Zane

BSOD upon awakening my PC from sleep

Recommended Posts

I have been having a BSOD upon awakening my PC from sleep and the debugger tool points to oanet.sys.  I am happy to provide a copy of the dump file.  I am using Online Armor (great product btw!)

Share this post


Link to post
Share on other sites


Pulled using instructions here: http://weblogs.asp.net/owscott/archive/2012/07/18/reading-a-memory-dmp-or-other-dmp-file.aspx

Opened log file 'c:\debuglog.txt'

6: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

6: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

Loading Kernel Symbols

...............................................................

................................................................

................................

Loading User Symbols

Loading unloaded module list

............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)

A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Arg2: fffff88005cb91e0, Address of the trap frame for the exception that caused the bugcheck

Arg3: fffff88005cb9138, Address of the exception record for the exception that caused the bugcheck

Arg4: 0000000000000000, Reserved

Debugging Details:

------------------

*** ERROR: Module load completed but symbols could not be loaded for oanet.sys

Page 208c71 not present in the dump file. Type ".hh dbgerr004" for details

TRAP_FRAME: fffff88005cb91e0 -- (.trap 0xfffff88005cb91e0)

.trap 0xfffff88005cb91e0

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000003

rdx=fffff80346cfcf70 rsi=0000000000000000 rdi=0000000000000000

rip=fffff88001678591 rsp=fffff88005cb9370 rbp=0000000000000000

r8=0000000000000000 r9=0000000000000000 r10=fffff88002beb000

r11=fffffa8007943b70 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz ac pe cy

ndis!ndisFreePacketPool+0x55:

fffff880`01678591 cd29 int 29h

.trap

Resetting default scope

EXCEPTION_RECORD: fffff88005cb9138 -- (.exr 0xfffff88005cb9138)

.exr 0xfffff88005cb9138

ExceptionAddress: fffff88001678591 (ndis!ndisFreePacketPool+0x0000000000000055)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT

BUGCHECK_STR: 0x139

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1: 0000000000000003

LAST_CONTROL_TRANSFER: from fffff80346aec369 to fffff80346aed040

STACK_TEXT:

fffff880`05cb8eb8 fffff803`46aec369 : 00000000`00000139 00000000`00000003 fffff880`05cb91e0 fffff880`05cb9138 : nt!KeBugCheckEx

fffff880`05cb8ec0 fffff803`46aec690 : fffff880`05cb9000 fffff880`05cb9000 fffff880`05cb9010 00000000`000000a0 : nt!KiBugCheckDispatch+0x69

fffff880`05cb9000 fffff803`46aeb8f4 : 00000000`00000100 00000000`00000000 fffffa80`06a289b8 fffff803`46aec053 : nt!KiFastFailDispatch+0xd0

fffff880`05cb91e0 fffff880`01678591 : 00000000`00000100 fffff880`05cb9700 fffffa80`06a289b8 fffffa80`07943b70 : nt!KiRaiseSecurityCheckFailure+0xf4

fffff880`05cb9370 fffff880`01678699 : fffff803`46cfcf30 00000000`00000000 fffffa80`06a289b8 fffffa80`6370444e : ndis!ndisFreePacketPool+0x55

fffff880`05cb93a0 fffff880`0660f463 : fffff880`06614118 00000000`00000000 fffffa80`06a289b8 00000000`00000011 : ndis!NdisFreePacketPool+0x2e

fffff880`05cb93d0 fffff880`016f53d3 : fffffa80`0812f630 fffff880`05cb9689 fffffa80`06a289b8 fffffa80`081901a0 : oanet+0x2463

fffff880`05cb95c0 fffff880`016cb11a : fffff880`05cb9a60 fffff8a0`202d7301 ffffffff`c0000001 fffff880`05cb9918 : ndis!ndisInitializeBinding+0x2a563

fffff880`05cb96f0 fffff880`016cb0b3 : fffff8a0`202d73b8 fffff880`05cb9978 00000000`00000002 00000000`00000000 : ndis!ndisBindForEachProtocol+0x2a

fffff880`05cb9720 fffff803`46e1d610 : fffff8a0`202d73b8 00000000`0000000c fffff880`05cb9978 fffff880`05cb9841 : ndis!ndisReadProtocolBinding+0x97

fffff880`05cb9770 fffff803`46e1ce27 : 00000000`00000000 fffff880`05cb9841 fffff880`05cb9978 00000001`82000000 : nt!RtlpCallQueryRegistryRoutine+0x270

fffff880`05cb97d0 fffff803`46e0b83e : 00000000`00000000 fffffa80`08190100 fffffa80`081901a0 fffff880`05cb9918 : nt!RtlpQueryRegistryValues+0x177

fffff880`05cb98a0 fffff880`016cc10f : 00000000`00000000 fffff880`05cb99e0 fffffa80`08190100 fffffa80`081901a0 : nt!RtlQueryRegistryValuesEx+0xe

fffff880`05cb98e0 fffff880`016fd143 : 00000000`00000000 fffffa80`081901a0 fffffa80`08190200 fffff880`0164d461 : ndis!ndisIterateProtocolBindings+0xef

fffff880`05cb9a40 fffff880`01702003 : fffffa80`08190200 fffff880`05cb9b90 fffffa80`081901a0 fffffa80`08190201 : ndis!ndisCheckAdapterBindings+0x7b

fffff880`05cb9a90 fffff880`0164a375 : fffffa80`00000031 ffffffff`ff676980 fffffa80`0a46ccc0 fffffa80`0a46ccc0 : ndis!ndisDevicePowerOn+0x3b3

fffff880`05cb9be0 fffff803`46a953d5 : fffffa80`088f3940 00000000`00000000 fffffa80`00000000 00000000`0159f649 : ndis!ndisWorkerThread+0x95

fffff880`05cb9c10 fffff803`46ad3116 : fffff880`02bb7180 fffffa80`088f3940 fffff880`02bc2f40 fffffa80`066ac940 : nt!PspSystemThreadStartup+0x59

fffff880`05cb9c60 00000000`00000000 : fffff880`05cba000 fffff880`05cb4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:

oanet+2463

fffff880`0660f463 4c8b5c2460 mov r11,qword ptr [rsp+60h]

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: oanet+2463

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: oanet

IMAGE_NAME: oanet.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 506ae5c8

FAILURE_BUCKET_ID: 0x139_3_oanet+2463

BUCKET_ID: 0x139_3_oanet+2463

Followup: MachineOwner

---------

rax=fffff88005cb8fc0 rbx=fffff80346cfcf30 rcx=0000000000000139

rdx=0000000000000003 rsi=fffffa8006a289b8 rdi=fffff80346cfcf78

rip=fffff80346aed040 rsp=fffff88005cb8eb8 rbp=fffff88005cb9260

r8=fffff88005cb91e0 r9=fffff88005cb9138 r10=0000000000000000

r11=fffffa8007943b70 r12=0000000000000100 r13=0000000000000000

r14=fffffa800812f678 r15=fffffa8006740600

iopl=0 nv up ei ng nz na po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286

nt!KeBugCheckEx:

fffff803`46aed040 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`05cb8ec0=3901000000000000

Child-SP RetAddr : Args to Child : Call Site

fffff880`05cb8eb8 fffff803`46aec369 : 00000000`00000139 00000000`00000003 fffff880`05cb91e0 fffff880`05cb9138 : nt!KeBugCheckEx

fffff880`05cb8ec0 fffff803`46aec690 : fffff880`05cb9000 fffff880`05cb9000 fffff880`05cb9010 00000000`000000a0 : nt!KiBugCheckDispatch+0x69

fffff880`05cb9000 fffff803`46aeb8f4 : 00000000`00000100 00000000`00000000 fffffa80`06a289b8 fffff803`46aec053 : nt!KiFastFailDispatch+0xd0

fffff880`05cb91e0 fffff880`01678591 : 00000000`00000100 fffff880`05cb9700 fffffa80`06a289b8 fffffa80`07943b70 : nt!KiRaiseSecurityCheckFailure+0xf4 (TrapFrame @ fffff880`05cb91e0)

fffff880`05cb9370 fffff880`01678699 : fffff803`46cfcf30 00000000`00000000 fffffa80`06a289b8 fffffa80`6370444e : ndis!ndisFreePacketPool+0x55

fffff880`05cb93a0 fffff880`0660f463 : fffff880`06614118 00000000`00000000 fffffa80`06a289b8 00000000`00000011 : ndis!NdisFreePacketPool+0x2e

fffff880`05cb93d0 fffff880`016f53d3 : fffffa80`0812f630 fffff880`05cb9689 fffffa80`06a289b8 fffffa80`081901a0 : oanet+0x2463

fffff880`05cb95c0 fffff880`016cb11a : fffff880`05cb9a60 fffff8a0`202d7301 ffffffff`c0000001 fffff880`05cb9918 : ndis!ndisInitializeBinding+0x2a563

fffff880`05cb96f0 fffff880`016cb0b3 : fffff8a0`202d73b8 fffff880`05cb9978 00000000`00000002 00000000`00000000 : ndis!ndisBindForEachProtocol+0x2a

fffff880`05cb9720 fffff803`46e1d610 : fffff8a0`202d73b8 00000000`0000000c fffff880`05cb9978 fffff880`05cb9841 : ndis!ndisReadProtocolBinding+0x97

fffff880`05cb9770 fffff803`46e1ce27 : 00000000`00000000 fffff880`05cb9841 fffff880`05cb9978 00000001`82000000 : nt!RtlpCallQueryRegistryRoutine+0x270

fffff880`05cb97d0 fffff803`46e0b83e : 00000000`00000000 fffffa80`08190100 fffffa80`081901a0 fffff880`05cb9918 : nt!RtlpQueryRegistryValues+0x177

fffff880`05cb98a0 fffff880`016cc10f : 00000000`00000000 fffff880`05cb99e0 fffffa80`08190100 fffffa80`081901a0 : nt!RtlQueryRegistryValuesEx+0xe

fffff880`05cb98e0 fffff880`016fd143 : 00000000`00000000 fffffa80`081901a0 fffffa80`08190200 fffff880`0164d461 : ndis!ndisIterateProtocolBindings+0xef

fffff880`05cb9a40 fffff880`01702003 : fffffa80`08190200 fffff880`05cb9b90 fffffa80`081901a0 fffffa80`08190201 : ndis!ndisCheckAdapterBindings+0x7b

fffff880`05cb9a90 fffff880`0164a375 : fffffa80`00000031 ffffffff`ff676980 fffffa80`0a46ccc0 fffffa80`0a46ccc0 : ndis!ndisDevicePowerOn+0x3b3

fffff880`05cb9be0 fffff803`46a953d5 : fffffa80`088f3940 00000000`00000000 fffffa80`00000000 00000000`0159f649 : ndis!ndisWorkerThread+0x95

fffff880`05cb9c10 fffff803`46ad3116 : fffff880`02bb7180 fffffa80`088f3940 fffff880`02bc2f40 fffffa80`066ac940 : nt!PspSystemThreadStartup+0x59

fffff880`05cb9c60 00000000`00000000 : fffff880`05cba000 fffff880`05cb4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

start end module name

fffff803`45d16000 fffff803`45d1f000 kd kd.dll Wed Jul 25 22:30:34 2012 (5010ABCA)

fffff803`46a07000 fffff803`46a73000 hal hal.dll Tue Oct 23 23:03:21 2012 (50875A79)

fffff803`46a73000 fffff803`471bb000 nt ntkrnlmp.exe Tue Jan 08 23:05:11 2013 (50ECEC77)

fffff880`00c00000 fffff880`00c63000 msrpc msrpc.sys Wed Jul 25 22:28:37 2012 (5010AB55)

fffff880`00c71000 fffff880`00cd0000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Wed Jul 25 22:30:12 2012 (5010ABB4)

fffff880`00cd0000 fffff880`00d2c000 CLFS CLFS.SYS Wed Jul 25 22:29:39 2012 (5010AB93)

fffff880`00d2c000 fffff880`00d4f000 tm tm.sys Wed Jul 25 22:29:01 2012 (5010AB6D)

fffff880`00d4f000 fffff880`00d64000 PSHED PSHED.dll Thu Jul 26 00:53:53 2012 (5010CD61)

fffff880`00d64000 fffff880`00d6e000 BOOTVID BOOTVID.dll Wed Jul 25 22:30:22 2012 (5010ABBE)

fffff880`00d6e000 fffff880`00ded000 CI CI.dll Thu Oct 11 01:17:18 2012 (5076565E)

fffff880`00e00000 fffff880`00e49000 spaceport spaceport.sys Wed Jul 25 22:28:36 2012 (5010AB54)

fffff880`00e49000 fffff880`00e61000 volmgr volmgr.sys Wed Jul 25 22:29:22 2012 (5010AB82)

fffff880`00e61000 fffff880`00ec1000 volmgrx volmgrx.sys Wed Jul 25 22:29:59 2012 (5010ABA7)

fffff880`00ec1000 fffff880`00ec9000 pciide pciide.sys Wed Jul 25 22:29:52 2012 (5010ABA0)

fffff880`00ec9000 fffff880`00ed8000 PCIIDEX PCIIDEX.SYS Wed Jul 25 22:29:09 2012 (5010AB75)

fffff880`00ed8000 fffff880`00ee2000 atapi atapi.sys Wed Jul 25 22:30:33 2012 (5010ABC9)

fffff880`00ee8000 fffff880`00f74000 cng cng.sys Thu Oct 11 01:17:34 2012 (5076566E)

fffff880`00f74000 fffff880`00f9c000 tpm tpm.sys Thu Sep 20 02:07:21 2012 (505AB299)

fffff880`00fa7000 fffff880`00fb4000 vdrvroot vdrvroot.sys Wed Jul 25 22:27:29 2012 (5010AB11)

fffff880`00fb4000 fffff880`00fcb000 pdc pdc.sys Sat Feb 02 02:25:15 2013 (510CBF5B)

fffff880`00fcb000 fffff880`00fe5000 partmgr partmgr.sys Tue Jan 08 23:01:42 2013 (50ECEBA6)

fffff880`00fe5000 fffff880`00fff000 mountmgr mountmgr.sys Wed Jul 25 22:29:33 2012 (5010AB8D)

fffff880`01000000 fffff880`0106d000 ACPI ACPI.sys Thu Sep 20 02:09:16 2012 (505AB30C)

fffff880`0106d000 fffff880`01077000 WMILIB WMILIB.SYS Wed Jul 25 22:30:04 2012 (5010ABAC)

fffff880`01077000 fffff880`01081000 msisadrv msisadrv.sys Wed Jul 25 22:28:02 2012 (5010AB32)

fffff880`01081000 fffff880`010be000 pci pci.sys Wed Jul 25 22:27:43 2012 (5010AB1F)

fffff880`010be000 fffff880`010f2000 ataport ataport.SYS Wed Jul 25 22:29:04 2012 (5010AB70)

fffff880`010f9000 fffff880`011bb000 Wdf01000 Wdf01000.sys Tue Jan 08 22:59:00 2013 (50ECEB04)

fffff880`011bb000 fffff880`011cb000 WDFLDR WDFLDR.SYS Wed Jul 25 22:29:04 2012 (5010AB70)

fffff880`011cb000 fffff880`011e2000 acpiex acpiex.sys Wed Jul 25 22:25:57 2012 (5010AAB5)

fffff880`011e2000 fffff880`011ed000 WppRecorder WppRecorder.sys Wed Jul 25 22:29:07 2012 (5010AB73)

fffff880`01235000 fffff880`01295000 fltmgr fltmgr.sys Wed Jul 25 22:30:09 2012 (5010ABB1)

fffff880`01295000 fffff880`012a9000 fileinfo fileinfo.sys Wed Jul 25 22:28:02 2012 (5010AB32)

fffff880`012a9000 fffff880`012e2000 WdFilter WdFilter.sys Fri Jan 25 02:56:28 2013 (51023AAC)

fffff880`012e2000 fffff880`012ee1a0 PxHlpa64 PxHlpa64.sys Mon Oct 17 10:29:34 2011 (4E9C3BCE)

fffff880`012ef000 fffff880`0130a000 ksecdd ksecdd.sys Thu Sep 20 02:09:16 2012 (505AB30C)

fffff880`0130a000 fffff880`01360000 CLASSPNP CLASSPNP.SYS Thu Oct 11 01:19:44 2012 (507656F0)

fffff880`01360000 fffff880`013a9000 dtsoftbus01 dtsoftbus01.sys Fri Jan 13 08:45:46 2012 (4F10358A)

fffff880`013a9000 fffff880`013da000 cdrom cdrom.sys Wed Jul 25 22:26:36 2012 (5010AADC)

fffff880`01400000 fffff880`01411000 pcw pcw.sys Wed Jul 25 22:28:44 2012 (5010AB5C)

fffff880`01413000 fffff880`015f6000 Ntfs Ntfs.sys Sat Feb 02 02:25:09 2013 (510CBF55)

fffff880`015f6000 fffff880`01600000 Fs_Rec Fs_Rec.sys Wed Jul 25 22:30:08 2012 (5010ABB0)

fffff880`01614000 fffff880`0161d000 Null Null.SYS Wed Jul 25 22:30:16 2012 (5010ABB8)

fffff880`0161d000 fffff880`01625000 Beep Beep.SYS Wed Jul 25 22:30:19 2012 (5010ABBB)

fffff880`01625000 fffff880`01632000 BasicRender BasicRender.sys Wed Jul 25 22:28:51 2012 (5010AB63)

fffff880`01642000 fffff880`0173b000 ndis ndis.sys Sat Feb 02 02:23:49 2013 (510CBF05)

fffff880`0173b000 fffff880`017aa000 NETIO NETIO.SYS Thu Oct 11 01:16:20 2012 (50765624)

fffff880`017aa000 fffff880`017d9000 ksecpkg ksecpkg.sys Thu Oct 11 01:16:46 2012 (5076563E)

fffff880`017d9000 fffff880`017f5000 disk disk.sys Wed Jul 25 22:29:25 2012 (5010AB85)

fffff880`01a00000 fffff880`01a3b000 rdyboost rdyboost.sys Wed Jul 25 22:28:34 2012 (5010AB52)

fffff880`01a4a000 fffff880`01c80000 tcpip tcpip.sys Sat Feb 02 02:24:42 2013 (510CBF3A)

fffff880`01c80000 fffff880`01ce8000 fwpkclnt fwpkclnt.sys Thu Sep 20 02:06:46 2012 (505AB276)

fffff880`01ce8000 fffff880`01d03000 wfplwfs wfplwfs.sys Mon Nov 05 22:53:12 2012 (509889A8)

fffff880`01d03000 fffff880`01d79000 fvevol fvevol.sys Thu Sep 20 02:08:15 2012 (505AB2CF)

fffff880`01d79000 fffff880`01dce000 volsnap volsnap.sys Wed Jul 25 22:30:26 2012 (5010ABC2)

fffff880`01dce000 fffff880`01de5000 mup mup.sys Wed Jul 25 22:30:00 2012 (5010ABA8)

fffff880`01de5000 fffff880`01df9000 crashdmp crashdmp.sys Sat Feb 02 02:26:00 2013 (510CBF88)

fffff880`03626000 fffff880`036b7000 csc csc.sys Thu Sep 20 02:08:29 2012 (505AB2DD)

fffff880`036b7000 fffff880`036d1000 wanarp wanarp.sys Thu Sep 20 02:05:51 2012 (505AB23F)

fffff880`036d1000 fffff880`036ddbe0 oahlp64 oahlp64.sys Thu Jul 05 13:30:59 2012 (4FF5CF53)

fffff880`036de000 fffff880`03701000 OADriver OADriver.sys Tue Oct 02 09:01:51 2012 (506AE5BF)

fffff880`03701000 fffff880`0370f000 nsiproxy nsiproxy.sys Wed Jul 25 22:25:00 2012 (5010AA7C)

fffff880`0370f000 fffff880`0371b000 npsvctrig npsvctrig.sys Wed Jul 25 22:27:33 2012 (5010AB15)

fffff880`0371b000 fffff880`03727000 mssmbios mssmbios.sys Wed Jul 25 22:29:19 2012 (5010AB7F)

fffff880`03727000 fffff880`03738000 discache discache.sys Wed Jul 25 22:28:23 2012 (5010AB47)

fffff880`03738000 fffff880`03759000 dfsc dfsc.sys Wed Jul 25 22:26:53 2012 (5010AAED)

fffff880`0376b000 fffff880`03777000 ndistapi ndistapi.sys Thu Sep 20 02:09:19 2012 (505AB30F)

fffff880`03777000 fffff880`037a6000 ndiswan ndiswan.sys Wed Jul 25 22:23:13 2012 (5010AA11)

fffff880`037a6000 fffff880`037c4000 rassstp rassstp.sys Wed Jul 25 22:23:59 2012 (5010AA3F)

fffff880`037c4000 fffff880`037dc000 AgileVpn AgileVpn.sys Wed Jul 25 22:23:11 2012 (5010AA0F)

fffff880`05e00000 fffff880`05e2a000 pacer pacer.sys Wed Jul 25 22:23:05 2012 (5010AA09)

fffff880`05e2a000 fffff880`05e40000 vwififlt vwififlt.sys Wed Jul 25 22:26:39 2012 (5010AADF)

fffff880`05e40000 fffff880`05e50000 netbios netbios.sys Wed Jul 25 22:28:19 2012 (5010AB43)

fffff880`05e50000 fffff880`05ec2000 rdbss rdbss.sys Wed Jul 25 22:25:57 2012 (5010AAB5)

fffff880`05ee1000 fffff880`06048000 dxgkrnl dxgkrnl.sys Tue Jan 08 22:59:24 2013 (50ECEB1C)

fffff880`06048000 fffff880`06059000 watchdog watchdog.sys Wed Jul 25 22:29:05 2012 (5010AB71)

fffff880`06059000 fffff880`060a7000 dxgmms1 dxgmms1.sys Tue Jan 08 22:58:58 2013 (50ECEB02)

fffff880`060a7000 fffff880`060b8000 BasicDisplay BasicDisplay.sys Wed Jul 25 22:29:08 2012 (5010AB74)

fffff880`060b8000 fffff880`060ca000 Npfs Npfs.SYS Wed Jul 25 22:30:26 2012 (5010ABC2)

fffff880`060ca000 fffff880`060d6000 Msfs Msfs.SYS Wed Jul 25 22:30:24 2012 (5010ABC0)

fffff880`060d6000 fffff880`060f8000 tdx tdx.sys Wed Jul 25 22:24:58 2012 (5010AA7A)

fffff880`060f8000 fffff880`06106000 TDI TDI.SYS Wed Jul 25 22:27:59 2012 (5010AB2F)

fffff880`06106000 fffff880`06112000 OAmon OAmon.sys Tue Oct 02 09:01:55 2012 (506AE5C3)

fffff880`06112000 fffff880`0616a000 netbt netbt.sys Wed Jul 25 22:24:26 2012 (5010AA5A)

fffff880`0616a000 fffff880`061fc000 afd afd.sys Mon Nov 05 22:53:42 2012 (509889C6)

fffff880`06400000 fffff880`06438000 ucx01000 ucx01000.sys Thu Sep 20 02:07:54 2012 (505AB2BA)

fffff880`06438000 fffff880`064cc000 Rt630x64 Rt630x64.sys Wed Oct 19 08:12:55 2011 (4E9EBEC7)

fffff880`064cc000 fffff880`064f1000 rasl2tp rasl2tp.sys Wed Jul 25 22:23:16 2012 (5010AA14)

fffff880`064f9000 fffff880`06525000 tunnel tunnel.sys Wed Jul 25 22:23:04 2012 (5010AA08)

fffff880`06525000 fffff880`06534000 CompositeBus CompositeBus.sys Wed Jul 25 22:28:03 2012 (5010AB33)

fffff880`06534000 fffff880`06546000 umbus umbus.sys Wed Jul 25 22:27:39 2012 (5010AB1B)

fffff880`06546000 fffff880`06562000 intelppm intelppm.sys Mon Nov 05 22:55:02 2012 (50988A16)

fffff880`06562000 fffff880`065d8000 atikmpag atikmpag.sys Thu Sep 27 21:12:52 2012 (5064F994)

fffff880`065d8000 fffff880`065f2000 raspppoe raspppoe.sys Wed Jul 25 22:24:55 2012 (5010AA77)

fffff880`06600000 fffff880`0660d000 serenum serenum.sys Wed Jul 25 22:30:13 2012 (5010ABB5)

fffff880`0660d000 fffff880`06618000 oanet oanet.sys Tue Oct 02 09:02:00 2012 (506AE5C8)

fffff880`06618000 fffff880`06619480 swenum swenum.sys Wed Jul 25 22:28:53 2012 (5010AB65)

fffff880`06627000 fffff880`067d5000 netr28x netr28x.sys Wed Apr 11 04:25:34 2012 (4F853FFE)

fffff880`067d5000 fffff880`067e2000 vwifibus vwifibus.sys Wed Jul 25 22:27:54 2012 (5010AB2A)

fffff880`067e2000 fffff880`067fa000 serial serial.sys Wed Jul 25 22:30:01 2012 (5010ABA9)

fffff880`06800000 fffff880`06821000 raspptp raspptp.sys Wed Jul 25 22:23:13 2012 (5010AA11)

fffff880`06834000 fffff880`072bd000 atikmdag atikmdag.sys Thu Sep 27 22:14:57 2012 (50650821)

fffff880`072bd000 fffff880`072d3000 HDAudBus HDAudBus.sys Thu Sep 20 02:08:43 2012 (505AB2EB)

fffff880`072d3000 fffff880`072e4000 HECIx64 HECIx64.sys Tue Oct 19 19:33:43 2010 (4CBE2AD7)

fffff880`072e4000 fffff880`072fa000 usbehci usbehci.sys Thu Sep 20 02:09:27 2012 (505AB317)

fffff880`072fa000 fffff880`07375000 USBPORT USBPORT.SYS Thu Sep 20 02:09:39 2012 (505AB323)

fffff880`07375000 fffff880`073cc000 USBXHCI USBXHCI.SYS Thu Sep 20 02:07:35 2012 (505AB2A7)

fffff880`073cc000 fffff880`073ea000 parport parport.sys Wed Jul 25 22:29:53 2012 (5010ABA1)

fffff880`0741e000 fffff880`0746d000 ks ks.sys Sat Feb 02 02:25:50 2013 (510CBF7E)

fffff880`0746d000 fffff880`07478000 rdpbus rdpbus.sys Wed Jul 25 22:28:19 2012 (5010AB43)

fffff880`07478000 fffff880`0748c000 NDProxy NDProxy.SYS Thu Sep 20 02:08:11 2012 (505AB2CB)

fffff880`0748c000 fffff880`0750a000 usbhub usbhub.sys Sat Feb 02 02:25:14 2013 (510CBF5A)

fffff880`0750a000 fffff880`07515000 USBD USBD.SYS Thu Sep 20 02:10:20 2012 (505AB34C)

fffff880`07515000 fffff880`0756e000 HdAudio HdAudio.sys Tue Jan 08 22:59:46 2013 (50ECEB32)

fffff880`0756e000 fffff880`075b9000 portcls portcls.sys Thu Oct 11 01:16:51 2012 (50765643)

fffff880`075b9000 fffff880`075db000 drmk drmk.sys Thu Oct 11 01:18:59 2012 (507656C3)

fffff880`075db000 fffff880`075e0380 ksthunk ksthunk.sys Wed Jul 25 22:28:58 2012 (5010AB6A)

fffff880`07e00000 fffff880`07e28000 luafv luafv.sys Wed Jul 25 22:29:13 2012 (5010AB79)

fffff880`07e28000 fffff880`07e3c000 lltdio lltdio.sys Wed Jul 25 22:24:02 2012 (5010AA42)

fffff880`07e73000 fffff880`07ee6000 UsbHub3 UsbHub3.sys Sat Feb 02 02:23:36 2013 (510CBEF8)

fffff880`07ee6000 fffff880`07f09000 usbccgp usbccgp.sys Wed Jul 25 22:27:06 2012 (5010AAFA)

fffff880`07f09000 fffff880`07f1a000 usbscan usbscan.sys Thu Oct 11 01:20:11 2012 (5076570B)

fffff880`07f1a000 fffff880`07f27000 usbprint usbprint.sys Wed Jul 25 22:24:50 2012 (5010AA72)

fffff880`07f27000 fffff880`07f46000 USBSTOR USBSTOR.SYS Wed Jul 25 22:27:04 2012 (5010AAF8)

fffff880`07f46000 fffff880`07f53000 hidusb hidusb.sys Wed Jul 25 22:28:25 2012 (5010AB49)

fffff880`07f53000 fffff880`07f6e000 HIDCLASS HIDCLASS.SYS Sat Feb 02 02:25:26 2013 (510CBF66)

fffff880`07f6e000 fffff880`07f76000 HIDPARSE HIDPARSE.SYS Wed Jul 25 22:30:15 2012 (5010ABB7)

fffff880`07f76000 fffff880`07f83000 kbdhid kbdhid.sys Wed Jul 25 22:28:49 2012 (5010AB61)

fffff880`07f83000 fffff880`07f92000 kbdclass kbdclass.sys Wed Jul 25 22:28:47 2012 (5010AB5F)

fffff880`07f92000 fffff880`07f9e000 mouhid mouhid.sys Wed Jul 25 22:28:47 2012 (5010AB5F)

fffff880`07f9e000 fffff880`07fad000 mouclass mouclass.sys Wed Jul 25 22:28:47 2012 (5010AB5F)

fffff880`07fad000 fffff880`07fba000 dump_dumpata dump_dumpata.sys Wed Jul 25 22:29:16 2012 (5010AB7C)

fffff880`07fba000 fffff880`07fc4000 dump_atapi dump_atapi.sys Wed Jul 25 22:30:33 2012 (5010ABC9)

fffff880`07fc4000 fffff880`07fd8000 dump_dumpfve dump_dumpfve.sys Thu Sep 20 02:09:30 2012 (505AB31A)

fffff880`07fd8000 fffff880`07fe6000 monitor monitor.sys Wed Jul 25 22:24:55 2012 (5010AA77)

fffff880`19800000 fffff880`1988d000 srv srv.sys Wed Jul 25 22:25:28 2012 (5010AA98)

fffff880`198c6000 fffff880`19934000 nwifi nwifi.sys Wed Jul 25 22:25:11 2012 (5010AA87)

fffff880`19934000 fffff880`19948000 ndisuio ndisuio.sys Wed Jul 25 22:26:21 2012 (5010AACD)

fffff880`19948000 fffff880`19960000 rspndr rspndr.sys Wed Jul 25 22:24:06 2012 (5010AA46)

fffff880`19960000 fffff880`1996a000 vwifimp vwifimp.sys Wed Jul 25 22:26:39 2012 (5010AADF)

fffff880`1996a000 fffff880`199a5000 mrxsmb20 mrxsmb20.sys Tue Feb 05 17:28:36 2013 (51118794)

fffff880`199a5000 fffff880`199dc000 fastfat fastfat.SYS Wed Jul 25 22:30:23 2012 (5010ABBF)

fffff880`19c00000 fffff880`19c1c000 Ndu Ndu.sys Wed Jul 25 22:23:41 2012 (5010AA2D)

fffff880`19c2f000 fffff880`19d0b000 HTTP HTTP.sys Mon Nov 05 22:54:06 2012 (509889DE)

fffff880`19d0b000 fffff880`19d2b000 bowser bowser.sys Wed Jul 25 22:28:01 2012 (5010AB31)

fffff880`19d2b000 fffff880`19d42000 mpsdrv mpsdrv.sys Thu Oct 11 01:15:15 2012 (507655E3)

fffff880`19d42000 fffff880`19da5000 mrxsmb mrxsmb.sys Tue Feb 05 17:29:08 2013 (511187B4)

fffff880`19da5000 fffff880`19df0000 mrxsmb10 mrxsmb10.sys Wed Jul 25 22:23:06 2012 (5010AA0A)

fffff880`19df0000 fffff880`19dfc000 asyncmac asyncmac.sys Wed Jul 25 22:28:25 2012 (5010AB49)

fffff880`1a400000 fffff880`1a412000 tcpipreg tcpipreg.sys Wed Jul 25 22:23:13 2012 (5010AA11)

fffff880`1a412000 fffff880`1a41f000 condrv condrv.sys Wed Jul 25 22:30:08 2012 (5010ABB0)

fffff880`1a41f000 fffff880`1a4c0000 srv2 srv2.sys Tue Feb 05 17:31:09 2013 (5111882D)

fffff880`1a4c0000 fffff880`1a4d9000 WudfPf WudfPf.sys Wed Jul 25 22:26:45 2012 (5010AAE5)

fffff880`1a4dc000 fffff880`1a5a7000 peauth peauth.sys Wed Jul 25 22:24:24 2012 (5010AA58)

fffff880`1a5a7000 fffff880`1a5b2000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E)

fffff880`1a5b2000 fffff880`1a5f6000 srvnet srvnet.sys Tue Feb 05 17:28:48 2013 (511187A0)

fffff960`000da000 fffff960`004cb000 win32k win32k.sys Mon Feb 11 19:24:55 2013 (51198BD7)

fffff960`00624000 fffff960`0062d000 TSDDD TSDDD.dll Wed Jul 25 22:30:25 2012 (5010ABC1)

fffff960`00927000 fffff960`0095d000 cdd cdd.dll Thu Jul 26 00:49:37 2012 (5010CC61)

fffff960`00b9d000 fffff960`00bfd000 ATMFD ATMFD.DLL Sun Dec 16 03:08:33 2012 (50CD8181)

Unloaded modules:

fffff880`19c1c000 fffff880`19c27000 WpdUpFltr.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000B000

fffff880`1988d000 fffff880`198c3000 WUDFRd.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 00036000

fffff880`1988d000 fffff880`198c3000 WUDFRd.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 00036000

fffff880`1a4c0000 fffff880`1a4da000 EhStorClass.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0001A000

fffff880`01a3b000 fffff880`01a48000 dump_ataport.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000D000

fffff880`017f5000 fffff880`017ff000 dump_atapi.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000A000

fffff880`01600000 fffff880`01614000 dump_dumpfve.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 00014000

fffff880`0121b000 fffff880`01235000 EhStorClass.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0001A000

fffff880`03759000 fffff880`0376b000 dam.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 00012000

fffff880`00f9c000 fffff880`00fa7000 WdBoot.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000B000

fffff880`01de5000 fffff880`01df1000 hwpolicy.sys

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000C000

fffff880`00c64000 fffff880`00c71000 ApiSetSchema.dll

Timestamp: unavailable (00000000)

Checksum: 00000000

ImageSize: 0000D000

Closing open log file c:\debuglog.txt

Share this post


Link to post
Share on other sites

Whatever is stored in C:\Windows\memory.dmp after a BSOD.  I just followed the instructions on this page:  http://weblogs.asp.net/owscott/archive/2012/07/18/reading-a-memory-dmp-or-other-dmp-file.aspx

Share this post


Link to post
Share on other sites

Then it's probably just a kernel memory dump, as that's the default setting. Here's a link to instructions on how to set Windows to create full memory dumps when there is a BSoD. Please note that the memory dump will be huge, so you will need to be able to compress it in some manner (ZIP, RAR, 7z, etc. will all work). Note that, if you don't have a utility such as 7-Zip, WinZip, or WinRar that you can ZIP files and folders by right-clicking on them, going to Send To, and clicking on Compressed (zipped) Folder. Also note that this process will most likely change the default location of memory dumps to the root of your C: drive.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.