BSOD when opening Web Browsers [Dump data]

I am using Windows XP SP2, with Mozilla Firefox 2.00.11. When I open either Mozilla or IE7 my computer immediately bogs down and freezes up. The mouse freezes and will not move and then moves again... continuously. Sometimes it snaps out of its fit and seems to work smoothly. But sometimes it comes up with a Blue Screen of Death. This happens only when I open a web browser and not when I open World of Warcraft. These are the two instance were I would access the internt. I have scanned my computer with Kaspersky Anti-Virus 6.0, Adaware Personal SE and Spybot SD. There were some mal-ware on the computer but it was all cleared off and I have recently performed a Disk Defragment. I tried to perform a Scan from E-trust and during the scan it went BSOD again, not sure if it was because of the scan, but it does seem fishy. I am wondering what could be wrong, I will post my Deckard log soon.

Deckard's Scan Log following:

Deckard's System Scanner v20071014.68
Run by user on 2008-01-11 13:55:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-11 13:56:21
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Mozilla Firefox 2\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Browser Mouse\MOffice.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Documents and Settings\user\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ndcgaming.net/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe "
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe "
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe "
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\MOffice.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194762606296
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1194765061390
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


--
End of file - 8614 bytes

-- Files created between 2007-12-11 and 2008-01-11 -----------------------------

2007-12-18 01:05:13 0 d-------- C:\Documents and Settings\user\Application Data\Apple Computer
2007-12-12 22:08:55 0 d-------- C:\Documents and Settings\user\Application Data\dvdcss


-- Find3M Report ---------------------------------------------------------------

2008-01-11 13:27:56 0 d-------- C:\Program Files\Mozilla Firefox 2
2008-01-08 14:48:51 0 d-------- C:\Program Files\World of Warcraft
2007-12-28 13:54:56 0 d-------- C:\Program Files\Vodei
2007-12-25 05:09:34 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-18 18:46:27 0 d-------- C:\Documents and Settings\user\Application Data\uTorrent
2007-12-13 03:59:18 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-13 03:55:29 0 d-------- C:\Program Files\Diablo II
2007-12-12 21:00:55 4 --a------ C:\WINDOWS\system32\A06EFF
2007-12-03 15:32:59 0 d-------- C:\Documents and Settings\user\Application Data\Nvu
2007-12-03 14:31:59 0 d-------- C:\Program Files\Pivot Stickfigure Animator
2007-11-26 19:00:33 0 d-------- C:\Documents and Settings\user\Application Data\CiscoCAA
2007-11-26 18:59:49 0 d-------- C:\Program Files\Cisco Systems
2007-11-15 17:08:01 688 --a------ C:\WINDOWS\vimtutor.bat
2007-11-15 17:08:01 662 --a------ C:\WINDOWS\vimdiff.bat
2007-11-15 17:08:01 658 --a------ C:\WINDOWS\vim.bat
2007-11-15 17:08:01 662 --a------ C:\WINDOWS\view.bat
2007-11-15 17:08:01 987 --a------ C:\WINDOWS\gvimdiff.bat
2007-11-15 17:08:01 979 --a------ C:\WINDOWS\gvim.bat
2007-11-15 17:08:01 987 --a------ C:\WINDOWS\gview.bat
2007-11-15 17:08:01 987 --a------ C:\WINDOWS\evim.bat
2007-11-15 17:08:01 0 d-------- C:\Program Files\Vim
2007-11-14 18:31:44 0 d-------- C:\Program Files\Common Files
2007-11-14 18:31:44 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-11-11 02:24:41 0 d-------- C:\Program Files\MSBuild
2007-11-11 02:16:33 0 d-------- C:\Program Files\Reference Assemblies
2007-11-11 02:13:37 0 d-------- C:\Program Files\MSXML 6.0
2007-11-11 02:11:47 0 d-------- C:\Program Files\CONEXANT
2007-11-11 02:03:38 0 d-------- C:\Program Files\NetWaiting
2007-11-11 01:31:35 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-30 02:38:36 833985037 --a------ C:\zu_online11737.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant "= "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [03/05/2006 11:58 PM]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [27/09/2006 05:10 PM]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [27/09/2006 05:10 PM]
"nwiz "= "nwiz.exe" [27/09/2006 05:10 PM C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut "= "CHDAudPropShortcut.exe" [26/07/2006 10:44 PM C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [15/09/2007 02:27 AM]
"QPService "= "C:\Program Files\HP\QuickPlay\QPService.exe" [21/06/2006 11:54 PM]
"HP Software Update "= "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [17/02/2005 01:11 AM]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [11/08/2005 06:30 PM]
"QlbCtrl "= "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [02/06/2006 05:21 PM]
"Cpqset "= "C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [30/05/2006 06:02 PM]
"ISUSPM Startup "= "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [11/08/2005 06:30 PM]
"kav "= "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [24/03/2006 07:09 PM]
"@ "=" " []
"UnlockerAssistant "= "C:\Program Files\Unlocker\UnlockerAssistant.exe" [07/09/2006 11:19 AM]
"FLMOFFICE4DMOUSE "= "C:\Program Files\Browser Mouse\MOffice.exe" [23/05/2007 12:51 PM]
"NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" []
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [16/02/2007 10:54 AM]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
"SynTPStart "= "C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [15/09/2007 02:29 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 03:00 PM]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" []
"WMPNSCFG "= "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [18/10/2006 08:05 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Clean Access Agent.lnk - C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe [28/07/2006 5:09:30 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"system "=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
C:\Windows\SMINST\RecGuard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
C:\Windows\CREATOR\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" -atboottime
"CloneCDTray "= "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9449d7f9-eb77-11db-ac46-001636b86498}]
AutoRun\command- F:\ONSPCLCK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7ece15d-9cc1-11db-8d43-806d6172696f}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480




-- End of Deckard's System Scanner: finished at 2008-01-11 13:57:20 ------------

 

I'm sorry that I won't be able to post the log I have to go to work very soon. Also wondering why my thread got moved.. isnt this were i posted it? Ya, whenever i get help from here they always ask for a hijackthis log or now i guess a deckard log... didnt know if i should just put it up instead of them coming to solve a problem and then all they can say is please post a decard log and then I can help you. Sorry for posting in the wrong forum, I always have trouble with this, because I thought the problem to be related to Mozilla (software).

 

Im at a loss for getting my memory dump. I've tried to find the path to my memory dump but I cannot find it, so when the debugwiz tool generates debuglog.txt it shows up with this (keeping in mind this isn't the only path i've tried):

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\%SystemRoot%\MEMORY.dmp]
Could not open dump file [%SystemRoot%\MEMORY.dmp], Win32 error 0n3
"The system cannot find the path specified. "

 

ok the BSOD will be w red circle with a white X in it that says Error?

 

Just an observation. There is a folder in Program Files "Browser Mouse ". Since the problem happens with the browser and mouse, I would investigate that program. It may be added by a browser (example http://crystalcoasttech.com/blog/opera-browser-mouse-gestures ) or may be a program to modify the mouse. I would find out what it was and if you don't need it, find out how to uninstall it (uninstall and reinstall if you think you need it).

Matt

 

ok, i have prepped my computer for BSOD Dumps but im not sure how to generate a log for it using the debug wizard. Im not sure what path i enter in or what path i use to get my memory.dmp from. I found the user.dmp but im not quite sure if it is the right one.

This is my user.dmp (still unsure how to attain memory.dmp)

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS Personal
Debug session time: Thu Jan 3 11:01:18.000 2008 (GMT-6)
System Uptime: not available
Process Uptime: 0 days 0:10:48.000
...........................................................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(784.7ac): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=016bd800 ecx=016de86c edx=00000000 esi=016ddfc0 edi=02f6cffe
eip=1c409890 esp=0365fd04 ebp=0365fd50 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
*** WARNING: Unable to verify checksum for divxdec.ax
*** ERROR: Symbol file could not be found. Defaulted to export symbols for divxdec.ax -
divxdec!DllUnregisterServer+0x7c10:
1c409890 8b07 mov eax,dword ptr [edi] ds:0023:02f6cffe=????????
0:010> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for wmp.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for l3codecx.ax -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_IP:
divxdec!DllUnregisterServer+7c10
1c409890 8b07 mov eax,dword ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
.exr 0xffffffffffffffff
ExceptionAddress: 1c409890 (divxdec!DllUnregisterServer+0x00007c10)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 02f6d000
Attempt to read from address 02f6d000

DEFAULT_BUCKET_ID: INVALID_POINTER_READ

PROCESS_NAME: wmplayer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

READ_ADDRESS: 02f6d000

LAST_CONTROL_TRANSFER: from 1c408b72 to 1c409890

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
0365fd50 1c408b72 016de98c 0365fd70 0365fd8c divxdec!DllUnregisterServer+0x7c10
0365fd90 1c403576 0154c800 0000000f 0365fe38 divxdec!DllUnregisterServer+0x6ef2
0365fdb0 12ac678e 0365fdf0 129e093a 00000002 divxdec!DllUnregisterServer+0x18f6
0365fe4c 1c459916 0167ed58 0365fe78 00000000 wmp!Ordinal3003+0x14130
0365fe84 1c454b29 016b7b20 00000000 01643490 divxdec!DllCanUnloadNow+0x54d6
00000000 00000000 00000000 00000000 00000000 divxdec!DllCanUnloadNow+0x6e9


FAULTING_THREAD: 000007ac

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ

FOLLOWUP_IP:
divxdec!DllUnregisterServer+7c10
1c409890 8b07 mov eax,dword ptr [edi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: divxdec!DllUnregisterServer+7c10

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: divxdec

IMAGE_NAME: divxdec.ax

DEBUG_FLR_IMAGE_TIMESTAMP: 41423bcf

STACK_COMMAND: ~10s; .ecxr ; kb

FAILURE_BUCKET_ID: divxdec.ax!DllUnregisterServer_c0000005_INVALID_POINTER_READ

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_divxdec!DllUnregisterServer+7c10

Followup: MachineOwner
---------

eax=00000000 ebx=016bd800 ecx=016de86c edx=00000000 esi=016ddfc0 edi=02f6cffe
eip=1c409890 esp=0365fd04 ebp=0365fd50 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
divxdec!DllUnregisterServer+0x7c10:
1c409890 8b07 mov eax,dword ptr [edi] ds:0023:02f6cffe=????????
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0365fd50 1c408b72 016de98c 0365fd70 0365fd8c divxdec!DllUnregisterServer+0x7c10
0365fd90 1c403576 0154c800 0000000f 0365fe38 divxdec!DllUnregisterServer+0x6ef2
0365fdb0 12ac678e 0365fdf0 129e093a 00000002 divxdec!DllUnregisterServer+0x18f6
0365fe4c 1c459916 0167ed58 0365fe78 00000000 wmp!Ordinal3003+0x14130
0365fe84 1c454b29 016b7b20 00000000 01643490 divxdec!DllCanUnloadNow+0x54d6
00000000 00000000 00000000 00000000 00000000 divxdec!DllCanUnloadNow+0x6e9
start end module name
00be0000 00be4000 UnlockerHook UnlockerHook.dll Thu Sep 07 11:18:56 2006 (45005480)
01000000 01013000 wmplayer wmplayer.exe Wed Oct 18 23:46:18 2006 (4537112A)
01720000 01729000 normaliz normaliz.dll Thu Jun 29 09:05:42 2006 (44A3EC46)
02240000 02253000 mouDL32A mouDL32A.dll Thu Aug 04 00:26:43 2005 (42F1B523)
02aa0000 02b2c000 VodeiMPAVI VodeiMPAVI.ax Mon Apr 30 00:56:03 2007 (46359303)
07940000 0797b000 cewmdm cewmdm.dll Wed Oct 18 23:47:09 2006 (4537115D)
0bef0000 0bf27000 MFPLAT MFPLAT.dll Wed Oct 18 23:47:35 2006 (45371177)
0d780000 0d7be000 mpvis mpvis.dll Wed Oct 18 23:47:59 2006 (4537118F)
0dfb0000 0dfe9000 mspmsp mspmsp.dll Wed Oct 18 23:48:20 2006 (453711A4)
0e510000 0e562000 mswmdm mswmdm.dll Wed Oct 18 23:48:31 2006 (453711AF)
0ffd0000 0fff8000 rsaenh rsaenh.dll Tue Jul 06 20:17:12 2004 (40EB5D28)
10000000 10170000 nview nview.dll Wed Sep 27 17:05:16 2006 (451B03AC)
11c70000 11caa000 wmasf wmasf.dll Thu Oct 25 10:28:34 2007 (4720C432)
11d10000 11d1d000 wmdmps wmdmps.dll Wed Oct 18 23:47:26 2006 (4537116E)
12950000 133b4000 wmp wmp.dll Tue Jun 12 00:51:45 2007 (466E4281)
134d0000 1351c000 wmpeffects wmpeffects.dll Wed Oct 18 23:47:57 2006 (4537118D)
13740000 13f1b000 wmploc wmploc.dll Wed Oct 18 23:48:00 2006 (45371190)
14030000 14054000 wmpps wmpps.dll Wed Oct 18 23:48:03 2006 (45371193)
15110000 1536a000 wmvcore wmvcore.dll Wed Oct 18 23:48:18 2006 (453711A2)
1c400000 1c491000 divxdec divxdec.ax Fri Sep 10 17:42:07 2004 (41423BCF)
1d200000 1d21e000 muveespmpeg muveespmpeg.ax Wed Oct 05 08:16:47 2005 (4343E04F)
20000000 202c5000 xpsp2res xpsp2res.dll Wed Aug 04 01:56:41 2004 (411096B9)
24000000 2427b000 muveempegin muveempegin.dll Thu Nov 17 09:37:34 2005 (437CA3BE)
42990000 429d5000 iertutil iertutil.dll Wed Oct 10 17:55:57 2007 (470D668D)
42c10000 42cdf000 wininet wininet.dll Wed Oct 10 17:56:00 2007 (470D6690)
42cf0000 42e17000 urlmon urlmon.dll Wed Oct 10 17:55:59 2007 (470D668F)
4d4f0000 4d548000 winhttp winhttp.dll Wed Aug 04 01:57:07 2004 (411096D3)
4ec50000 4edf3000 GdiPlus GdiPlus.dll Wed Aug 04 01:55:55 2004 (4110968B)
59a60000 59b01000 dbghelp dbghelp.dll Wed Aug 04 01:56:10 2004 (4110969A)
5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 01:56:43 2004 (411096BB)
5b860000 5b8b4000 netapi32 netapi32.dll Thu Aug 17 06:28:27 2006 (44E460EB)
5d360000 5d36e000 MFC71ENU MFC71ENU.DLL Tue Mar 18 22:44:36 2003 (3E77F5B4)
5e760000 5e76a000 perfos perfos.dll Wed Aug 04 01:56:35 2004 (411096B3)
5edd0000 5ede7000 olepro32 olepro32.dll Wed Aug 04 01:57:43 2004 (411096F7)
629c0000 629c9000 lpk lpk.dll Wed Aug 04 01:56:26 2004 (411096AA)
62bf0000 62c21000 upnphost upnphost.dll Mon Feb 05 14:17:02 2007 (45C790BE)
63380000 633f8000 jscript jscript.dll Tue Oct 17 13:59:54 2006 (4535363A)
64a00000 64a30000 PrKernel PrKernel.ppl Fri Mar 24 09:04:29 2006 (44240A7D)
64d00000 64d47000 prloader prloader.dll Fri Mar 24 09:04:41 2006 (44240A89)
66200000 66243000 params params.ppl Fri Mar 24 09:04:33 2006 (44240A81)
66600000 66622000 pr_remote pr_remote.dll Fri Mar 24 09:02:47 2006 (44240A17)
66900000 6692d000 pxstub pxstub.ppl Fri Mar 24 09:04:45 2006 (44240A8D)
67000000 67008000 klscav klscav.dll Fri Mar 24 09:02:34 2006 (44240A0A)
67500000 67510000 scr_ch_pg scr_ch_pg.dll Fri Mar 24 09:04:35 2006 (44240A83)
67f00000 67f07000 TempFile TempFile.ppl Fri Mar 24 09:03:18 2006 (44240A36)
71aa0000 71aa8000 ws2help ws2help.dll Wed Aug 04 01:57:39 2004 (411096F3)
71ab0000 71ac7000 ws2_32 ws2_32.dll Wed Aug 04 01:57:38 2004 (411096F2)
71bf0000 71c03000 samlib samlib.dll Wed Aug 04 01:56:29 2004 (411096AD)
722b0000 722b5000 sensapi sensapi.dll Wed Aug 04 01:56:28 2004 (411096AC)
72cd0000 72ce8000 l3codecx l3codecx.ax Fri Aug 17 23:33:30 2001 (3B7DFE2A)
72d10000 72d18000 msacm32 msacm32.drv Fri Aug 17 23:33:30 2001 (3B7DFE2A)
72d20000 72d29000 wdmaud wdmaud.drv Wed Aug 04 01:56:54 2004 (411096C6)
736b0000 736b7000 msdmo msdmo.dll Wed Aug 04 01:57:53 2004 (41109701)
73760000 737a9000 ddraw ddraw.dll Wed Aug 04 01:56:16 2004 (411096A0)
73bc0000 73bc6000 dciman32 dciman32.dll Wed Aug 04 01:56:15 2004 (4110969F)
73ee0000 73ee4000 ksuser ksuser.dll Wed Aug 04 01:56:29 2004 (411096AD)
73f10000 73f6c000 dsound dsound.dll Wed Aug 04 01:57:08 2004 (411096D4)
74720000 7476b000 MSCTF MSCTF.dll Wed Aug 04 01:57:30 2004 (411096EA)
74810000 7497d000 quartz quartz.dll Mon Oct 29 16:43:03 2007 (472661F7)
74d90000 74dfb000 usp10 usp10.dll Wed Aug 04 01:56:42 2004 (411096BA)
74f00000 74f0c000 ssdpapi ssdpapi.dll Wed Aug 04 01:59:16 2004 (41109754)
755c0000 755ee000 MSCTFIME MSCTFIME.IME Wed Aug 04 01:57:31 2004 (411096EB)
75a70000 75a91000 msvfw32 msvfw32.dll Wed Aug 04 01:59:15 2004 (41109753)
75cf0000 75d81000 mlang mlang.dll Wed Aug 04 01:56:29 2004 (411096AD)
75e90000 75f40000 sxs sxs.dll Thu Oct 19 07:56:28 2006 (4537840C)
75f40000 75f51000 devenum devenum.dll Wed Aug 04 01:56:22 2004 (411096A6)
76080000 760e5000 msvcp60 msvcp60.dll Wed Aug 04 01:59:13 2004 (41109751)
76380000 76385000 msimg32 msimg32.dll Wed Aug 04 01:58:31 2004 (41109727)
76390000 763ad000 imm32 imm32.dll Wed Aug 04 01:56:30 2004 (411096AE)
769c0000 76a73000 userenv userenv.dll Wed Aug 04 01:56:41 2004 (411096B9)
76b40000 76b6d000 winmm winmm.dll Wed Aug 04 01:57:10 2004 (411096D6)
76bf0000 76bfb000 psapi psapi.dll Wed Aug 04 01:56:58 2004 (411096CA)
76c30000 76c5e000 wintrust wintrust.dll Wed Aug 04 01:56:41 2004 (411096B9)
76c90000 76cb8000 imagehlp imagehlp.dll Wed Aug 04 01:56:25 2004 (411096A9)
76d60000 76d79000 iphlpapi iphlpapi.dll Fri May 19 06:59:41 2006 (446DC13D)
76e80000 76e8e000 rtutils rtutils.dll Wed Aug 04 01:56:36 2004 (411096B4)
76e90000 76ea2000 rasman rasman.dll Wed Aug 04 01:56:29 2004 (411096AD)
76eb0000 76edf000 tapi32 tapi32.dll Wed Aug 04 01:56:38 2004 (411096B6)
76ee0000 76f1c000 rasapi32 rasapi32.dll Wed Aug 04 01:56:25 2004 (411096A9)
76f60000 76f8c000 wldap32 wldap32.dll Wed Aug 04 01:56:43 2004 (411096BB)
76fd0000 7704f000 clbcatq clbcatq.dll Mon Jul 25 22:39:44 2005 (42E5BE90)
77050000 77115000 comres comres.dll Wed Aug 04 01:56:36 2004 (411096B4)
77120000 771ab000 oleaut32 oleaut32.dll Thu May 17 05:28:05 2007 (464C3C45)
773d0000 774d3000 comctl32 comctl32.dll Fri Aug 25 09:45:55 2006 (44EF1B33)
774e0000 7761d000 ole32 ole32.dll Mon Jul 25 22:39:47 2005 (42E5BE93)
77690000 776b1000 ntmarta ntmarta.dll Wed Aug 04 01:57:02 2004 (411096CE)
77920000 77a13000 setupapi setupapi.dll Wed Aug 04 01:56:32 2004 (411096B0)
77a80000 77b14000 crypt32 crypt32.dll Wed Aug 04 01:56:01 2004 (41109691)
77b20000 77b32000 msasn1 msasn1.dll Wed Aug 04 01:57:23 2004 (411096E3)
77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 01:56:36 2004 (411096B4)
77bd0000 77bd7000 midimap midimap.dll Wed Aug 04 01:56:25 2004 (411096A9)
77be0000 77bf5000 msacm32_77be0000 msacm32.dll Wed Aug 04 01:57:03 2004 (411096CF)
77c00000 77c08000 version version.dll Wed Aug 04 01:56:39 2004 (411096B7)
77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 01:59:14 2004 (41109752)
77c70000 77c93000 msv1_0 msv1_0.dll Wed Aug 04 01:59:11 2004 (4110974F)
77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 01:56:23 2004 (411096A7)
77e70000 77f01000 rpcrt4 rpcrt4.dll Mon Jul 09 07:16:16 2007 (46923520)
77f10000 77f57000 gdi32 gdi32.dll Tue Jun 19 07:31:19 2007 (4677DAA7)
77f60000 77fd6000 shlwapi shlwapi.dll Thu Jan 04 07:36:54 2007 (459D02F6)
77fe0000 77ff1000 secur32 secur32.dll Wed Aug 04 01:56:49 2004 (411096C1)
7c140000 7c243000 MFC71 MFC71.dll Tue Mar 18 23:19:57 2003 (3E77FDFD)
7c340000 7c396000 msvcr71 msvcr71.dll Fri Feb 21 06:42:20 2003 (3E561EAC)
7c3a0000 7c41b000 msvcp71 msvcp71.dll Tue Mar 18 22:14:51 2003 (3E77EEBB)
7c800000 7c8f5000 kernel32 kernel32.dll Mon Apr 16 09:52:53 2007 (46239BD5)
7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 01:56:36 2004 (411096B4)
7c9c0000 7d1d7000 shell32 shell32.dll Thu Oct 25 21:33:59 2007 (47216027)
7e410000 7e4a0000 user32 user32.dll Thu Mar 08 09:36:28 2007 (45F02D7C)
Closing open log file c:\debuglog.txt

Found my MEMORY.dmp:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805535a0
Debug session time: Mon Jan 14 19:22:40.781 2008 (GMT-6)
System Uptime: 0 days 0:04:00.363
Loading Kernel Symbols
.............................................................................................................................................
Loading User Symbols

Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {81, 2, 0, 87399550}





Probably caused by : ntkrnlpa.exe ( nt!KiTrap0E+233 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000081, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 87399550, address which referenced memory

Debugging Details:
------------------






READ_ADDRESS: 00000081

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffff87399550
87399550 0000 add byte ptr [eax],al

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

TRAP_FRAME: 805491b8 -- (.trap 0xffffffff805491b8)
.trap 0xffffffff805491b8
ErrCode = 00000000
eax=00000081 ebx=ffdff000 ecx=87399544 edx=873ace48 esi=80551d20 edi=80551f80
eip=87399550 esp=8054922c ebp=8054922c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
87399550 0000 add byte ptr [eax],al ds:0023:00000081=??
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 87399550 to 8053fc13

STACK_TEXT:
805491b8 87399550 badb0d00 873ace48 badb0d00 nt!KiTrap0E+0x233
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054922c 8054111d 873ace48 8739a000 00000000 0x87399550
80549250 80541096 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
80549254 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+233
8053fc13 f7457000000200 test dword ptr [ebp+70h],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+233

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54849

FAILURE_BUCKET_ID: 0xD1_nt!KiTrap0E+233

BUCKET_ID: 0xD1_nt!KiTrap0E+233

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000002 ecx=00000000 edx=00000000 esi=87399550 edi=00000081
eip=8053fc13 esp=805491a0 ebp=805491b8 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x233:
8053fc13 f7457000000200 test dword ptr [ebp+70h],20000h ss:0010:80549228=00010206
ChildEBP RetAddr Args to Child
805491b8 87399550 badb0d00 873ace48 badb0d00 nt!KiTrap0E+0x233 (FPO: [0,0] TrapFrame @ 805491b8)
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054922c 8054111d 873ace48 8739a000 00000000 0x87399550
80549250 80541096 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
80549254 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26 (FPO: [0,0,0])
start end module name
804d7000 806cdc80 nt ntkrnlpa.exe Wed Feb 28 03:15:53 2007 (45E54849)
806ce000 806ee280 hal halaacpi.dll Mon Nov 15 19:37:02 2004 (419959BE)
a327f000 a32a9180 kmixer kmixer.sys Wed Jun 14 02:47:45 2006 (448FCD31)
a4aca000 a4acd800 asyncmac asyncmac.sys Wed Aug 04 00:05:02 2004 (41107C8E)
a4b66000 a4b75900 Cdfs Cdfs.SYS Wed Aug 04 00:14:09 2004 (41107EB1)
a5109000 a511d400 wdmaud wdmaud.sys Wed Jun 14 03:00:44 2006 (448FD03C)
a520e000 a525f480 srv srv.sys Mon Aug 14 04:34:39 2006 (44E051BF)
a5288000 a52c8280 HTTP HTTP.sys Thu Mar 16 18:33:09 2006 (441A03C5)
a5319000 a5345400 mrxdav mrxdav.sys Wed Aug 04 00:00:49 2004 (41107B91)
a9336000 a9339180 mdmxsdk mdmxsdk.sys Mon Jun 19 15:26:59 2006 (449716A3)
bf800000 bf9c2180 win32k win32k.sys Thu Mar 08 07:47:34 2007 (45F013F6)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 00:00:51 2004 (41107B93)
bf9d5000 bfda2f80 nv4_disp nv4_disp.dll Wed Sep 27 18:54:42 2006 (451B1D52)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 01:56:56 2004 (411096C8)
ee059000 ee071500 dump_nvata dump_nvata.sys Fri Jan 27 16:04:15 2006 (43DA98DF)
ee072000 ee095000 Fastfat Fastfat.SYS Wed Aug 04 00:14:15 2004 (41107EB7)
ee095000 ee0b5f00 ipnat ipnat.sys Wed Sep 29 16:28:36 2004 (415B3714)
ee0b6000 ee0ee000 klif klif.sys Fri Aug 04 05:00:23 2006 (44D328C7)
ee0ee000 ee15ca00 mrxsmb mrxsmb.sys Fri May 05 03:41:42 2006 (445B1DD6)
ee15d000 ee187a00 rdbss rdbss.sys Fri May 05 03:47:55 2006 (445B1F4B)
ee188000 ee1a9d00 afd afd.sys Wed Aug 04 00:14:13 2004 (41107EB5)
ee1aa000 ee1d1c00 netbt netbt.sys Wed Aug 04 00:14:36 2004 (41107ECC)
ee1d2000 ee229e80 tcpip tcpip.sys Tue Oct 30 11:20:52 2007 (472767F4)
ee22a000 ee23c400 ipsec ipsec.sys Wed Aug 04 00:14:27 2004 (41107EC3)
ee2e5000 ee2ec880 Npfs Npfs.SYS Wed Aug 04 00:00:38 2004 (41107B86)
ee2ed000 ee2f1a80 Msfs Msfs.SYS Wed Aug 04 00:00:37 2004 (41107B85)
ee2f5000 ee2fa200 vga vga.sys Wed Aug 04 00:07:06 2004 (41107D0A)
ee489000 ee489d00 dxgthk dxgthk.sys Fri Aug 17 14:53:12 2001 (3B7D8438)
ee892000 ee943e00 HSF_CNXT HSF_CNXT.sys Tue Aug 29 15:10:51 2006 (44F4AD5B)
ee944000 eea35d80 HSF_DPV HSF_DPV.sys Tue Aug 29 15:12:19 2006 (44F4ADB3)
eea36000 eea68e00 HSFHWAZL HSFHWAZL.sys Tue Aug 29 15:11:06 2006 (44F4AD6A)
eea69000 eea8ca00 portcls portcls.sys Mon Mar 21 21:43:14 2005 (423F9452)
eea8d000 eeb24000 CHDAud CHDAud.sys Thu Jul 27 15:44:40 2006 (44C933C8)
eecbd000 eecbf900 Dxapi Dxapi.sys Fri Aug 17 14:53:19 2001 (3B7D843F)
eecf3000 eecf6280 ndisuio ndisuio.sys Wed Aug 04 00:03:10 2004 (41107C1E)
eed0f000 eed10100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 15:07:23 2001 (3B7D878B)
eee86000 eee94b80 drmk drmk.sys Wed Aug 04 00:07:54 2004 (41107D3A)
eeea6000 eeeae580 NVENETFD NVENETFD.sys Fri Mar 03 16:31:00 2006 (4408C3A4)
eeeb6000 eeec4100 usbhub usbhub.sys Wed Aug 04 00:08:40 2004 (41107D68)
ef8b2000 ef8b3e80 eabfiltr eabfiltr.sys Mon Sep 19 13:23:51 2005 (432F1047)
ef8b4000 ef8b5080 RDPCDD RDPCDD.sys Fri Aug 17 14:46:56 2001 (3B7D82C0)
ef8b6000 ef8b7080 mnmdd mnmdd.SYS Fri Aug 17 14:57:28 2001 (3B7D8538)
ef8b8000 ef8b9080 Beep Beep.SYS Fri Aug 17 14:47:33 2001 (3B7D82E5)
ef8ba000 ef8bbf00 Fs_Rec Fs_Rec.SYS Fri Aug 17 14:49:37 2001 (3B7D8361)
ef8bc000 ef8be000 i2omgmt i2omgmt.SYS Wed Aug 04 00:00:50 2004 (41107B92)
f1082000 f1089580 Modem Modem.SYS Wed Aug 04 00:08:04 2004 (41107D44)
f129c000 f12aad80 sysaudio sysaudio.sys Wed Aug 04 00:15:54 2004 (41107F1A)
f56e4000 f5717200 update update.sys Tue Aug 03 23:58:32 2004 (41107B08)
f5718000 f5728e00 psched psched.sys Wed Aug 04 00:04:16 2004 (41107C60)
f5729000 f573f680 ndiswan ndiswan.sys Wed Aug 04 00:14:30 2004 (41107EC6)
f5768000 f579e580 NVSNPU NVSNPU.SYS Fri Mar 03 16:30:30 2006 (4408C386)
f579f000 f57e9780 NVNRM NVNRM.SYS Fri Mar 03 16:30:44 2006 (4408C394)
f57ea000 f580f000 HDAudBus HDAudBus.sys Fri Jan 07 19:07:15 2005 (41DF3243)
f5b7d000 f5bc8700 rixdptsk rixdptsk.sys Tue Nov 01 03:07:59 2005 (4367306F)
f5bc9000 f5bd9800 sdbus sdbus.sys Wed Aug 04 00:07:47 2004 (41107D33)
f5bda000 f5bfc680 ks ks.sys Wed Aug 04 00:15:20 2004 (41107EF8)
f5bfd000 f5c20000 USBPORT USBPORT.SYS Wed Apr 19 05:50:49 2006 (44462419)
f5c20000 f5c33780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 00:07:04 2004 (41107D08)
f5c34000 f5fba040 nv4_mini nv4_mini.sys Wed Sep 27 19:01:28 2006 (451B1EE8)
f5fbb000 f604eb00 bcmwl5 bcmwl5.sys Thu Oct 12 17:12:19 2006 (452ECBD3)
f606f000 f607dd80 arp1394 arp1394.sys Tue Aug 03 23:58:28 2004 (41107B04)
f607f000 f6087700 wanarp wanarp.sys Wed Aug 04 00:04:57 2004 (41107C89)
f608f000 f6097880 Fips Fips.SYS Fri Aug 17 19:31:49 2001 (3B7DC585)
f609f000 f60a8480 NDProxy NDProxy.SYS Fri Aug 17 14:55:30 2001 (3B7D84C2)
f60af000 f60b8f00 termdd termdd.sys Tue Aug 03 23:58:52 2004 (41107B1C)
f60bf000 f60c7900 msgpc msgpc.sys Wed Aug 04 00:04:11 2004 (41107C5B)
f60cf000 f60dad00 raspptp raspptp.sys Wed Aug 04 00:14:26 2004 (41107EC2)
f60df000 f60e9200 raspppoe raspppoe.sys Wed Aug 04 00:05:06 2004 (41107C92)
f6524000 f6527a00 kbdhid kbdhid.sys Tue Aug 03 23:58:33 2004 (41107B09)
f6baf000 f6bbb880 rasl2tp rasl2tp.sys Wed Aug 04 00:14:21 2004 (41107EBD)
f6bbf000 f6bcbe00 i8042prt i8042prt.sys Wed Aug 04 00:14:36 2004 (41107ECC)
f7086000 f7088280 rasacd rasacd.sys Fri Aug 17 14:55:39 2001 (3B7D84CB)
f7096000 f7099c80 mssmbios mssmbios.sys Wed Aug 04 00:07:47 2004 (41107D33)
f709a000 f709c580 ndistapi ndistapi.sys Fri Aug 17 14:55:29 2001 (3B7D84C1)
f709e000 f70a1300 nvnetbus nvnetbus.sys Fri Mar 03 16:31:02 2006 (4408C3A6)
f70d2000 f70ec580 Mup Mup.sys Wed Aug 04 00:15:20 2004 (41107EF8)
f70ed000 f7119900 NDIS NDIS.sys Mon Jan 09 19:01:04 2006 (43C30750)
f711a000 f71a6400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f71a7000 f71bd780 KSecDD KSecDD.sys Tue Aug 03 23:59:45 2004 (41107B51)
f71be000 f71cff00 sr sr.sys Wed Aug 04 00:06:22 2004 (41107CDE)
f71d0000 f71ef780 fltMgr fltMgr.sys Mon Aug 21 03:14:57 2006 (44E97991)
f71f0000 f7208500 nvata nvata.sys Fri Jan 27 16:04:15 2006 (43DA98DF)
f7209000 f7220480 atapi atapi.sys Tue Aug 03 23:59:41 2004 (41107B4D)
f7221000 f723f880 ftdisk ftdisk.sys Fri Aug 17 14:52:41 2001 (3B7D8419)
f7240000 f725d480 pcmcia pcmcia.sys Wed Aug 04 00:07:45 2004 (41107D31)
f725e000 f726ea80 pci pci.sys Wed Aug 04 00:07:45 2004 (41107D31)
f726f000 f729cd80 ACPI ACPI.sys Wed Aug 04 00:07:35 2004 (41107D27)
f729d000 f72b4800 SPTD6205 SPTD6205.SYS Tue Aug 03 23:59:39 2004 (41107B4B)
f72b5000 f7386000 sptd sptd.sys Sat Jun 24 03:18:51 2006 (449D037B)
f7487000 f748fc00 isapnp isapnp.sys Fri Aug 17 14:58:01 2001 (3B7D8559)
f7497000 f74a5e80 ohci1394 ohci1394.sys Mon Sep 27 16:19:12 2004 (415891E0)
f74a7000 f74b4000 1394BUS 1394BUS.SYS Wed Aug 04 00:10:03 2004 (41107DBB)
f74b7000 f74c1500 MountMgr MountMgr.sys Tue Aug 03 23:58:29 2004 (41107B05)
f74c7000 f74d3c80 VolSnap VolSnap.sys Wed Aug 04 00:00:14 2004 (41107B6E)
f74d7000 f74dfe00 disk disk.sys Tue Aug 03 23:59:53 2004 (41107B59)
f74e7000 f74f3200 CLASSPNP CLASSPNP.SYS Wed Aug 04 00:14:26 2004 (41107EC2)
f74f7000 f7506d80 Serial Serial.sys Wed Aug 04 00:15:51 2004 (41107F17)
f7587000 f7596180 nic1394 nic1394.sys Tue Aug 03 23:58:28 2004 (41107B04)
f7627000 f762fd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 00:08:18 2004 (41107D52)
f7637000 f7645000 AmdK8 AmdK8.sys Wed May 10 12:26:59 2006 (44623073)
f7647000 f7651380 imapi imapi.sys Wed Aug 04 00:00:12 2004 (41107B6C)
f7657000 f7663180 cdrom cdrom.sys Tue Aug 03 23:59:52 2004 (41107B58)
f7667000 f7673980 rimsptsk rimsptsk.sys Tue Nov 01 02:54:48 2005 (43672D58)
f7677000 f7685000 redbook redbook.sys Mon Feb 27 18:10:19 2006 (440394EB)
f76f7000 f76ff700 netbios netbios.sys Wed Aug 04 00:03:19 2004 (41107C27)
f7707000 f770d200 PCIIDEX PCIIDEX.SYS Tue Aug 03 23:59:40 2004 (41107B4C)
f770f000 f7713900 PartMgr PartMgr.sys Fri Aug 17 19:32:23 2001 (3B7DC5A7)
f7717000 f771be20 PxHelp20 PxHelp20.sys Mon Apr 25 13:48:02 2005 (426D4972)
f771f000 f7723880 TDI TDI.SYS Wed Aug 04 00:07:47 2004 (41107D33)
f774f000 f7753500 watchdog watchdog.sys Wed Aug 04 00:07:32 2004 (41107D24)
f775f000 f7765000 kbdclass kbdclass.sys Tue Aug 03 23:58:32 2004 (41107B08)
f7767000 f776ca00 mouclass mouclass.sys Tue Aug 03 23:58:32 2004 (41107B08)
f776f000 f7773580 ptilink ptilink.sys Fri Aug 17 14:49:53 2001 (3B7D8371)
f7777000 f777b080 raspti raspti.sys Fri Aug 17 14:55:32 2001 (3B7D84C4)
f784f000 f7856580 usbehci usbehci.sys Wed Apr 19 05:50:49 2006 (44462419)
f7857000 f785d180 HIDPARSE HIDPARSE.SYS Wed Aug 04 00:08:15 2004 (41107D4F)
f785f000 f7863300 usbohci usbohci.sys Wed Apr 19 05:50:50 2006 (4446241A)
f7867000 f786db00 ElbyCDFL ElbyCDFL.sys Thu Dec 14 15:22:33 2006 (4581C099)
f786f000 f7876100 rimmptsk rimmptsk.sys Wed Nov 16 20:28:31 2005 (437BEACF)
f7877000 f787e260 SCDEmu SCDEmu.SYS Mon Apr 09 06:27:07 2007 (461A311B)
f7897000 f789a000 BOOTVID BOOTVID.dll Fri Aug 17 14:49:09 2001 (3B7D8345)
f789b000 f789d480 compbatt compbatt.sys Fri Aug 17 14:57:58 2001 (3B7D8556)
f789f000 f78a2700 BATTC BATTC.SYS Fri Aug 17 14:57:52 2001 (3B7D8550)
f78a3000 f78a5d80 ACPIEC ACPIEC.sys Fri Aug 17 14:57:55 2001 (3B7D8553)
f78a7000 f78a9640 kl1 kl1.sys Mon Feb 13 06:24:10 2006 (43F07A6A)
f795b000 f795e700 CmBatt CmBatt.sys Wed Aug 04 00:07:39 2004 (41107D2B)
f795f000 f7961480 cpqbttn cpqbttn.sys Mon Sep 19 13:24:09 2005 (432F1059)
f7963000 f7965280 wmiacpi wmiacpi.sys Wed Aug 04 00:07:39 2004 (41107D2B)
f7977000 f7979b80 nvsmu nvsmu.sys Mon Mar 06 15:49:35 2006 (440CAE6F)
f7987000 f7988b80 kdcom kdcom.dll Fri Aug 17 14:49:10 2001 (3B7D8346)
f7989000 f798a100 WMILIB WMILIB.SYS Fri Aug 17 15:07:23 2001 (3B7D878B)
f798b000 f798c580 intelide intelide.sys Tue Aug 03 23:59:40 2004 (41107B4C)
f798d000 f798e500 viaide viaide.sys Tue Aug 03 23:59:42 2004 (41107B4E)
f798f000 f7990480 aliide aliide.sys Fri Aug 17 14:51:54 2001 (3B7D83EA)
f79d9000 f79da280 USBD USBD.SYS Fri Aug 17 15:02:58 2001 (3B7D8682)
f7a29000 f7a2a100 swenum swenum.sys Tue Aug 03 23:58:41 2004 (41107B11)
f7a39000 f7a3af80 ElbyCDIO ElbyCDIO.sys Tue Dec 12 16:48:53 2006 (457F31D5)
f7a3b000 f7a3ccc0 MCSTRM MCSTRM.SYS Tue Dec 16 16:24:32 2003 (3FDF8620)
f7a4f000 f7a4fd00 pciide pciide.sys Fri Aug 17 14:51:49 2001 (3B7D83E5)
f7a50000 f7a50d80 OPRGHDLR OPRGHDLR.SYS Fri Aug 17 14:57:55 2001 (3B7D8553)
f7abc000 f7abcc00 audstub audstub.sys Fri Aug 17 14:59:40 2001 (3B7D85BC)
f7b4a000 f7b4ab80 Null Null.SYS Fri Aug 17 14:47:39 2001 (3B7D82EB)

Unloaded modules:
a50bb000 a50e6000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7aec000 f7aed000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eeda9000 eedb6000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eedb9000 eedc7000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
a50e6000 a5109000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f79eb000 f79ed000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6bcf000 f6bd8000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ee2fd000 ee302000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f708a000 f708d000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ee305000 ee30a000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ee30d000 ee314000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

As far as i can tell this problem began to occur when i installed my university's internet access its called Cisco Clean Access Agent, thats as far as I can tell what seems to cause the problem, because it does run all the time and if i shut it off it seems to work fine, but im not too sure if it is all that great. And im in safe mode with network prompting and it seems to be running flawlessly. Although im in safe mode lol. But these BSOD's are killing me, im sitting in a night class trying to take notes and i keep losing my notes, not to mention when it restarts it makes this insane beeping noise which disrupts my whole class, the funny thing is that proffessor left the soviet union illegally and she is really paranoid, when she heard that she thought that someone was recording her lectures. But that anecdote is another story. But I'll try uninstalling that Access Agent will fix some problems, followed by a system restore.

Well aside from having to re-install World of Warcraft I think a major system restore fixed the problem. I just went back to november and it seems to have taken care of the problem... but im wondering if World of Warcraft was causing the problem...

 

The problem maybe related to faulty ram. BTW your windows has two software and their version has known software problem and they are daemon tools and kaspery AV.

klif.sys Fri Aug 4 5:00:23 2006 44D328C7 <-- Kaspery Anti Virus
sptd.sys Sat Jun 24 3:18:51 2006 449D037B <-- daemon tool 4.0.3

You had better upgrade or de-install the above software. If your windows still crashes, attach the latest debug report here.

 

Is there any way to check if i have faulty ram.. but ya, i didnt even know I still had daemon tools installed.. ya i heard it wasn't great. Can i upgrade Kaspersky for free.. or do i have to buy a new program to get Kaspersky AV 7?

I did some resarch and i can update my kaspersky to 7 for free, but it asks me to save my activation info.. dont know how to do that.. and as for Daemon tools, i dont think its still on my computer, so why would it show up in that scan. I have tried to find it... cna you tell were it is from the logs?

 

I believe its faulty ram, my computer constantly getting windows stop errors, with IRQL_NOT_LESS_OR_EQUAL, it is also beeping when it boots up, as well as not booting up at all. Like booting and then shutting down and over again. I check a site and it said that is the problem, more or less. Im trying to run a diagnostic on it right now. But i cant get the diagnostic tool to run from my usb drive... tried setting the boot order for my usb drive.. but it didnt work... But im still quite sure that the RAM is out of wack, but i need to bring it into my computer store for their diagnostic .. the problem is they need 7-9 days to diagnose and i need it for an essay.. hopefully it will all work out sooner or later.