Bugcheck String: 0x0000000a (0xf000c19f, 0xd000001b, 0x00000000, 0x808312b6

Hi,


Hope someone can help me to explain to me the dump files i collected on my windows 2003 with sp2 the debug log i got .



Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator\Desktop\minidump\Mini051708-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sat May 17 03:33:37.496 2008 (GMT+8)
System Uptime: 6 days 17:24:42.406
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
........................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {f000c19f, d000001b, 0, 808312b6}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntkrnlpa.exe ( nt+312b6 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: f000c19f, memory referenced
Arg2: d000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 808312b6, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
f000c19f

CURRENT_IRQL: d000001b

FAULTING_IP:
nt+312b6
808312b6 ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 808312b6 to 8088c963

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
bad44bdc 808312b6 badb0d00 00000000 00000000 nt+0x8c963
bad44c54 808313f3 00000001 01f9eaa4 00000000 nt+0x312b6
bad44c74 8082ba39 00000000 808a6580 bad44d30 nt+0x313f3
bad44c84 8092269f 8bb9ed74 00000001 00000001 nt+0x2ba39
bad44d30 809229a4 000000a8 00c6ffbc 00c6fed8 nt+0x12269f
bad44d4c 8088978c 000000a8 00c6ffbc 00c6fed8 nt+0x1229a4
bad44d64 7c8285ec badb0d00 00c6febc 00000000 nt+0x8978c
bad44d68 badb0d00 00c6febc 00000000 00000000 0x7c8285ec
bad44d6c 00c6febc 00000000 00000000 00000000 0xbadb0d00
bad44d70 00000000 00000000 00000000 00000000 0xc6febc


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+312b6
808312b6 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt+312b6

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlpa.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

7: kd> lmvm nt
start end module name
80800000 80a56000 nt T (no symbols)
Loaded symbol image file: ntkrnlpa.exe
Image path: \WINDOWS\system32\ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Mon Mar 05 20:16:25 2007 (45EC0A19)
CheckSum: 0023FE7D
ImageSize: 00256000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

 

here is my new debug logfile collected.

Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_rtm.070216-1710
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed May 21 23:55:16.743 2008 (GMT+8)
System Uptime: 1 days 5:48:24.125
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 121a, 0, 8b6e6d00}



Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )

Followup: MachineOwner
---------

3: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 00000000, Memory contents of the pool block
Arg4: 8b6e6d00, Address of the block of pool being deallocated

Debugging Details:
------------------




POOL_ADDRESS: 8b6e6d00

FREED_POOL_TAG: Thre

BUGCHECK_STR: 0xc2_7_Thre

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: Rtvscan.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 808927bb to 80827c63

STACK_TEXT:
b86e18c0 808927bb 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
b86e1928 8081e1b6 8b6e6d00 00000000 8b6e6af8 nt!ExFreePoolWithTag+0x477
b86e1954 f78037a1 8c8c8af8 8b95d030 b86e1988 nt!IopfCompleteRequest+0x180
b86e1964 f780309e 8c8c8af8 8a3aabd8 8c897730 Fs_Rec!UdfsRecFsControl+0x63
b86e1974 8081df65 8c8c8af8 8a3aabd8 8a3aabd8 Fs_Rec!FsRecFsControl+0x5a
b86e1988 808f785c 80a5a4d0 8b95d030 80a5a540 nt!IofCallDriver+0x45
b86e19d8 808220a4 8c8c8af8 b86e1c00 00000000 nt!IopMountVolume+0x1b4
b86e1a04 808f8910 b86e1c38 8b95d000 b86e1b40 nt!IopCheckVpbMounted+0x5c
b86e1afc 80937942 8b95d030 00000000 8a8d01e0 nt!IopParseDevice+0x3d4
b86e1b7c 80933a76 00000000 b86e1bbc 00000040 nt!ObpLookupObjectName+0x5b0
b86e1bd0 808ec76b 00000000 00000000 b86e1c01 nt!ObOpenObjectByName+0xea
b86e1d54 8088978c 05e7e2b4 05e7e28c 05e7e2d4 nt!NtQueryAttributesFile+0x11d
b86e1d54 7c8285ec 05e7e2b4 05e7e28c 05e7e2d4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
05e7e2d4 00000000 00000000 00000000 00000000 0x7c8285ec


STACK_COMMAND: kb

FOLLOWUP_IP:
Fs_Rec!UdfsRecFsControl+63
f78037a1 8bc6 mov eax,esi

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Fs_Rec

IMAGE_NAME: Fs_Rec.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3e800074

FAILURE_BUCKET_ID: 0xc2_7_Thre_Fs_Rec!UdfsRecFsControl+63

BUCKET_ID: 0xc2_7_Thre_Fs_Rec!UdfsRecFsControl+63

Followup: MachineOwner
---------

eax=f773713c ebx=0000121a ecx=00000000 edx=8b6e6d00 esi=f7737120 edi=000001ff
eip=80827c63 esp=b86e18a8 ebp=b86e18c0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80827c63 5d pop ebp
ChildEBP RetAddr Args to Child
b86e18c0 808927bb 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b86e1928 8081e1b6 8b6e6d00 00000000 8b6e6af8 nt!ExFreePoolWithTag+0x477 (FPO: [Non-Fpo])
b86e1954 f78037a1 8c8c8af8 8b95d030 b86e1988 nt!IopfCompleteRequest+0x180 (FPO: [Non-Fpo])
b86e1964 f780309e 8c8c8af8 8a3aabd8 8c897730 Fs_Rec!UdfsRecFsControl+0x63 (FPO: [Non-Fpo])
b86e1974 8081df65 8c8c8af8 8a3aabd8 8a3aabd8 Fs_Rec!FsRecFsControl+0x5a (FPO: [2,0,0])
b86e1988 808f785c 80a5a4d0 8b95d030 80a5a540 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
b86e19d8 808220a4 8c8c8af8 b86e1c00 00000000 nt!IopMountVolume+0x1b4 (FPO: [Non-Fpo])
b86e1a04 808f8910 b86e1c38 8b95d000 b86e1b40 nt!IopCheckVpbMounted+0x5c (FPO: [Non-Fpo])
b86e1afc 80937942 8b95d030 00000000 8a8d01e0 nt!IopParseDevice+0x3d4 (FPO: [Non-Fpo])
b86e1b7c 80933a76 00000000 b86e1bbc 00000040 nt!ObpLookupObjectName+0x5b0 (FPO: [Non-Fpo])
b86e1bd0 808ec76b 00000000 00000000 b86e1c01 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
b86e1d54 8088978c 05e7e2b4 05e7e28c 05e7e2d4 nt!NtQueryAttributesFile+0x11d (FPO: [Non-Fpo])
b86e1d54 7c8285ec 05e7e2b4 05e7e28c 05e7e2d4 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b86e1d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
05e7e2d4 00000000 00000000 00000000 00000000 0x7c8285ec
start end module name
80800000 80a56000 nt ntkrpamp.exe Sat Feb 17 13:48:00 2007 (45D69710)
80a56000 80a82000 hal halmacpi.dll Sat Feb 17 13:48:26 2007 (45D6972A)
b6e94000 b6ea6720 naveng naveng.sys Fri Feb 29 09:21:51 2008 (47C75E2F)
b6ea7000 b6f7ff80 navex15 navex15.sys Fri Feb 29 09:20:50 2008 (47C75DF2)
b734c000 b736a000 EraserUtilDrv10741 EraserUtilDrv10741.sys Fri Jan 18 10:44:27 2008 (4790128B)
b736a000 b73ca000 eeCtrl eeCtrl.sys Fri Jan 18 10:44:27 2008 (4790128B)
b7492000 b74f4000 SPBBCDrv SPBBCDrv.sys Thu Jan 11 08:09:29 2007 (45A58039)
b788e000 b78e6000 savrt savrt.sys Thu Sep 07 05:26:23 2006 (44FF3CFF)
b790e000 b7922000 Savrtpel Savrtpel.sys Thu Sep 07 05:26:26 2006 (44FF3D02)
b79ea000 b7a0c000 SYMEVENT SYMEVENT.SYS Wed Nov 08 11:38:37 2006 (4551513D)
b7a0c000 b7a29000 EraserUtilDrv10710 EraserUtilDrv10710.sys Thu Feb 01 08:54:39 2007 (45C13A4F)
b7e9a000 b7ec5000 RDPWD RDPWD.SYS Sat Feb 17 13:44:38 2007 (45D69646)
b8235000 b8240000 TDTCP TDTCP.SYS Sat Feb 17 13:44:32 2007 (45D69640)
b85a5000 b85bd000 mqac mqac.sys Sat Feb 17 13:44:18 2007 (45D69632)
b85e5000 b8642000 srv srv.sys Sat Feb 17 14:27:20 2007 (45D6A048)
b875a000 b87aa000 HTTP HTTP.sys Sat Feb 17 14:28:12 2007 (45D6A07C)
b89b2000 b89ca000 clusnet clusnet.sys Sat Feb 17 14:02:57 2007 (45D69A91)
b89f2000 b8a21000 RMCAST RMCAST.sys Sat Feb 17 13:57:43 2007 (45D69957)
b9511000 b951b000 ndisuio ndisuio.sys Sat Feb 17 13:58:25 2007 (45D69981)
b9551000 b9565000 dump_arcsas dump_arcsas.sys Thu Jul 19 08:33:04 2007 (469EB140)
b9587000 b959c000 Cdfs Cdfs.SYS Sat Feb 17 14:27:08 2007 (45D6A03C)
b95ce000 b95df000 Fips Fips.SYS Sat Feb 17 14:26:33 2007 (45D6A019)
b95df000 b9655000 mrxsmb mrxsmb.sys Sat Feb 17 14:28:15 2007 (45D6A07F)
b9655000 b9685000 rdbss rdbss.sys Sat Feb 17 14:27:37 2007 (45D6A059)
b9685000 b96af000 afd afd.sys Sat Feb 17 14:28:16 2007 (45D6A080)
b96af000 b96e0000 netbt netbt.sys Sat Feb 17 14:28:57 2007 (45D6A0A9)
b9708000 b9798000 tcpip tcpip.sys Sat Feb 17 14:28:05 2007 (45D6A075)
b9798000 b97b1000 ipsec ipsec.sys Sat Feb 17 14:29:28 2007 (45D6A0C8)
b9821000 b9838000 ClusDisk ClusDisk.sys Sat Feb 17 14:02:55 2007 (45D69A8F)
b9967000 b997c000 usbhub usbhub.sys Sat Feb 17 14:13:05 2007 (45D69CF1)
b9a1d000 b9a67000 update update.sys Sat Feb 17 14:28:59 2007 (45D6A0AB)
b9a67000 b9a9e000 rdpdr rdpdr.sys Sat Feb 17 13:51:00 2007 (45D697C4)
b9a9e000 b9ab0000 raspptp raspptp.sys Sat Feb 17 14:29:20 2007 (45D6A0C0)
b9ab0000 b9ac9000 ndiswan ndiswan.sys Sat Feb 17 14:29:22 2007 (45D6A0C2)
b9ac9000 b9add000 rasl2tp rasl2tp.sys Sat Feb 17 14:29:02 2007 (45D6A0AE)
b9add000 b9b04e00 e1000325 e1000325.sys Wed Oct 25 02:15:26 2006 (453E583E)
b9b05000 b9b30000 b57xp32 b57xp32.sys Tue Aug 29 07:10:05 2006 (44F377CD)
b9b30000 b9b45000 serial serial.sys Sat Feb 17 14:06:46 2007 (45D69B76)
b9b58000 b9b7f000 ks ks.sys Sat Feb 17 14:30:40 2007 (45D6A110)
b9b7f000 b9b93000 redbook redbook.sys Sat Feb 17 14:07:26 2007 (45D69B9E)
b9b93000 b9ba8000 cdrom cdrom.sys Sat Feb 17 14:07:48 2007 (45D69BB4)
b9ba8000 b9bd2000 USBPORT USBPORT.SYS Sat Feb 17 14:12:59 2007 (45D69CEB)
b9bd2000 b9bee000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 14:10:30 2007 (45D69C56)
b9bee000 b9d56000 ati2mtag ati2mtag.sys Thu Apr 06 11:03:52 2006 (44348518)
ba265000 ba26c000 dxgthk dxgthk.sys Tue Mar 25 15:05:52 2003 (3E7FFFD0)
ba26d000 ba275000 mouhid mouhid.sys Tue Mar 25 15:03:12 2003 (3E7FFF30)
ba275000 ba27cd80 usbccgp usbccgp.sys Sat Feb 17 14:13:08 2007 (45D69CF4)
ba27d000 ba285000 rasacd rasacd.sys Tue Mar 25 15:11:50 2003 (3E800136)
bac95000 bac9e000 hidusb hidusb.sys Tue Mar 25 15:10:17 2003 (3E8000D9)
bacd5000 bace0000 ptilink ptilink.sys Sat Feb 17 14:06:38 2007 (45D69B6E)
bace5000 bacef000 Dxapi Dxapi.sys Tue Mar 25 15:06:01 2003 (3E7FFFD9)
bad45000 bad50000 Msfs Msfs.SYS Sat Feb 17 13:50:33 2007 (45D697A9)
bad55000 bad5e000 watchdog watchdog.sys Sat Feb 17 14:11:45 2007 (45D69CA1)
bad75000 bad7e000 kbdhid kbdhid.sys Sat Feb 17 14:05:42 2007 (45D69B36)
bad85000 bad92000 wanarp wanarp.sys Sat Feb 17 13:59:17 2007 (45D699B5)
badd5000 bade0000 IPMI IPMI.sys Tue May 15 10:18:31 2007 (46491877)
bae35000 bae44000 termdd termdd.sys Sat Feb 17 13:44:32 2007 (45D69640)
bae65000 bae6f000 mouclass mouclass.sys Tue Mar 25 15:03:09 2003 (3E7FFF2D)
baf0d000 baf2c000 Mup Mup.sys Sat Feb 17 14:27:41 2007 (45D6A05D)
baf2c000 baf6b000 NDIS NDIS.sys Sat Feb 17 14:28:49 2007 (45D6A0A1)
baf6b000 bb000000 Ntfs Ntfs.sys Sat Feb 17 14:27:23 2007 (45D6A04B)
bf800000 bf9cf000 win32k win32k.sys Sat Feb 17 14:31:05 2007 (45D6A129)
bf9cf000 bf9e6000 dxg dxg.sys Sat Feb 17 14:14:39 2007 (45D69D4F)
bf9e6000 bfa29000 ati2dvag ati2dvag.dll Thu Apr 06 11:04:15 2006 (4434852F)
bfa29000 bfa68000 ati2cqag ati2cqag.dll Thu Apr 06 09:57:18 2006 (4434757E)
bfa68000 bfa9e000 atikvmag atikvmag.dll Thu Apr 06 10:25:29 2006 (44347C19)
bfa9e000 bfd280c0 ati3duag ati3duag.dll Thu Apr 06 10:47:35 2006 (44348147)
bfd29000 bfe3d180 ativvaxx ativvaxx.dll Thu Apr 06 10:40:57 2006 (44347FB9)
f720e000 f7222000 arcsas arcsas.sys Thu Jul 19 08:33:04 2007 (469EB140)
f7222000 f7241000 SCSIPORT SCSIPORT.SYS Sat Feb 17 14:28:41 2007 (45D6A099)
f7241000 f725e000 atapi atapi.sys Sat Feb 17 14:07:34 2007 (45D69BA6)
f725e000 f72be880 sddbus sddbus.sys Fri Aug 26 04:56:09 2005 (430E3069)
f72bf000 f72e9000 volsnap volsnap.sys Sat Feb 17 14:08:23 2007 (45D69BD7)
f72e9000 f7315000 dmio dmio.sys Sat Feb 17 14:10:44 2007 (45D69C64)
f7315000 f733c000 ftdisk ftdisk.sys Sat Feb 17 14:08:05 2007 (45D69BC5)
f733c000 f7352000 pci pci.sys Sat Feb 17 13:59:03 2007 (45D699A7)
f7352000 f7386000 ACPI ACPI.sys Sat Feb 17 13:58:47 2007 (45D69997)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 15:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Sat Feb 17 13:58:57 2007 (45D699A1)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Sat Feb 17 14:07:32 2007 (45D69BA4)
f74b7000 f74c7000 MountMgr MountMgr.sys Sat Feb 17 14:05:35 2007 (45D69B2F)
f74c7000 f74d2000 PartMgr PartMgr.sys Sat Feb 17 14:29:25 2007 (45D6A0C5)
f74d7000 f74e7000 disk disk.sys Sat Feb 17 14:07:51 2007 (45D69BB7)
f74e7000 f74f3000 Dfs Dfs.sys Sat Feb 17 13:51:17 2007 (45D697D5)
f74f7000 f7501000 crcdisk crcdisk.sys Sat Feb 17 14:09:50 2007 (45D69C2E)
f7577000 f7582000 TDI TDI.SYS Sat Feb 17 14:01:19 2007 (45D69A2F)
f7587000 f7590000 raspti raspti.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f7597000 f75a0000 mssmbios mssmbios.sys Sat Feb 17 13:59:12 2007 (45D699B0)
f75a7000 f75b6000 intelppm intelppm.sys Sat Feb 17 13:48:30 2007 (45D6972E)
f75c7000 f75d1000 dump_diskdump dump_diskdump.sys Sat Feb 17 14:07:44 2007 (45D69BB0)
f75d7000 f75e1000 serenum serenum.sys Sat Feb 17 14:06:44 2007 (45D69B74)
f75e7000 f75f2000 kbdclass kbdclass.sys Sat Feb 17 14:05:39 2007 (45D69B33)
f75f7000 f7605000 NDProxy NDProxy.SYS Sat Feb 17 13:59:21 2007 (45D699B9)
f7607000 f7614000 netbios netbios.sys Sat Feb 17 13:58:29 2007 (45D69985)
f7617000 f7625000 msgpc msgpc.sys Sat Feb 17 13:58:37 2007 (45D6998D)
f7637000 f7641000 ibmhpa ibmhpa.sys Wed Aug 31 02:51:17 2005 (4314AAA5)
f7647000 f7654000 Npfs Npfs.SYS Sat Feb 17 13:50:36 2007 (45D697AC)
f7657000 f7665000 HIDCLASS HIDCLASS.SYS Tue Mar 25 15:10:17 2003 (3E8000D9)
f7687000 f7690000 ndistapi ndistapi.sys Sat Feb 17 13:59:19 2007 (45D699B7)
f76a7000 f76b6000 raspppoe raspppoe.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f76b7000 f76c3000 vga vga.sys Sat Feb 17 14:10:30 2007 (45D69C56)
f76d7000 f76e8ac0 AACMgt AACMgt.sys Mon Nov 14 09:26:15 2005 (4377E7B7)
f76e9000 f7707000 storport storport.sys Sat Feb 17 14:07:48 2007 (45D69BB4)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 15:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 15:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 15:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 15:08:08 2003 (3E800058)
f775f000 f7767000 RDPCDD RDPCDD.sys Tue Mar 25 15:03:05 2003 (3E7FFF29)
f77df000 f77e3400 usbohci usbohci.sys Sat Feb 17 14:13:01 2007 (45D69CED)
f77e7000 f77edb80 usbehci usbehci.sys Sat Feb 17 14:12:56 2007 (45D69CE8)
f77ef000 f77f7000 pnpmem pnpmem.sys Sat Feb 17 13:59:03 2007 (45D699A7)
f77f7000 f77ff000 audstub audstub.sys Tue Mar 25 15:09:12 2003 (3E800098)
f77ff000 f7807000 Fs_Rec Fs_Rec.SYS Tue Mar 25 15:08:36 2003 (3E800074)
f7807000 f780e000 Null Null.SYS Tue Mar 25 15:03:05 2003 (3E7FFF29)
f780f000 f7816000 Beep Beep.SYS Tue Mar 25 15:03:04 2003 (3E7FFF28)
f7817000 f781d300 HIDPARSE HIDPARSE.SYS Sat Feb 17 14:12:35 2007 (45D69CD3)
f781f000 f7827000 mnmdd mnmdd.SYS Tue Mar 25 15:07:53 2003 (3E800049)
f7839000 f785f000 KSecDD KSecDD.sys Sat Feb 17 13:46:32 2007 (45D696B8)
f785f000 f7884000 fltmgr fltmgr.sys Sat Feb 17 13:51:08 2007 (45D697CC)
f7884000 f7897000 CLASSPNP CLASSPNP.SYS Sat Feb 17 14:28:16 2007 (45D6A080)
f7897000 f789a280 sddfltr sddfltr.sys Fri Aug 26 04:56:09 2005 (430E3069)
f7987000 f7988b00 sdddisk sdddisk.sys Fri Aug 26 04:56:08 2005 (430E3068)
f7999000 f799a280 swenum swenum.sys Sat Feb 17 14:05:56 2007 (45D69B44)
f799f000 f79a0580 USBD USBD.SYS Tue Mar 25 15:10:39 2003 (3E8000EF)
f7b2f000 f7bdf000 ql2300 ql2300.sys Fri Nov 05 06:05:34 2004 (418AA7AE)

Unloaded modules:
b7160000 b7173000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7173000 b724c000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7260000 b7273000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7273000 b734c000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b77ad000 b77bf000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b77bf000 b788e000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b7a29000 b7a8a000 eeCtrl.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b77ad000 b77bf000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b77bf000 b788e000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9b45000 b9b58000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bad35000 bad43000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f75b7000 f75c0000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
badf5000 badff000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bae05000 bae10000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 

This happening repeatedly or just once so far?

Driver verifier is the easiest way to track this down.

Start>run>verifier.exe
1. Create Custom Settings
2. Select individual settings from list
3. Check everything but "low resource simulation "
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Pick your C drive
8. Finish & reboot

Next time the box crashes, upload the dumps. Driver verifier adds a bunch of checks to help us identify the culprit.

This will slow things down beware.