Crash Dumps on Win2k3

Hi All,
New to the forum but I'm hoping somebody can help me out with deciphering a driver crash dump. Here's the contents of it. The server is Win2k3 SP2 running Citrix Presentation Server 4.0. I'm pretty certain that I have a faulty print driver but I can't figure out which one it is. Any help would be greatly appreciated!


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Thu Dec 13 17:11:22.649 2007 (GMT-5)
System Uptime: 0 days 14:08:32.130
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols

Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {d5940000, 0, 808ce49f, 0}

Probably caused by : ntkrpamp.exe ( nt!CmpFileWrite+5d )

Followup: MachineOwner
---------

0: kd> !analyze -hang -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d5940000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808ce49f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

Scanning for threads blocked on locks ...

READ_ADDRESS: d5940000

FAULTING_IP:
nt!CmpFileWrite+5d
808ce49f 0fbe32 movsx esi,byte ptr [edx]

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 1

TRAP_FRAME: f70f8c04 -- (.trap fffffffff70f8c04)
ErrCode = 00000000
eax=d5941000 ebx=e2b24860 ecx=00000099 edx=d5940000 esi=00000068 edi=00000000
eip=808ce49f esp=f70f8c78 ebp=f70f8cd0 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!CmpFileWrite+0x5d:
808ce49f 0fbe32 movsx esi,byte ptr [edx] ds:0023:d5940000=??
Resetting default scope

BLOCKED_THREAD: 8b3763f0

LAST_CONTROL_TRANSFER: from 8085e6cd to 80827447

STACK_TEXT:
f70f8b74 8085e6cd 00000050 d5940000 00000000 nt!KeBugCheckEx+0x1b
f70f8bec 8088bc18 00000000 d5940000 00000000 nt!MmAccessFault+0xb25
f70f8bec 808ce49f 00000000 d5940000 00000000 nt!KiTrap0E+0xdc
f70f8cd0 808befdf e2b24860 00000001 e43a0000 nt!CmpFileWrite+0x5d
f70f8d28 808bf9a5 000000e0 e2b24860 e2b24b58 nt!HvpWriteLog+0x2cd
f70f8d3c 808c134d e2b24801 8b3763f0 808a4828 nt!HvSyncHive+0x71
f70f8d58 808ca4b5 00000000 e2b24b58 f70f8d78 nt!CmpDoFlushNextHive+0xe1
f70f8d80 8087f92f 00000000 00000000 8b3763f0 nt!CmpLazyFlushWorker+0x7f
f70f8dac 80948bd0 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f70f8ddc 8088d4e2 8087f844 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpFileWrite+5d
808ce49f 0fbe32 movsx esi,byte ptr [edx]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ebdefe

SYMBOL_NAME: nt!CmpFileWrite+5d

FAILURE_BUCKET_ID: 0x50_nt!CmpFileWrite+5d

BUCKET_ID: 0x50_nt!CmpFileWrite+5d

Followup: MachineOwner
---------

0: kd>

 

Your debug report is incomplete, the output of !analyze has the module list and you only attach the first half of the debug report. If you suspect it is the faulty printer driver, attach the output of windbg !lm tn.

 

When I enter the windbg !lm tn, I get the following: "No runnable debuggees error in 'windbg !lm tn' ".

When I enter !lm tn, I get: "No export lm found "

Are you looking for the loaded modules using the lmv command?


Thanks again for helping out a novice debugger.

 

lm tn is windbg subcommand. It is typo error and ! is not required . You must issue windbg and enter lm tn

 

Thanks cpc2004 and Admin. The lm tn without the ! worked. Here's the output of debugwiz which looks like it pretty much has the info that lm tn gives. Pretty much looking for a smoking gun in this. I suspect a print driver but can't tell for sure. Hopefully it makes better sense to you...



Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp1_gdr.070304-2232
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Thu Dec 13 17:11:22.649 2007 (GMT-5)
System Uptime: 0 days 14:08:32.130
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols

Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {d5940000, 0, 808ce49f, 0}

Probably caused by : ntkrpamp.exe ( nt!CmpFileWrite+5d )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d5940000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 808ce49f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: d5940000

FAULTING_IP:
nt!CmpFileWrite+5d
808ce49f 0fbe32 movsx esi,byte ptr [edx]

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 1

TRAP_FRAME: f70f8c04 -- (.trap fffffffff70f8c04)
.trap fffffffff70f8c04
ErrCode = 00000000
eax=d5941000 ebx=e2b24860 ecx=00000099 edx=d5940000 esi=00000068 edi=00000000
eip=808ce49f esp=f70f8c78 ebp=f70f8cd0 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!CmpFileWrite+0x5d:
808ce49f 0fbe32 movsx esi,byte ptr [edx] ds:0023:d5940000=??
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 8085e6cd to 80827447

STACK_TEXT:
f70f8b74 8085e6cd 00000050 d5940000 00000000 nt!KeBugCheckEx+0x1b
f70f8bec 8088bc18 00000000 d5940000 00000000 nt!MmAccessFault+0xb25
f70f8bec 808ce49f 00000000 d5940000 00000000 nt!KiTrap0E+0xdc
f70f8cd0 808befdf e2b24860 00000001 e43a0000 nt!CmpFileWrite+0x5d
f70f8d28 808bf9a5 000000e0 e2b24860 e2b24b58 nt!HvpWriteLog+0x2cd
f70f8d3c 808c134d e2b24801 8b3763f0 808a4828 nt!HvSyncHive+0x71
f70f8d58 808ca4b5 00000000 e2b24b58 f70f8d78 nt!CmpDoFlushNextHive+0xe1
f70f8d80 8087f92f 00000000 00000000 8b3763f0 nt!CmpLazyFlushWorker+0x7f
f70f8dac 80948bd0 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f70f8ddc 8088d4e2 8087f844 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpFileWrite+5d
808ce49f 0fbe32 movsx esi,byte ptr [edx]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ebdefe

SYMBOL_NAME: nt!CmpFileWrite+5d

FAILURE_BUCKET_ID: 0x50_nt!CmpFileWrite+5d

BUCKET_ID: 0x50_nt!CmpFileWrite+5d

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000000 ecx=00000000 edx=000003e0 esi=ffdff120 edi=c06aca00
eip=80827447 esp=f70f8b5c ebp=f70f8b74 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80827447 5d pop ebp
ChildEBP RetAddr Args to Child
f70f8b74 8085e6cd 00000050 d5940000 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f70f8bec 8088bc18 00000000 d5940000 00000000 nt!MmAccessFault+0xb25 (FPO: [Non-Fpo])
f70f8bec 808ce49f 00000000 d5940000 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ f70f8c04)
f70f8cd0 808befdf e2b24860 00000001 e43a0000 nt!CmpFileWrite+0x5d (FPO: [Non-Fpo])
f70f8d28 808bf9a5 000000e0 e2b24860 e2b24b58 nt!HvpWriteLog+0x2cd (FPO: [Non-Fpo])
f70f8d3c 808c134d e2b24801 8b3763f0 808a4828 nt!HvSyncHive+0x71 (FPO: [Non-Fpo])
f70f8d58 808ca4b5 00000000 e2b24b58 f70f8d78 nt!CmpDoFlushNextHive+0xe1 (FPO: [Non-Fpo])
f70f8d80 8087f92f 00000000 00000000 8b3763f0 nt!CmpLazyFlushWorker+0x7f (FPO: [Non-Fpo])
f70f8dac 80948bd0 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb (FPO: [Non-Fpo])
f70f8ddc 8088d4e2 8087f844 00000001 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
80800000 80a53000 nt ntkrpamp.exe Mon Mar 05 04:12:30 2007 (45EBDEFE)
80a53000 80a7f000 hal halmacpi.dll Thu Mar 24 20:28:37 2005 (42435B35)
b1b06000 b1b18320 naveng naveng.sys Tue Oct 30 16:39:40 2007 (4727968C)
b1b19000 b1beac40 navex15 navex15.sys Tue Oct 30 15:58:16 2007 (47278CD8)
bf800000 bf9d2000 win32k win32k.sys Thu Mar 01 07:18:23 2007 (45E6C48F)
bf9d2000 bf9e8000 dxg dxg.sys Thu Mar 24 20:27:25 2005 (42435AED)
bf9e8000 bfa22000 ati2dvag ati2dvag.dll Thu Nov 11 22:02:23 2004 (419427BF)
bfa22000 bfa5f000 ati2cqag ati2cqag.dll Thu Nov 11 21:22:24 2004 (41941E60)
bfa5f000 bfc92320 ati3duag ati3duag.dll Thu Nov 11 21:43:23 2004 (4194234B)
bfc93000 bfcfd000 ativvaxx ativvaxx.dll Thu Nov 11 21:38:17 2004 (41942219)
bfcfd000 bfd75000 vdtw30 vdtw30.dll Tue Nov 29 13:31:17 2005 (438C9E75)
bffa0000 bffea000 ATMFD ATMFD.DLL Thu Mar 24 22:30:36 2005 (424377CC)
f3ed9000 f3edc300 pdcrypt1 pdcrypt1.sys Mon Apr 11 22:54:18 2005 (425B385A)
f48ed000 f48efa00 pdrframe pdrframe.sys Mon Apr 11 22:54:12 2005 (425B3854)
f4a2d000 f4a5a000 RDPWD RDPWD.SYS Wed Jun 15 11:33:14 2005 (42B04A3A)
f4a5a000 f4a91c00 WDICA WDICA.SYS Tue Nov 29 13:31:50 2005 (438C9E96)
f4b1e000 f4b21100 icareduc icareduc.sys Mon Apr 11 22:53:03 2005 (425B380F)
f4d0a000 f4d15000 TDTCP TDTCP.SYS Thu Mar 24 20:27:15 2005 (42435AE3)
f4e02000 f4e16000 pdlndldl pdlndldl.sys Mon Apr 18 18:05:55 2005 (42642F43)
f4f22000 f4f24300 uphcleanhlp uphcleanhlp.sys Wed Apr 27 14:58:56 2005 (426FE0F0)
f4f56000 f4fab000 userdump userdump.sys Fri Dec 15 03:27:06 2006 (45825C5A)
f51db000 f5247000 srv srv.sys Fri Sep 01 10:32:26 2006 (44F8447A)
f5297000 f52e7000 HTTP HTTP.sys Thu Mar 24 20:40:36 2005 (42435E04)
f533f000 f534c000 pdlndoem pdlndoem.sys Mon Apr 18 18:05:49 2005 (42642F3D)
f5427000 f546fc00 cdm cdm.sys Tue Nov 29 13:30:08 2005 (438C9E30)
f5588000 f55a5560 appnapi appnapi.sys Mon Apr 18 17:09:14 2005 (426421FA)
f55a6000 f55b6670 pdlnemap pdlnemap.sys Mon Apr 18 18:06:15 2005 (42642F57)
f55b7000 f55c8000 pdlndtdl pdlndtdl.sys Mon Apr 18 18:05:48 2005 (42642F3C)
f55c8000 f55dc000 pdlndsdl pdlndsdl.sys Mon Apr 18 18:05:45 2005 (42642F39)
f55dc000 f55ee000 pdlndqll pdlndqll.sys Mon Apr 18 18:05:42 2005 (42642F36)
f55ee000 f5603000 pdlndlpb pdlndlpb.sys Mon Apr 18 18:05:40 2005 (42642F34)
f5603000 f562a220 pdlncfwk pdlncfwk.sys Mon Apr 18 18:05:12 2005 (42642F18)
f562b000 f563d5c0 pdlnacom pdlnacom.sys Mon Apr 18 18:06:44 2005 (42642F74)
f563e000 f57781a0 appn appn.sys Mon Apr 18 17:08:49 2005 (426421E1)
f5779000 f5791c20 llc2 llc2.sys Mon Apr 18 17:06:53 2005 (4264216D)
f5792000 f57c1d20 AppnBase AppnBase.sys Mon Apr 18 17:06:44 2005 (42642164)
f5912000 f591acd0 pdlnafac pdlnafac.sys Mon Apr 18 18:07:06 2005 (42642F8A)
f5922000 f5930440 pdlnsx25 pdlnsx25.sys Mon Apr 18 18:06:37 2005 (42642F6D)
f5932000 f593f490 pdlnsv25 pdlnsv25.sys Mon Apr 18 18:06:31 2005 (42642F67)
f5942000 f5950870 pdlnshay pdlnshay.sys Mon Apr 18 18:06:28 2005 (42642F64)
f5976000 f5978300 ctxsmcdrv ctxsmcdrv.sys Mon Apr 11 22:54:41 2005 (425B3871)
f5992000 f59951e0 pdlnemsg pdlnemsg.sys Mon Apr 18 18:04:54 2005 (42642F06)
f5996000 f59981a0 pdlnebas pdlnebas.sys Mon Apr 18 18:04:53 2005 (42642F05)
f59a2000 f59a48a0 klognt klognt.sys Mon Apr 18 16:55:03 2005 (42641EA7)
f59f2000 f5a0b980 CtxSbx CtxSbx.sys Mon Apr 11 22:55:07 2005 (425B388B)
f5b24000 f5b27300 ctxpidmn ctxpidmn.sys Mon Apr 11 22:55:12 2005 (425B3890)
f5b6c000 f5b76000 pdlnatcm pdlnatcm.sys Mon Apr 18 18:05:22 2005 (42642F22)
f5c14000 f5c25000 Fips Fips.SYS Thu Mar 24 20:40:33 2005 (42435E01)
f5c25000 f5ca5000 mrxsmb mrxsmb.sys Mon May 08 13:18:45 2006 (445F7D75)
f5ca5000 f5cde000 rdbss rdbss.sys Mon May 08 13:18:53 2006 (445F7D7D)
f5cde000 f5d08000 afd afd.sys Thu Mar 24 20:40:43 2005 (42435E0B)
f5d08000 f5d39000 netbt netbt.sys Thu Mar 24 20:40:31 2005 (42435DFF)
f5d39000 f5d9a000 tcpip tcpip.sys Tue May 23 21:02:22 2006 (4473B09E)
f5d9a000 f5db3000 ipsec ipsec.sys Thu Mar 24 20:40:49 2005 (42435E11)
f5f3e000 f5f50f00 SYMEVENT SYMEVENT.SYS Wed Jan 14 21:02:13 2004 (4005F4A5)
f5f51000 f5fa0000 savrt savrt.sys Mon Feb 09 18:24:30 2004 (402816AE)
f5fa0000 f5fac4a0 pdlnecfg pdlnecfg.sys Mon Apr 18 18:05:01 2005 (42642F0D)
f60a2000 f60b6000 usbhub usbhub.sys Thu Mar 24 20:30:46 2005 (42435BB6)
f6199000 f61f8000 update update.sys Mon May 28 07:30:38 2007 (465ABD5E)
f61f8000 f6220000 ks ks.sys Thu Mar 24 20:41:03 2005 (42435E1F)
f6248000 f627f000 rdpdr rdpdr.sys Thu Mar 24 20:30:20 2005 (42435B9C)
f627f000 f6292000 raspptp raspptp.sys Thu Mar 24 20:40:43 2005 (42435E0B)
f6292000 f62ac000 ndiswan ndiswan.sys Thu Mar 24 20:40:46 2005 (42435E0E)
f62ac000 f62c1000 rasl2tp rasl2tp.sys Thu Mar 24 20:40:29 2005 (42435DFD)
f62c1000 f62dc000 ianswxp ianswxp.sys Fri Nov 19 17:31:27 2004 (419E743F)
f62dc000 f62ef000 i8042prt i8042prt.sys Thu Mar 24 20:41:05 2005 (42435E21)
f62ef000 f630a000 VIDEOPRT VIDEOPRT.SYS Thu Mar 24 20:29:53 2005 (42435B81)
f630a000 f63e8000 ati2mtag ati2mtag.sys Thu Nov 11 22:02:01 2004 (419427A9)
f63e8000 f6412000 USBPORT USBPORT.SYS Thu Mar 24 20:30:43 2005 (42435BB3)
f6412000 f643d000 e1000325 e1000325.sys Mon Nov 22 13:38:39 2004 (41A2322F)
f6ce5000 f6cf4000 dump_symmpi dump_symmpi.sys Wed Oct 08 12:47:35 2003 (3F843FA7)
f6cf5000 f6d03000 NDProxy NDProxy.SYS Thu Mar 24 20:34:13 2005 (42435C85)
f6d05000 f6d10000 dcdbas32 dcdbas32.sys Mon Dec 05 12:48:51 2005 (43947D83)
f6d15000 f6d1e000 mssmbios mssmbios.sys Thu Mar 24 20:34:14 2005 (42435C86)
f6d25000 f6d34000 termdd termdd.sys Thu Mar 24 20:27:15 2005 (42435AE3)
f6d35000 f6d3e000 raspti raspti.sys Thu Mar 24 20:34:16 2005 (42435C88)
f6d45000 f6d50000 ptilink ptilink.sys Thu Mar 24 20:28:25 2005 (42435B29)
f6d55000 f6d60000 TDI TDI.SYS Thu Mar 24 20:35:34 2005 (42435CD6)
f6d65000 f6d74000 raspppoe raspppoe.sys Thu Mar 24 20:34:16 2005 (42435C88)
f6d75000 f6d7e000 ndistapi ndistapi.sys Thu Mar 24 20:34:11 2005 (42435C83)
f7141000 f7160000 Mup Mup.sys Thu Mar 24 20:40:49 2005 (42435E11)
f7160000 f7196000 NDIS NDIS.sys Thu Mar 24 20:40:26 2005 (42435DFA)
f7196000 f722b000 Ntfs Ntfs.sys Thu Mar 24 20:40:29 2005 (42435DFD)
f722b000 f7252000 KSecDD KSecDD.sys Thu Mar 24 20:28:53 2005 (42435B45)
f7252000 f7277000 fltMgr fltMgr.sys Thu Mar 24 20:30:25 2005 (42435BA1)
f7277000 f728a000 CLASSPNP CLASSPNP.SYS Thu Mar 24 20:40:23 2005 (42435DF7)
f728a000 f72a9000 SCSIPORT SCSIPORT.SYS Thu Mar 24 20:40:26 2005 (42435DFA)
f72a9000 f72d3000 volsnap volsnap.sys Thu Mar 24 20:29:10 2005 (42435B56)
f72d3000 f72ff000 dmio dmio.sys Thu Mar 24 20:30:02 2005 (42435B8A)
f72ff000 f7326000 ftdisk ftdisk.sys Thu Mar 24 20:29:00 2005 (42435B4C)
f7326000 f733c000 pci pci.sys Thu Mar 24 20:34:14 2005 (42435C86)
f733c000 f7370000 ACPI ACPI.sys Thu Mar 24 20:34:09 2005 (42435C81)
f7370000 f7386000 sacdrv sacdrv.sys Thu Mar 24 20:28:25 2005 (42435B29)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 03:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 03:16:35 2003 (3E800253)
f74a7000 f74b7000 MountMgr MountMgr.sys Thu Mar 24 20:27:23 2005 (42435AEB)
f74b7000 f74c2000 PartMgr PartMgr.sys Thu Mar 24 20:40:34 2005 (42435E02)
f74c7000 f74d6000 symmpi symmpi.sys Wed Oct 08 12:47:35 2003 (3F843FA7)
f74d7000 f74e7000 disk disk.sys Thu Mar 24 20:28:58 2005 (42435B4A)
f74e7000 f74f3000 Dfs Dfs.sys Thu Mar 24 20:30:28 2005 (42435BA4)
f74f7000 f7501000 crcdisk crcdisk.sys Thu Mar 24 20:29:40 2005 (42435B74)
f7537000 f7544000 netbios netbios.sys Thu Mar 24 20:33:21 2005 (42435C51)
f7547000 f7551000 pdlnatdl pdlnatdl.sys Mon Apr 18 18:05:25 2005 (42642F25)
f7597000 f75a4b00 CtxAltStr CtxAltStr.sys Mon Apr 11 23:10:44 2005 (425B3C34)
f75c7000 f75d0000 watchdog watchdog.sys Thu Mar 24 20:30:19 2005 (42435B9B)
f75f7000 f7602000 Msfs Msfs.SYS Thu Mar 24 20:30:04 2005 (42435B8C)
f7607000 f7611000 mouclass mouclass.sys Tue Mar 25 03:03:09 2003 (3E7FFF2D)
f7617000 f7624000 wanarp wanarp.sys Thu Mar 24 20:34:07 2005 (42435C7F)
f7627000 f7631000 Dxapi Dxapi.sys Tue Mar 25 03:06:01 2003 (3E7FFFD9)
f7637000 f7641000 kbdclass kbdclass.sys Tue Mar 25 03:03:10 2003 (3E7FFF2E)
f7657000 f7667000 Savrtpel Savrtpel.sys Mon Feb 09 18:24:34 2004 (402816B2)
f7667000 f7674000 Npfs Npfs.SYS Thu Mar 24 20:30:04 2005 (42435B8C)
f7677000 f7685000 msgpc msgpc.sys Thu Mar 24 20:33:31 2005 (42435C5B)
f7687000 f7691000 dump_diskdump dump_diskdump.sys Thu Mar 24 20:28:56 2005 (42435B48)
f76a7000 f76b3000 vga vga.sys Thu Mar 24 20:29:54 2005 (42435B82)
f76b7000 f76c6000 intelppm intelppm.sys Thu Mar 24 20:28:40 2005 (42435B38)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 03:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 03:07:58 2003 (3E80004E)
f7717000 f771e000 dmload dmload.sys Tue Mar 25 03:08:08 2003 (3E800058)
f774f000 f7754960 anydlc anydlc.sys Mon Apr 18 17:38:38 2005 (426428DE)
f7757000 f775be10 pdlnepkt pdlnepkt.sys Mon Apr 18 18:04:58 2005 (42642F0A)
f775f000 f7767000 pdlndint pdlndint.sys Mon Apr 18 18:05:32 2005 (42642F2C)
f7767000 f776c770 pdlnslea pdlnslea.sys Mon Apr 18 18:06:19 2005 (42642F5B)
f777f000 f7784180 usbuhci usbuhci.sys Thu Mar 24 20:30:45 2005 (42435BB5)
f7787000 f778da00 usbehci usbehci.sys Thu Mar 24 20:30:43 2005 (42435BB3)
f778f000 f7797000 audstub audstub.sys Tue Mar 25 03:09:12 2003 (3E800098)
f779f000 f77a7000 pdlnctdl pdlnctdl.sys Mon Apr 18 18:05:26 2005 (42642F26)
f77bf000 f77c7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 03:08:36 2003 (3E800074)
f77c7000 f77ce000 Null Null.SYS Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77cf000 f77d6000 Beep Beep.SYS Tue Mar 25 03:03:04 2003 (3E7FFF28)
f77d7000 f77dd300 HIDPARSE HIDPARSE.SYS Thu Mar 24 20:30:36 2005 (42435BAC)
f77df000 f77e7000 mnmdd mnmdd.SYS Tue Mar 25 03:07:53 2003 (3E800049)
f77e7000 f77ef000 RDPCDD RDPCDD.sys Tue Mar 25 03:03:05 2003 (3E7FFF29)
f77ef000 f77f7000 rasacd rasacd.sys Tue Mar 25 03:11:50 2003 (3E800136)
f77f7000 f77fb280 cdfdrv cdfdrv.sys Tue Mar 22 19:24:03 2005 (4240A913)
f780f000 f7816000 dxgthk dxgthk.sys Tue Mar 25 03:05:52 2003 (3E7FFFD0)
f798d000 f798ea80 pdlncbas pdlncbas.sys Mon Apr 18 18:05:02 2005 (42642F0E)
f799d000 f799e280 swenum swenum.sys Thu Mar 24 20:27:42 2005 (42435AFE)
f79a7000 f79a8580 USBD USBD.SYS Tue Mar 25 03:10:39 2003 (3E8000EF)
f7a05000 f7a06e00 nstrcnt nstrcnt.sys Mon Apr 18 16:51:45 2005 (42641DE1)
f7a81000 f7a81f00 icacdd icacdd.sys Mon Apr 11 22:52:52 2005 (425B3804)

Unloaded modules:
f5e4f000 f5e62000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e62000 f5f34000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4121000 f4125000 pdcrypt1.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4279000 f427c000 pdrframe.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f584d000 f5862000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f75e7000 f75f5000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5cca000 f5cde000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f75a7000 f75b0000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5f8b000 f5fa0000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77a7000 f77af000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f75b7000 f75c1000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7547000 f7552000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Your Norton AV is at year 2004 and it has known software problem. You had better upgrade or de-install Norton AV. Does your server install HP USB printer server? If yes, upgrade the HP printer server.