
Timestamp: Fri Feb 16 23:07:48 2007 (45D69BB4)
CheckSum: 0001CAE1
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7c6000 ba7db000 serial (deferred)
Image path: \SystemRoot\system32\DRIVERS\serial.sys
Image name: serial.sys
Timestamp: Fri Feb 16 23:06:46 2007 (45D69B76)
CheckSum: 0001E1B9
ImageSize: 00015000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7db000 ba7ee000 i8042prt (deferred)
Image path: \SystemRoot\system32\DRIVERS\i8042prt.sys
Image name: i8042prt.sys
Timestamp: Fri Feb 16 23:30:40 2007 (45D6A110)
CheckSum: 000184DF
ImageSize: 00013000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba7ee000 ba816200 e1000325 (deferred)
Image path: \SystemRoot\system32\DRIVERS\e1000325.sys
Image name: e1000325.sys
Timestamp: Thu Apr 27 09:26:28 2006 (4450F0B4)
CheckSum: 00028670
ImageSize: 00028200
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba817000 ba833000 VIDEOPRT (deferred)
Image path: \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
Image name: VIDEOPRT.SYS
Timestamp: Fri Feb 16 23:10:30 2007 (45D69C56)
CheckSum: 000223AF
ImageSize: 0001C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba833000 ba886d80 ati2mpad (deferred)
Image path: \SystemRoot\system32\DRIVERS\ati2mpad.sys
Image name: ati2mpad.sys
Timestamp: Thu Jul 18 18:13:20 2002 (3D3767B0)
CheckSum: 0006029D
ImageSize: 00053D80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
ba887000 ba8b1000 USBPORT (deferred)
Image path: \SystemRoot\system32\DRIVERS\USBPORT.SYS
Image name: USBPORT.SYS
Timestamp: Fri Feb 16 23:12:59 2007 (45D69CEB)
CheckSum: 00027A92
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf800000 bf9cf000 win32k (deferred)
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Timestamp: Fri Feb 16 23:31:05 2007 (45D6A129)
CheckSum: 001C50CA
ImageSize: 001CF000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf9cf000 bf9e6000 dxg (deferred)
Image path: \SystemRoot\System32\drivers\dxg.sys
Image name: dxg.sys
Timestamp: Fri Feb 16 23:14:39 2007 (45D69D4F)
CheckSum: 00012550
ImageSize: 00017000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
bf9e6000 bfa3c680 ati2drad (deferred)
Image path: \SystemRoot\System32\ati2drad.dll
Image name: ati2drad.dll
Timestamp: Sat Feb 17 06:59:26 2007 (45D70A3E)
CheckSum: 0005E694
ImageSize: 00056680
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f70f9000 f7105000 vga (deferred)
Image path: \SystemRoot\System32\drivers\vga.sys
Image name: vga.sys
Timestamp: Fri Feb 16 23:10:30 2007 (45D69C56)
CheckSum: 00014C94
ImageSize: 0000C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7109000 f7112000 watchdog (deferred)
Image path: \SystemRoot\system32\DRIVERS\watchdog.sys
Image name: watchdog.sys
Timestamp: Fri Feb 16 23:11:45 2007 (45D69CA1)
CheckSum: 00009AB6
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7129000 f7132000 raspti (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspti.sys
Image name: raspti.sys
Timestamp: Fri Feb 16 22:59:23 2007 (45D699BB)
CheckSum: 0001246A
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7139000 f7148000 termdd (deferred)
Image path: \SystemRoot\system32\DRIVERS\termdd.sys
Image name: termdd.sys
Timestamp: Fri Feb 16 22:44:32 2007 (45D69640)
CheckSum: 0000ED7D
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7159000 f7167980 dlgcmcd (deferred)
Image path: \SystemRoot\system32\DRIVERS\dlgcmcd.sys
Image name: dlgcmcd.sys
Timestamp: Tue Aug 08 13:19:46 2006 (44D8F1E2)
CheckSum: 000120A1
ImageSize: 0000E980
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7169000 f7171880 SMBios (deferred)
Image path: \SystemRoot\system32\DRIVERS\SMBios.sys
Image name: SMBios.sys
Timestamp: Tue Feb 04 12:33:18 2003 (3E40157E)
CheckSum: 00015915
ImageSize: 00008880
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7179000 f7186000 Npfs (deferred)
Image path: \SystemRoot\System32\Drivers\Npfs.SYS
Image name: Npfs.SYS
Timestamp: Fri Feb 16 22:50:36 2007 (45D697AC)
CheckSum: 00015D8A
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7189000 f7196000 netbios (deferred)
Image path: \SystemRoot\system32\DRIVERS\netbios.sys
Image name: netbios.sys
Timestamp: Fri Feb 16 22:58:29 2007 (45D69985)
CheckSum: 00011592
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7231000 f7250000 Mup (deferred)
Image path: Mup.sys
Image name: Mup.sys
Timestamp: Fri Feb 16 23:27:41 2007 (45D6A05D)
CheckSum: 00023FA8
ImageSize: 0001F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7250000 f728f000 NDIS (deferred)
Image path: NDIS.sys
Image name: NDIS.sys
Timestamp: Fri Feb 16 23:28:49 2007 (45D6A0A1)
CheckSum: 0003CA0F
ImageSize: 0003F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f728f000 f7324000 Ntfs (deferred)
Image path: Ntfs.sys
Image name: Ntfs.sys
Timestamp: Fri Feb 16 23:27:23 2007 (45D6A04B)
CheckSum: 00097DDD
ImageSize: 00095000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7324000 f734a000 KSecDD (deferred)
Image path: KSecDD.sys
Image name: KSecDD.sys
Timestamp: Fri Feb 16 22:46:32 2007 (45D696B8)
CheckSum: 00024591
ImageSize: 00026000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f734a000 f736f000 fltmgr (deferred)
Image path: fltmgr.sys
Image name: fltmgr.sys
Timestamp: Fri Feb 16 22:51:08 2007 (45D697CC)
CheckSum: 00028DAD
ImageSize: 00025000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f736f000 f7382000 CLASSPNP (deferred)
Image path: \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Image name: CLASSPNP.SYS
Timestamp: Fri Feb 16 23:28:16 2007 (45D6A080)
CheckSum: 0000EFB8
ImageSize: 00013000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7382000 f739f000 atapi (deferred)
Image path: atapi.sys
Image name: atapi.sys
Timestamp: Fri Feb 16 23:07:34 2007 (45D69BA6)
CheckSum: 0001D4C5
ImageSize: 0001D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f739f000 f73c9000 volsnap (deferred)
Image path: volsnap.sys
Image name: volsnap.sys
Timestamp: Fri Feb 16 23:08:23 2007 (45D69BD7)
CheckSum: 00029843
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f73c9000 f73f5000 dmio (deferred)
Image path: dmio.sys
Image name: dmio.sys
Timestamp: Fri Feb 16 23:10:44 2007 (45D69C64)
CheckSum: 000270C9
ImageSize: 0002C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f73f5000 f741c000 ftdisk (deferred)
Image path: ftdisk.sys
Image name: ftdisk.sys
Timestamp: Fri Feb 16 23:08:05 2007 (45D69BC5)
CheckSum: 00024F7A
ImageSize: 00027000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f741c000 f7432000 pci (deferred)
Image path: pci.sys
Image name: pci.sys
Timestamp: Fri Feb 16 22:59:03 2007 (45D699A7)
CheckSum: 0001E42B
ImageSize: 00016000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7432000 f7466000 ACPI (deferred)
Image path: ACPI.sys
Image name: ACPI.sys
Timestamp: Fri Feb 16 22:58:47 2007 (45D69997)
CheckSum: 00032E63
ImageSize: 00034000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7487000 f7490000 WMILIB (deferred)
Image path: \WINDOWS\system32\DRIVERS\WMILIB.SYS
Image name: WMILIB.SYS
Timestamp: Tue Mar 25 00:13:00 2003 (3E80017C)
CheckSum: 00004365
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7497000 f74a6000 isapnp (deferred)
Image path: isapnp.sys
Image name: isapnp.sys
Timestamp: Fri Feb 16 22:58:57 2007 (45D699A1)
CheckSum: 0000DC0C
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74a7000 f74b4000 PCIIDEX (deferred)
Image path: \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Image name: PCIIDEX.SYS
Timestamp: Fri Feb 16 23:07:32 2007 (45D69BA4)
CheckSum: 00010ED8
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74b7000 f74c7000 MountMgr (deferred)
Image path: MountMgr.sys
Image name: MountMgr.sys
Timestamp: Fri Feb 16 23:05:35 2007 (45D69B2F)
CheckSum: 00018F39
ImageSize: 00010000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74c7000 f74d2000 PartMgr (deferred)
Image path: PartMgr.sys
Image name: PartMgr.sys
Timestamp: Fri Feb 16 23:29:25 2007 (45D6A0C5)
CheckSum: 0000EE27
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74d7000 f74e7000 disk (deferred)
Image path: disk.sys
Image name: disk.sys
Timestamp: Fri Feb 16 23:07:51 2007 (45D69BB7)
CheckSum: 00017691
ImageSize: 00010000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74e7000 f74f3000 Dfs (deferred)
Image path: Dfs.sys
Image name: Dfs.sys
Timestamp: Fri Feb 16 22:51:17 2007 (45D697D5)
CheckSum: 00016C54
ImageSize: 0000C000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f74f7000 f7501000 crcdisk (deferred)
Image path: crcdisk.sys
Image name: crcdisk.sys
Timestamp: Fri Feb 16 23:09:50 2007 (45D69C2E)
CheckSum: 0001142A
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7557000 f7566000 intelppm (deferred)
Image path: \SystemRoot\system32\DRIVERS\intelppm.sys
Image name: intelppm.sys
Timestamp: Fri Feb 16 22:48:30 2007 (45D6972E)
CheckSum: 0001690F
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7567000 f7571000 serenum (deferred)
Image path: \SystemRoot\system32\DRIVERS\serenum.sys
Image name: serenum.sys
Timestamp: Fri Feb 16 23:06:44 2007 (45D69B74)
CheckSum: 00009B3C
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7577000 f7580000 ndistapi (deferred)
Image path: \SystemRoot\system32\DRIVERS\ndistapi.sys
Image name: ndistapi.sys
Timestamp: Fri Feb 16 22:59:19 2007 (45D699B7)
CheckSum: 00010072
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7587000 f7592000 TDI (deferred)
Image path: \SystemRoot\system32\DRIVERS\TDI.SYS
Image name: TDI.SYS
Timestamp: Fri Feb 16 23:01:19 2007 (45D69A2F)
CheckSum: 0000C620
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7597000 f75a2000 Msfs (deferred)
Image path: \SystemRoot\System32\Drivers\Msfs.SYS
Image name: Msfs.SYS
Timestamp: Fri Feb 16 22:50:33 2007 (45D697A9)
CheckSum: 000118ED
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75b7000 f75c6000 raspppoe (deferred)
Image path: \SystemRoot\system32\DRIVERS\raspppoe.sys
Image name: raspppoe.sys
Timestamp: Fri Feb 16 22:59:23 2007 (45D699BB)
CheckSum: 0001208D
ImageSize: 0000F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75d7000 f75e1000 mouclass (deferred)
Image path: \SystemRoot\system32\DRIVERS\mouclass.sys
Image name: mouclass.sys
Timestamp: Tue Mar 25 00:03:09 2003 (3E7FFF2D)
CheckSum: 000062DB
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75e7000 f75f2000 kbdclass (deferred)
Image path: \SystemRoot\system32\DRIVERS\kbdclass.sys
Image name: kbdclass.sys
Timestamp: Fri Feb 16 23:05:39 2007 (45D69B33)
CheckSum: 00007486
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f75f7000 f7605000 NDProxy (deferred)
Image path: \SystemRoot\System32\Drivers\NDProxy.SYS
Image name: NDProxy.SYS
Timestamp: Fri Feb 16 22:59:21 2007 (45D699B9)
CheckSum: 0000EC7F
ImageSize: 0000E000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7617000 f7624000 wanarp (deferred)
Image path: \SystemRoot\system32\DRIVERS\wanarp.sys
Image name: wanarp.sys
Timestamp: Fri Feb 16 22:59:17 2007 (45D699B5)
CheckSum: 0000969A
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7627000 f7630000 mssmbios (deferred)
Image path: \SystemRoot\system32\DRIVERS\mssmbios.sys
Image name: mssmbios.sys
Timestamp: Fri Feb 16 22:59:12 2007 (45D699B0)
CheckSum: 0000C632
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7637000 f7642000 ptilink (deferred)
Image path: \SystemRoot\system32\DRIVERS\ptilink.sys
Image name: ptilink.sys
Timestamp: Fri Feb 16 23:06:38 2007 (45D69B6E)
CheckSum: 0000D201
ImageSize: 0000B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7657000 f7665000 msgpc (deferred)
Image path: \SystemRoot\system32\DRIVERS\msgpc.sys
Image name: msgpc.sys
Timestamp: Fri Feb 16 22:58:37 2007 (45D6998D)
CheckSum: 0001679D
ImageSize: 0000E000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7697000 f76a0000 dump_WMILIB (deferred)
Image path: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Image name: dump_WMILIB.SYS
Timestamp: Tue Mar 25 00:13:00 2003 (3E80017C)
CheckSum: 00004365
ImageSize: 00009000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f76b7000 f76c2a00 Haspnt (deferred)
Image path: ??\C:\WINDOWS\system32\drivers\Haspnt.sys
Image name: Haspnt.sys
Timestamp: Fri Nov 02 07:31:06 2001 (3BE2AE2A)
CheckSum: 000118F4
ImageSize: 0000BA00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7707000 f770f000 kdcom (deferred)
Image path: \WINDOWS\system32\KDCOM.DLL
Image name: KDCOM.DLL
Timestamp: Tue Mar 25 00:08:00 2003 (3E800050)
CheckSum: 0000E3AA
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f770f000 f7717000 BOOTVID (deferred)
Image path: \WINDOWS\system32\BOOTVID.dll
Image name: BOOTVID.dll
Timestamp: Tue Mar 25 00:07:58 2003 (3E80004E)
CheckSum: 00008BE3
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7717000 f771e000 pciide (deferred)
Image path: pciide.sys
Image name: pciide.sys
Timestamp: Tue Mar 25 00:04:46 2003 (3E7FFF8E)
CheckSum: 00009478
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f771f000 f7726000 intelide (deferred)
Image path: intelide.sys
Image name: intelide.sys
Timestamp: Fri Feb 16 23:07:32 2007 (45D69BA4)
CheckSum: 0000B3A2
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7727000 f772e000 dmload (deferred)
Image path: dmload.sys
Image name: dmload.sys
Timestamp: Tue Mar 25 00:08:08 2003 (3E800058)
CheckSum: 00004F35
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f777f000 f7786000 dxgthk (deferred)
Image path: \SystemRoot\System32\drivers\dxgthk.sys
Image name: dxgthk.sys
Timestamp: Tue Mar 25 00:05:52 2003 (3E7FFFD0)
CheckSum: 000019C5
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f779f000 f77a4180 usbuhci (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbuhci.sys
Image name: usbuhci.sys
Timestamp: Fri Feb 16 23:13:02 2007 (45D69CEE)
CheckSum: 0000FDE1
ImageSize: 00005180
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77a7000 f77adb80 usbehci (deferred)
Image path: \SystemRoot\system32\DRIVERS\usbehci.sys
Image name: usbehci.sys
Timestamp: Fri Feb 16 23:12:56 2007 (45D69CE8)
CheckSum: 00016935
ImageSize: 00006B80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77af000 f77b3480 sspIntf (deferred)
Image path: \SystemRoot\system32\DRIVERS\sspIntf.SYS
Image name: sspIntf.SYS
Timestamp: Tue Aug 08 13:19:24 2006 (44D8F1CC)
CheckSum: 00007631
ImageSize: 00004480
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77b7000 f77bf000 audstub (deferred)
Image path: \SystemRoot\system32\DRIVERS\audstub.sys
Image name: audstub.sys
Timestamp: Tue Mar 25 00:09:12 2003 (3E800098)
CheckSum: 00005AA7
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77e7000 f77ef000 Fs_Rec (deferred)
Image path: \SystemRoot\System32\Drivers\Fs_Rec.SYS
Image name: Fs_Rec.SYS
Timestamp: Tue Mar 25 00:08:36 2003 (3E800074)
CheckSum: 0000F5E9
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77ef000 f77f6000 Null (deferred)
Image path: \SystemRoot\System32\Drivers\Null.SYS
Image name: Null.SYS
Timestamp: Tue Mar 25 00:03:05 2003 (3E7FFF29)
CheckSum: 0000C34A
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77f7000 f77fe000 Beep (deferred)
Image path: \SystemRoot\System32\Drivers\Beep.SYS
Image name: Beep.SYS
Timestamp: Tue Mar 25 00:03:04 2003 (3E7FFF28)
CheckSum: 0000B82F
ImageSize: 00007000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f77ff000 f7805300 HIDPARSE (deferred)
Image path: \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
Image name: HIDPARSE.SYS
Timestamp: Fri Feb 16 23:12:35 2007 (45D69CD3)
CheckSum: 000156D7
ImageSize: 00006300
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f780f000 f7817000 mnmdd (deferred)
Image path: \SystemRoot\System32\Drivers\mnmdd.SYS
Image name: mnmdd.SYS
Timestamp: Tue Mar 25 00:07:53 2003 (3E800049)
CheckSum: 0000B73B
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f7817000 f781f000 RDPCDD (deferred)
Image path: \SystemRoot\System32\DRIVERS\RDPCDD.sys
Image name: RDPCDD.sys
Timestamp: Tue Mar 25 00:03:05 2003 (3E7FFF29)
CheckSum: 00008EDA
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f781f000 f7827000 rasacd (deferred)
Image path: \SystemRoot\system32\DRIVERS\rasacd.sys
Image name: rasacd.sys
Timestamp: Tue Mar 25 00:11:50 2003 (3E800136)
CheckSum: 000067ED
ImageSize: 00008000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f799f000 f79a0280 swenum (deferred)
Image path: \SystemRoot\system32\DRIVERS\swenum.sys
Image name: swenum.sys
Timestamp: Fri Feb 16 23:05:56 2007 (45D69B44)
CheckSum: 00006FC6
ImageSize: 00001280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
f79a9000 f79aa580 USBD (deferred)
Image path: \SystemRoot\system32\DRIVERS\USBD.SYS
Image name: USBD.SYS
Timestamp: Tue Mar 25 00:10:39 2003 (3E8000EF)
CheckSum: 0000A359
ImageSize: 00001580
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

Unloaded modules:
f7607000 f7615000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7537000 f7540000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77df000 f77e7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

You are currently subscribed to windbg as: xxxxx@evitechnology.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · May 11, 2007, 3:38pm

Hi Martin,

Thank you for responding. I have more information to add (below):

---- Martin O’Brien wrote:
> Mark:
>
> There really isn’t much to go on here. You either need a more complete
> dump file than this to have any chance of identifying the problem, or,
> ideally, to have WinDbg connected while it occurs. If you’re interested
> in doing the former, enable a kernel memory dump via “System Properties
> -> Advanced -> Startup and Recovery” in control panel.
>
> Is this the first time this occurred? If not, can you reproduce it? I

This problem has happened several times on 4 different computers, but it isn’t really reproducible. I have full memory dump files for some of the BSODs, but they are kind of large. Is there some information I can extract and post that might help, or do you have any ideas on what I can do to dig into this further?

As far as I can tell, here is the kernel stack dump. That’s all I can think of to look at, but it doesn’t really mean anything to me.

2: kd> kb 10
ChildEBP RetAddr Args to Child
b935b8bc 8085bb9f 0000008e c0000005 80833de3 nt!KeBugCheckEx+0x1b
b935bc80 808346b4 b935bc9c 00000000 b935bcf0 nt!KiDispatchException+0x3a2
b935bce8 80834668 b92e0114 00000000 badb0d00 nt!CommonDispatchException+0x4a
b935bcfc 80a803d9 ffdffa01 00000000 00000000 nt!Kei386EoiHelper+0x186
b935bd70 80a803d9 ffdffa01 00000000 00000000 hal!HalpCheckForSoftwareInterrupt+0x81
b935bd78 00000000 00000000 ffffff00 ffdffa01 hal!HalpCheckForSoftwareInterrupt+0x81

> can’t say that I have seen a CLI_FAULT issue before, and it sounds like
> bad hardware, but there isn’t enough information here, for me, at least,
> to say anything reliable.
>
> mm

Thank you.
Mark

OSR_Community_User · May 11, 2007, 4:45pm

Mark:

I have to ask - what is your background? You seem to have an
interesting mix going on?

>> xxxxx@cox.net 2007-05-11 15:37:44 >>>
Hi Martin,

Thank you for responding. I have more information to add (below):

---- Martin O’Brien wrote:
> Mark:
>
> There really isn’t much to go on here. You either need a more
complete
> dump file than this to have any chance of identifying the problem,
or,
> ideally, to have WinDbg connected while it occurs. If you’re
interested
> in doing the former, enable a kernel memory dump via “System
Properties
> -> Advanced -> Startup and Recovery” in control panel.
>
> Is this the first time this occurred? If not, can you reproduce it?
I

This problem has happened several times on 4 different computers, but
it isn’t really reproducible. I have full memory dump files for some of
the BSODs, but they are kind of large. Is there some information I can
extract and post that might help, or do you have any ideas on what I can
do to dig into this further?

As far as I can tell, here is the kernel stack dump. That’s all I can
think of to look at, but it doesn’t really mean anything to me.

2: kd> kb 10
ChildEBP RetAddr Args to Child
b935b8bc 8085bb9f 0000008e c0000005 80833de3 nt!KeBugCheckEx+0x1b
b935bc80 808346b4 b935bc9c 00000000 b935bcf0
nt!KiDispatchException+0x3a2
b935bce8 80834668 b92e0114 00000000 badb0d00
nt!CommonDispatchException+0x4a
b935bcfc 80a803d9 ffdffa01 00000000 00000000 nt!Kei386EoiHelper+0x186
b935bd70 80a803d9 ffdffa01 00000000 00000000
hal!HalpCheckForSoftwareInterrupt+0x81
b935bd78 00000000 00000000 ffffff00 ffdffa01
hal!HalpCheckForSoftwareInterrupt+0x81

> can’t say that I have seen a CLI_FAULT issue before, and it sounds
like
> bad hardware, but there isn’t enough information here, for me, at
least,
> to say anything reliable.
>
> mm

Thank you.
Mark

—
You are currently subscribed to windbg as: xxxxx@evitechnology.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · May 14, 2007, 5:14am

Mark,

Pay attention to following error appeared in your report.

Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe

And your symbol search path doesn’t connect symbol server.
Symbol search path is: c:\WINDOWS\Symbols

Suggest you using command .symfix c:\symbols to connect symbol server
and let WinDbg to download correct image file and symbol file.

Without correct image file and symbol file loaded, other information
maybe completely wrong.

BR, Raymond

OSR_Community_User · May 14, 2007, 2:46pm

I would agree that using symbol server is basically always the best
thing to do, but, if I recall correctly, the local symbols his is using
are correct. In any case, the actual symbols command (or at least one
that will do this):

.sympath
srv*c:\windows\symbols*http://msdl.microsoft.com/download/symbols

mm

>> xxxxx@intel.com 2007-05-14 05:13 >>>
Mark,

Pay attention to following error appeared in your report.

Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe

And your symbol search path doesn’t connect symbol server.
Symbol search path is: c:\WINDOWS\Symbols

Suggest you using command .symfix c:\symbols to connect symbol server
and let WinDbg to download correct image file and symbol file.

Without correct image file and symbol file loaded, other information
maybe completely wrong.

BR, Raymond

You are currently subscribed to windbg as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · May 14, 2007, 3:16pm

Thank you Martin and Raymond.

With your help, I think I got the symbols situation figured out. To answer your previous question Martin, I am primarily a user-level programmer with some assembly language experience (in school) in x86 MSDOS device-drivers and 68k OS development – but that was many years ago.

Anyway, I don’t want to lean too heavily for help from anyone on this list. I had hoped that some of the information from windbg would point to something obvious. For example, the various stackdumps are not always the same, but the exception address appears to always be:

80833de3 fa cli

I find this curious. Also, the fact that it’s a CLI_FAULT seems odd – I’m not even sure what that fault means unless it means trying to execute a CLI exception from user mode, which I would think the Windows OS would be careful to not do that

Given this stack dump, it looks like it was checking for a SW int when it got an exception, but I still don’t know if that exception was the CLI fault, or if it got another exception while it was executing KeBugCheckEx.

STACK_TEXT:
b98728bc 8082d800 0000008e c0000005 80889990 nt!KeBugCheckEx+0x1b
b9872c80 8088a262 b9872c9c 00000000 b9872cf0 nt!KiDispatchException+0x3a2
b9872ce8 8088a216 b9890114 00000000 badb0d00 nt!CommonDispatchException+0x4a
b9872cfc 80a5c3d9 ffdffa01 00000000 00000000 nt!KiExceptionExit+0x186
b9890114 00000000 00000000 00000000 00000000 hal!HalpCheckForSoftwareInterrupt+0x81

Anyway, I’m trying to flesh my understanding of these things. If anything is obvious to anyone about any of this, I’d appreciate any comments. Otherwise, could someone recommend a site or book that would help me learn how to deal with this? My first thought was to look for information about device drivers…

Thanks again.

---- Martin O’Brien wrote:
> I would agree that using symbol server is basically always the best
> thing to do, but, if I recall correctly, the local symbols his is using
> are correct. In any case, the actual symbols command (or at least one
> that will do this):
>
> .sympath
> srvc:\windows\symbolshttp://msdl.microsoft.com/download/symbols
>
> mm
>
>
> >>> xxxxx@intel.com 2007-05-14 05:13 >>>
> Mark,
>
> Pay attention to following error appeared in your report.
>
> Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
>
> And your symbol search path doesn’t connect symbol server.
> Symbol search path is: c:\WINDOWS\Symbols
>
> Suggest you using command .symfix c:\symbols to connect symbol server
> and let WinDbg to download correct image file and symbol file.
>
> Without correct image file and symbol file loaded, other information
> maybe completely wrong.
>
> BR, Raymond
>
> —
> You are currently subscribed to windbg as: unknown lmsubst tag
> argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> You are currently subscribed to windbg as: xxxxx@cox.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com