AndyD Posted May 1, 2009 Share Posted May 1, 2009 I'm not sure what's causing this. The only thing I can think of is that maybe it's Kaspersky. Anyway here is a link to the minidump... http://users.rcn.com/andyd2k/050109-29265-01.dmp I tried doing it myself but I don't think I did it right because I've seen other people discuss and able to point out specific files that might have been the culprit. Plus, nothing comes up under debugging details Opened log file 'c:\debuglog.txt' 2: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols WARNING: Whitespace at end of path element 2: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols ............................................................... ................................................................ ........................... Loading User Symbols Loading unloaded module list ........................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffa80c654bdc0, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff80002a92dcc, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000005, (reserved) Debugging Details: ------------------ Link to comment Share on other sites More sharing options...
hdood Posted May 1, 2009 Share Posted May 1, 2009 The debugger needs the symbols files for the RC. They are not on the public symbol server, and I do not believe they have been released yet. Link to comment Share on other sites More sharing options...
AndyD Posted May 1, 2009 Author Share Posted May 1, 2009 Well that's no good :( Thanks for the info Link to comment Share on other sites More sharing options...
hdood Posted May 6, 2009 Share Posted May 6, 2009 For what it's worth, avp.exe seems to be implicated, and I'm guessing that's Kaspersky. Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf60e0 fffffa80c654bdc0 FAULTING_IP: nt!MiDecommitPages+1fc fffff800`02a92dcc 448b04c2 mov r8d,dword ptr [rdx+rax*8] MM_INTERNAL_CODE: 5 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: avp.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002b38fc9 to fffff80002ad0f80 STACK_TEXT: fffff880`06e34f98 fffff800`02b38fc9 : 00000000`00000050 fffffa80`c654bdc0 00000000`00000000 fffff880`06e35100 : nt!KeBugCheckEx fffff880`06e34fa0 00000000`00000050 : fffffa80`c654bdc0 00000000`00000000 fffff880`06e35100 00000000`00000005 : nt! ?? ::FNODOBFM::`string'+0x3de2b fffff880`06e34fa8 fffffa80`c654bdc0 : 00000000`00000000 fffff880`06e35100 00000000`00000005 0000b0eb`f284d58d : 0x50 fffff880`06e34fb0 00000000`00000000 : fffff880`06e35100 00000000`00000005 0000b0eb`f284d58d 00000000`00000000 : 0xfffffa80`c654bdc0 Link to comment Share on other sites More sharing options...
Recommended Posts