Analyzing "d:\TMP\UTDM\DUMPEVNT\071211-26812-01.dmp", please wait... Done.
Didn't find the answer. Try again with '-v' switch.
d:\TMP\UTDM\DUMPEVNT>kdfe -v "071211-26812-01.dmp"
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\TMP\UTDM\DUMPEVNT\071211-26812-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Executable search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83209000 PsLoadedModuleList = 0x83351810
Debug session time: Tue Jul 12 13:02:53.380 2011 (UTC + 4:00)
System Uptime: 0 days 0:16:49.943
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
0: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00000403, The subtype of the bugcheck.
Arg2: c0062678
Arg3: 47cf3847
Arg4: 3bcc0174
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
BUGCHECK_STR: 0x1a_403
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: avp.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 832c2ac4 to 832b0580
STACK_TEXT:
8be7fa74 832c2ac4 c0062678 c0062ff8 884feb20 nt!MiDeletePteRun+0x663
8be7fb78 832bc3fe 0c030002 0d68bfff 884feb20 nt!MiDeleteVirtualAddresses+0x3c1
8be7fc48 832b0708 884feb20 85967820 8584c030 nt!MiRemoveMappedView+0x325
8be7fc70 834834c8 8584c030 00000000 ffffffff nt!MiRemoveVadAndView+0xe5
8be7fcd0 83484d31 884feb20 0c030000 00000000 nt!MiUnmapViewOfSection+0x265
8be7fcf0 89cccd76 ffffffff 0c030000 ffffffff nt!NtUnmapViewOfSection+0x55
WARNING: Stack unwind information not available. Following frames may be wrong.
8be7fd24 8324c42a ffffffff 0c030000 00f2f950 klif+0x30d76
8be7fd24 774c64f4 ffffffff 0c030000 00f2f950 nt!KiFastCallEntry+0x12a
00f2f950 00000000 00000000 00000000 00000000 0x774c64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
klif+30d76
89cccd76 ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: klif+30d76
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: klif
IMAGE_NAME: klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c5c4352
FAILURE_BUCKET_ID: 0x1a_403_klif+30d76
BUCKET_ID: 0x1a_403_klif+30d76
Followup: MachineOwner
---------
quit:
Analyzing "d:\TMP\UTDM\DUMPEVNT\071211-25343-01.dmp", please wait... Done.
Crash date: Tue Jul 12 10:12:11.092 2011 (UTC + 4:00)
Stop error code: 0x8E
Process name: avp.exe
Probably caused by: ntkrpamp.exe ( ntIoRemoveIoCompletion+48 )
Analyzing "d:\TMP\UTDM\DUMPEVNT\071211-15562-01.dmp", please wait... Done.
Crash date: Tue Jul 12 13:20:05.952 2011 (UTC + 4:00)
Stop error code: 0xA
Process name: svchost.exe
Probably caused by: ntkrpamp.exe ( ntSwapContext_PatchFxe+24 )
Analyzing "d:\TMP\UTDM\DUMPEVNT\071211-15187-01.dmp", please wait... Done.
Crash date: Tue Jul 12 13:44:16.888 2011 (UTC + 4:00)
Stop error code: 0x7E
Process name: csrss.exe
Probably caused by: nvlddmkm.sys ( nvlddmkm+16fc84 )
Analyzing "d:\TMP\UTDM\DUMPEVNT\070611-18125-01.dmp", please wait... Done.
Didn't find the answer. Try again with '-v' switch.
d:\TMP\UTDM\DUMPEVNT>kdfe -v "070611-18125-01.dmp"
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\TMP\UTDM\DUMPEVNT\070611-18125-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Executable search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83205000 PsLoadedModuleList = 0x8334d810
Debug session time: Wed Jul 6 11:43:23.403 2011 (UTC + 4:00)
System Uptime: 0 days 0:17:19.981
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
0: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: 85efe510, Optional pointer to internal TDR recovery context (TDR_RECOVERY_
CONTEXT).
Arg2: 9114bb2c, The pointer into responsible device driver module (e.g. owner ta
g).
Arg3: 00000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 00000002, Optional internal context dependent data.
Debugging Details:
------------------
Unable to load image nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sy
s
FAULTING_IP:
nvlddmkm+11fb2c
9114bb2c 55 push ebp
DEFAULT_BUCKET_ID: GRAPHICS_DRIVER_TDR_FAULT
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x116
PROCESS_NAME: System
CURRENT_IRQL: 0
STACK_TEXT:
8be9cb74 91ae992c 00000116 85efe510 9114bb2c nt!KeBugCheckEx+0x1e
8be9cb98 91aea74b 9114bb2c 00000000 00000002 dxgkrnl!TdrBugcheckOnTimeout+0x8d
8be9cbbc 91b1a92c 00000000 00000102 8756b4e0 dxgkrnl!TdrIsRecoveryRequired+0xb8
8be9cc34 91b44a32 fffffcfb 00010364 00000000 dxgmms1!VidSchiReportHwHang+0x3c0
8be9cc5c 91b45153 00000000 00000000 00000000 dxgmms1!VidSchiCheckHwProgress+0x68
8be9cc98 91b218f0 8be9cc90 85ebaa80 86b326c0 dxgmms1!VidSchiWaitForSchedulerEven
ts+0x1b1
8be9cd28 91b464b7 8756b4e0 832413f1 8756b4e0 dxgmms1!VidSchiScheduleCommandToRun
+0xaa
8be9cd3c 91b46573 8756b4e0 00000000 8763a948 dxgmms1!VidSchiRun_PriorityTable+0x
f
8be9cd50 8341366d 8756b4e0 a1c9cecc 00000000 dxgmms1!VidSchiWorkerThread+0x7f
8be9cd90 832c50d9 91b464f4 8756b4e0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nvlddmkm+11fb2c
9114bb2c 55 push ebp
SYMBOL_NAME: nvlddmkm+11fb2c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4dd73a6b
FAILURE_BUCKET_ID: 0x116_IMAGE_nvlddmkm.sys
BUCKET_ID: 0x116_IMAGE_nvlddmkm.sys
Followup: MachineOwner
---------
quit:
Analyzing "d:\TMP\UTDM\DUMPEVNT\070611-14875-01.dmp", please wait... Done.
Crash date: Wed Jul 6 16:23:23.656 2011 (UTC + 4:00)
Stop error code: 0xA
Process name: System
Probably caused by: ntkrpamp.exe ( ntKiSignalThread+8b )
Analyzing "d:\TMP\UTDM\DUMPEVNT\070311-17640-01.dmp", please wait... Done.
Crash date: Sun Jul 3 15:21:01.615 2011 (UTC + 4:00)
Stop error code: 0xA
Process name: R6Vegas2_Game.
Probably caused by: ntkrpamp.exe ( ntPsCheckThreadCpuQuota+8b )
Analyzing "d:\TMP\UTDM\DUMPEVNT\062211-18390-01.dmp", please wait... Done.
Crash date: Wed Jun 22 14:45:25.364 2011 (UTC + 4:00)
Stop error code: 0x7f_8
Process name: TS3SP02.exe
Probably caused by: Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Analyzing "d:\TMP\UTDM\DUMPEVNT\062111-20968-01.dmp", please wait... Done.
Crash date: Tue Jun 21 15:58:40.154 2011 (UTC + 4:00)
Stop error code: 0x7f_8
Process name: svchost.exe
Probably caused by: hardware ( ntKiTrap0E+dc )
Analyzing "d:\TMP\UTDM\DUMPEVNT\062111-15578-01.dmp", please wait... Done.
Crash date: Tue Jun 21 16:08:29.204 2011 (UTC + 4:00)
Stop error code: 0x50
Process name: avp.exe
Probably caused by: win32k.sys ( win32kEngCopyBits+5bd )
Analyzing "d:\TMP\UTDM\DUMPEVNT\061011-14968-01.dmp", please wait... Done.
Didn't find the answer. Try again with '-v' switch.
d:\TMP\UTDM\DUMPEVNT>kdfe -v "061011-14968-01.dmp"
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\TMP\UTDM\DUMPEVNT\061011-14968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Executable search path is: srv*c:\symbols *
http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83037000 PsLoadedModuleList = 0x8317f810
Debug session time: Fri Jun 10 12:20:34.017 2011 (UTC + 4:00)
System Uptime: 0 days 0:12:23.658
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
1: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 2d806b85, Actual security check cookie from the stack
Arg2: 2d826b85, Expected security check cookie
Arg3: d27d947a, Complement of the expected security check cookie
Arg4: 00000000, zero
Debugging Details:
------------------
GSFAILURE_MEMORY_READ_ERROR: TRUE
GSFAILURE_FUNCTION: nt!KiDeferredReadyThread
GSFAILURE_RA_SMASHED: TRUE
GSFAILURE_MODULE_COOKIE: <unavailable> nt!__security_cookie [ 83160a04 ]
GSFAILURE_FRAME_COOKIE: ffffffff
SECURITY_COOKIE: Expected 2d826b85 found 2d806b85
GSFAILURE_ANALYSIS_TEXT: !gs output:
Corruption occurred in nt!KiDeferredReadyThread or one of its callers
Analyzing __report_gsfailure frame (2)...
LEA usage: Function @0xFFFFFFFF830A3297-0xFFFFFFFF830A3B89 is NOT using LEA
Error reading module canary at FFFFFFFF83160A04.
Fatal error - aborting analysis!
couldn't disassemble
BUGCHECK_STR: 0xF7_ONE_BIT
DEFAULT_BUCKET_ID: GS_FALSE_POSITIVE_PROBABLY_NOT_USING_GS
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 2
STACK_TEXT:
807e2abc 83105999 000000f7 2d806b85 2d826b85 nt!KeBugCheckEx+0x1e
807e2adc 830a3b89 875bb96c 047e2b1c 807c6120 nt!__report_gsfailure+0x24
807e2b4c 830a45a9 875bb938 00000000 875bb938 nt!KiDeferredReadyThread+0x8f2
807e2b68 830a4567 807e2ba4 807c6120 807c7a88 nt!KiReadyThread+0x30
807e2b80 830a0fd9 00000000 00000000 807c7a80 nt!KiProcessThreadWaitList+0x3f
807e2c68 830a0eae 807c6120 807e2ca8 00000000 nt!KiProcessExpiredTimerList+0xe9
807e2cdc 8309f20e 0000b9ea 85fa5bb0 807cb800 nt!KiTimerExpiration+0x25c
807e2d20 8309f038 00000000 0000000e 00000000 nt!KiRetireDpcList+0xcb
807e2d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDeferredReadyThread+8f2
830a3b89 8be5 mov esp,ebp
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDeferredReadyThread+8f2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007
FAILURE_BUCKET_ID: 0xF7_ONE_BIT_nt!KiDeferredReadyThread+8f2
BUCKET_ID: 0xF7_ONE_BIT_nt!KiDeferredReadyThread+8f2
Followup: MachineOwner
---------
quit:
Analyzing "d:\TMP\UTDM\DUMPEVNT\061011-14750-01.dmp", please wait... Done.
Crash date: Fri Jun 10 14:28:48.541 2011 (UTC + 4:00)
Stop error code: 0x1
Process name: opera.exe
Probably caused by: Unknown_Image ( ntNtWaitForMultipleObjects+0 )
Analyzing "d:\TMP\UTDM\DUMPEVNT\061011-12875-01.dmp", please wait... Done.
Crash date: Fri Jun 10 11:43:05.982 2011 (UTC + 4:00)
Stop error code: 0xBE
Process name: opera.exe
Probably caused by: Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Analyzing "d:\TMP\UTDM\DUMPEVNT\060911-14765-01.dmp", please wait... Done.
Crash date: Thu Jun 9 23:54:34.086 2011 (UTC + 4:00)
Stop error code: 0x8E
Process name: RivaTuner.exe
Probably caused by: klif.sys ( klif+3f5d9 )
Analyzing "d:\TMP\UTDM\DUMPEVNT\030311-23953-01.dmp", please wait... Done.
Crash date: Thu Mar 3 20:05:07.797 2011 (UTC + 4:00)
Stop error code: 0x8E
Process name: witcher2.exe
Probably caused by: dxgmms1.sys ( dxgmms1:UpdateFence+5f )
