# Blue screen 0x0000008E vista (Acer laptop) - please help!



## katiesam (May 7, 2008)

I have an Acer Travelmate 8215WLMi which has today developed a problem!

Previously it was running alright using Vista Professional but when I try to start the laptop, it lets me log-in using my password but then gives me the blue screen of death.

The only specific information on the screen is as follows:

"STOP: 0x0000008E (0xC0000005, 0x821570E6, 0x8D06694C, 0x00000000)"

I have searched google and the microsoft help site but don't seem to be able to come up with any solution.

I am able to access safe mode and have been led to believe this may point to it being a problem with software rather than hardware?

As an aside, I am also wanting to restore my laptop to factory settings but am not sure how to do it. The laptop came preinstalled with Windows XP, which I upgraded using the Acer Vista upgrade disk. I am unhappy with vista and would prefer to go back to using XP but do not have an XP disk. I believe there is a keystoke sequence that can be used to factory restore an Acer machine but I am unsure what it is - can anyone help?


----------



## jcgriff2 (Sep 30, 2007)

Hi katiesam. . .

Welcome to the Tech Support Forum - Vista Support!

The STOP error code that you posted refers to NTFS file corruption of some type. Since you cannot log in, your only recourse is to invoke the recovery system and try to repair the operating system. In THIS article, it describes a hot-key located above the keyboard to invoke the system recovery.

Good Luck . . .

jcgriff2


----------



## katiesam (May 7, 2008)

Hi jcgriff2,

Thanks for your reply. That sounds like a serious problem.

I am able to access safe mode and safe mode with networking support (I am using the machine in safe mode to access this forum now).

I have followed the link you kindly posted but can't see any reference to the hot-key you mentioned. It just seems to be a CNet review of the Travelmate 8215wlmi and although I've read it, it didn't seem to mention how to reset to factory settings.

Katiesam


----------



## jcgriff2 (Sep 30, 2007)

katiesam said:


> Hi jcgriff2,
> 
> Thanks for your reply. That sounds like a serious problem.
> 
> ...






Hi katiesam. . .

From the link - 3rd paragraph. . .



> When opened up you'll notice that the keyboard and control design is very basic, barring the peculiar banana-shaped key layout, which is designed to ensure a comfortable and more ergonomic typing position. Above the keyboard you'll find an Acer hotkey that acts like your own personal Superman, rushing a range of preloaded support, performance and recovery tools to the fore for instant system management.


Well, there is the recovery option, but ...



katiesam said:


> . ..I am able to access safe mode and have been led to believe this may point to it being a problem with software rather than hardware?


I know that when I read fast, I tend to miss a word or two... but I missed that entire sentence from your opening statement in the first post... apologies.

This means there are options... what would you like to do? I will be happy to go through the memory dump files along with various reports to see what I can find out. I'll need the memory dump files c:\windows\minidump. a Belarc Advisor report saved in MHT format, a msinfo32 file (system information) saved in NFO format - START | type msinfo32 | right-click msinfo32.exe | run as admin | ~10 sec report viewer will appear | save as NFO file, and the best for last - Event Viewer logs - all of them - c:\windows\system32\winevt\logs\*.evtx. Then zip them up - you may need more than 1 zip file - split them - Please see my PM. I'll be back later today/tonight.

It is, of course, your choice... however - I would simply ask - what if this is something that surfaces again post-Vista re-format? 

Bye for now. . .

jcgriff2 (JC)



.


----------



## katiesam (May 7, 2008)

jcgriff2 said:


> It is, of course, your choice... however - I would simply ask - what if this is something that surfaces again post-Vista re-format?
> 
> 
> .


Thanks for the speedy response JC, I have sent you a PM


----------



## jcgriff2 (Sep 30, 2007)

Hi katiesam. . .

Here are the instructions for the system information that I promised:

Please run the following -

• Belarc Advisor report saved as a web page (*html*, mht (IE7/8) or as a Word document (docx/doc), or as a Word document. You can download Belarc HERE

• DXDiag report - START | type dxdiag into the Start Search box | right-click on dxdiag.exe | select Run as Administrator | respond to User Access Control prompt | Save as a text file. 

• MS32info NFO file - START | type msinfo32 into the Start Search box | right-click on msinfo32.exe | select Run as Administrator | respond to User Access Control prompt | System Information will then come up | save the report in *System Information File (NFO)* format by selecting File, then Save As.

• Event Logs - Get them all - dozens -They are located in: c:\windows\system32\winevt\logs.

Then zip them up and send to my email.


Regards. . .

jcgriff2


----------



## batteryland (May 10, 2008)

http://www.vista-xp.co.uk/forums/windows-xp-technical/5600-blue-screen-stop-0x0000008e.html

May be you meet the RAM are faulty


----------



## katiesam (May 7, 2008)

Hi JC, files sent as requested.

Hi Batteryland, I checked the link you kindly posted. I'm not sure how to test the RAM.


----------



## batteryland (May 10, 2008)

Hi Katiesam, I found three sites to tech how to test the RAM,these reference may be help you.


----------



## katiesam (May 7, 2008)

hi batteryland, please can you let me know the addresses for the sites you found?

thanks


----------



## jcgriff2 (Sep 30, 2007)

Good Morning Katiesam. . .

I heard that you were in the market for a memory test... well you just happen to have one on board your system:

You can use the in-house Windows Vista Memory Diagnostic Tool. 
First - close all open windows and programs. Then click on START; type MdSched.exe in the Start Search box; right-click on MdSched.exe; select Run as Administrator; answer the UAC prompt; then select the option to re-start your system so that the program can run. 
It will most likely take several hours to complete.

Or you can download Memtest86+ found HERE, then burn an ISO DVD/CD and boot-up with it. This test can take >12 hours.

I have downloaded your files and expect to start on them later today. I will keep you posted. Thanks.

Regards. . .

JC


----------



## katiesam (May 7, 2008)

Thanks again JC,

I might try running the memory test overnight.

I hope that whatever turns out to be wrong is easily resolved!

Kind regards,

Katiesam


----------



## batteryland (May 10, 2008)

Hi Katiesam, sorry for my careless,now I give the sites.

http://www.ghacks.net/2007/07/26/how-to-test-your-ram-for-errors/

http://www.ehow.com/how_2020294_test-ram-computer.html

http://www.pcdoctor-guide.com/wordpress/?p=3134

I also support the software Memtest86+ that jcgriff2 provided.


----------



## katiesam (May 7, 2008)

OK, so I ran the windows vista memory diagnostic tool and left it running overnight.

Most of the time it was just showing a blank black screen and this morning I thought it wasn't doing anything as the hard drive light was only flashing occassionally so I pressed Ctrl+Alt+Del but it took me to the log-in screen. 

After logging in, Vista seemed to boot up normally. I got a message saying that no memory events were found. :smile:

Anyway, it's logged in in normal mode and so far (15mins) there has been no blue screen. I've done nothing different to normal apart from let the memory diagnostic tool run overnight (I set it to run 14 hours ago and then just left it). These past few days, I haven't even had time to log onto the internet after putting my laptop on because the blue screen occurs pretty much straightaway after logging in.

I'm very confused now!! :4-dontkno


----------



## jcgriff2 (Sep 30, 2007)

Hi Katie. . .

I have given the 60+ files that you sent to me a cursory look. It is clearly evident to me that some catastrophic system event(s) occurred on March 18, 2008, 19:47 hours. Take a look in msinfo32 - Software Environment, Windows Error Reporting tab. 

Also, there is one primary item that for some reason I do not have from you - the memory dumps themselves. If you would be so kind, please retrieve them and send them to me. They are located in c:\windows\minidump and have file names like mini051908.dmp. Please get all of them - I don't care if there are hundreds of them. The more we can invite to this party the better - and may make the difference for you in quashing the BSOD infestation - hopefully.

There are two other items that I would like as well, please:
Please download these two executable files to your Desktop - Deckard's System Scanner (DSS), HERE and Trend Micro's HiJackThis from HERE.. Then double-click on DSS.exe - it may ask you for the location of HiJackThis. If so, tell it - it's on your Desktop. When finished in a minute or two, a Notepad will appear with a file name of main.txt - save it as a text file. Then minimized will be another report - extra.txt - save it as a text file as well. If extra.txt is not minimized, look in the folder c:\Deckard.

Please either send these to me via email and/or attach the zip file to your next post. Thanks.

Any ?? - just ask... OK?

Regards. . .

JC


----------



## bdesmondMVP (May 19, 2008)

Curious where the NTFS corruption thing came from? Based on the bugcheck some driver (guessing based on safe mode note here) a/v'ed. This can probably be sorted given the dumps.


----------



## jcgriff2 (Sep 30, 2007)

jcgriff2 said:


> . . .The STOP error code that you posted refers to NTFS file corruption of some type.
> 
> 
> 
> ...




Hello Brian. . .

Admittedly so, calling an 8E "NTFS file corruption" was a poor choice of words on my part at the time. As you undoubtedly know, an 8E refers to a kernel exception issue - and I agree that the dumps will more likely than not lead to the name of a 3RD party driver that is at fault. However, most recent experiences dictate that removal or update of such does not necessarily guarantee freedom from system crashes as it may just be one side of a multi-side system issue.

It is my humbled opinion that a Microsoft driver is rarely - if ever - at fault. I have only seen a handful of cases where such a thing has occurred - and most of those involved extensive infections where the module would never pass a verification inspection. But then I ask myself what the purpose of sfc is if not to fix/replace somehow-corrupted MS files.

Thank you for the comments and please feel free to do so anywhere, anytime. God knows that I can use the help and scrutiny - not only for myself, but for the user at hand that relies upon the information and instructions given.

I will make sure that the dumps are posted and would appreciate your debugging of them.

Regards. . .

jcgriff2 (JC)











[/font][/size]


----------



## katiesam (May 7, 2008)

Hi JC,

I have emailed the files to you as requested.

Just to note that, as I reported in my last post, the blue screen hasn't yet occurred again. I'm confused!

Regards,

katiesam


----------



## jcgriff2 (Sep 30, 2007)

Hi Katiesam. . .

I have gone through all 8 of the kernel memory dumps and they all are literally identical - ntkrpamp.exe comes up as the program running at the time of the system crashes - every time. This is a Microsoft module and I don't believe for one second that it is really the primary cause of your trouble. I'm not sure what the underlying cause is at this time and plan to spend additional time with your event logs to see what I can find out.

The STOP error is 1000008E, (c0000005, . . .) - as you posted.

I believe that it is by no coincidence that your system fails every time within 2 -3 hours of boot-up. All 8 of the dumps clearly show this - this is not irony at play here. What ever is happening here is either scheduled to run within this time parameter after boot or it is a culmination of events triggered by some pattern that you perform after boot-up. I have a problem believing the latter as I would think it impossible to perform the same tasks each time after boot-up - in the same sequence anyway.

Another area to focus on is out-dated drivers. This is something that I always look at anyway and have had good success in identifying those modules that appear to be out of place based on their date alone. It comes as a surprise sometimes to find out exactly what is loaded into memory - and to see them in their memory address relation to the "crashing" module itself. This is not an exact science by any means, but I think it could be a way to further isolate the problem at hand.

I also would like to look at your system's stat-up programs to see exactly what is running at boot. I don't know what role they play in all of this as we would be looking at a time frame here of 0 - 180 seconds after the initial boot-up commands are given.

Based on your last post, I see that the BSODs have not occurred again... is this still true? It would be nice, but it may also be temporary in nature.

There is an area of the dumps that I am listing below as it represents the area of code that failed. I believe that it is referring to the page file and also something to do with the boot sector file. 

```
[SIZE=2][COLOR=Blue]
8d49b9d8 8216609c 88623268 00000208 88623268 [COLOR=Red]nt!HvpGetCellPaged+0x89[/COLOR]
8d49b9f4 8215d778 8da12234 8ff3f814 88623268 nt!CmpMarkValueDataDirty+0x61
8d49ba40 8215ce50 00000000 01f3f814 88623268 nt!CmpMarkKeyValuesDirty+0x139
8d49ba58 8215d10c 88623268 00bee810 8db3b6c4 nt!CmpFreeKeyValues+0x15
8d49bac4 8215c5d8 88623268 8db3b6c4 88623268 nt!CmpSyncKeyValues+0x3d
8d49bb10 8215c3d0 930a7000 88623268 88623268 nt!CmpCopySyncTree2+0x1e9
8d49bb34 8213e3fe 88623268 000001d0 88623268 nt!CmpCopySyncTree+0x3d
8d49bca4 82138675 00010020 8d49bd48 82138601 [COLOR=red]nt!CmpSaveBootControlSet+0x[/COLOR]2ae
8d49bcc0 8208caaa 00000022 8d49bd58 8207e941 nt!NtInitializeRegistry+0x74
8d49bcc0 8207e941 00000022 8d49bd58 8207e941 nt!KiFastCallEntry+0x12a
8d49bd3c 82138627 00000022 0019f8b8 82138601 nt!ZwInitializeRegistry+0x11
8d49bd58 8208caaa 00000022 0019f8f4 770a0f34 nt!NtInitializeRegistry+0x26
8d49bd58 770a0f34 00000022 0019f8f4 770a0f34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0019f8f4 00000000 00000000 00000000 00000000 0x770a0f34[/COLOR][/SIZE]
```
Also, there are three drivers in particular that have caught my eye thus far. Please take a look:

• ozscr.sys time stamp Thu Apr 21 09:58:36 2005 - O2Micro OZ711E1 SmartCard Reader (plug and play device)

• AvgAsCln.sys time stamp Tue Sep 05 12:03:16 2006 - AVG Anti-Spyware Clean Driver

•  sasenum.sys time stamp Mon Feb 13 17:21:44 2006 - SuperAntiSpyware 

Now... I know that we have discussed anti-virus and firewalls, but even I was surprised at the number of products that you have floating around in your system - and an incredible 20+ programs from them fire at boot-up:

• ZoneAlarm v7.1.248.000 (Check Point, LTD.)
• AVG 7.5.524 v7.5.524 (Grisoft)
• AVG Anti-Rootkit
• Spyware Doctor with AntiVirus v (PC Tools)
• Spyware Doctor v5.0.5.259 (PC Tools) Disabled
• Spybot - Search and Destroy v1.0.0.5 (Safer Networking Ltd.) Outdated
• AVG Anti-Spyware v7, 5, 1, 43 (GRISOFT s.r.o.) Outdated
• Windows Defender v1.1.1505.0 (Microsoft Corporation) Disabled 
• SUPERAntiSpyware v4, 0, 0, 1154 (SUPERAntiSpyware.com)


And finally, here are the results as seen from the debugger:

```
[size=2][color=blue]





Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\$Dumps\Katiesam - Vista - 05-16-08\Mini050908-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Fri May  9 05:32:46.910 2008 (GMT-4)
System Uptime: 0 days 0:02:36.672
Loading Kernel Symbols
........................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 821570e6, 939bf94c, 0}

Probably caused by : ntkrpamp.exe ( nt!HvpGetCellPaged+89 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 821570e6, The address that the exception occurred at
Arg3: 939bf94c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

TRAP_FRAME:  939bf94c -- (.trap 0xffffffff939bf94c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=8862f000 edx=86765030 esi=88623290 edi=00000030
eip=821570e6 esp=939bf9c0 ebp=939bf9d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8216609c to 821570e6

STACK_TEXT:  
939bf9d8 8216609c 88623290 00000208 88623290 nt!HvpGetCellPaged+0x89
939bf9f4 8215d778 9505e234 94174814 88623290 nt!CmpMarkValueDataDirty+0x61
939bfa40 8215ce50 00000000 01174814 88623290 nt!CmpMarkKeyValuesDirty+0x139
939bfa58 8215d10c 88623290 00bee810 951876c4 nt!CmpFreeKeyValues+0x15
939bfac4 8215c5d8 88623290 951876c4 88623290 nt!CmpSyncKeyValues+0x3d
939bfb10 8215c3d0 9c286000 88623290 88623290 nt!CmpCopySyncTree2+0x1e9
939bfb34 8213e3fe 88623290 000001d0 88623290 nt!CmpCopySyncTree+0x3d
939bfca4 82138675 00010020 939bfd48 82138601 nt!CmpSaveBootControlSet+0x2ae
939bfcc0 8208caaa 00000022 939bfd58 8207e941 nt!NtInitializeRegistry+0x74
939bfcc0 8207e941 00000022 939bfd58 8207e941 nt!KiFastCallEntry+0x12a
939bfd3c 82138627 00000022 0018f9ac 82138601 nt!ZwInitializeRegistry+0x11
939bfd58 8208caaa 00000022 0018f9e8 77d60f34 nt!NtInitializeRegistry+0x26
939bfd58 77d60f34 00000022 0018f9e8 77d60f34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0018f9e8 00000000 00000000 00000000 00000000 0x77d60f34


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!HvpGetCellPaged+89

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  471ea39c

FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=8862f000 edx=86765030 esi=88623290 edi=00000030
eip=821570e6 esp=939bf9c0 ebp=939bf9d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
ChildEBP RetAddr  Args to Child              
939bf9d8 8216609c 88623290 00000208 88623290 nt!HvpGetCellPaged+0x89
939bf9f4 8215d778 9505e234 94174814 88623290 nt!CmpMarkValueDataDirty+0x61
939bfa40 8215ce50 00000000 01174814 88623290 nt!CmpMarkKeyValuesDirty+0x139
939bfa58 8215d10c 88623290 00bee810 951876c4 nt!CmpFreeKeyValues+0x15
939bfac4 8215c5d8 88623290 951876c4 88623290 nt!CmpSyncKeyValues+0x3d
939bfb10 8215c3d0 9c286000 88623290 88623290 nt!CmpCopySyncTree2+0x1e9
939bfb34 8213e3fe 88623290 000001d0 88623290 nt!CmpCopySyncTree+0x3d
939bfca4 82138675 00010020 939bfd48 82138601 nt!CmpSaveBootControlSet+0x2ae
939bfcc0 8208caaa 00000022 939bfd58 8207e941 nt!NtInitializeRegistry+0x74
939bfcc0 8207e941 00000022 939bfd58 8207e941 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 939bfccc)
939bfd3c 82138627 00000022 0018f9ac 82138601 nt!ZwInitializeRegistry+0x11 (FPO: [1,0,0])
939bfd58 8208caaa 00000022 0018f9e8 77d60f34 nt!NtInitializeRegistry+0x26
939bfd58 77d60f34 00000022 0018f9e8 77d60f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 939bfd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0018f9e8 00000000 00000000 00000000 00000000 0x77d60f34
start    end        module name
80202000 80203600   avgarkt  avgarkt.sys  Wed Jan 31 08:33:46 2007 (45C09ABA)
80204000 8020d000   WMILIB   WMILIB.SYS   Thu Nov 02 04:54:53 2006 (4549B25D)
8020d000 8021a000   WDFLDR   WDFLDR.SYS   Wed Dec 05 21:21:19 2007 (47575C9F)
8021a000 80255000   CLFS     CLFS.SYS     Wed Dec 05 20:55:42 2007 (4757569E)
80255000 8025d000   BOOTVID  BOOTVID.dll  Thu Nov 02 05:39:29 2006 (4549BCD1)
8025d000 80266000   PSHED    PSHED.dll    Thu Nov 02 05:42:51 2006 (4549BD9B)
80266000 802c6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Apr 23 23:40:05 2007 (462D7C15)
802c6000 802ce000   kdcom    kdcom.dll    Thu Nov 02 05:42:20 2006 (4549BD7C)
80401000 80408000   intelide intelide.sys Fri Jan 18 22:01:57 2008 (47916825)
80408000 80418000   mountmgr mountmgr.sys Thu Nov 02 04:51:06 2006 (4549B17A)
80418000 80422000   BATTC    BATTC.SYS    Thu Aug 30 20:57:44 2007 (46D76788)
80422000 80424900   compbatt compbatt.sys Thu Aug 30 20:57:47 2007 (46D7678B)
80425000 80434000   volmgr   volmgr.sys   Thu Nov 02 04:51:44 2006 (4549B1A0)
80434000 80459000   pci      pci.sys      Thu Nov 02 04:35:13 2006 (4549ADC1)
80459000 80461000   msisadrv msisadrv.sys Thu Nov 02 04:35:08 2006 (4549ADBC)
80461000 804a4000   acpi     acpi.sys     Thu Aug 30 20:57:46 2007 (46D7678A)
804a4000 8051f000   Wdf01000 Wdf01000.sys Wed Dec 05 21:21:28 2007 (47575CA8)
8051f000 80600000   CI       CI.dll       Mon Feb 18 23:59:14 2008 (47BA6222)
80606000 8070a000   ndis     ndis.sys     Thu Nov 02 04:57:33 2006 (4549B2FD)
8070a000 80717000   ikfilesec ikfilesec.sys Thu Aug 02 23:42:12 2007 (46B2A414)
80717000 80727000   fileinfo fileinfo.sys Thu Nov 02 04:36:47 2006 (4549AE1F)
80727000 80758000   fltmgr   fltmgr.sys   Thu Nov 02 04:30:58 2006 (4549ACC2)
80758000 80776000   ataport  ataport.SYS  Fri Jan 18 22:01:56 2008 (47916824)
80776000 8077e000   atapi    atapi.sys    Fri Jan 18 22:01:56 2008 (47916824)
8077e000 807c8000   volmgrx  volmgrx.sys  Thu Nov 02 04:51:54 2006 (4549B1AA)
807c8000 807f2000   pcmcia   pcmcia.sys   Thu Nov 02 04:35:13 2006 (4549ADC1)
807f2000 80800000   PCIIDEX  PCIIDEX.SYS  Fri Jan 18 22:01:56 2008 (47916824)
81e04000 81e13000   mup      mup.sys      Thu Nov 02 04:31:04 2006 (4549ACC8)
81e13000 81e22000   partmgr  partmgr.sys  Thu Nov 02 04:51:47 2006 (4549B1A3)
81e22000 81e2a000   spldr    spldr.sys    Wed Oct 25 18:40:44 2006 (453FE7EC)
81e2a000 81e94000   ksecdd   ksecdd.sys   Thu Nov 02 04:43:45 2006 (4549AFC1)
81e94000 81f9c000   Ntfs     Ntfs.sys     Sun Dec 16 04:31:37 2007 (4764F079)
81f9c000 81fd5000   NETIO    NETIO.SYS    Sun Jan 13 22:16:04 2008 (478AD3F4)
81fd5000 82000000   msrpc    msrpc.sys    Thu Nov 02 04:50:16 2006 (4549B148)
82000000 823a1000   nt       ntkrpamp.exe Tue Oct 23 21:45:00 2007 (471EA39C)
823a1000 823d5000   hal      halmacpi.dll Thu Nov 02 04:30:18 2006 (4549AC9A)
8296a000 82973000   crcdisk  crcdisk.sys  Thu Nov 02 04:52:27 2006 (4549B1CB)
82973000 82994000   CLASSPNP CLASSPNP.SYS Thu Nov 02 04:51:34 2006 (4549B196)
82994000 829a5000   disk     disk.sys     Thu Nov 02 04:51:40 2006 (4549B19C)
829a5000 829ca000   ecache   ecache.sys   Thu Nov 02 04:52:42 2006 (4549B1DA)
829ca000 82a00000   volsnap  volsnap.sys  Thu Oct 25 22:04:17 2007 (47214B21)
82a50000 82a50f80   AvgAsCln AvgAsCln.sys Tue Sep 05 12:03:16 2006 (44FD9FC4)
82a58000 82a68000   NDProxy  NDProxy.SYS  Tue Jul 03 21:28:13 2007 (468AF7AD)
82a78000 82a88000   HIDCLASS HIDCLASS.SYS Thu Nov 02 04:55:00 2006 (4549B264)
82aa8000 82ab7280   ohci1394 ohci1394.sys Thu Nov 02 04:55:16 2006 (4549B274)
82ac8000 82ad8000   lltdio   lltdio.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
82bcb000 82bd4000   tunmp    tunmp.sys    Wed Jun 06 22:56:53 2007 (466773F5)
8881f000 88827000   RDPCDD   RDPCDD.sys   Thu Nov 02 05:02:01 2006 (4549B409)
88827000 8882f000   rdpencdd rdpencdd.sys Thu Nov 02 05:02:01 2006 (4549B409)
8882f000 88837000   mouhid   mouhid.sys   Wed Dec 05 21:18:25 2007 (47575BF1)
88837000 8883f000   dump_atapi dump_atapi.sys Fri Jan 18 22:01:56 2008 (47916824)
88887000 8888e800   nscirda  nscirda.sys  Thu Nov 02 04:57:06 2006 (4549B2E2)
8891f000 8892e000   raspppoe raspppoe.sys Thu Nov 02 04:58:12 2006 (4549B324)
8892e000 8893d000   termdd   termdd.sys   Thu Nov 02 05:02:00 2006 (4549B408)
8896a000 88979000   monitor  monitor.sys  Sun Dec 16 04:56:44 2007 (4764F65C)
88997000 889a6000   avgwfp   avgwfp.sys   Tue Mar 11 07:24:16 2008 (47D66BE0)
8b408000 8b409700   USBD     USBD.SYS     Thu Aug 30 21:19:54 2007 (46D76CBA)
8b40c000 8b40d380   swenum   swenum.sys   Thu Nov 02 04:51:15 2006 (4549B183)
8b424000 8b425780   osaio    osaio.sys    Wed Nov 01 02:33:34 2006 (45483FBE)
8b432000 8b432f80   AvgArCln AvgArCln.sys Thu Jan 18 07:00:28 2007 (45AF615C)
8b433000 8b434000   guard    guard.sys    Wed May 30 07:55:24 2007 (465D662C)
8b43e000 8b44b000   umbus    umbus.sys    Thu Nov 02 04:55:24 2006 (4549B27C)
8b44b000 8b455000   mssmbios mssmbios.sys Thu Nov 02 04:35:13 2006 (4549ADC1)
8b455000 8b461000   vga      vga.sys      Thu Nov 02 04:53:56 2006 (4549B224)
8b464000 8b466500   GEARAspiWDM GEARAspiWDM.sys Tue Jan 29 12:00:57 2008 (479F5BC9)
8b491000 8b49a000   irenum   irenum.sys   Thu Nov 02 04:57:04 2006 (4549B2E0)
8b49a000 8b4a5000   Msfs     Msfs.SYS     Thu Nov 02 04:30:56 2006 (4549ACC0)
8b4b1000 8b4b4780   CmBatt   CmBatt.sys   Thu Aug 30 20:57:48 2007 (46D7678C)
8b4e6000 8b4f1000   usbuhci  usbuhci.sys  Thu Aug 30 21:19:58 2007 (46D76CBE)
8b4f1000 8b4ff000   intelppm intelppm.sys Thu Nov 02 04:30:18 2006 (4549AC9A)
8b502000 8b536000   usbhub   usbhub.sys   Thu Aug 30 21:20:18 2007 (46D76CD2)
8b548000 8b555000   watchdog watchdog.sys Thu Nov 02 04:37:44 2006 (4549AE58)
8b564000 8b565000   avgclean avgclean.sys Mon Dec 03 07:09:01 2007 (4753F1DD)
8b573000 8b57d000   nsiproxy nsiproxy.sys Thu Nov 02 04:57:30 2006 (4549B2FA)
8b584000 8b58d000   Fs_Rec   Fs_Rec.SYS   Mon Apr 16 21:26:39 2007 (4624224F)
8b58d000 8b59b000   KCOM     KCOM.SYS     Thu Mar 22 20:22:00 2007 (46031DA8)
8b59b000 8b5ae000   iksysflt iksysflt.sys Mon Jun 04 21:45:15 2007 (4664C02B)
8b5be000 8b5c9000   SMCLIB   SMCLIB.SYS   Thu Nov 02 04:51:25 2006 (4549B18D)
8b5c9000 8b5df960   ozscr    ozscr.sys    Thu Apr 21 09:58:36 2005 (4267B18C)
8b5e0000 8b5ee000   usbehci  usbehci.sys  Thu Aug 30 21:19:59 2007 (46D76CBF)
8b5ee000 8b600000   HDAudBus HDAudBus.sys Sat Mar 24 14:54:34 2007 (460573EA)
8ba04000 8ba0e000   DKbFltr  DKbFltr.sys  Thu Oct 19 04:24:28 2006 (4537363C)
8ba0e000 8ba18000   serenum  serenum.sys  Thu Nov 02 04:51:25 2006 (4549B18D)
8ba18000 8ba25080   1394BUS  1394BUS.SYS  Thu Nov 02 04:55:12 2006 (4549B270)
8ba26000 8ba5a000   e1e6032  e1e6032.sys  Mon Aug 21 12:20:47 2006 (44E9DD5F)
8ba5a000 8ba7f000   drmk     drmk.sys     Thu Nov 02 05:20:49 2006 (4549B871)
8ba7f000 8ba8c000   modem    modem.sys    Thu Nov 02 04:58:52 2006 (4549B34C)
8ba99000 8baa6000   crashdmp crashdmp.sys Thu Nov 02 04:51:36 2006 (4549B198)
8bb53000 8bb5c000   rasacd   rasacd.sys   Thu Nov 02 04:58:13 2006 (4549B325)
8bb5c000 8bb73000   iksyssec iksyssec.sys Mon Jun 04 21:45:54 2007 (4664C052)
8bbd3000 8bc00000   portcls  portcls.sys  Thu Nov 02 04:55:02 2006 (4549B266)
8be06000 8be1d000   rasl2tp  rasl2tp.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8be1d000 8be28000   TDI      TDI.SYS      Thu Nov 02 04:58:46 2006 (4549B346)
8be28000 8be53000   msiscsi  msiscsi.sys  Thu Nov 02 04:52:40 2006 (4549B1D8)
8be53000 8be5c000   wmiacpi  wmiacpi.sys  Thu Aug 30 20:57:47 2007 (46D7678B)
8be5c000 8be74000   cdrom    cdrom.sys    Thu Nov 02 04:51:44 2006 (4549B1A0)
8be74000 8be7f000   mouclass mouclass.sys Wed Dec 05 21:18:22 2007 (47575BEE)
8be7f000 8bea9380   SynTP    SynTP.sys    Fri Oct 27 16:07:10 2006 (454266EE)
8beb0000 8beb9000   hidusb   hidusb.sys   Thu Nov 02 04:55:01 2006 (4549B265)
8beb9000 8bec7000   Npfs     Npfs.SYS     Thu Nov 02 04:30:57 2006 (4549ACC1)
8bec7000 8bee8000   VIDEOPRT VIDEOPRT.SYS Thu Nov 02 04:54:07 2006 (4549B22F)
8bee8000 8bef3000   kbdclass kbdclass.sys Wed Dec 05 21:18:23 2007 (47575BEF)
8bf0e000 8bf23000   tdx      tdx.sys      Thu Nov 02 04:57:34 2006 (4549B2FE)
8bf23000 8bf36000   i8042prt i8042prt.sys Wed Dec 05 21:18:28 2007 (47575BF4)
8bf36000 8bf50000   serial   serial.sys   Thu Nov 02 04:51:29 2006 (4549B191)
8bf50000 8bf8d000   USBPORT  USBPORT.SYS  Thu Aug 30 21:20:03 2007 (46D76CC3)
8bf8d000 8c02a000   dxgkrnl  dxgkrnl.sys  Mon Jul 02 21:01:10 2007 (46899FD6)
8c02a000 8c041000   usbccgp  usbccgp.sys  Thu Aug 30 21:20:08 2007 (46D76CC8)
8c041000 8c13c000   AGRSM    AGRSM.sys    Mon Apr 10 06:21:02 2006 (443A318E)
8c13c000 8c2ce780   RTKVHDA  RTKVHDA.sys  Fri Dec 01 00:38:47 2006 (456FBFE7)
8c2cf000 8ca00000   atikmdag atikmdag.sys Fri Nov 24 21:46:35 2006 (4567AE8B)
8ca00000 8ca40000   storport storport.sys Thu Nov 02 04:51:45 2006 (4549B1A1)
8ca40000 8cc00000   NETw3v32 NETw3v32.sys Mon Sep 25 04:11:18 2006 (45178F26)
8cc18000 8cc42000   ks       ks.sys       Thu Nov 02 04:51:18 2006 (4549B186)
8cc42000 8cc4d000   dump_dumpata dump_dumpata.sys Thu Nov 02 04:51:34 2006 (4549B196)
8cc4d000 8ccd4000   rdpdr    rdpdr.sys    Thu Nov 02 05:02:58 2006 (4549B442)
8ccd4000 8cce7000   raspptp  raspptp.sys  Thu Nov 02 04:58:14 2006 (4549B326)
8ccf7000 8cd10000   fwpkclnt fwpkclnt.sys Thu Nov 02 04:57:26 2006 (4549B2F6)
8cd30000 8cd53000   ndiswan  ndiswan.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8cd53000 8cd5e000   ndistapi ndistapi.sys Tue Jul 03 21:28:09 2007 (468AF7A9)
8cd6a000 8cd9c000   netbt    netbt.sys    Thu Nov 02 04:57:18 2006 (4549B2EE)
8cd9c000 8cdb0000   smb      smb.sys      Thu Nov 02 04:57:10 2006 (4549B2E6)
8cdb5000 8cdb9f40   avgmfx86 avgmfx86.sys Mon Dec 03 22:13:43 2007 (4754C5E7)
8cdc9000 8cdcdce0   OsaFsLoc OsaFsLoc.sys Wed Dec 27 07:43:51 2006 (45926A87)
8cdec000 8cdf1000   SASENUM  SASENUM.SYS  Mon Feb 13 17:21:44 2006 (43F10678)
8d000000 8d017000   dfsc     dfsc.sys     Thu Nov 02 04:31:04 2006 (4549ACC8)
8d017000 8d02a000   wanarp   wanarp.sys   Tue Jul 03 21:28:16 2007 (468AF7B0)
8d02a000 8d040000   pacer    pacer.sys    Tue Jul 03 21:27:33 2007 (468AF785)
8d06d000 8d095000   fastfat  fastfat.SYS  Thu Nov 02 04:30:49 2006 (4549ACB9)
8d09c000 8d0a3000   Null     Null.SYS     Thu Nov 02 04:51:05 2006 (4549B179)
8d0a3000 8d0aa000   Beep     Beep.SYS     Thu Nov 02 04:51:03 2006 (4549B177)
8d0c6000 8d0cc380   HIDPARSE HIDPARSE.SYS Thu Nov 02 04:55:00 2006 (4549B264)
8d0d4000 8d0db000   SASDIFSV SASDIFSV.SYS Tue Oct 03 19:02:46 2006 (4522EC16)
8d109000 8d150000   afd      afd.sys      Thu Nov 02 04:58:41 2006 (4549B341)
8d15b000 8d166000   tcpipreg tcpipreg.sys Thu Nov 02 04:57:46 2006 (4549B30A)
8d207000 8d260000   vsdatant vsdatant.sys Wed Jan 09 06:27:36 2008 (4784AFA8)
8d260000 8d26e000   netbios  netbios.sys  Thu Nov 02 04:57:26 2006 (4549B2F6)
8e208000 8e228000   SASKUTIL SASKUTIL.sys Thu Nov 29 17:05:31 2007 (474F37AB)
8e260000 8e32d300   lv321av  lv321av.sys  Tue Nov 28 21:08:09 2006 (456CEB89)
8e32e000 8e400000   tcpip    tcpip.sys    Sun Jan 13 22:16:37 2008 (478AD415)
8e622000 8e7ff800   LVMVDrv  LVMVDrv.sys  Tue Nov 28 20:55:40 2006 (456CE89C)
92875000 92875a00   mchInjDrv mchInjDrv.sys Wed Jan 11 02:07:52 2006 (43C4AEC8)
92892000 928e5000   csc      csc.sys      Mon Jun 18 20:48:27 2007 (467727DB)
928ef000 928f9000   Dxapi    Dxapi.sys    Thu Nov 02 04:38:17 2006 (4549AE79)
92917000 92921000   ndisuio  ndisuio.sys  Thu Nov 02 04:57:22 2006 (4549B2F2)
92921000 9292b000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
929c5000 92a00000   rdbss    rdbss.sys    Thu Nov 02 04:31:24 2006 (4549ACDC)
93941000 9394a000   asyncmac asyncmac.sys Thu Nov 02 04:58:10 2006 (4549B322)
97e00000 97fff000   win32k   win32k.sys   Thu Feb 28 23:16:24 2008 (47C78718)
98265000 98280000   luafv    luafv.sys    Thu Nov 02 04:33:07 2006 (4549AD43)
98800000 98809000   TSDDD    TSDDD.dll    Thu Nov 02 05:02:02 2006 (4549B40A)
98810000 9881e000   cdd      cdd.dll      unavailable (00000000)
98e01000 98e14000   rspndr   rspndr.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
98fe8000 98ffe000   cdfs     cdfs.sys     Thu Nov 02 04:30:50 2006 (4549ACBA)
99aa9000 99ad4000   nwifi    nwifi.sys    Fri Jan 18 22:06:33 2008 (47916939)
99ad4000 99af2000   irda     irda.sys     Thu Nov 02 04:57:09 2006 (4549B2E5)
99af2000 99b80000   spsys    spsys.sys    Wed Oct 25 18:43:28 2006 (453FE890)
99c0f000 99c2a000   srvnet   srvnet.sys   Thu Oct 25 21:40:43 2007 (4721459B)
99c2a000 99c90000   HTTP     HTTP.sys     Thu Nov 02 04:57:06 2006 (4549B2E2)
99cf3000 99cf3dc0   osanbm   osanbm.sys   Wed Nov 08 08:02:53 2006 (4551D57D)
9a974000 9a9c0000   srv      srv.sys      Thu Nov 02 04:31:55 2006 (4549ACFB)
9b242000 9b320000   peauth   peauth.sys   Mon Oct 23 04:55:32 2006 (453C8384)
9b6e6000 9b70a000   srv2     srv2.sys     Thu Oct 25 21:40:47 2007 (4721459F)
9b70a000 9b71c000   mrxsmb20 mrxsmb20.sys Thu Oct 25 21:40:16 2007 (47214580)
9b71c000 9b755000   mrxsmb10 mrxsmb10.sys Thu Nov 02 04:31:25 2006 (4549ACDD)
9b755000 9b773000   mrxsmb   mrxsmb.sys   Thu Oct 25 21:40:17 2007 (47214581)
9b773000 9b793000   mrxdav   mrxdav.sys   Fri Jan 11 20:45:54 2008 (47881BD2)
9b793000 9b7a7000   mpsdrv   mpsdrv.sys   Wed Jun 06 22:55:55 2007 (466773BB)
9b7a7000 9b7c0000   bowser   bowser.sys   Thu Nov 02 04:31:11 2006 (4549ACCF)

Unloaded modules:
88857000 8885f000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
88812000 8881f000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
888a5000 888b0000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
88877000 8887f000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
1: kd> drivers
*** WARNING: Unable to verify timestamp for avgarkt.sys
*** ERROR: Module load completed but symbols could not be loaded for avgarkt.sys
*** WARNING: Unable to verify timestamp for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for AvgAsCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgAsCln.sys
*** WARNING: Unable to verify timestamp for avgwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for avgwfp.sys
*** WARNING: Unable to verify timestamp for osaio.sys
*** ERROR: Module load completed but symbols could not be loaded for osaio.sys
*** WARNING: Unable to verify timestamp for AvgArCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgArCln.sys
*** WARNING: Unable to verify timestamp for guard.sys
*** ERROR: Module load completed but symbols could not be loaded for guard.sys
*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
*** WARNING: Unable to verify timestamp for avgclean.sys
*** ERROR: Module load completed but symbols could not be loaded for avgclean.sys
*** WARNING: Unable to verify timestamp for KCOM.SYS
*** ERROR: Module load completed but symbols could not be loaded for KCOM.SYS
*** WARNING: Unable to verify timestamp for iksysflt.sys
*** ERROR: Module load completed but symbols could not be loaded for iksysflt.sys
*** WARNING: Unable to verify timestamp for ozscr.sys
*** ERROR: Module load completed but symbols could not be loaded for ozscr.sys
*** WARNING: Unable to verify timestamp for DKbFltr.sys
*** ERROR: Module load completed but symbols could not be loaded for DKbFltr.sys
*** WARNING: Unable to verify timestamp for e1e6032.sys
*** ERROR: Module load completed but symbols could not be loaded for e1e6032.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for iksyssec.sys
*** ERROR: Module load completed but symbols could not be loaded for iksyssec.sys
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** WARNING: Unable to verify timestamp for AGRSM.sys
*** ERROR: Module load completed but symbols could not be loaded for AGRSM.sys
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** WARNING: Unable to verify timestamp for NETw3v32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw3v32.sys
*** WARNING: Unable to verify timestamp for avgmfx86.sys
*** ERROR: Module load completed but symbols could not be loaded for avgmfx86.sys
*** WARNING: Unable to verify timestamp for OsaFsLoc.sys
*** ERROR: Module load completed but symbols could not be loaded for OsaFsLoc.sys
*** WARNING: Unable to verify timestamp for SASENUM.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASENUM.SYS
*** WARNING: Unable to verify timestamp for SASDIFSV.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASDIFSV.SYS
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for SASKUTIL.sys
*** ERROR: Module load completed but symbols could not be loaded for SASKUTIL.sys
*** WARNING: Unable to verify timestamp for lv321av.sys
*** ERROR: Module load completed but symbols could not be loaded for lv321av.sys
*** WARNING: Unable to verify timestamp for LVMVDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for LVMVDrv.sys
*** WARNING: Unable to verify timestamp for mchInjDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for mchInjDrv.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for spsys.sys - 
*** WARNING: Unable to verify timestamp for osanbm.sys
*** ERROR: Module load completed but symbols could not be loaded for osanbm.sys
Couldn't resolve error at 'rivers'
1: kd> u
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]
821570e9 8b8614030000    mov     eax,dword ptr [esi+314h]
821570ef 037df4          add     edi,dword ptr [ebp-0Ch]
821570f2 83600400        and     dword ptr [eax+4],0
821570f6 33c9            xor     ecx,ecx
821570f8 894508          mov     dword ptr [ebp+8],eax
821570fb 41              inc     ecx
821570fc 8bd0            mov     edx,eax









7#############################################


Loading Dump File [E:\$Dumps\Katiesam - Vista - 05-16-08\Mini050908-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Thu May  8 19:35:58.783 2008 (GMT-4)
System Uptime: 0 days 0:03:57.534
Loading Kernel Symbols
.........................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 821570e6, 924a594c, 0}

Probably caused by : ntkrpamp.exe ( nt!HvpGetCellPaged+89 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 821570e6, The address that the exception occurred at
Arg3: 924a594c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

TRAP_FRAME:  924a594c -- (.trap 0xffffffff924a594c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=8862f000 edx=85e6a5d0 esi=88623220 edi=00000030
eip=821570e6 esp=924a59c0 ebp=924a59d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8216609c to 821570e6

STACK_TEXT:  
924a59d8 8216609c 88623220 00000208 88623220 nt!HvpGetCellPaged+0x89
924a59f4 8215d778 94e21234 93d38814 88623220 nt!CmpMarkValueDataDirty+0x61
924a5a40 8215ce50 00000000 01d38814 88623220 nt!CmpMarkKeyValuesDirty+0x139
924a5a58 8215d10c 88623220 00bee810 94f4a6c4 nt!CmpFreeKeyValues+0x15
924a5ac4 8215c5d8 88623220 94f4a6c4 88623220 nt!CmpSyncKeyValues+0x3d
924a5b10 8215c3d0 a11e4000 88623220 88623220 nt!CmpCopySyncTree2+0x1e9
924a5b34 8213e3fe 88623220 000001d0 88623220 nt!CmpCopySyncTree+0x3d
924a5ca4 82138675 00010020 924a5d48 82138601 nt!CmpSaveBootControlSet+0x2ae
924a5cc0 8208caaa 00000022 924a5d58 8207e941 nt!NtInitializeRegistry+0x74
924a5cc0 8207e941 00000022 924a5d58 8207e941 nt!KiFastCallEntry+0x12a
924a5d3c 82138627 00000022 0020fab0 82138601 nt!ZwInitializeRegistry+0x11
924a5d58 8208caaa 00000022 0020faec 771e0f34 nt!NtInitializeRegistry+0x26
924a5d58 771e0f34 00000022 0020faec 771e0f34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0020faec 00000000 00000000 00000000 00000000 0x771e0f34


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!HvpGetCellPaged+89

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  471ea39c

FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=8862f000 edx=85e6a5d0 esi=88623220 edi=00000030
eip=821570e6 esp=924a59c0 ebp=924a59d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
ChildEBP RetAddr  Args to Child              
924a59d8 8216609c 88623220 00000208 88623220 nt!HvpGetCellPaged+0x89
924a59f4 8215d778 94e21234 93d38814 88623220 nt!CmpMarkValueDataDirty+0x61
924a5a40 8215ce50 00000000 01d38814 88623220 nt!CmpMarkKeyValuesDirty+0x139
924a5a58 8215d10c 88623220 00bee810 94f4a6c4 nt!CmpFreeKeyValues+0x15
924a5ac4 8215c5d8 88623220 94f4a6c4 88623220 nt!CmpSyncKeyValues+0x3d
924a5b10 8215c3d0 a11e4000 88623220 88623220 nt!CmpCopySyncTree2+0x1e9
924a5b34 8213e3fe 88623220 000001d0 88623220 nt!CmpCopySyncTree+0x3d
924a5ca4 82138675 00010020 924a5d48 82138601 nt!CmpSaveBootControlSet+0x2ae
924a5cc0 8208caaa 00000022 924a5d58 8207e941 nt!NtInitializeRegistry+0x74
924a5cc0 8207e941 00000022 924a5d58 8207e941 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 924a5ccc)
924a5d3c 82138627 00000022 0020fab0 82138601 nt!ZwInitializeRegistry+0x11 (FPO: [1,0,0])
924a5d58 8208caaa 00000022 0020faec 771e0f34 nt!NtInitializeRegistry+0x26
924a5d58 771e0f34 00000022 0020faec 771e0f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 924a5d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0020faec 00000000 00000000 00000000 00000000 0x771e0f34
start    end        module name
80202000 80203600   avgarkt  avgarkt.sys  Wed Jan 31 08:33:46 2007 (45C09ABA)
80204000 8020d000   WMILIB   WMILIB.SYS   Thu Nov 02 04:54:53 2006 (4549B25D)
8020d000 8021a000   WDFLDR   WDFLDR.SYS   Wed Dec 05 21:21:19 2007 (47575C9F)
8021a000 80255000   CLFS     CLFS.SYS     Wed Dec 05 20:55:42 2007 (4757569E)
80255000 8025d000   BOOTVID  BOOTVID.dll  Thu Nov 02 05:39:29 2006 (4549BCD1)
8025d000 80266000   PSHED    PSHED.dll    Thu Nov 02 05:42:51 2006 (4549BD9B)
80266000 802c6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Apr 23 23:40:05 2007 (462D7C15)
802c6000 802ce000   kdcom    kdcom.dll    Thu Nov 02 05:42:20 2006 (4549BD7C)
80401000 80408000   intelide intelide.sys Fri Jan 18 22:01:57 2008 (47916825)
80408000 80418000   mountmgr mountmgr.sys Thu Nov 02 04:51:06 2006 (4549B17A)
80418000 80422000   BATTC    BATTC.SYS    Thu Aug 30 20:57:44 2007 (46D76788)
80422000 80424900   compbatt compbatt.sys Thu Aug 30 20:57:47 2007 (46D7678B)
80425000 80434000   volmgr   volmgr.sys   Thu Nov 02 04:51:44 2006 (4549B1A0)
80434000 80459000   pci      pci.sys      Thu Nov 02 04:35:13 2006 (4549ADC1)
80459000 80461000   msisadrv msisadrv.sys Thu Nov 02 04:35:08 2006 (4549ADBC)
80461000 804a4000   acpi     acpi.sys     Thu Aug 30 20:57:46 2007 (46D7678A)
804a4000 8051f000   Wdf01000 Wdf01000.sys Wed Dec 05 21:21:28 2007 (47575CA8)
8051f000 80600000   CI       CI.dll       Mon Feb 18 23:59:14 2008 (47BA6222)
80606000 8070a000   ndis     ndis.sys     Thu Nov 02 04:57:33 2006 (4549B2FD)
8070a000 80717000   ikfilesec ikfilesec.sys Thu Aug 02 23:42:12 2007 (46B2A414)
80717000 80727000   fileinfo fileinfo.sys Thu Nov 02 04:36:47 2006 (4549AE1F)
80727000 80758000   fltmgr   fltmgr.sys   Thu Nov 02 04:30:58 2006 (4549ACC2)
80758000 80776000   ataport  ataport.SYS  Fri Jan 18 22:01:56 2008 (47916824)
80776000 8077e000   atapi    atapi.sys    Fri Jan 18 22:01:56 2008 (47916824)
8077e000 807c8000   volmgrx  volmgrx.sys  Thu Nov 02 04:51:54 2006 (4549B1AA)
807c8000 807f2000   pcmcia   pcmcia.sys   Thu Nov 02 04:35:13 2006 (4549ADC1)
807f2000 80800000   PCIIDEX  PCIIDEX.SYS  Fri Jan 18 22:01:56 2008 (47916824)
81e04000 81e13000   mup      mup.sys      Thu Nov 02 04:31:04 2006 (4549ACC8)
81e13000 81e22000   partmgr  partmgr.sys  Thu Nov 02 04:51:47 2006 (4549B1A3)
81e22000 81e2a000   spldr    spldr.sys    Wed Oct 25 18:40:44 2006 (453FE7EC)
81e2a000 81e94000   ksecdd   ksecdd.sys   Thu Nov 02 04:43:45 2006 (4549AFC1)
81e94000 81f9c000   Ntfs     Ntfs.sys     Sun Dec 16 04:31:37 2007 (4764F079)
81f9c000 81fd5000   NETIO    NETIO.SYS    Sun Jan 13 22:16:04 2008 (478AD3F4)
81fd5000 82000000   msrpc    msrpc.sys    Thu Nov 02 04:50:16 2006 (4549B148)
82000000 823a1000   nt       ntkrpamp.exe Tue Oct 23 21:45:00 2007 (471EA39C)
823a1000 823d5000   hal      halmacpi.dll Thu Nov 02 04:30:18 2006 (4549AC9A)
8296a000 82973000   crcdisk  crcdisk.sys  Thu Nov 02 04:52:27 2006 (4549B1CB)
82973000 82994000   CLASSPNP CLASSPNP.SYS Thu Nov 02 04:51:34 2006 (4549B196)
82994000 829a5000   disk     disk.sys     Thu Nov 02 04:51:40 2006 (4549B19C)
829a5000 829ca000   ecache   ecache.sys   Thu Nov 02 04:52:42 2006 (4549B1DA)
829ca000 82a00000   volsnap  volsnap.sys  Thu Oct 25 22:04:17 2007 (47214B21)
82aa8000 82ab8000   lltdio   lltdio.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
82ad8000 82ae8000   NDProxy  NDProxy.SYS  Tue Jul 03 21:28:13 2007 (468AF7AD)
82b18000 82b27280   ohci1394 ohci1394.sys Thu Nov 02 04:55:16 2006 (4549B274)
82ba4000 82bb4000   HIDCLASS HIDCLASS.SYS Thu Nov 02 04:55:00 2006 (4549B264)
82bcb000 82bd4000   tunmp    tunmp.sys    Wed Jun 06 22:56:53 2007 (466773F5)
88820000 88828000   rdpencdd rdpencdd.sys Thu Nov 02 05:02:01 2006 (4549B409)
88828000 88830000   mouhid   mouhid.sys   Wed Dec 05 21:18:25 2007 (47575BF1)
88830000 88838000   dump_atapi dump_atapi.sys Fri Jan 18 22:01:56 2008 (47916824)
88880000 88887800   nscirda  nscirda.sys  Thu Nov 02 04:57:06 2006 (4549B2E2)
888ab000 888abf80   AvgAsCln AvgAsCln.sys Tue Sep 05 12:03:16 2006 (44FD9FC4)
888ad000 888adf80   AvgArCln AvgArCln.sys Thu Jan 18 07:00:28 2007 (45AF615C)
888b1000 888b9000   RDPCDD   RDPCDD.sys   Thu Nov 02 05:02:01 2006 (4549B409)
8892e000 8893d000   raspppoe raspppoe.sys Thu Nov 02 04:58:12 2006 (4549B324)
8893d000 8894c000   termdd   termdd.sys   Thu Nov 02 05:02:00 2006 (4549B408)
8895b000 8896a000   monitor  monitor.sys  Sun Dec 16 04:56:44 2007 (4764F65C)
889a6000 889b5000   avgwfp   avgwfp.sys   Tue Mar 11 07:24:16 2008 (47D66BE0)
8ac07000 8ac08700   USBD     USBD.SYS     Thu Aug 30 21:19:54 2007 (46D76CBA)
8ac0b000 8ac0c380   swenum   swenum.sys   Thu Nov 02 04:51:15 2006 (4549B183)
8ac27000 8ac28000   avgclean avgclean.sys Mon Dec 03 07:09:01 2007 (4753F1DD)
8ac38000 8ac46000   Npfs     Npfs.SYS     Thu Nov 02 04:30:57 2006 (4549ACC1)
8ac46000 8ac54000   KCOM     KCOM.SYS     Thu Mar 22 20:22:00 2007 (46031DA8)
8ac60000 8ac63780   CmBatt   CmBatt.sys   Thu Aug 30 20:57:48 2007 (46D7678C)
8aca0000 8acad000   watchdog watchdog.sys Thu Nov 02 04:37:44 2006 (4549AE58)
8accb000 8acd9000   intelppm intelppm.sys Thu Nov 02 04:30:18 2006 (4549AC9A)
8ace2000 8ad16000   usbhub   usbhub.sys   Thu Aug 30 21:20:18 2007 (46D76CD2)
8ad24000 8ad32000   usbehci  usbehci.sys  Thu Aug 30 21:19:59 2007 (46D76CBF)
8ad32000 8ad44000   HDAudBus HDAudBus.sys Sat Mar 24 14:54:34 2007 (460573EA)
8ad4b000 8ad5e000   iksysflt iksysflt.sys Mon Jun 04 21:45:15 2007 (4664C02B)
8ad7e000 8ada3000   drmk     drmk.sys     Thu Nov 02 05:20:49 2006 (4549B871)
8ada3000 8add0000   portcls  portcls.sys  Thu Nov 02 04:55:02 2006 (4549B266)
8add9000 8addb500   GEARAspiWDM GEARAspiWDM.sys Tue Jan 29 12:00:57 2008 (479F5BC9)
8b400000 8b409000   irenum   irenum.sys   Thu Nov 02 04:57:04 2006 (4549B2E0)
8b409000 8b412000   wmiacpi  wmiacpi.sys  Thu Aug 30 20:57:47 2007 (46D7678B)
8b412000 8b41b000   Fs_Rec   Fs_Rec.SYS   Mon Apr 16 21:26:39 2007 (4624224F)
8b41b000 8b424000   asyncmac asyncmac.sys Thu Nov 02 04:58:10 2006 (4549B322)
8b424000 8b42d000   rasacd   rasacd.sys   Thu Nov 02 04:58:13 2006 (4549B325)
8b42d000 8b436000   hidusb   hidusb.sys   Thu Nov 02 04:55:01 2006 (4549B265)
8b490000 8b49b000   usbuhci  usbuhci.sys  Thu Aug 30 21:19:58 2007 (46D76CBE)
8b49b000 8b4a6000   SMCLIB   SMCLIB.SYS   Thu Nov 02 04:51:25 2006 (4549B18D)
8b4a6000 8b4b1000   kbdclass kbdclass.sys Wed Dec 05 21:18:23 2007 (47575BEF)
8b4b1000 8b4bc000   mouclass mouclass.sys Wed Dec 05 21:18:22 2007 (47575BEE)
8b4bc000 8b4c7000   TDI      TDI.SYS      Thu Nov 02 04:58:46 2006 (4549B346)
8b4c7000 8b4d2000   ndistapi ndistapi.sys Tue Jul 03 21:28:09 2007 (468AF7A9)
8b4dd000 8b4e8000   Msfs     Msfs.SYS     Thu Nov 02 04:30:56 2006 (4549ACC0)
8b4e8000 8b4f3000   dump_dumpata dump_dumpata.sys Thu Nov 02 04:51:34 2006 (4549B196)
8b4fe000 8b509000   tcpipreg tcpipreg.sys Thu Nov 02 04:57:46 2006 (4549B30A)
8b50c000 8b540000   e1e6032  e1e6032.sys  Mon Aug 21 12:20:47 2006 (44E9DD5F)
8b54c000 8b558000   vga      vga.sys      Thu Nov 02 04:53:56 2006 (4549B224)
8bc02000 8bc0c000   Dxapi    Dxapi.sys    Thu Nov 02 04:38:17 2006 (4549AE79)
8bc0c000 8bc23000   iksyssec iksyssec.sys Mon Jun 04 21:45:54 2007 (4664C052)
8bc2d000 8bc31f40   avgmfx86 avgmfx86.sys Mon Dec 03 22:13:43 2007 (4754C5E7)
8bc32000 8bc37000   SASENUM  SASENUM.SYS  Mon Feb 13 17:21:44 2006 (43F10678)
8bc5f000 8bc63ce0   OsaFsLoc OsaFsLoc.sys Wed Dec 27 07:43:51 2006 (45926A87)
8bc73000 8be05780   RTKVHDA  RTKVHDA.sys  Fri Dec 01 00:38:47 2006 (456FBFE7)
8be06000 8be13080   1394BUS  1394BUS.SYS  Thu Nov 02 04:55:12 2006 (4549B270)
8be14000 8be51000   USBPORT  USBPORT.SYS  Thu Aug 30 21:20:03 2007 (46D76CC3)
8be51000 8c011000   NETw3v32 NETw3v32.sys Mon Sep 25 04:11:18 2006 (45178F26)
8c011000 8c0ae000   dxgkrnl  dxgkrnl.sys  Mon Jul 02 21:01:10 2007 (46899FD6)
8c0b3000 8c0cc000   fwpkclnt fwpkclnt.sys Thu Nov 02 04:57:26 2006 (4549B2F6)
8c10c000 8c207000   AGRSM    AGRSM.sys    Mon Apr 10 06:21:02 2006 (443A318E)
8c207000 8c211000   mssmbios mssmbios.sys Thu Nov 02 04:35:13 2006 (4549ADC1)
8c211000 8c23b380   SynTP    SynTP.sys    Fri Oct 27 16:07:10 2006 (454266EE)
8c241000 8c256000   tdx      tdx.sys      Thu Nov 02 04:57:34 2006 (4549B2FE)
8c256000 8c277000   VIDEOPRT VIDEOPRT.SYS Thu Nov 02 04:54:07 2006 (4549B22F)
8c277000 8c281000   DKbFltr  DKbFltr.sys  Thu Oct 19 04:24:28 2006 (4537363C)
8c281000 8c294000   i8042prt i8042prt.sys Wed Dec 05 21:18:28 2007 (47575BF4)
8c294000 8c29e000   serenum  serenum.sys  Thu Nov 02 04:51:25 2006 (4549B18D)
8c29e000 8c2b8000   serial   serial.sys   Thu Nov 02 04:51:29 2006 (4549B191)
8c2b8000 8c2ce960   ozscr    ozscr.sys    Thu Apr 21 09:58:36 2005 (4267B18C)
8c2cf000 8ca00000   atikmdag atikmdag.sys Fri Nov 24 21:46:35 2006 (4567AE8B)
8ca01000 8ca14000   raspptp  raspptp.sys  Thu Nov 02 04:58:14 2006 (4549B326)
8ca14000 8ca2b000   usbccgp  usbccgp.sys  Thu Aug 30 21:20:08 2007 (46D76CC8)
8ca4b000 8ca76000   msiscsi  msiscsi.sys  Thu Nov 02 04:52:40 2006 (4549B1D8)
8ca76000 8ca84000   netbios  netbios.sys  Thu Nov 02 04:57:26 2006 (4549B2F6)
8ca84000 8ca98000   smb      smb.sys      Thu Nov 02 04:57:10 2006 (4549B2E6)
8cac4000 8cacb000   Null     Null.SYS     Thu Nov 02 04:51:05 2006 (4549B179)
8cacb000 8cad2000   Beep     Beep.SYS     Thu Nov 02 04:51:03 2006 (4549B177)
8cad9000 8cadf380   HIDPARSE HIDPARSE.SYS Thu Nov 02 04:55:00 2006 (4549B264)
8cae0000 8cae7000   SASDIFSV SASDIFSV.SYS Tue Oct 03 19:02:46 2006 (4522EC16)
8cb18000 8cb30000   cdrom    cdrom.sys    Thu Nov 02 04:51:44 2006 (4549B1A0)
8cb35000 8cb3f000   nsiproxy nsiproxy.sys Thu Nov 02 04:57:30 2006 (4549B2FA)
8cbaf000 8cbbc000   modem    modem.sys    Thu Nov 02 04:58:52 2006 (4549B34C)
8cbc9000 8cbd6000   crashdmp crashdmp.sys Thu Nov 02 04:51:36 2006 (4549B198)
8cc7f000 8cc8c000   umbus    umbus.sys    Thu Nov 02 04:55:24 2006 (4549B27C)
8cc8c000 8ccb6000   ks       ks.sys       Thu Nov 02 04:51:18 2006 (4549B186)
8ccb6000 8cd3d000   rdpdr    rdpdr.sys    Thu Nov 02 05:02:58 2006 (4549B442)
8cd5e000 8cd86000   fastfat  fastfat.SYS  Thu Nov 02 04:30:49 2006 (4549ACB9)
8cd86000 8cda9000   ndiswan  ndiswan.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8cda9000 8cdc0000   rasl2tp  rasl2tp.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8cdc0000 8ce00000   storport storport.sys Thu Nov 02 04:51:45 2006 (4549B1A1)
8dc60000 8dd2d300   lv321av  lv321av.sys  Tue Nov 28 21:08:09 2006 (456CEB89)
8dd2e000 8de00000   tcpip    tcpip.sys    Sun Jan 13 22:16:37 2008 (478AD415)
8f002000 8f00c000   ndisuio  ndisuio.sys  Thu Nov 02 04:57:22 2006 (4549B2F2)
8f00c000 8f022000   pacer    pacer.sys    Tue Jul 03 21:27:33 2007 (468AF785)
8f022000 8f1ff800   LVMVDrv  LVMVDrv.sys  Tue Nov 28 20:55:40 2006 (456CE89C)
8fe0f000 8fe68000   vsdatant vsdatant.sys Wed Jan 09 06:27:36 2008 (4784AFA8)
8fe68000 8fe9a000   netbt    netbt.sys    Thu Nov 02 04:57:18 2006 (4549B2EE)
8fe9a000 8fee1000   afd      afd.sys      Thu Nov 02 04:58:41 2006 (4549B341)
8fee6000 8fef0000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
92428000 9243f000   dfsc     dfsc.sys     Thu Nov 02 04:31:04 2006 (4549ACC8)
9243f000 92492000   csc      csc.sys      Mon Jun 18 20:48:27 2007 (467727DB)
924d2000 9250d000   rdbss    rdbss.sys    Thu Nov 02 04:31:24 2006 (4549ACDC)
9250d000 9252d000   SASKUTIL SASKUTIL.sys Thu Nov 29 17:05:31 2007 (474F37AB)
92557000 92558000   guard    guard.sys    Wed May 30 07:55:24 2007 (465D662C)
92586000 92586dc0   osanbm   osanbm.sys   Wed Nov 08 08:02:53 2006 (4551D57D)
925e5000 925e5a00   mchInjDrv mchInjDrv.sys Wed Jan 11 02:07:52 2006 (43C4AEC8)
925ed000 92600000   wanarp   wanarp.sys   Tue Jul 03 21:28:16 2007 (468AF7B0)
93407000 93425000   irda     irda.sys     Thu Nov 02 04:57:09 2006 (4549B2E5)
93465000 93480000   luafv    luafv.sys    Thu Nov 02 04:33:07 2006 (4549AD43)
97c00000 97dff000   win32k   win32k.sys   Thu Feb 28 23:16:24 2008 (47C78718)
98000000 98009000   TSDDD    TSDDD.dll    Thu Nov 02 05:02:02 2006 (4549B40A)
98010000 9801e000   cdd      cdd.dll      unavailable (00000000)
98020000 9806c000   ATMFD    ATMFD.DLL    unavailable (00000000)
98442000 98455000   rspndr   rspndr.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
98455000 98480000   nwifi    nwifi.sys    Fri Jan 18 22:06:33 2008 (47916939)
98846000 988d4000   spsys    spsys.sys    Wed Oct 25 18:43:28 2006 (453FE890)
98aef000 98b05000   cdfs     cdfs.sys     Thu Nov 02 04:30:50 2006 (4549ACBA)
99c06000 99c1f000   bowser   bowser.sys   Thu Nov 02 04:31:11 2006 (4549ACCF)
99c1f000 99c3a000   srvnet   srvnet.sys   Thu Oct 25 21:40:43 2007 (4721459B)
99c7a000 99ce0000   HTTP     HTTP.sys     Thu Nov 02 04:57:06 2006 (4549B2E2)
99d62000 99d63780   osaio    osaio.sys    Wed Nov 01 02:33:34 2006 (45483FBE)
9a0b3000 9a0ff000   srv      srv.sys      Thu Nov 02 04:31:55 2006 (4549ACFB)
9a13f000 9a163000   srv2     srv2.sys     Thu Oct 25 21:40:47 2007 (4721459F)
9a163000 9a175000   mrxsmb20 mrxsmb20.sys Thu Oct 25 21:40:16 2007 (47214580)
9a175000 9a1ae000   mrxsmb10 mrxsmb10.sys Thu Nov 02 04:31:25 2006 (4549ACDD)
9a1ae000 9a1cc000   mrxsmb   mrxsmb.sys   Thu Oct 25 21:40:17 2007 (47214581)
9a1cc000 9a1ec000   mrxdav   mrxdav.sys   Fri Jan 11 20:45:54 2008 (47881BD2)
9a1ec000 9a200000   mpsdrv   mpsdrv.sys   Wed Jun 06 22:55:55 2007 (466773BB)
a1c62000 a1d40000   peauth   peauth.sys   Mon Oct 23 04:55:32 2006 (453C8384)

Unloaded modules:
88850000 88858000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8880b000 88818000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
88800000 8880b000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
88870000 88878000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
1: kd> drivers
*** WARNING: Unable to verify timestamp for avgarkt.sys
*** ERROR: Module load completed but symbols could not be loaded for avgarkt.sys
*** WARNING: Unable to verify timestamp for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for AvgAsCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgAsCln.sys
*** WARNING: Unable to verify timestamp for AvgArCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgArCln.sys
*** WARNING: Unable to verify timestamp for avgwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for avgwfp.sys
*** WARNING: Unable to verify timestamp for avgclean.sys
*** ERROR: Module load completed but symbols could not be loaded for avgclean.sys
*** WARNING: Unable to verify timestamp for KCOM.SYS
*** ERROR: Module load completed but symbols could not be loaded for KCOM.SYS
*** WARNING: Unable to verify timestamp for iksysflt.sys
*** ERROR: Module load completed but symbols could not be loaded for iksysflt.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
*** WARNING: Unable to verify timestamp for e1e6032.sys
*** ERROR: Module load completed but symbols could not be loaded for e1e6032.sys
*** WARNING: Unable to verify timestamp for iksyssec.sys
*** ERROR: Module load completed but symbols could not be loaded for iksyssec.sys
*** WARNING: Unable to verify timestamp for avgmfx86.sys
*** ERROR: Module load completed but symbols could not be loaded for avgmfx86.sys
*** WARNING: Unable to verify timestamp for SASENUM.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASENUM.SYS
*** WARNING: Unable to verify timestamp for OsaFsLoc.sys
*** ERROR: Module load completed but symbols could not be loaded for OsaFsLoc.sys
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for NETw3v32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw3v32.sys
*** WARNING: Unable to verify timestamp for AGRSM.sys
*** ERROR: Module load completed but symbols could not be loaded for AGRSM.sys
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** WARNING: Unable to verify timestamp for DKbFltr.sys
*** ERROR: Module load completed but symbols could not be loaded for DKbFltr.sys
*** WARNING: Unable to verify timestamp for ozscr.sys
*** ERROR: Module load completed but symbols could not be loaded for ozscr.sys
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** WARNING: Unable to verify timestamp for SASDIFSV.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASDIFSV.SYS
*** WARNING: Unable to verify timestamp for lv321av.sys
*** ERROR: Module load completed but symbols could not be loaded for lv321av.sys
*** WARNING: Unable to verify timestamp for LVMVDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for LVMVDrv.sys
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for SASKUTIL.sys
*** ERROR: Module load completed but symbols could not be loaded for SASKUTIL.sys
*** WARNING: Unable to verify timestamp for guard.sys
*** ERROR: Module load completed but symbols could not be loaded for guard.sys
*** WARNING: Unable to verify timestamp for osanbm.sys
*** ERROR: Module load completed but symbols could not be loaded for osanbm.sys
*** WARNING: Unable to verify timestamp for mchInjDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for mchInjDrv.sys
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for ATMFD.DLL
*** ERROR: Module load completed but symbols could not be loaded for ATMFD.DLL
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for spsys.sys - 
*** WARNING: Unable to verify timestamp for osaio.sys
*** ERROR: Module load completed but symbols could not be loaded for osaio.sys
Couldn't resolve error at 'rivers'
1: kd> u
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]
821570e9 8b8614030000    mov     eax,dword ptr [esi+314h]
821570ef 037df4          add     edi,dword ptr [ebp-0Ch]
821570f2 83600400        and     dword ptr [eax+4],0
821570f6 33c9            xor     ecx,ecx
821570f8 894508          mov     dword ptr [ebp+8],eax
821570fb 41              inc     ecx
821570fc 8bd0            mov     edx,eax

6#############################################


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\$Dumps\Katiesam - Vista - 05-16-08\Mini050808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x82000000 PsLoadedModuleList = 0x82111e10
Debug session time: Thu May  8 06:13:12.117 2008 (GMT-4)
System Uptime: 0 days 0:02:27.887
Loading Kernel Symbols
..........................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 821570e6, 8d35f94c, 0}

Probably caused by : ntkrpamp.exe ( nt!HvpGetCellPaged+89 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 821570e6, The address that the exception occurred at
Arg3: 8d35f94c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

TRAP_FRAME:  8d35f94c -- (.trap 0xffffffff8d35f94c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=8862f000 edx=86e486d8 esi=88623290 edi=00000030
eip=821570e6 esp=8d35f9c0 ebp=8d35f9d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8216609c to 821570e6

STACK_TEXT:  
8d35f9d8 8216609c 88623290 00000208 88623290 nt!HvpGetCellPaged+0x89
8d35f9f4 8215d778 91c05234 91532814 88623290 nt!CmpMarkValueDataDirty+0x61
8d35fa40 8215ce50 00000000 01532814 88623290 nt!CmpMarkKeyValuesDirty+0x139
8d35fa58 8215d10c 88623290 00bee810 91d2e6c4 nt!CmpFreeKeyValues+0x15
8d35fac4 8215c5d8 88623290 91d2e6c4 88623290 nt!CmpSyncKeyValues+0x3d
8d35fb10 8215c3d0 98aea000 88623290 88623290 nt!CmpCopySyncTree2+0x1e9
8d35fb34 8213e3fe 88623290 000001d0 88623290 nt!CmpCopySyncTree+0x3d
8d35fca4 82138675 00010020 8d35fd48 82138601 nt!CmpSaveBootControlSet+0x2ae
8d35fcc0 8208caaa 00000022 8d35fd58 8207e941 nt!NtInitializeRegistry+0x74
8d35fcc0 8207e941 00000022 8d35fd58 8207e941 nt!KiFastCallEntry+0x12a
8d35fd3c 82138627 00000022 000af880 82138601 nt!ZwInitializeRegistry+0x11
8d35fd58 8208caaa 00000022 000af8bc 779a0f34 nt!NtInitializeRegistry+0x26
8d35fd58 779a0f34 00000022 000af8bc 779a0f34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
000af8bc 00000000 00000000 00000000 00000000 0x779a0f34


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!HvpGetCellPaged+89
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!HvpGetCellPaged+89

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  471ea39c

FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

BUCKET_ID:  0x8E_nt!HvpGetCellPaged+89

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=8862f000 edx=86e486d8 esi=88623290 edi=00000030
eip=821570e6 esp=8d35f9c0 ebp=8d35f9d8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi] ds:0023:00000030=????????
ChildEBP RetAddr  Args to Child              
8d35f9d8 8216609c 88623290 00000208 88623290 nt!HvpGetCellPaged+0x89
8d35f9f4 8215d778 91c05234 91532814 88623290 nt!CmpMarkValueDataDirty+0x61
8d35fa40 8215ce50 00000000 01532814 88623290 nt!CmpMarkKeyValuesDirty+0x139
8d35fa58 8215d10c 88623290 00bee810 91d2e6c4 nt!CmpFreeKeyValues+0x15
8d35fac4 8215c5d8 88623290 91d2e6c4 88623290 nt!CmpSyncKeyValues+0x3d
8d35fb10 8215c3d0 98aea000 88623290 88623290 nt!CmpCopySyncTree2+0x1e9
8d35fb34 8213e3fe 88623290 000001d0 88623290 nt!CmpCopySyncTree+0x3d
8d35fca4 82138675 00010020 8d35fd48 82138601 nt!CmpSaveBootControlSet+0x2ae
8d35fcc0 8208caaa 00000022 8d35fd58 8207e941 nt!NtInitializeRegistry+0x74
8d35fcc0 8207e941 00000022 8d35fd58 8207e941 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8d35fccc)
8d35fd3c 82138627 00000022 000af880 82138601 nt!ZwInitializeRegistry+0x11 (FPO: [1,0,0])
8d35fd58 8208caaa 00000022 000af8bc 779a0f34 nt!NtInitializeRegistry+0x26
8d35fd58 779a0f34 00000022 000af8bc 779a0f34 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8d35fd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
000af8bc 00000000 00000000 00000000 00000000 0x779a0f34
start    end        module name
80202000 80203600   avgarkt  avgarkt.sys  Wed Jan 31 08:33:46 2007 (45C09ABA)
80204000 8020d000   WMILIB   WMILIB.SYS   Thu Nov 02 04:54:53 2006 (4549B25D)
8020d000 8021a000   WDFLDR   WDFLDR.SYS   Wed Dec 05 21:21:19 2007 (47575C9F)
8021a000 80255000   CLFS     CLFS.SYS     Wed Dec 05 20:55:42 2007 (4757569E)
80255000 8025d000   BOOTVID  BOOTVID.dll  Thu Nov 02 05:39:29 2006 (4549BCD1)
8025d000 80266000   PSHED    PSHED.dll    Thu Nov 02 05:42:51 2006 (4549BD9B)
80266000 802c6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Apr 23 23:40:05 2007 (462D7C15)
802c6000 802ce000   kdcom    kdcom.dll    Thu Nov 02 05:42:20 2006 (4549BD7C)
80401000 80408000   intelide intelide.sys Fri Jan 18 22:01:57 2008 (47916825)
80408000 80418000   mountmgr mountmgr.sys Thu Nov 02 04:51:06 2006 (4549B17A)
80418000 80422000   BATTC    BATTC.SYS    Thu Aug 30 20:57:44 2007 (46D76788)
80422000 80424900   compbatt compbatt.sys Thu Aug 30 20:57:47 2007 (46D7678B)
80425000 80434000   volmgr   volmgr.sys   Thu Nov 02 04:51:44 2006 (4549B1A0)
80434000 80459000   pci      pci.sys      Thu Nov 02 04:35:13 2006 (4549ADC1)
80459000 80461000   msisadrv msisadrv.sys Thu Nov 02 04:35:08 2006 (4549ADBC)
80461000 804a4000   acpi     acpi.sys     Thu Aug 30 20:57:46 2007 (46D7678A)
804a4000 8051f000   Wdf01000 Wdf01000.sys Wed Dec 05 21:21:28 2007 (47575CA8)
8051f000 80600000   CI       CI.dll       Mon Feb 18 23:59:14 2008 (47BA6222)
80606000 8070a000   ndis     ndis.sys     Thu Nov 02 04:57:33 2006 (4549B2FD)
8070a000 80717000   ikfilesec ikfilesec.sys Thu Aug 02 23:42:12 2007 (46B2A414)
80717000 80727000   fileinfo fileinfo.sys Thu Nov 02 04:36:47 2006 (4549AE1F)
80727000 80758000   fltmgr   fltmgr.sys   Thu Nov 02 04:30:58 2006 (4549ACC2)
80758000 80776000   ataport  ataport.SYS  Fri Jan 18 22:01:56 2008 (47916824)
80776000 8077e000   atapi    atapi.sys    Fri Jan 18 22:01:56 2008 (47916824)
8077e000 807c8000   volmgrx  volmgrx.sys  Thu Nov 02 04:51:54 2006 (4549B1AA)
807c8000 807f2000   pcmcia   pcmcia.sys   Thu Nov 02 04:35:13 2006 (4549ADC1)
807f2000 80800000   PCIIDEX  PCIIDEX.SYS  Fri Jan 18 22:01:56 2008 (47916824)
81e04000 81e13000   mup      mup.sys      Thu Nov 02 04:31:04 2006 (4549ACC8)
81e13000 81e22000   partmgr  partmgr.sys  Thu Nov 02 04:51:47 2006 (4549B1A3)
81e22000 81e2a000   spldr    spldr.sys    Wed Oct 25 18:40:44 2006 (453FE7EC)
81e2a000 81e94000   ksecdd   ksecdd.sys   Thu Nov 02 04:43:45 2006 (4549AFC1)
81e94000 81f9c000   Ntfs     Ntfs.sys     Sun Dec 16 04:31:37 2007 (4764F079)
81f9c000 81fd5000   NETIO    NETIO.SYS    Sun Jan 13 22:16:04 2008 (478AD3F4)
81fd5000 82000000   msrpc    msrpc.sys    Thu Nov 02 04:50:16 2006 (4549B148)
82000000 823a1000   nt       ntkrpamp.exe Tue Oct 23 21:45:00 2007 (471EA39C)
823a1000 823d5000   hal      halmacpi.dll Thu Nov 02 04:30:18 2006 (4549AC9A)
8296a000 82973000   crcdisk  crcdisk.sys  Thu Nov 02 04:52:27 2006 (4549B1CB)
82973000 82994000   CLASSPNP CLASSPNP.SYS Thu Nov 02 04:51:34 2006 (4549B196)
82994000 829a5000   disk     disk.sys     Thu Nov 02 04:51:40 2006 (4549B19C)
829a5000 829ca000   ecache   ecache.sys   Thu Nov 02 04:52:42 2006 (4549B1DA)
829ca000 82a00000   volsnap  volsnap.sys  Thu Oct 25 22:04:17 2007 (47214B21)
82a52000 82a53000   avgclean avgclean.sys Mon Dec 03 07:09:01 2007 (4753F1DD)
82a55000 82a55f80   AvgAsCln AvgAsCln.sys Tue Sep 05 12:03:16 2006 (44FD9FC4)
82ab8000 82ac8000   lltdio   lltdio.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
82ae8000 82af7280   ohci1394 ohci1394.sys Thu Nov 02 04:55:16 2006 (4549B274)
82b38000 82b48000   NDProxy  NDProxy.SYS  Tue Jul 03 21:28:13 2007 (468AF7AD)
8884a000 8884d780   CmBatt   CmBatt.sys   Thu Aug 30 20:57:48 2007 (46D7678C)
88855000 8885d000   rdpencdd rdpencdd.sys Thu Nov 02 05:02:01 2006 (4549B409)
888a5000 888a7500   GEARAspiWDM GEARAspiWDM.sys Tue Jan 29 12:00:57 2008 (479F5BC9)
888ac000 888ad700   USBD     USBD.SYS     Thu Aug 30 21:19:54 2007 (46D76CBA)
888ae000 888af380   swenum   swenum.sys   Thu Nov 02 04:51:15 2006 (4549B183)
88910000 8891f000   raspppoe raspppoe.sys Thu Nov 02 04:58:12 2006 (4549B324)
8891f000 8892e000   termdd   termdd.sys   Thu Nov 02 05:02:00 2006 (4549B408)
889a6000 889b5000   monitor  monitor.sys  Sun Dec 16 04:56:44 2007 (4764F65C)
889c4000 889d3000   avgwfp   avgwfp.sys   Tue Mar 11 07:24:16 2008 (47D66BE0)
8ac00000 8ac12000   HDAudBus HDAudBus.sys Sat Mar 24 14:54:34 2007 (460573EA)
8ac12000 8ac20000   intelppm intelppm.sys Thu Nov 02 04:30:18 2006 (4549AC9A)
8ac20000 8ac2d000   watchdog watchdog.sys Thu Nov 02 04:37:44 2006 (4549AE58)
8ac68000 8ac6cf40   avgmfx86 avgmfx86.sys Mon Dec 03 22:13:43 2007 (4754C5E7)
8ac7c000 8acb0000   e1e6032  e1e6032.sys  Mon Aug 21 12:20:47 2006 (44E9DD5F)
8ad10000 8ad18000   dump_atapi dump_atapi.sys Fri Jan 18 22:01:56 2008 (47916824)
8ad38000 8ad3f800   nscirda  nscirda.sys  Thu Nov 02 04:57:06 2006 (4549B2E2)
8ad70000 8ad78000   mouhid   mouhid.sys   Wed Dec 05 21:18:25 2007 (47575BF1)
8ad88000 8ad90000   RDPCDD   RDPCDD.sys   Thu Nov 02 05:02:01 2006 (4549B409)
8ada5000 8adac000   SASDIFSV SASDIFSV.SYS Tue Oct 03 19:02:46 2006 (4522EC16)
8adc1000 8adc8000   Null     Null.SYS     Thu Nov 02 04:51:05 2006 (4549B179)
8adc8000 8adcf000   Beep     Beep.SYS     Thu Nov 02 04:51:03 2006 (4549B177)
8adcf000 8add5380   HIDPARSE HIDPARSE.SYS Thu Nov 02 04:55:00 2006 (4549B264)
8ae0a000 8ae18000   usbehci  usbehci.sys  Thu Aug 30 21:19:59 2007 (46D76CBF)
8ae18000 8ae23000   usbuhci  usbuhci.sys  Thu Aug 30 21:19:58 2007 (46D76CBE)
8ae26000 8ae26f80   AvgArCln AvgArCln.sys Thu Jan 18 07:00:28 2007 (45AF615C)
8ae28000 8ae29000   guard    guard.sys    Wed May 30 07:55:24 2007 (465D662C)
8ae33000 8aed0000   dxgkrnl  dxgkrnl.sys  Mon Jul 02 21:01:10 2007 (46899FD6)
8af02000 8af0c000   serenum  serenum.sys  Thu Nov 02 04:51:25 2006 (4549B18D)
8af0c000 8af16000   DKbFltr  DKbFltr.sys  Thu Oct 19 04:24:28 2006 (4537363C)
8af16000 8af20000   mssmbios mssmbios.sys Thu Nov 02 04:35:13 2006 (4549ADC1)
8af2a000 8af34000   ndisuio  ndisuio.sys  Thu Nov 02 04:57:22 2006 (4549B2F2)
8af34000 8af3e000   nsiproxy nsiproxy.sys Thu Nov 02 04:57:30 2006 (4549B2FA)
8af3e000 8af48000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
8af5c000 8af66000   Dxapi    Dxapi.sys    Thu Nov 02 04:38:17 2006 (4549AE79)
8af70000 8af79000   Fs_Rec   Fs_Rec.SYS   Mon Apr 16 21:26:39 2007 (4624224F)
8af79000 8af82000   rasacd   rasacd.sys   Thu Nov 02 04:58:13 2006 (4549B325)
8af9d000 8afa6000   irenum   irenum.sys   Thu Nov 02 04:57:04 2006 (4549B2E0)
8afa6000 8afaf000   asyncmac asyncmac.sys Thu Nov 02 04:58:10 2006 (4549B322)
8afb8000 8afc1000   tunmp    tunmp.sys    Wed Jun 06 22:56:53 2007 (466773F5)
8afc1000 8afca000   wmiacpi  wmiacpi.sys  Thu Aug 30 20:57:47 2007 (46D7678B)
8aff7000 8b000000   hidusb   hidusb.sys   Thu Nov 02 04:55:01 2006 (4549B265)
8b407000 8b41f000   cdrom    cdrom.sys    Thu Nov 02 04:51:44 2006 (4549B1A0)
8b41f000 8b42a000   mouclass mouclass.sys Wed Dec 05 21:18:22 2007 (47575BEE)
8b42a000 8b435000   kbdclass kbdclass.sys Wed Dec 05 21:18:23 2007 (47575BEF)
8b435000 8b448000   i8042prt i8042prt.sys Wed Dec 05 21:18:28 2007 (47575BF4)
8b448000 8b462000   serial   serial.sys   Thu Nov 02 04:51:29 2006 (4549B191)
8b462000 8b46f080   1394BUS  1394BUS.SYS  Thu Nov 02 04:55:12 2006 (4549B270)
8b470000 8b47b000   SMCLIB   SMCLIB.SYS   Thu Nov 02 04:51:25 2006 (4549B18D)
8b47b000 8b491960   ozscr    ozscr.sys    Thu Apr 21 09:58:36 2005 (4267B18C)
8b492000 8b4cf000   USBPORT  USBPORT.SYS  Thu Aug 30 21:20:03 2007 (46D76CC3)
8b4cf000 8bc00000   atikmdag atikmdag.sys Fri Nov 24 21:46:35 2006 (4567AE8B)
8bc0a000 8bc15000   TDI      TDI.SYS      Thu Nov 02 04:58:46 2006 (4549B346)
8bc15000 8bc3f380   SynTP    SynTP.sys    Fri Oct 27 16:07:10 2006 (454266EE)
8bc40000 8be00000   NETw3v32 NETw3v32.sys Mon Sep 25 04:11:18 2006 (45178F26)
8c006000 8c013000   modem    modem.sys    Thu Nov 02 04:58:52 2006 (4549B34C)
8c013000 8c040000   portcls  portcls.sys  Thu Nov 02 04:55:02 2006 (4549B266)
8c040000 8c074000   usbhub   usbhub.sys   Thu Aug 30 21:20:18 2007 (46D76CD2)
8c074000 8c09e000   ks       ks.sys       Thu Nov 02 04:51:18 2006 (4549B186)
8c09e000 8c0ab000   umbus    umbus.sys    Thu Nov 02 04:55:24 2006 (4549B27C)
8c0b6000 8c13d000   rdpdr    rdpdr.sys    Thu Nov 02 05:02:58 2006 (4549B442)
8c13d000 8c150000   raspptp  raspptp.sys  Thu Nov 02 04:58:14 2006 (4549B326)
8c150000 8c173000   ndiswan  ndiswan.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8c173000 8c17e000   ndistapi ndistapi.sys Tue Jul 03 21:28:09 2007 (468AF7A9)
8c17e000 8c195000   rasl2tp  rasl2tp.sys  Thu Nov 02 04:58:13 2006 (4549B325)
8c195000 8c1d5000   storport storport.sys Thu Nov 02 04:51:45 2006 (4549B1A1)
8c1d5000 8c200000   msiscsi  msiscsi.sys  Thu Nov 02 04:52:40 2006 (4549B1D8)
8c209000 8c21c000   iksysflt iksysflt.sys Mon Jun 04 21:45:15 2007 (4664C02B)
8c248000 8c26d000   drmk     drmk.sys     Thu Nov 02 05:20:49 2006 (4549B871)
8c26d000 8c3ff780   RTKVHDA  RTKVHDA.sys  Fri Dec 01 00:38:47 2006 (456FBFE7)
8c406000 8c41b000   tdx      tdx.sys      Thu Nov 02 04:57:34 2006 (4549B2FE)
8c41b000 8c434000   fwpkclnt fwpkclnt.sys Thu Nov 02 04:57:26 2006 (4549B2F6)
8c454000 8c475000   VIDEOPRT VIDEOPRT.SYS Thu Nov 02 04:54:07 2006 (4549B22F)
8c485000 8c49c000   iksyssec iksyssec.sys Mon Jun 04 21:45:54 2007 (4664C052)
8c49c000 8c4a9000   crashdmp crashdmp.sys Thu Nov 02 04:51:36 2006 (4549B198)
8c4b7000 8c4c5000   KCOM     KCOM.SYS     Thu Mar 22 20:22:00 2007 (46031DA8)
8c505000 8c600000   AGRSM    AGRSM.sys    Mon Apr 10 06:21:02 2006 (443A318E)
8c602000 8c615000   wanarp   wanarp.sys   Tue Jul 03 21:28:16 2007 (468AF7B0)
8c615000 8c65c000   afd      afd.sys      Thu Nov 02 04:58:41 2006 (4549B341)
8c65c000 8c670000   smb      smb.sys      Thu Nov 02 04:57:10 2006 (4549B2E6)
8c69a000 8c6a8000   Npfs     Npfs.SYS     Thu Nov 02 04:30:57 2006 (4549ACC1)
8c6a8000 8c6b6000   netbios  netbios.sys  Thu Nov 02 04:57:26 2006 (4549B2F6)
8c750000 8c75b000   Msfs     Msfs.SYS     Thu Nov 02 04:30:56 2006 (4549ACC0)
8c75b000 8c766000   dump_dumpata dump_dumpata.sys Thu Nov 02 04:51:34 2006 (4549B196)
8c771000 8c77c000   tcpipreg tcpipreg.sys Thu Nov 02 04:57:46 2006 (4549B30A)
8cc05000 8cc5e000   vsdatant vsdatant.sys Wed Jan 09 06:27:36 2008 (4784AFA8)
8cc5e000 8cc90000   netbt    netbt.sys    Thu Nov 02 04:57:18 2006 (4549B2EE)
8cc90000 8ce6d800   LVMVDrv  LVMVDrv.sys  Tue Nov 28 20:55:40 2006 (456CE89C)
8ce6e000 8cf40000   tcpip    tcpip.sys    Sun Jan 13 22:16:37 2008 (478AD415)
8cf40000 8cf4c000   vga      vga.sys      Thu Nov 02 04:53:56 2006 (4549B224)
8d017000 8d02e000   dfsc     dfsc.sys     Thu Nov 02 04:31:04 2006 (4549ACC8)
8d02e000 8d081000   csc      csc.sys      Mon Jun 18 20:48:27 2007 (467727DB)
8d0c1000 8d0fc000   rdbss    rdbss.sys    Thu Nov 02 04:31:24 2006 (4549ACDC)
8d0fc000 8d11c000   SASKUTIL SASKUTIL.sys Thu Nov 29 17:05:31 2007 (474F37AB)
8d11c000 8d132000   pacer    pacer.sys    Tue Jul 03 21:27:33 2007 (468AF785)
8d132000 8d1ff300   lv321av  lv321av.sys  Tue Nov 28 21:08:09 2006 (456CEB89)
8d355000 8d355dc0   osanbm   osanbm.sys   Wed Nov 08 08:02:53 2006 (4551D57D)
8d3d8000 8d400000   fastfat  fastfat.SYS  Thu Nov 02 04:30:49 2006 (4549ACB9)
92a00000 92bff000   win32k   win32k.sys   Thu Feb 28 23:16:24 2008 (47C78718)
92c85000 92ca0000   luafv    luafv.sys    Thu Nov 02 04:33:07 2006 (4549AD43)
93800000 93809000   TSDDD    TSDDD.dll    Thu Nov 02 05:02:02 2006 (4549B40A)
93810000 9381e000   cdd      cdd.dll      unavailable (00000000)
93820000 9386c000   ATMFD    ATMFD.DLL    unavailable (00000000)
942ac000 942b0ce0   OsaFsLoc OsaFsLoc.sys Wed Dec 27 07:43:51 2006 (45926A87)
942cf000 942d4000   SASENUM  SASENUM.SYS  Mon Feb 13 17:21:44 2006 (43F10678)
95600000 95610000   HIDCLASS HIDCLASS.SYS Thu Nov 02 04:55:00 2006 (4549B264)
956a6000 956b9000   rspndr   rspndr.sys   Thu Nov 02 04:56:48 2006 (4549B2D0)
956b9000 956e4000   nwifi    nwifi.sys    Fri Jan 18 22:06:33 2008 (47916939)
956e4000 95702000   irda     irda.sys     Thu Nov 02 04:57:09 2006 (4549B2E5)
95772000 95800000   spsys    spsys.sys    Wed Oct 25 18:43:28 2006 (453FE890)
9622e000 96247000   bowser   bowser.sys   Thu Nov 02 04:31:11 2006 (4549ACCF)
96247000 96262000   srvnet   srvnet.sys   Thu Oct 25 21:40:43 2007 (4721459B)
962a2000 96308000   HTTP     HTTP.sys     Thu Nov 02 04:57:06 2006 (4549B2E2)
96322000 96323780   osaio    osaio.sys    Wed Nov 01 02:33:34 2006 (45483FBE)
96e33000 96e7f000   srv      srv.sys      Thu Nov 02 04:31:55 2006 (4549ACFB)
96ebf000 96ee3000   srv2     srv2.sys     Thu Oct 25 21:40:47 2007 (4721459F)
96ee3000 96ef5000   mrxsmb20 mrxsmb20.sys Thu Oct 25 21:40:16 2007 (47214580)
96f75000 96fae000   mrxsmb10 mrxsmb10.sys Thu Nov 02 04:31:25 2006 (4549ACDD)
96fae000 96fcc000   mrxsmb   mrxsmb.sys   Thu Oct 25 21:40:17 2007 (47214581)
96fcc000 96fec000   mrxdav   mrxdav.sys   Fri Jan 11 20:45:54 2008 (47881BD2)
96fec000 97000000   mpsdrv   mpsdrv.sys   Wed Jun 06 22:55:55 2007 (466773BB)
971a9000 971c0000   usbccgp  usbccgp.sys  Thu Aug 30 21:20:08 2007 (46D76CC8)
9aa6b000 9aa73000   drmkaud  drmkaud.sys  Thu Nov 02 04:54:59 2006 (4549B263)
9bec8000 9bec8a00   mchInjDrv mchInjDrv.sys Wed Jan 11 02:07:52 2006 (43C4AEC8)
9befa000 9bf10000   cdfs     cdfs.sys     Thu Nov 02 04:30:50 2006 (4549ACBA)
a1252000 a1330000   peauth   peauth.sys   Mon Oct 23 04:55:32 2006 (453C8384)

Unloaded modules:
93f88000 93f90000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ac42000 8ac4f000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ac37000 8ac42000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ad80000 8ad88000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
1: kd> drivers
*** WARNING: Unable to verify timestamp for avgarkt.sys
*** ERROR: Module load completed but symbols could not be loaded for avgarkt.sys
*** WARNING: Unable to verify timestamp for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for ikfilesec.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for avgclean.sys
*** ERROR: Module load completed but symbols could not be loaded for avgclean.sys
*** WARNING: Unable to verify timestamp for AvgAsCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgAsCln.sys
*** WARNING: Unable to verify timestamp for GEARAspiWDM.sys
*** ERROR: Module load completed but symbols could not be loaded for GEARAspiWDM.sys
*** WARNING: Unable to verify timestamp for avgwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for avgwfp.sys
*** WARNING: Unable to verify timestamp for avgmfx86.sys
*** ERROR: Module load completed but symbols could not be loaded for avgmfx86.sys
*** WARNING: Unable to verify timestamp for e1e6032.sys
*** ERROR: Module load completed but symbols could not be loaded for e1e6032.sys
*** WARNING: Unable to verify timestamp for SASDIFSV.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASDIFSV.SYS
*** WARNING: Unable to verify timestamp for AvgArCln.sys
*** ERROR: Module load completed but symbols could not be loaded for AvgArCln.sys
*** WARNING: Unable to verify timestamp for guard.sys
*** ERROR: Module load completed but symbols could not be loaded for guard.sys
*** WARNING: Unable to verify timestamp for DKbFltr.sys
*** ERROR: Module load completed but symbols could not be loaded for DKbFltr.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for ozscr.sys
*** ERROR: Module load completed but symbols could not be loaded for ozscr.sys
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** WARNING: Unable to verify timestamp for NETw3v32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw3v32.sys
*** WARNING: Unable to verify timestamp for iksysflt.sys
*** ERROR: Module load completed but symbols could not be loaded for iksysflt.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for iksyssec.sys
*** ERROR: Module load completed but symbols could not be loaded for iksyssec.sys
*** WARNING: Unable to verify timestamp for KCOM.SYS
*** ERROR: Module load completed but symbols could not be loaded for KCOM.SYS
*** WARNING: Unable to verify timestamp for AGRSM.sys
*** ERROR: Module load completed but symbols could not be loaded for AGRSM.sys
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for LVMVDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for LVMVDrv.sys
*** WARNING: Unable to verify timestamp for SASKUTIL.sys
*** ERROR: Module load completed but symbols could not be loaded for SASKUTIL.sys
*** WARNING: Unable to verify timestamp for lv321av.sys
*** ERROR: Module load completed but symbols could not be loaded for lv321av.sys
*** WARNING: Unable to verify timestamp for osanbm.sys
*** ERROR: Module load completed but symbols could not be loaded for osanbm.sys
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for ATMFD.DLL
*** ERROR: Module load completed but symbols could not be loaded for ATMFD.DLL
*** WARNING: Unable to verify timestamp for OsaFsLoc.sys
*** ERROR: Module load completed but symbols could not be loaded for OsaFsLoc.sys
*** WARNING: Unable to verify timestamp for SASENUM.SYS
*** ERROR: Module load completed but symbols could not be loaded for SASENUM.SYS
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for spsys.sys - 
*** WARNING: Unable to verify timestamp for osaio.sys
*** ERROR: Module load completed but symbols could not be loaded for osaio.sys
*** WARNING: Unable to verify timestamp for mchInjDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for mchInjDrv.sys
Couldn't resolve error at 'rivers'
1: kd> u
nt!HvpGetCellPaged+0x89:
821570e6 8b3c38          mov     edi,dword ptr [eax+edi]
821570e9 8b8614030000    mov     eax,dword ptr [esi+314h]
821570ef 037df4          add     edi,dword ptr [ebp-0Ch]
821570f2 83600400        and     dword ptr [eax+4],0
821570f6 33c9            xor     ecx,ecx
821570f8 894508          mov     dword ptr [ebp+8],eax
821570fb 41              inc     ecx
821570fc 8bd0            mov     edx,eax

###[/color][/size]
```


Regards. . .

jcgriff2 (JC)


----------



## katiesam (May 7, 2008)

Many thanks for your dedication JC, it must take ages to work through all this stuff.

I can confirm that I still have not had another occurance of the blue screen and my laptop is now still loading up normally (I no longer have to boot in safe mode with networking).

I have replied to the email you sent.

I agree that the amount of anti-virus programs etc is probably overkill! It's all precautionary as, at the time, I didn't want to damage my newly-purchased laptop by getting it infected with any viruses etc (and still don't).

As I've said previously, my ideal result would be to restore the laptop to factory settings so that it is back running xp and has everything in it's pre-problem state and I can start again from scratch.

I know there is a certain keystroke sequence that can be used to start to Acer factory restore process but I've been led to believe that, because I upgraded to vista using the acer vista upgrade dvd, that this may have overwritten one of the files needed to complete the factory restore.

So my problem is that I don't have a copy of xp on disk (as it only came preloaded on the laptop) and so can't install xp this way either.

I do have backup disks that I made when I first bought my machine, as prompted during the first startup. I also made futher backup disks when I upgraded to vista.

I'm not sure how these work though and don't want to use them if they're going to return me to xp but leave a lot of stray files around my machine.

As I said before, I want to restore to factory settings so it's in essence a 'clean' machine again. I hope this makes sense!

Kind regards and thanks again for your help so far.


----------

