Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121210-18844-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a0b000 PsLoadedModuleList = 0x82b53810
Debug session time: Sat Dec 11 15:29:56.275 2010 (UTC - 5:00)
System Uptime: 0 days 8:45:58.633
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, 801dc000, 0, 0}
Probably caused by : ntkrpamp.exe ( nt!KeDelayExecutionThread+3e2 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 801dc000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Blizzard Downl
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 00cefcd0 to 82a7821b
STACK_TEXT:
8f297cd8 00cefcd0 00cefc8c 97460e2c ffffffff nt!KeDelayExecutionThread+0x3e2
WARNING: Frame IP not in any known module. Following frames may be wrong.
8f297cf4 82a75792 86fa2f70 82a93d01 8f297cd8 0xcefcd0
8f297d1c 82a4e42a 00cefcd0 00000000 00000000 nt!ExReleaseResourceLite+0xf
8f297d1c 0000003b 00cefcd0 00000000 00000000 nt!KiFastCallEntry+0x12a
00000001 00000000 00000000 00000000 00000000 0x3b
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeDelayExecutionThread+3e2
82a7821b 5d pop ebp
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeDelayExecutionThread+3e2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007
FAILURE_BUCKET_ID: 0x7f_8_nt!KeDelayExecutionThread+3e2
BUCKET_ID: 0x7f_8_nt!KeDelayExecutionThread+3e2
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121110-24102-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a19000 PsLoadedModuleList = 0x82b61810
Debug session time: Sat Dec 11 06:39:51.044 2010 (UTC - 5:00)
System Uptime: 0 days 2:46:05.012
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 8d77f6c0
Arg3: 8d77f2a0
Arg4: 82c91199
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
EXCEPTION_RECORD: 8d77f6c0 -- (.exr 0xffffffff8d77f6c0)
ExceptionAddress: 82c91199 (nt!PfpRpFileKeyUpdate+0x00000199)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 1008080c
Attempt to read from address 1008080c
CONTEXT: 8d77f2a0 -- (.cxr 0xffffffff8d77f2a0)
eax=965bf3a0 ebx=14081014 ecx=a12040f8 edx=ffffffff esi=82b50730 edi=10080808
eip=82c91199 esp=8d77f788 ebp=8d77f7b8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!PfpRpFileKeyUpdate+0x199:
82c91199 8b5f04 mov ebx,dword ptr [edi+4] ds:0023:1008080c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 1008080c
READ_ADDRESS: GetPointerFromAddress: unable to read from 82b81718
Unable to read MiSystemVaType memory at 82b61160
1008080c
FOLLOWUP_IP:
fileinfo!FIStreamLog+6f
8b5e8bc3 8b0d80775e8b mov ecx,dword ptr [fileinfo!FIGlobals+0x5c0 (8b5e7780)]
FAULTING_IP:
nt!PfpRpFileKeyUpdate+199
82c91199 8b5f04 mov ebx,dword ptr [edi+4]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 82aafbeb to 82c91199
STACK_TEXT:
8d77f7b8 82aafbeb 00000000 a12040f8 8d77f890 nt!PfpRpFileKeyUpdate+0x199
8d77f814 8b5e8bc3 8d77f87c 85a68820 a2e877f0 nt!PfFileInfoNotify+0x4ae
8d77f8a0 8b5e8d3d 8d77f8b0 a2e877c0 871af72f fileinfo!FIStreamLog+0x6f
8d77f8c4 8b3a55f4 a2e877f0 00000008 00000000 fileinfo!FIStreamCleanup+0x79
8d77f8e0 8b3a57c0 a2e877c0 a2e877c0 8d77f904 fltmgr!DoFreeContext+0x66
8d77f8f0 8b3b6722 a2e877c0 871af728 871af700 fltmgr!DoReleaseContext+0x42
8d77f904 8b3c3793 871af72c 871af728 ffffffff fltmgr!FltpDeleteContextList+0x15c
8d77f924 8b3c39b4 871af700 a12040f8 00000000 fltmgr!CleanupStreamListCtrl+0x1b
8d77f938 82c377b8 871af704 aa5e2d42 00000000 fltmgr!DeleteStreamListCtrlCallback+0x5a
8d77f978 8b6dbfb2 a12040f8 a1204008 a12040f8 nt!FsRtlTeardownPerStreamContexts+0x13a
8d77f994 8b6d2b3b 00000705 a1204030 a1204008 Ntfs!NtfsDeleteScb+0x214
8d77f9ac 8b64271e 85312118 a12040f8 00000000 Ntfs!NtfsRemoveScb+0xc5
8d77f9c8 8b6c30d2 85312118 a1204008 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x62
8d77fa0c 8b63fbec 85312118 a12040f8 a12042a0 Ntfs!NtfsTeardownStructures+0x68
8d77fa34 8b6bf55b 85312118 a12040f8 a12042a0 Ntfs!NtfsDecrementCloseCounts+0xaf
8d77fa94 8b6c11a9 85312118 a12040f8 a1204008 Ntfs!NtfsCommonClose+0x4f2
8d77fb30 82a554bc 00000000 857d7c48 857d7c48 Ntfs!NtfsFsdClose+0x403
8d77fb48 8b3a820c 86092630 857d7c48 00000000 nt!IofCallDriver+0x63
8d77fb6c 8b3a83cb 8d77fb8c 86092630 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
8d77fba4 82a554bc 86092630 857d7c48 857d7e44 fltmgr!FltpDispatch+0xc5
8d77fbbc 926102ab 857d7c48 86cc6af0 87206da0 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8d77fbd0 82a554bc 86cc6af0 857d7c48 8603f024 eamon+0x52ab
8d77fbe8 82c5adc7 8513aeb0 87206d88 00000000 nt!IofCallDriver+0x63
8d77fc2c 82c3a6f4 87206da0 87206da0 87206d88 nt!IopDeleteFile+0x10c
8d77fc44 82a81f60 00000000 853062c8 85f4bd18 nt!ObpRemoveObjectRoutine+0x59
8d77fc58 82a81ed0 87206da0 82a540a3 00000000 nt!ObfDereferenceObjectWithTag+0x88
8d77fc60 82a540a3 00000000 853062c8 87206da0 nt!ObfDereferenceObject+0xd
8d77fc78 82ab1ea3 00000001 00000000 852ae0d0 nt!CcDeleteSharedCacheMap+0x131
8d77fca8 82ab9ed6 8d77fcc4 aa5e293a 851362f0 nt!CcWriteBehind+0x715
8d77fd00 82a86f2b 851362f0 00000000 85132d48 nt!CcWorkerThread+0x164
8d77fd50 82c2766d 00000000 aa5e29aa 00000000 nt!ExpWorkerThread+0x10d
8d77fd90 82ad90d9 82a86e1e 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: fileinfo!FIStreamLog+6f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc18f
STACK_COMMAND: .cxr 0xffffffff8d77f2a0 ; kb
FAILURE_BUCKET_ID: 0x24_fileinfo!FIStreamLog+6f
BUCKET_ID: 0x24_fileinfo!FIStreamLog+6f
Followup: MachineOwner
---------