Ernimus Prime
Well-known member
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Ernie\Dump folder\120411-28282-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324f670
Debug session time: Sun Dec 4 01:19:13.906 2011 (UTC - 4:00)
System Uptime: 0 days 1:22:15.092
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fc400085f0, ffffffffc0000185, 10d971860, fffff880010be93c}
*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
Unable to load image ataport.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ataport.SYS
*** ERROR: Module load completed but symbols could not be loaded for ataport.SYS
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ataport.SYS ( ataport+1e93c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc400085f0, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 000000010d971860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff880010be93c, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: ataport
FAULTING_MODULE: fffff8000300a000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79293
ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c0000185
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030f7b52 to fffff80003086c40
STACK_TEXT:
fffff880`031a81c8 fffff800`030f7b52 : 00000000`0000007a fffff6fc`400085f0 ffffffff`c0000185 00000001`0d971860 : nt+0x7cc40
fffff880`031a81d0 00000000`0000007a : fffff6fc`400085f0 ffffffff`c0000185 00000001`0d971860 fffff880`010be93c : nt+0xedb52
fffff880`031a81d8 fffff6fc`400085f0 : ffffffff`c0000185 00000001`0d971860 fffff880`010be93c fffffa80`0b157bf0 : 0x7a
fffff880`031a81e0 ffffffff`c0000185 : 00000001`0d971860 fffff880`010be93c fffffa80`0b157bf0 00000000`c0000185 : 0xfffff6fc`400085f0
fffff880`031a81e8 00000001`0d971860 : fffff880`010be93c fffffa80`0b157bf0 00000000`c0000185 fffffa80`00000000 : 0xffffffff`c0000185
fffff880`031a81f0 fffff880`010be93c : fffffa80`0b157bf0 00000000`c0000185 fffffa80`00000000 fffff880`010be93c : 0x1`0d971860
fffff880`031a81f8 fffffa80`0b157bf0 : 00000000`c0000185 fffffa80`00000000 fffff880`010be93c fffff800`030aebc5 : ataport+0x1e93c
fffff880`031a8200 00000000`c0000185 : fffffa80`00000000 fffff880`010be93c fffff800`030aebc5 fffffa80`0b157cc0 : 0xfffffa80`0b157bf0
fffff880`031a8208 fffffa80`00000000 : fffff880`010be93c fffff800`030aebc5 fffffa80`0b157cc0 fffffa80`0b157cc0 : 0xc0000185
fffff880`031a8210 fffff880`010be93c : fffff800`030aebc5 fffffa80`0b157cc0 fffffa80`0b157cc0 fffffa80`06d2e680 : 0xfffffa80`00000000
fffff880`031a8218 fffff800`030aebc5 : fffffa80`0b157cc0 fffffa80`0b157cc0 fffffa80`06d2e680 fffffa80`0328c530 : ataport+0x1e93c
fffff880`031a8220 fffffa80`0b157cc0 : fffffa80`0b157cc0 fffffa80`06d2e680 fffffa80`0328c530 00000000`00002000 : nt+0xa4bc5
fffff880`031a8228 fffffa80`0b157cc0 : fffffa80`06d2e680 fffffa80`0328c530 00000000`00002000 fffff6fc`400085f0 : 0xfffffa80`0b157cc0
fffff880`031a8230 fffffa80`06d2e680 : fffffa80`0328c530 00000000`00002000 fffff6fc`400085f0 ffffffff`ffffffff : 0xfffffa80`0b157cc0
fffff880`031a8238 fffffa80`0328c530 : 00000000`00002000 fffff6fc`400085f0 ffffffff`ffffffff 00000000`00000000 : 0xfffffa80`06d2e680
fffff880`031a8240 00000000`00002000 : fffff6fc`400085f0 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : 0xfffffa80`0328c530
fffff880`031a8248 fffff6fc`400085f0 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 fffffa80`06d18820 : 0x2000
fffff880`031a8250 ffffffff`ffffffff : 00000000`00000000 00000000`00000000 fffffa80`06d18820 fffff800`032bc500 : 0xfffff6fc`400085f0
fffff880`031a8258 00000000`00000000 : 00000000`00000000 fffffa80`06d18820 fffff800`032bc500 fffffa80`0328c530 : 0xffffffff`ffffffff
STACK_COMMAND: kb
FOLLOWUP_IP:
ataport+1e93c
fffff880`010be93c ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: ataport+1e93c
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ataport.SYS
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
3: kd> lmvm ataport
start end module name
fffff880`010a0000 fffff880`010ca000 ataport T (no symbols)
Loaded symbol image file: ataport.SYS
Image path: ataport.SYS
Image name: ataport.SYS
Timestamp: Sat Nov 20 05:19:15 2010 (4CE79293)
CheckSum: 000287EF
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
3: kd> lmvm nt
start end module name
fffff800`0300a000 fffff800`035f3000 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Jun 22 23:53:23 2011 (4E02AAA3)
CheckSum: 0055C228
ImageSize: 005E9000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
I also completed a scan disk with these results:
CHKDSK is verifying files (stage 1 of 5)...
220160 file records processed.
File verification completed.
386 large file records processed.
0 bad file records processed.
2 EA records processed.
92 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
282154 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
220160 file SDs/SIDs processed.
Cleaning up 467 unused index entries from index $SII of file 0x9.
Cleaning up 467 unused index entries from index $SDH of file 0x9.
Cleaning up 467 unused security descriptors.
Security descriptor verification completed.
30998 data files processed.
CHKDSK is verifying Usn Journal...
33836832 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
220144 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
87908547 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
488282111 KB total disk space.
136212344 KB in 178386 files.
100584 KB in 30999 indexes.
0 KB in bad sectors.
334991 KB in use by the system.
65536 KB occupied by the log file.
351634192 KB available on disk.
4096 bytes in each allocation unit.
122070527 total allocation units on disk.
87908548 allocation units available on disk.
Internal Info:
00 5c 03 00 f4 31 03 00 24 5f 05 00 00 00 00 00 .\...1..$_......
de 72 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 .r..\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-12-05T01:19:23.000000000Z" />
<EventRecordID>4360</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer></Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
220160 file records processed.
File verification completed.
386 large file records processed.
0 bad file records processed.
2 EA records processed.
92 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
282154 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
220160 file SDs/SIDs processed.
Cleaning up 467 unused index entries from index $SII of file 0x9.
Cleaning up 467 unused index entries from index $SDH of file 0x9.
Cleaning up 467 unused security descriptors.
Security descriptor verification completed.
30998 data files processed.
CHKDSK is verifying Usn Journal...
33836832 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
220144 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
87908547 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
488282111 KB total disk space.
136212344 KB in 178386 files.
100584 KB in 30999 indexes.
0 KB in bad sectors.
334991 KB in use by the system.
65536 KB occupied by the log file.
351634192 KB available on disk.
4096 bytes in each allocation unit.
122070527 total allocation units on disk.
87908548 allocation units available on disk.
Internal Info:
00 5c 03 00 f4 31 03 00 24 5f 05 00 00 00 00 00 .\...1..$_......
de 72 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 .r..\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Thanks for the help!!!!
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Ernie\Dump folder\120411-28282-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324f670
Debug session time: Sun Dec 4 01:19:13.906 2011 (UTC - 4:00)
System Uptime: 0 days 1:22:15.092
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fc400085f0, ffffffffc0000185, 10d971860, fffff880010be93c}
*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
Unable to load image ataport.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ataport.SYS
*** ERROR: Module load completed but symbols could not be loaded for ataport.SYS
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ataport.SYS ( ataport+1e93c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc400085f0, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 000000010d971860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff880010be93c, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: ataport
FAULTING_MODULE: fffff8000300a000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79293
ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c0000185
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030f7b52 to fffff80003086c40
STACK_TEXT:
fffff880`031a81c8 fffff800`030f7b52 : 00000000`0000007a fffff6fc`400085f0 ffffffff`c0000185 00000001`0d971860 : nt+0x7cc40
fffff880`031a81d0 00000000`0000007a : fffff6fc`400085f0 ffffffff`c0000185 00000001`0d971860 fffff880`010be93c : nt+0xedb52
fffff880`031a81d8 fffff6fc`400085f0 : ffffffff`c0000185 00000001`0d971860 fffff880`010be93c fffffa80`0b157bf0 : 0x7a
fffff880`031a81e0 ffffffff`c0000185 : 00000001`0d971860 fffff880`010be93c fffffa80`0b157bf0 00000000`c0000185 : 0xfffff6fc`400085f0
fffff880`031a81e8 00000001`0d971860 : fffff880`010be93c fffffa80`0b157bf0 00000000`c0000185 fffffa80`00000000 : 0xffffffff`c0000185
fffff880`031a81f0 fffff880`010be93c : fffffa80`0b157bf0 00000000`c0000185 fffffa80`00000000 fffff880`010be93c : 0x1`0d971860
fffff880`031a81f8 fffffa80`0b157bf0 : 00000000`c0000185 fffffa80`00000000 fffff880`010be93c fffff800`030aebc5 : ataport+0x1e93c
fffff880`031a8200 00000000`c0000185 : fffffa80`00000000 fffff880`010be93c fffff800`030aebc5 fffffa80`0b157cc0 : 0xfffffa80`0b157bf0
fffff880`031a8208 fffffa80`00000000 : fffff880`010be93c fffff800`030aebc5 fffffa80`0b157cc0 fffffa80`0b157cc0 : 0xc0000185
fffff880`031a8210 fffff880`010be93c : fffff800`030aebc5 fffffa80`0b157cc0 fffffa80`0b157cc0 fffffa80`06d2e680 : 0xfffffa80`00000000
fffff880`031a8218 fffff800`030aebc5 : fffffa80`0b157cc0 fffffa80`0b157cc0 fffffa80`06d2e680 fffffa80`0328c530 : ataport+0x1e93c
fffff880`031a8220 fffffa80`0b157cc0 : fffffa80`0b157cc0 fffffa80`06d2e680 fffffa80`0328c530 00000000`00002000 : nt+0xa4bc5
fffff880`031a8228 fffffa80`0b157cc0 : fffffa80`06d2e680 fffffa80`0328c530 00000000`00002000 fffff6fc`400085f0 : 0xfffffa80`0b157cc0
fffff880`031a8230 fffffa80`06d2e680 : fffffa80`0328c530 00000000`00002000 fffff6fc`400085f0 ffffffff`ffffffff : 0xfffffa80`0b157cc0
fffff880`031a8238 fffffa80`0328c530 : 00000000`00002000 fffff6fc`400085f0 ffffffff`ffffffff 00000000`00000000 : 0xfffffa80`06d2e680
fffff880`031a8240 00000000`00002000 : fffff6fc`400085f0 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : 0xfffffa80`0328c530
fffff880`031a8248 fffff6fc`400085f0 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 fffffa80`06d18820 : 0x2000
fffff880`031a8250 ffffffff`ffffffff : 00000000`00000000 00000000`00000000 fffffa80`06d18820 fffff800`032bc500 : 0xfffff6fc`400085f0
fffff880`031a8258 00000000`00000000 : 00000000`00000000 fffffa80`06d18820 fffff800`032bc500 fffffa80`0328c530 : 0xffffffff`ffffffff
STACK_COMMAND: kb
FOLLOWUP_IP:
ataport+1e93c
fffff880`010be93c ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: ataport+1e93c
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ataport.SYS
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
3: kd> lmvm ataport
start end module name
fffff880`010a0000 fffff880`010ca000 ataport T (no symbols)
Loaded symbol image file: ataport.SYS
Image path: ataport.SYS
Image name: ataport.SYS
Timestamp: Sat Nov 20 05:19:15 2010 (4CE79293)
CheckSum: 000287EF
ImageSize: 0002A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
3: kd> lmvm nt
start end module name
fffff800`0300a000 fffff800`035f3000 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Jun 22 23:53:23 2011 (4E02AAA3)
CheckSum: 0055C228
ImageSize: 005E9000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
I also completed a scan disk with these results:
CHKDSK is verifying files (stage 1 of 5)...
220160 file records processed.
File verification completed.
386 large file records processed.
0 bad file records processed.
2 EA records processed.
92 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
282154 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
220160 file SDs/SIDs processed.
Cleaning up 467 unused index entries from index $SII of file 0x9.
Cleaning up 467 unused index entries from index $SDH of file 0x9.
Cleaning up 467 unused security descriptors.
Security descriptor verification completed.
30998 data files processed.
CHKDSK is verifying Usn Journal...
33836832 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
220144 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
87908547 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
488282111 KB total disk space.
136212344 KB in 178386 files.
100584 KB in 30999 indexes.
0 KB in bad sectors.
334991 KB in use by the system.
65536 KB occupied by the log file.
351634192 KB available on disk.
4096 bytes in each allocation unit.
122070527 total allocation units on disk.
87908548 allocation units available on disk.
Internal Info:
00 5c 03 00 f4 31 03 00 24 5f 05 00 00 00 00 00 .\...1..$_......
de 72 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 .r..\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-12-05T01:19:23.000000000Z" />
<EventRecordID>4360</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer></Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
220160 file records processed.
File verification completed.
386 large file records processed.
0 bad file records processed.
2 EA records processed.
92 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
282154 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
220160 file SDs/SIDs processed.
Cleaning up 467 unused index entries from index $SII of file 0x9.
Cleaning up 467 unused index entries from index $SDH of file 0x9.
Cleaning up 467 unused security descriptors.
Security descriptor verification completed.
30998 data files processed.
CHKDSK is verifying Usn Journal...
33836832 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
220144 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
87908547 free clusters processed.
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.
488282111 KB total disk space.
136212344 KB in 178386 files.
100584 KB in 30999 indexes.
0 KB in bad sectors.
334991 KB in use by the system.
65536 KB occupied by the log file.
351634192 KB available on disk.
4096 bytes in each allocation unit.
122070527 total allocation units on disk.
87908548 allocation units available on disk.
Internal Info:
00 5c 03 00 f4 31 03 00 24 5f 05 00 00 00 00 00 .\...1..$_......
de 72 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 .r..\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Thanks for the help!!!!
