invalid kernel handle & Win32k.sys

Hello everybody, i have several problem with my XP can anyone help me...

The FIRST problem are:

When the first time turn on then i log on to my Comp, i always got the blue screen error message.
But then, when i restart it again, finally i can ran my comp like usual.
This matter is always happen again and again, when the first time i start my comp.

Here's the message:

invalid kernel handle
STOP: 0x00000093 (0x00000088, 0x00000000, 0x00000000, 0x00000000)

And the SECOND is:

Sometimes i always got this blue screen message:

Win32k.sys
page fault in non page area
STOP: 0x00000050 (0xE8069304, 0x00000000, 0xBF8AF5D9, 0x00000001)

Everytime i play the assassin's creed game.
Which i run this game in drive E. in my thought, i can save more space in drive C.

then i read some articles, about windbg, ntclose, Bug Check 0x93: INVALID_KERNEL_HANDLE,install nt,
install XP, STOP 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA, or else.
Which related with this problem, but im affraid if i do something wrong, im gonna crash it all, and lose all my data.

The point is, i don't know what im going to do next.

Here's the result from Windbg for the 1st problem:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3.3311) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Apr 22 21:49:59.406 2008 (GMT+7)
System Uptime: 0 days 0:01:30.062
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.......................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 93, {88, 0, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************



Probably caused by : ntoskrnl.exe ( nt+22f33 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver, etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00000088, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************




MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 47b0bf97

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x93

LAST_CONTROL_TRANSFER: from 805bc2d7 to 804f9f33

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f78cac6c 805bc2d7 00000093 00000088 00000000 nt+0x22f33
f78cac98 805bc3d1 e1002d68 89eaff90 00000088 nt+0xe52d7
f78cace0 805bc509 00000088 00000000 00000000 nt+0xe53d1
f78cacf4 8054161c 00000088 f78cad7c 804fff31 nt+0xe5509
f78cad00 804fff31 badb0d00 f78cad78 00000000 nt+0x6a61c
f78cad7c 8053876d 00000000 00000000 8b194420 nt+0x28f31
f78cadac 805cff64 00000000 00000000 00000000 nt+0x6176d
f78caddc 805460de 8053867e 00000000 00000000 nt+0xf8f64
00000000 00000000 00000000 00000000 00000000 nt+0x6f0de


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+22f33
804f9f33 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+22f33

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------


Here's the result from Windbg for the 2nd problem:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3.3311) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Apr 22 22:50:44.546 2008 (GMT+7)
System Uptime: 0 days 1:00:03.208
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Unable to load image dxg.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dxg.sys
*** ERROR: Module load completed but symbols could not be loaded for dxg.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e8069304, 0, bf8af5d9, 1}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************



Probably caused by : win32k.sys ( win32k+af5d9 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e8069304, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf8af5d9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

MODULE_NAME: win32k

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 47b0cdb5

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
e8069304

FAULTING_IP:
win32k+af5d9
bf8af5d9 8b0e mov ecx,dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from bf008af2 to bf8af5d9

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
aa1de2a0 bf008af2 e7247080 e7d6ea24 aa1de2dc win32k+0xaf5d9
aa1de2e8 bf009033 00000001 e86965e0 aa1de370 dxg+0x8af2
aa1de304 bf892266 e7d6e2d8 00000001 e65a0008 dxg+0x9033
aa1de324 bf8acbeb aa1de4c4 e18e1538 00000000 win32k+0x92266
aa1de350 bf8ad5eb e18e1538 e7b1d290 e919af20 win32k+0xacbeb
aa1de4c8 bf8b3f2e aa1de590 00000000 00000001 win32k+0xad5eb
aa1de5bc bf8b6199 aa1de590 e105a008 00000000 win32k+0xb3f2e
aa1de600 bf8b608c 03cdfafc 00000000 00000000 win32k+0xb6199
aa1de628 8054161c 03cdfafc 00000000 00000000 win32k+0xb608c
aa1de644 7c90e4f4 badb0d00 03cdfad8 011c0000 nt+0x6a61c
aa1de648 badb0d00 03cdfad8 011c0000 008ebd49 0x7c90e4f4
aa1de64c 03cdfad8 011c0000 008ebd49 7ffd9000 0xbadb0d00
aa1de650 011c0000 008ebd49 7ffd9000 00000000 0x3cdfad8
aa1de654 008ebd49 7ffd9000 00000000 03cdfdf4 0x11c0000
aa1de658 7ffd9000 00000000 03cdfdf4 00001fbb 0x8ebd49
aa1de65c 00000000 03cdfdf4 00001fbb 7e4194aa 0x7ffd9000


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k+af5d9
bf8af5d9 8b0e mov ecx,dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k+af5d9

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Here's my system information:

OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 3, v.3311 Build 2600
OS Manufacturer Microsoft Corporation
System Name LEINUK
System Manufacturer Gigabyte Technology Co., Ltd.
System Model P35-DS3
System Type X86-based PC
Processor x86 Family 6 Model 15 Stepping 11 GenuineIntel ~2333 Mhz
BIOS Version/Date Award Software International, Inc. F4, 6/29/2007
SMBIOS Version 2.4
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.1.2600.3311 (xpsp.080212-0005) "
User Name lEINUK\user
Time Zone SE Asia Standard Time
Total Physical Memory 3,072.00 MB
Available Physical Memory 2.70 GB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.93 GB
Page File Space 5.34 GB
Page File C:\pagefile.sys

And here's my hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:48:31 AM, on 4/28/2008
Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Norman\Npm\bin\ZLH.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\VistaDriveIcon\DrvIcon.exe
C:\Program Files\glass2k\Glass2k.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\Program Files\Free Download Manager\fumoei.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\UnHackMe\hackmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Norman\npm\bin\niu.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\GhostSurf Platinum\SCActiveBlock.dll (file missing)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe "
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [Glass2k] C:\Program Files\glass2k\Glass2k.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\fumoei.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - HKCU\..\Run: [TrueTransparency] "C:\Program Files\TrueTransparency\TrueTransparency.exe "
O4 - HKCU\..\Run: [VisualTaskTips] C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] c:\program files\common files\ahead\lib\nmbgmonitor.exe
O4 - HKCU\..\Run: [Washer] c:\program files\washer\washer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe "
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: SpywareGuard.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Fantastic Flame Agent.lnk = C:\Program Files\Fantastic Flame Screensaver\FantasticFlameAgent.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\paltalk.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\user\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\fumiebtn.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - c:\program files\monopoly\images\stg_drm.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1200166227625
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - c:\program files\monopoly\images\armhelper.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.sparkpea.net/controls/msnchat45.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
O20 - AppInit_DLLs: secuload.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: A2omgicnc - - (no file)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 18180 bytes



PLEASEEE I NEED HELP.....

Best Regards,
GBU

Leinuk

 

Hai Arie,

Thank you for your help and information, i will try it now.
And i'll get back a.s.a.p to you for the report.

Wish me luck.

Best Regards,
GBU

Leinuk

 

Hi arie,
here's the result from debugwiz.exe;

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini042808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 3.3311) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080212-0005
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Apr 28 16:42:34.921 2008 (GMT+7)
System Uptime: 0 days 0:09:31.459
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
........................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dxg.sys -
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e1545304, 0, bf8af5d9, 1}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************


Probably caused by : win32k.sys ( win32k!EngQuerySystemAttribute+5e9 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e1545304, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf8af5d9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************



MODULE_NAME: win32k

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 47b0cdb5

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
e1545304

FAULTING_IP:
win32k!EngQuerySystemAttribute+5e9
bf8af5d9 8b0e mov ecx,dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from bf008af2 to bf8af5d9

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
aaba12a0 bf008af2 e104a080 eab01754 aaba12dc win32k!EngQuerySystemAttribute+0x5e9
aaba12e8 bf009033 00000001 e1352460 aaba1370 dxg+0x8af2
aaba1304 bf892266 eab01008 00000001 ea4479c8 dxg+0x9033
aaba1324 bf8acbeb aaba14c4 e1bb0c00 00000000 win32k!EngCreateDeviceSurface+0x344
aaba1350 bf8ad5eb e1bb0c00 e65b8c28 e86a1c08 win32k!EngLoadImage+0x1ba0
aaba14c8 bf8b3f2e aaba1590 00000000 00000001 win32k!EngQueryPerformanceFrequency+0x6e7
aaba15bc bf8b6199 aaba1590 e108f008 00000000 win32k!EngFreeModule+0x2215
aaba1600 bf8b608c 03bcfafc 00000000 00000000 win32k!EngGetLastError+0x6e2
aaba1628 8054161c 03bcfafc 00000000 00000000 win32k!EngGetLastError+0x5d5
aaba1644 7c90e4f4 badb0d00 03bcfad8 011c0000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb74
aaba1648 badb0d00 03bcfad8 011c0000 008ebd49 0x7c90e4f4
aaba164c 03bcfad8 011c0000 008ebd49 7ffd8000 0xbadb0d00
aaba1650 011c0000 008ebd49 7ffd8000 00000000 0x3bcfad8
aaba1654 008ebd49 7ffd8000 00000000 03bcfdf4 0x11c0000
aaba1658 7ffd8000 00000000 03bcfdf4 00001fb3 0x8ebd49
aaba165c 00000000 03bcfdf4 00001fb3 7e4194aa 0x7ffd8000


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!EngQuerySystemAttribute+5e9
bf8af5d9 8b0e mov ecx,dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!EngQuerySystemAttribute+5e9

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=eab018e0 ebx=eab01754 ecx=bf170a60 edx=bf8c1858 esi=e1545304 edi=e5a0da18
eip=bf8af5d9 esp=aaba1270 ebp=aaba12a0 iopl=0 vif nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00290282
win32k!EngQuerySystemAttribute+0x5e9:
bf8af5d9 8b0e mov ecx,dword ptr [esi] ds:0023:e1545304=????????
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
aaba12a0 bf008af2 e104a080 eab01754 aaba12dc win32k!EngQuerySystemAttribute+0x5e9
aaba12e8 bf009033 00000001 e1352460 aaba1370 dxg+0x8af2
aaba1304 bf892266 eab01008 00000001 ea4479c8 dxg+0x9033
aaba1324 bf8acbeb aaba14c4 e1bb0c00 00000000 win32k!EngCreateDeviceSurface+0x344
aaba1350 bf8ad5eb e1bb0c00 e65b8c28 e86a1c08 win32k!EngLoadImage+0x1ba0
aaba14c8 bf8b3f2e aaba1590 00000000 00000001 win32k!EngQueryPerformanceFrequency+0x6e7
aaba15bc bf8b6199 aaba1590 e108f008 00000000 win32k!EngFreeModule+0x2215
aaba1600 bf8b608c 03bcfafc 00000000 00000000 win32k!EngGetLastError+0x6e2
aaba1628 8054161c 03bcfafc 00000000 00000000 win32k!EngGetLastError+0x5d5
aaba1644 7c90e4f4 badb0d00 03bcfad8 011c0000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb74
aaba1648 badb0d00 03bcfad8 011c0000 008ebd49 0x7c90e4f4
aaba164c 03bcfad8 011c0000 008ebd49 7ffd8000 0xbadb0d00
aaba1650 011c0000 008ebd49 7ffd8000 00000000 0x3bcfad8
aaba1654 008ebd49 7ffd8000 00000000 03bcfdf4 0x11c0000
aaba1658 7ffd8000 00000000 03bcfdf4 00001fb3 0x8ebd49
aaba165c 00000000 03bcfdf4 00001fb3 7e4194aa 0x7ffd8000
start end module name
804d7000 80723000 nt ntkrpamp.exe Tue Feb 12 04:35:19 2008 (47B0BF97)
80723000 80743d00 hal halmacpi.dll Tue Feb 12 04:35:41 2008 (47B0BFAD)
aa661000 aa68b180 kmixer kmixer.sys Tue Feb 12 04:48:49 2008 (47B0C2C1)
aa81c000 aa85ca80 HTTP HTTP.sys Tue Feb 12 04:44:28 2008 (47B0C1BC)
aa8ad000 aa8d4000 nvcw32mf nvcw32mf.sys Mon Feb 11 20:30:06 2008 (47B04DDE)
aabf5000 aac09480 wdmaud wdmaud.sys Tue Feb 12 05:23:43 2008 (47B0CAEF)
aacc8000 aacd6d80 sysaudio sysaudio.sys Tue Feb 12 05:22:20 2008 (47B0CA9C)
aaff0000 ab041c00 srv srv.sys Tue Feb 12 05:21:23 2008 (47B0CA63)
ab222000 ab264400 atksgt atksgt.sys Fri Sep 15 17:17:58 2006 (450A7DD6)
ab29d000 ab2a0b80 Aspi32 Aspi32.SYS Tue Dec 23 09:02:44 1997 (349F1BC4)
ab2b5000 ab2e1180 mrxdav mrxdav.sys Tue Feb 12 04:37:21 2008 (47B0C011)
ab2e2000 ab313000 SymIDSCo SymIDSCo.sys Fri Dec 22 05:54:54 2006 (458B10BE)
ab3b3000 ab3d4f00 SYMFW SYMFW.SYS Tue Jan 09 09:33:39 2007 (45A2FF03)
ab44d000 ab460000 avgntflt avgntflt.sys Mon Sep 17 15:09:54 2007 (46EE3652)
ab700000 ab708180 SYMIDS SYMIDS.SYS Tue Jan 09 09:34:19 2007 (45A2FF2B)
ab858000 ab862000 secdrv secdrv.sys Wed Sep 13 20:18:32 2006 (45080528)
aba3c000 aba3f900 ndisuio ndisuio.sys Tue Feb 12 04:46:42 2008 (47B0C242)
adda1000 addb8900 dump_atapi dump_atapi.sys Tue Feb 12 04:43:08 2008 (47B0C16C)
addb9000 adddc180 Fastfat Fastfat.SYS Tue Feb 12 05:20:42 2008 (47B0CA3A)
adde5000 addebe80 SYMNDIS SYMNDIS.SYS Tue Jan 09 09:32:03 2007 (45A2FEA3)
added000 addf2080 SYMREDRV SYMREDRV.SYS Tue Jan 09 09:34:37 2007 (45A2FF3D)
ade55000 adf1da60 avg7core avg7core.sys Wed Oct 10 23:23:39 2007 (470CFC8B)
adfbe000 adfdb000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Feb 01 07:54:39 2007 (45C13A4F)
adfdb000 ae03c000 eeCtrl eeCtrl.sys Thu Feb 01 07:54:39 2007 (45C13A4F)
ae03c000 ae0ab780 mrxsmb mrxsmb.sys Tue Feb 12 05:23:14 2008 (47B0CAD2)
ae0ac000 ae0d6e80 rdbss rdbss.sys Tue Feb 12 05:34:53 2008 (47B0CD8D)
ae0d7000 ae0f7000 SASKUTIL SASKUTIL.sys Fri Nov 30 05:05:31 2007 (474F37AB)
ae0f7000 ae160000 SPBBCDrv SPBBCDrv.sys Wed Jan 03 21:42:03 2007 (459BC0BB)
ae160000 ae171000 SRTSPX SRTSPX.SYS Fri Jan 12 09:11:05 2007 (45A6EE39)
ae171000 ae1ac000 vmm vmm.sys Sun Feb 18 15:10:42 2007 (45D80A02)
ae1ac000 ae1cdb80 afd afd.sys Tue Feb 12 11:49:04 2008 (47B12540)
ae1ce000 ae1f5c00 netbt netbt.sys Tue Feb 12 11:50:59 2008 (47B125B3)
ae1f6000 ae217000 pctfw1 pctfw1.sys Fri Apr 27 13:13:42 2007 (46319496)
ae217000 ae23a000 SYMEVENT SYMEVENT.SYS Sat Dec 16 07:30:34 2006 (45833E2A)
ae23a000 ae25f500 ipnat ipnat.sys Tue Feb 12 04:48:08 2008 (47B0C298)
ae260000 ae28d100 SYMTDI SYMTDI.SYS Tue Jan 09 09:31:16 2007 (45A2FE74)
ae28e000 ae2e6380 tcpip tcpip.sys Tue Feb 12 11:50:01 2008 (47B12579)
ae2e7000 ae2f9600 ipsec ipsec.sys Tue Feb 12 11:49:44 2008 (47B12568)
ae34e000 ae350e40 NDISKIO NDISKIO.SYS Wed Oct 04 18:53:12 2006 (4523A0A8)
ae352000 ae354900 Dxapi Dxapi.sys Sat Aug 18 03:53:19 2001 (3B7D843F)
ae36a000 ae7c0000 RtkHDAud RtkHDAud.sys Mon Apr 23 17:12:23 2007 (462C8687)
ae7c0000 ae7e3a80 portcls portcls.sys Tue Feb 12 05:26:18 2008 (47B0CB8A)
ae7e4000 ae7fe000 AtiHdmi AtiHdmi.sys Sat Jul 21 03:40:07 2007 (46A11DA7)
bf000000 bf011600 dxg dxg.sys Tue Feb 12 04:48:50 2008 (47B0C2C2)
bf012000 bf058000 ati2dvag ati2dvag.dll Wed Jan 23 03:43:41 2008 (4796557D)
bf058000 bf0d3000 ati2cqag ati2cqag.dll Wed Jan 23 02:53:48 2008 (479649CC)
bf0d3000 bf141000 atikvmag atikvmag.dll Wed Jan 23 03:01:08 2008 (47964B84)
bf141000 bf16e000 atiok3x2 atiok3x2.dll Wed Jan 23 02:57:14 2008 (47964A9A)
bf16e000 bf468300 ati3duag ati3duag.dll Wed Jan 23 03:25:32 2008 (4796513C)
bf469000 bf5ff500 ativvaxx ativvaxx.dll Wed Jan 23 03:14:57 2008 (47964EC1)
bf800000 bf9c2300 win32k win32k.sys Tue Feb 12 05:35:33 2008 (47B0CDB5)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Tue Feb 12 16:26:32 2008 (47B16648)
f5519000 f551b880 hidusb hidusb.sys Tue Feb 12 04:49:14 2008 (47B0C2DA)
f5521000 f5579e80 update update.sys Tue Feb 12 04:42:13 2008 (47B0C135)
f557a000 f5591800 mcdbus mcdbus.sys Mon Feb 18 16:29:14 2008 (47B94FEA)
f5592000 f55aa000 pctfw pctfw.sys Fri Apr 27 13:13:37 2007 (46319491)
f55ba000 f55c9900 Cdfs Cdfs.SYS Tue Feb 12 05:20:35 2008 (47B0CA33)
f565e000 f5660280 rasacd rasacd.sys Sat Aug 18 03:55:39 2001 (3B7D84CB)
f5672000 f56a1e80 rdpdr rdpdr.sys Tue Feb 12 04:37:29 2008 (47B0C019)
f69f0000 f6a00e00 psched psched.sys Tue Feb 12 04:47:16 2008 (47B0C264)
f6a01000 f6a17580 ndiswan ndiswan.sys Tue Feb 12 11:50:43 2008 (47B125A3)
f6a18000 f6acb000 cfosspeed cfosspeed.sys Fri Feb 15 00:21:30 2008 (47B4789A)
f6b0e000 f6b58000 ay60novg ay60novg.SYS Sun Nov 12 17:40:09 2006 (4556FA09)
f6b58000 f6b6b900 parport parport.sys Tue Feb 12 04:42:43 2008 (47B0C153)
f6b6c000 f6b85d80 Rtenicxp Rtenicxp.sys Thu Jan 03 21:10:16 2008 (477CECC8)
f6b86000 f6ba8700 ks ks.sys Tue Feb 12 05:23:00 2008 (47B0CAC4)
f6ba9000 f6bcc200 USBPORT USBPORT.SYS Tue Feb 12 04:49:23 2008 (47B0C2E3)
f6bcd000 f6bf2000 HDAudBus HDAudBus.sys Sat Jan 08 08:07:15 2005 (41DF3243)
f6bf2000 f6c05f00 VIDEOPRT VIDEOPRT.SYS Tue Feb 12 04:48:12 2008 (47B0C29C)
f6c06000 f700d000 ati2mtag ati2mtag.sys Wed Jan 23 03:43:20 2008 (47965568)
f7029000 f702cc80 mssmbios mssmbios.sys Tue Feb 12 04:42:25 2008 (47B0C141)
f7045000 f7047780 ndistapi ndistapi.sys Tue Feb 12 04:48:27 2008 (47B0C2AB)
f7079000 f707cd80 serenum serenum.sys Tue Feb 12 04:42:45 2008 (47B0C155)
f70a5000 f70ccf80 vidstub vidstub.sys Tue Apr 27 00:47:41 2004 (408D4B3D)
f70cd000 f70e6b80 Mup Mup.sys Tue Feb 12 05:23:20 2008 (47B0CAD8)
f70e7000 f70f8000 sfdrv01 sfdrv01.sys Fri Jan 14 23:14:06 2005 (41E7EFCE)
f70f8000 f7124980 NDIS NDIS.sys Tue Feb 12 11:50:39 2008 (47B1259F)
f7125000 f71b1600 Ntfs Ntfs.sys Tue Feb 12 05:21:59 2008 (47B0CA87)
f71b2000 f71c8880 KSecDD KSecDD.sys Tue Feb 12 04:36:35 2008 (47B0BFE3)
f71c9000 f71daf00 sr sr.sys Tue Feb 12 04:39:46 2008 (47B0C0A2)
f71db000 f71fab00 fltmgr fltmgr.sys Tue Feb 12 04:37:32 2008 (47B0C01C)
f71fb000 f7212900 atapi atapi.sys Tue Feb 12 04:43:08 2008 (47B0C16C)
f7213000 f7238700 dmio dmio.sys Tue Feb 12 04:48:19 2008 (47B0C2A3)
f7239000 f7257880 ftdisk ftdisk.sys Sat Aug 18 03:52:41 2001 (3B7D8419)
f7258000 f7285d80 ACPI ACPI.sys Tue Feb 12 04:42:12 2008 (47B0C134)
f7286000 f7296a80 pci pci.sys Tue Feb 12 04:42:22 2008 (47B0C13E)
f7297000 f72ae880 SCSIPORT SCSIPORT.SYS Tue Feb 12 04:43:07 2008 (47B0C16B)
f72af000 f7386000 sptd sptd.sys Wed Nov 08 10:35:48 2006 (45515094)
f7487000 f7490180 isapnp isapnp.sys Tue Feb 12 04:42:19 2008 (47B0C13B)
f7497000 f74a1580 MountMgr MountMgr.sys Tue Feb 12 04:42:13 2008 (47B0C135)
f74a7000 f74b3c80 VolSnap VolSnap.sys Tue Feb 12 04:43:45 2008 (47B0C191)
f74b7000 f74c1f80 jraid jraid.sys Fri Feb 16 09:27:11 2007 (45D5167F)
f74c7000 f74cfe00 disk disk.sys Tue Feb 12 04:43:27 2008 (47B0C17F)
f74d7000 f74e3180 CLASSPNP CLASSPNP.SYS Tue Feb 12 05:22:48 2008 (47B0CAB8)
f74e7000 f74efb80 PxHelp20 PxHelp20.sys Sat Feb 03 04:23:57 2007 (45C3ABED)
f7517000 f7520000 HIDCLASS HIDCLASS.SYS Tue Feb 12 04:49:13 2008 (47B0C2D9)
f7587000 f758fe00 intelppm intelppm.sys Tue Feb 12 04:35:46 2008 (47B0BFB2)
f7597000 f75a1480 imapi imapi.sys Tue Feb 12 04:43:42 2008 (47B0C18E)
f75a7000 f75b6600 cdrom cdrom.sys Tue Feb 12 04:43:25 2008 (47B0C17D)
f75b7000 f75c5100 redbook redbook.sys Tue Feb 12 04:43:02 2008 (47B0C166)
f75c7000 f75d6c00 serial serial.sys Tue Feb 12 05:22:09 2008 (47B0CA91)
f75d7000 f75e3d00 i8042prt i8042prt.sys Tue Feb 12 05:24:29 2008 (47B0CB1D)
f75e7000 f75f6000 VMNetSrv VMNetSrv.sys Wed Jan 24 19:05:29 2007 (45B74B89)
f75f7000 f7603880 rasl2tp rasl2tp.sys Tue Feb 12 11:49:45 2008 (47B12569)
f7607000 f7611200 raspppoe raspppoe.sys Tue Feb 12 04:48:31 2008 (47B0C2AF)
f7617000 f7622d00 raspptp raspptp.sys Tue Feb 12 11:50:02 2008 (47B1257A)
f7627000 f762f900 msgpc msgpc.sys Tue Feb 12 04:47:12 2008 (47B0C260)
f7637000 f7640f00 termdd termdd.sys Tue Feb 12 04:44:21 2008 (47B0C1B5)
f7647000 f7650e80 NDProxy NDProxy.SYS Tue Feb 12 04:48:28 2008 (47B0C2AC)
f7677000 f7685b00 drmk drmk.sys Tue Feb 12 04:48:53 2008 (47B0C2C5)
f7687000 f7695880 usbhub usbhub.sys Tue Feb 12 04:49:25 2008 (47B0C2E5)
f76c7000 f76cf700 wanarp wanarp.sys Tue Feb 12 04:48:19 2008 (47B0C2A3)
f76d7000 f76df780 netbios netbios.sys Tue Feb 12 04:46:47 2008 (47B0C247)
f76e7000 f76f1e00 Fips Fips.SYS Tue Feb 12 04:38:34 2008 (47B0C05A)
f76f7000 f7704b80 avipbb avipbb.sys Wed Sep 19 21:39:27 2007 (46F1349F)
f7707000 f770e960 Partizan Partizan.sys Mon Nov 19 20:02:19 2007 (4741895B)
f770f000 f7715180 PCIIDEX PCIIDEX.SYS Tue Feb 12 04:43:07 2008 (47B0C16B)
f7717000 f771bd00 PartMgr PartMgr.sys Tue Feb 12 04:43:29 2008 (47B0C181)
f771f000 f7723300 hotcore3 hotcore3.sys Tue Sep 04 22:32:36 2007 (46DD7A94)
f7727000 f772c040 sfsync02 sfsync02.sys Fri Dec 03 17:20:41 2004 (41B03DF9)
f772f000 f7737000 sfhlp02 sfhlp02.sys Thu Oct 28 17:47:59 2004 (4180CE5F)
f773f000 f7746880 Npfs Npfs.SYS Tue Feb 12 04:37:17 2008 (47B0C00D)
f7777000 f777c880 ssmdrv ssmdrv.sys Wed Feb 28 22:43:23 2007 (45E5A31B)
f7787000 f778e000 SASDIFSV SASDIFSV.SYS Wed Oct 04 06:02:46 2006 (4522EC16)
f7797000 f779d180 HIDPARSE HIDPARSE.SYS Tue Feb 12 04:49:08 2008 (47B0C2D4)
f779f000 f77a5c80 avg7rsxp avg7rsxp.sys Tue Jan 30 22:08:42 2007 (45BF5F7A)
f77a7000 f77ad700 USBSTOR USBSTOR.SYS Tue Feb 12 04:49:26 2008 (47B0C2E6)
f77b7000 f77bd500 usbprint usbprint.sys Tue Feb 12 05:03:57 2008 (47B0C64D)
f77bf000 f77c3860 pstrip pstrip.sys Tue May 08 16:51:01 2007 (46404805)
f77c7000 f77cb500 watchdog watchdog.sys Tue Feb 12 04:48:38 2008 (47B0C2B6)
f77d7000 f77dc080 usbuhci usbuhci.sys Tue Feb 12 04:49:23 2008 (47B0C2E3)
f77df000 f77e6600 usbehci usbehci.sys Tue Feb 12 04:49:23 2008 (47B0C2E3)
f77e7000 f77ee000 GEARAspiWDM GEARAspiWDM.sys Tue Aug 08 00:11:27 2006 (44D7743F)
f77ef000 f77f0000 fdc fdc.sys unavailable (00000000)
f77f7000 f77fca00 mouclass mouclass.sys Tue Feb 12 04:42:15 2008 (47B0C137)
f77ff000 f7805000 kbdclass kbdclass.sys Tue Feb 12 04:42:15 2008 (47B0C137)
f7827000 f782b680 lirsgt lirsgt.sys Sun Jan 29 18:06:18 2006 (43DCA1AA)
f784f000 f7853a80 TDI TDI.SYS Tue Feb 12 04:51:08 2008 (47B0C34C)
f7857000 f785b580 ptilink ptilink.sys Sat Aug 18 03:49:53 2001 (3B7D8371)
f785f000 f7863080 raspti raspti.sys Sat Aug 18 03:55:32 2001 (3B7D84C4)
f7877000 f787c000 flpydisk flpydisk.sys Tue Feb 12 04:43:00 2008 (47B0C164)
f7887000 f788c200 vga vga.sys Tue Feb 12 04:48:12 2008 (47B0C29C)
f788f000 f7893a80 Msfs Msfs.SYS Tue Feb 12 04:37:16 2008 (47B0C00C)
f7897000 f789a000 BOOTVID BOOTVID.dll Sat Aug 18 03:49:09 2001 (3B7D8345)
f789b000 f789d800 compbatt compbatt.sys Tue Feb 12 04:42:16 2008 (47B0C138)
f789f000 f78a2780 BATTC BATTC.SYS Tue Feb 12 04:42:10 2008 (47B0C132)
f7987000 f7988b80 kdcom kdcom.dll Sat Aug 18 03:49:10 2001 (3B7D8346)
f7989000 f798a100 WMILIB WMILIB.SYS Sat Aug 18 04:07:23 2001 (3B7D878B)
f798b000 f798c700 dmload dmload.sys Sat Aug 18 03:58:15 2001 (3B7D8567)
f798d000 f798eb00 JGOGO JGOGO.sys Tue Feb 07 18:52:58 2006 (43E88A1A)
f7999000 f799a780 SYMDNS SYMDNS.SYS Tue Jan 09 09:31:23 2007 (45A2FE7B)
f79a3000 f79a4100 swenum swenum.sys Tue Feb 12 04:42:22 2008 (47B0C13E)
f79a7000 f79a8280 USBD USBD.SYS Sat Aug 18 04:02:58 2001 (3B7D8682)
f79ab000 f79acf00 Fs_Rec Fs_Rec.SYS Sat Aug 18 03:49:37 2001 (3B7D8361)
f79ad000 f79ae080 Beep Beep.SYS Sat Aug 18 03:47:33 2001 (3B7D82E5)
f79af000 f79b0080 mnmdd mnmdd.SYS Sat Aug 18 03:57:28 2001 (3B7D8538)
f79b1000 f79b2080 RDPCDD RDPCDD.sys Sat Aug 18 03:46:56 2001 (3B7D82C0)
f79b3000 f79b4800 avgio avgio.sys Thu Feb 22 21:57:32 2007 (45DDAF5C)
f79b5000 f79b6080 avg7rsw avg7rsw.sys Tue Jul 26 19:10:51 2005 (42E6284B)
f79bd000 f79be100 dump_WMILIB dump_WMILIB.SYS Sat Aug 18 04:07:23 2001 (3B7D878B)
f79cb000 f79cc360 avgtdi avgtdi.sys Thu Aug 25 16:59:58 2005 (430D969E)
f7a0f000 f7a10a80 ParVdm ParVdm.SYS Sat Aug 18 03:49:49 2001 (3B7D836D)
f7a43000 f7a442e0 UnHackMeDrv UnHackMeDrv.sys Sun Apr 03 18:02:10 2005 (424FCD32)
f7a4f000 f7a4fd00 pciide pciide.sys Sat Aug 18 03:51:49 2001 (3B7D83E5)
f7a73000 f7a73d00 dxgthk dxgthk.sys Sat Aug 18 03:53:12 2001 (3B7D8438)
f7a90000 f7a91000 avgclean avgclean.sys Mon Dec 03 19:09:01 2007 (4753F1DD)
f7aa9000 f7aa9b80 Null Null.SYS Sat Aug 18 03:47:39 2001 (3B7D82EB)
f7ad1000 f7ad1c00 audstub audstub.sys Sat Aug 18 03:59:40 2001 (3B7D85BC)
f7b58000 f7b58a00 mchInjDrv mchInjDrv.sys Wed Jan 11 14:07:52 2006 (43C4AEC8)

Unloaded modules:
aab07000 aab32000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b4c000 f7b4d000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ab17a000 ab187000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
aabd2000 aabf5000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f55ba000 f55c8000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a3b000 f7a3d000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f787f000 f7884000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

So, what i must do now? looking for your answer in advance.

Best Regards,
GBU

Leinuk

 

ok, thank you for your info and advice.


Best Regards,
GBU

Leinuk

 

Your windows is crashed at win32k.sys and it is windows GDI routine. The culprit maybe faulty ram, video device driver or firewall. As you only provide 1 minidump and I cannot confirm the culprit. Provide more debug log if you have.

The following problem is related to faulty ram (bugcheck code 93)
http://www.windowsbbs.com/showthread.php?t=73101

 

hello cpc2004,

thank you for spare your time for me, but unfortunatly i only have windbg and
debugwiz.

can you explain it to me, what's the meaning of faulty ram (bugcheck code 93).
And what's the cause of faulty ram (bugcheck code 93)?

But this is the last result, that i made yesterday, from debugwiz.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042908-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 3.3311) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080212-0005
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Apr 29 21:43:40.421 2008 (GMT+7)
System Uptime: 0 days 0:01:40.078
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
....................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 0, f78c2cc8, f78c29c4}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************


Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000000, The address that the exception occurred at
Arg3: f78c2cc8, Exception Record Address
Arg4: f78c29c4, Context Record Address

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************



FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+0
00000000 ?? ???

EXCEPTION_RECORD: f78c2cc8 -- (.exr 0xfffffffff78c2cc8)
.exr 0xfffffffff78c2cc8
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 00000000
Attempt to execute non-executable address 00000000

CONTEXT: f78c29c4 -- (.cxr 0xfffffffff78c29c4)
.cxr 0xfffffffff78c29c4
eax=80536873 ebx=8b194720 ecx=89b18c08 edx=00000000 esi=8053876d edi=ab59ca40
eip=00000000 esp=f78c2d90 ebp=89b18c08 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
00000000 ?? ???
.cxr
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

STACK_TEXT:
f78c2d8c 00000000 00000000 00000000 00000001 0x0


STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=80536873 ebx=8b194720 ecx=89b18c08 edx=00000000 esi=8053876d edi=ab59ca40
eip=00000000 esp=f78c2d90 ebp=89b18c08 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
00000000 ?? ???
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78c2d8c 00000000 00000000 00000000 00000001 0x0
start end module name
804d7000 80723000 nt ntkrpamp.exe Tue Feb 12 04:35:19 2008 (47B0BF97)
80723000 80743d00 hal halmacpi.dll Tue Feb 12 04:35:41 2008 (47B0BFAD)
aadd3000 aae24c00 srv srv.sys Tue Feb 12 05:21:23 2008 (47B0CA63)
aafcd000 aafd7000 secdrv secdrv.sys Wed Sep 13 20:18:32 2006 (45080528)
ab0f5000 ab137400 atksgt atksgt.sys Fri Sep 15 17:17:58 2006 (450A7DD6)
ab22c000 ab22fb80 Aspi32 Aspi32.SYS Tue Dec 23 09:02:44 1997 (349F1BC4)
ab278000 ab28b000 avgntflt avgntflt.sys Mon Sep 17 15:09:54 2007 (46EE3652)
ab3a5000 ab3cf180 kmixer kmixer.sys Tue Feb 12 04:48:49 2008 (47B0C2C1)
ab470000 ab492d00 aec aec.sys Fri May 25 02:53:32 2007 (4655ED3C)
ab493000 ab4a7480 wdmaud wdmaud.sys Tue Feb 12 05:23:43 2008 (47B0CAEF)
ab4f8000 ab524180 mrxdav mrxdav.sys Tue Feb 12 04:37:21 2008 (47B0C011)
ab665000 ab671e80 DMusic DMusic.sys Tue Feb 12 04:48:41 2008 (47B0C2B9)
ab675000 ab682d00 swmidi swmidi.sys Tue Feb 12 04:48:49 2008 (47B0C2C1)
ab695000 ab6a3d80 sysaudio sysaudio.sys Tue Feb 12 05:22:20 2008 (47B0CA9C)
aba45000 aba48900 ndisuio ndisuio.sys Tue Feb 12 04:46:42 2008 (47B0C242)
add4e000 add65900 dump_atapi dump_atapi.sys Tue Feb 12 04:43:08 2008 (47B0C16C)
add66000 add89180 Fastfat Fastfat.SYS Tue Feb 12 05:20:42 2008 (47B0CA3A)
add8a000 ade52a60 avg7core avg7core.sys Wed Oct 10 23:23:39 2007 (470CFC8B)
ade73000 ade75e40 NDISKIO NDISKIO.SYS Wed Oct 04 18:53:12 2006 (4523A0A8)
ade7b000 ade98000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Feb 01 07:54:39 2007 (45C13A4F)
ade98000 adef9000 eeCtrl eeCtrl.sys Thu Feb 01 07:54:39 2007 (45C13A4F)
adef9000 adf68780 mrxsmb mrxsmb.sys Tue Feb 12 05:23:14 2008 (47B0CAD2)
adf81000 adf85680 lirsgt lirsgt.sys Sun Jan 29 18:06:18 2006 (43DCA1AA)
adfb9000 adfe3e80 rdbss rdbss.sys Tue Feb 12 05:34:53 2008 (47B0CD8D)
adfe4000 ae004000 SASKUTIL SASKUTIL.sys Fri Nov 30 05:05:31 2007 (474F37AB)
ae004000 ae06d000 SPBBCDrv SPBBCDrv.sys Wed Jan 03 21:42:03 2007 (459BC0BB)
ae06d000 ae07e000 SRTSPX SRTSPX.SYS Fri Jan 12 09:11:05 2007 (45A6EE39)
ae07e000 ae0b9000 vmm vmm.sys Sun Feb 18 15:10:42 2007 (45D80A02)
ae159000 ae17ab80 afd afd.sys Tue Feb 12 11:49:04 2008 (47B12540)
ae17b000 ae1a2c00 netbt netbt.sys Tue Feb 12 11:50:59 2008 (47B125B3)
ae1a3000 ae1c4000 pctfw1 pctfw1.sys Fri Apr 27 13:13:42 2007 (46319496)
ae1c4000 ae1f5000 SymIDSCo SymIDSCo.sys Fri Dec 22 05:54:54 2006 (458B10BE)
ae1f5000 ae216f00 SYMFW SYMFW.SYS Tue Jan 09 09:33:39 2007 (45A2FF03)
ae217000 ae23a000 SYMEVENT SYMEVENT.SYS Sat Dec 16 07:30:34 2006 (45833E2A)
ae23a000 ae267100 SYMTDI SYMTDI.SYS Tue Jan 09 09:31:16 2007 (45A2FE74)
ae268000 ae28d500 ipnat ipnat.sys Tue Feb 12 04:48:08 2008 (47B0C298)
ae28e000 ae2e6380 tcpip tcpip.sys Tue Feb 12 11:50:01 2008 (47B12579)
ae2e7000 ae2f9600 ipsec ipsec.sys Tue Feb 12 11:49:44 2008 (47B12568)
ae31e000 ae320900 Dxapi Dxapi.sys Sat Aug 18 03:53:19 2001 (3B7D843F)
ae36a000 ae7c0000 RtkHDAud RtkHDAud.sys Mon Apr 23 17:12:23 2007 (462C8687)
ae7c0000 ae7e3a80 portcls portcls.sys Tue Feb 12 05:26:18 2008 (47B0CB8A)
ae7e4000 ae7fe000 AtiHdmi AtiHdmi.sys Sat Jul 21 03:40:07 2007 (46A11DA7)
bf000000 bf011600 dxg dxg.sys Tue Feb 12 04:48:50 2008 (47B0C2C2)
bf012000 bf058000 ati2dvag ati2dvag.dll Wed Jan 23 03:43:41 2008 (4796557D)
bf058000 bf0d3000 ati2cqag ati2cqag.dll Wed Jan 23 02:53:48 2008 (479649CC)
bf0d3000 bf141000 atikvmag atikvmag.dll Wed Jan 23 03:01:08 2008 (47964B84)
bf141000 bf16e000 atiok3x2 atiok3x2.dll Wed Jan 23 02:57:14 2008 (47964A9A)
bf16e000 bf468300 ati3duag ati3duag.dll Wed Jan 23 03:25:32 2008 (4796513C)
bf469000 bf5ff500 ativvaxx ativvaxx.dll Wed Jan 23 03:14:57 2008 (47964EC1)
bf800000 bf9c2300 win32k win32k.sys Tue Feb 12 05:35:33 2008 (47B0CDB5)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Tue Feb 12 16:26:32 2008 (47B16648)
f68af000 f68b1280 rasacd rasacd.sys Sat Aug 18 03:55:39 2001 (3B7D84CB)
f68c3000 f691be80 update update.sys Tue Feb 12 04:42:13 2008 (47B0C135)
f691c000 f6933800 mcdbus mcdbus.sys Mon Feb 18 16:29:14 2008 (47B94FEA)
f6934000 f694c000 pctfw pctfw.sys Fri Apr 27 13:13:37 2007 (46319491)
f6a14000 f6a43e80 rdpdr rdpdr.sys Tue Feb 12 04:37:29 2008 (47B0C019)
f6a44000 f6a54e00 psched psched.sys Tue Feb 12 04:47:16 2008 (47B0C264)
f6a55000 f6a6b580 ndiswan ndiswan.sys Tue Feb 12 11:50:43 2008 (47B125A3)
f6a6c000 f6b1f000 cfosspeed cfosspeed.sys Fri Feb 15 00:21:30 2008 (47B4789A)
f6b1f000 f6b69000 arjpo3ox arjpo3ox.SYS Sun Nov 12 17:40:09 2006 (4556FA09)
f6b69000 f6b7c900 parport parport.sys Tue Feb 12 04:42:43 2008 (47B0C153)
f6b7d000 f6b96d80 Rtenicxp Rtenicxp.sys Thu Jan 03 21:10:16 2008 (477CECC8)
f6b97000 f6bb9700 ks ks.sys Tue Feb 12 05:23:00 2008 (47B0CAC4)
f6bba000 f6bdd200 USBPORT USBPORT.SYS Tue Feb 12 04:49:23 2008 (47B0C2E3)
f6bde000 f6c03000 HDAudBus HDAudBus.sys Sat Jan 08 08:07:15 2005 (41DF3243)
f6c03000 f6c16f00 VIDEOPRT VIDEOPRT.SYS Tue Feb 12 04:48:12 2008 (47B0C29C)
f6c3f000 f7046000 ati2mtag ati2mtag.sys Wed Jan 23 03:43:20 2008 (47965568)
f7046000 f7049c80 mssmbios mssmbios.sys Tue Feb 12 04:42:25 2008 (47B0C141)
f706a000 f706c780 ndistapi ndistapi.sys Tue Feb 12 04:48:27 2008 (47B0C2AB)
f70b6000 f70ddf80 vidstub vidstub.sys Tue Apr 27 00:47:41 2004 (408D4B3D)
f70de000 f70f7b80 Mup Mup.sys Tue Feb 12 05:23:20 2008 (47B0CAD8)
f70f8000 f7124980 NDIS NDIS.sys Tue Feb 12 11:50:39 2008 (47B1259F)
f7125000 f71b1600 Ntfs Ntfs.sys Tue Feb 12 05:21:59 2008 (47B0CA87)
f71b2000 f71c8880 KSecDD KSecDD.sys Tue Feb 12 04:36:35 2008 (47B0BFE3)
f71c9000 f71daf00 sr sr.sys Tue Feb 12 04:39:46 2008 (47B0C0A2)
f71db000 f71fab00 fltmgr fltmgr.sys Tue Feb 12 04:37:32 2008 (47B0C01C)
f71fb000 f7212900 atapi atapi.sys Tue Feb 12 04:43:08 2008 (47B0C16C)
f7213000 f7238700 dmio dmio.sys Tue Feb 12 04:48:19 2008 (47B0C2A3)
f7239000 f7257880 ftdisk ftdisk.sys Sat Aug 18 03:52:41 2001 (3B7D8419)
f7258000 f7285d80 ACPI ACPI.sys Tue Feb 12 04:42:12 2008 (47B0C134)
f7286000 f7296a80 pci pci.sys Tue Feb 12 04:42:22 2008 (47B0C13E)
f7297000 f72ae880 SCSIPORT SCSIPORT.SYS Tue Feb 12 04:43:07 2008 (47B0C16B)
f72af000 f7386000 sptd sptd.sys Wed Nov 08 10:35:48 2006 (45515094)
f7487000 f7490180 isapnp isapnp.sys Tue Feb 12 04:42:19 2008 (47B0C13B)
f7497000 f74a1580 MountMgr MountMgr.sys Tue Feb 12 04:42:13 2008 (47B0C135)
f74a7000 f74b3c80 VolSnap VolSnap.sys Tue Feb 12 04:43:45 2008 (47B0C191)
f74b7000 f74c1f80 jraid jraid.sys Fri Feb 16 09:27:11 2007 (45D5167F)
f74c7000 f74cfe00 disk disk.sys Tue Feb 12 04:43:27 2008 (47B0C17F)
f74d7000 f74e3180 CLASSPNP CLASSPNP.SYS Tue Feb 12 05:22:48 2008 (47B0CAB8)
f74e7000 f74efb80 PxHelp20 PxHelp20.sys Sat Feb 03 04:23:57 2007 (45C3ABED)
f7517000 f751fe00 intelppm intelppm.sys Tue Feb 12 04:35:46 2008 (47B0BFB2)
f7527000 f7531480 imapi imapi.sys Tue Feb 12 04:43:42 2008 (47B0C18E)
f7537000 f7546600 cdrom cdrom.sys Tue Feb 12 04:43:25 2008 (47B0C17D)
f7547000 f7555100 redbook redbook.sys Tue Feb 12 04:43:02 2008 (47B0C166)
f7557000 f7566c00 serial serial.sys Tue Feb 12 05:22:09 2008 (47B0CA91)
f7567000 f7573d00 i8042prt i8042prt.sys Tue Feb 12 05:24:29 2008 (47B0CB1D)
f7577000 f7586000 VMNetSrv VMNetSrv.sys Wed Jan 24 19:05:29 2007 (45B74B89)
f7587000 f7593880 rasl2tp rasl2tp.sys Tue Feb 12 11:49:45 2008 (47B12569)
f7597000 f75a1200 raspppoe raspppoe.sys Tue Feb 12 04:48:31 2008 (47B0C2AF)
f75a7000 f75b2d00 raspptp raspptp.sys Tue Feb 12 11:50:02 2008 (47B1257A)
f75b7000 f75bf900 msgpc msgpc.sys Tue Feb 12 04:47:12 2008 (47B0C260)
f75c7000 f75d0f00 termdd termdd.sys Tue Feb 12 04:44:21 2008 (47B0C1B5)
f75d7000 f75e0e80 NDProxy NDProxy.SYS Tue Feb 12 04:48:28 2008 (47B0C2AC)
f7607000 f7615b00 drmk drmk.sys Tue Feb 12 04:48:53 2008 (47B0C2C5)
f7617000 f7625880 usbhub usbhub.sys Tue Feb 12 04:49:25 2008 (47B0C2E5)
f7647000 f764f700 wanarp wanarp.sys Tue Feb 12 04:48:19 2008 (47B0C2A3)
f7657000 f765f180 SYMIDS SYMIDS.SYS Tue Jan 09 09:34:19 2007 (45A2FF2B)
f7667000 f7670000 HIDCLASS HIDCLASS.SYS Tue Feb 12 04:49:13 2008 (47B0C2D9)
f7677000 f767f780 netbios netbios.sys Tue Feb 12 04:46:47 2008 (47B0C247)
f7687000 f7691e00 Fips Fips.SYS Tue Feb 12 04:38:34 2008 (47B0C05A)
f7697000 f76a4b80 avipbb avipbb.sys Wed Sep 19 21:39:27 2007 (46F1349F)
f7707000 f770e960 Partizan Partizan.sys Mon Nov 19 20:02:19 2007 (4741895B)
f770f000 f7715180 PCIIDEX PCIIDEX.SYS Tue Feb 12 04:43:07 2008 (47B0C16B)
f7717000 f771bd00 PartMgr PartMgr.sys Tue Feb 12 04:43:29 2008 (47B0C181)
f771f000 f7723300 hotcore3 hotcore3.sys Tue Sep 04 22:32:36 2007 (46DD7A94)
f772f000 f7736000 SASDIFSV SASDIFSV.SYS Wed Oct 04 06:02:46 2006 (4522EC16)
f776f000 f7774080 usbuhci usbuhci.sys Tue Feb 12 04:49:23 2008 (47B0C2E3)
f7777000 f777e600 usbehci usbehci.sys Tue Feb 12 04:49:23 2008 (47B0C2E3)
f7787000 f778e000 GEARAspiWDM GEARAspiWDM.sys Tue Aug 08 00:11:27 2006 (44D7743F)
f778f000 f7794000 flpydisk flpydisk.sys Tue Feb 12 04:43:00 2008 (47B0C164)
f7797000 f7798000 fdc fdc.sys unavailable (00000000)
f77a7000 f77aca00 mouclass mouclass.sys Tue Feb 12 04:42:15 2008 (47B0C137)
f77af000 f77b5000 kbdclass kbdclass.sys Tue Feb 12 04:42:15 2008 (47B0C137)
f77bf000 f77c4200 vga vga.sys Tue Feb 12 04:48:12 2008 (47B0C29C)
f77cf000 f77d3a80 Msfs Msfs.SYS Tue Feb 12 04:37:16 2008 (47B0C00C)
f77df000 f77e6880 Npfs Npfs.SYS Tue Feb 12 04:37:17 2008 (47B0C00D)
f77e7000 f77eb860 pstrip pstrip.sys Tue May 08 16:51:01 2007 (46404805)
f77ef000 f77f5700 USBSTOR USBSTOR.SYS Tue Feb 12 04:49:26 2008 (47B0C2E6)
f77ff000 f7805c80 avg7rsxp avg7rsxp.sys Tue Jan 30 22:08:42 2007 (45BF5F7A)
f7807000 f780c080 SYMREDRV SYMREDRV.SYS Tue Jan 09 09:34:37 2007 (45A2FF3D)
f780f000 f7815e80 SYMNDIS SYMNDIS.SYS Tue Jan 09 09:32:03 2007 (45A2FEA3)
f7827000 f782ba80 TDI TDI.SYS Tue Feb 12 04:51:08 2008 (47B0C34C)
f7837000 f783b580 ptilink ptilink.sys Sat Aug 18 03:49:53 2001 (3B7D8371)
f7847000 f784b080 raspti raspti.sys Sat Aug 18 03:55:32 2001 (3B7D84C4)
f784f000 f7855180 HIDPARSE HIDPARSE.SYS Tue Feb 12 04:49:08 2008 (47B0C2D4)
f7867000 f786c880 ssmdrv ssmdrv.sys Wed Feb 28 22:43:23 2007 (45E5A31B)
f788f000 f7893500 watchdog watchdog.sys Tue Feb 12 04:48:38 2008 (47B0C2B6)
f7897000 f789a000 BOOTVID BOOTVID.dll Sat Aug 18 03:49:09 2001 (3B7D8345)
f789b000 f789d800 compbatt compbatt.sys Tue Feb 12 04:42:16 2008 (47B0C138)
f789f000 f78a2780 BATTC BATTC.SYS Tue Feb 12 04:42:10 2008 (47B0C132)
f796f000 f7971880 hidusb hidusb.sys Tue Feb 12 04:49:14 2008 (47B0C2DA)
f7973000 f7976d80 serenum serenum.sys Tue Feb 12 04:42:45 2008 (47B0C155)
f7987000 f7988b80 kdcom kdcom.dll Sat Aug 18 03:49:10 2001 (3B7D8346)
f7989000 f798a100 WMILIB WMILIB.SYS Sat Aug 18 04:07:23 2001 (3B7D878B)
f798b000 f798c700 dmload dmload.sys Sat Aug 18 03:58:15 2001 (3B7D8567)
f798d000 f798eb00 JGOGO JGOGO.sys Tue Feb 07 18:52:58 2006 (43E88A1A)
f799b000 f799c100 swenum swenum.sys Tue Feb 12 04:42:22 2008 (47B0C13E)
f79a3000 f79a4280 USBD USBD.SYS Sat Aug 18 04:02:58 2001 (3B7D8682)
f79a9000 f79aaf00 Fs_Rec Fs_Rec.SYS Sat Aug 18 03:49:37 2001 (3B7D8361)
f79ad000 f79ae080 Beep Beep.SYS Sat Aug 18 03:47:33 2001 (3B7D82E5)
f79b1000 f79b2080 mnmdd mnmdd.SYS Sat Aug 18 03:57:28 2001 (3B7D8538)
f79b5000 f79b6080 RDPCDD RDPCDD.sys Sat Aug 18 03:46:56 2001 (3B7D82C0)
f79b7000 f79b8780 SYMDNS SYMDNS.SYS Tue Jan 09 09:31:23 2007 (45A2FE7B)
f79bf000 f79c0a80 ParVdm ParVdm.SYS Sat Aug 18 03:49:49 2001 (3B7D836D)
f79c1000 f79c2800 avgio avgio.sys Thu Feb 22 21:57:32 2007 (45DDAF5C)
f79c9000 f79ca080 avg7rsw avg7rsw.sys Tue Jul 26 19:10:51 2005 (42E6284B)
f79df000 f79e0880 splitter splitter.sys Tue Feb 12 04:48:49 2008 (47B0C2C1)
f79e1000 f79e2100 dump_WMILIB dump_WMILIB.SYS Sat Aug 18 04:07:23 2001 (3B7D878B)
f7a43000 f7a44360 avgtdi avgtdi.sys Thu Aug 25 16:59:58 2005 (430D969E)
f7a4f000 f7a4fd00 pciide pciide.sys Sat Aug 18 03:51:49 2001 (3B7D83E5)
f7a8f000 f7a8fb80 Null Null.SYS Sat Aug 18 03:47:39 2001 (3B7D82EB)
f7a96000 f7a97000 avgclean avgclean.sys Mon Dec 03 19:09:01 2007 (4753F1DD)
f7b5f000 f7b5fd00 dxgthk dxgthk.sys Sat Aug 18 03:53:12 2001 (3B7D8438)
f7b80000 f7b80b80 drmkaud drmkaud.sys Tue Feb 12 04:48:56 2008 (47B0C2C8)
f7ba5000 f7ba5c00 audstub audstub.sys Sat Aug 18 03:59:40 2001 (3B7D85BC)

Unloaded modules:
f77b7000 f77bc000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt


Best Regards,
GBU

Leinuk