We help IT Professionals succeed at work.

Minidump Crash Dump File Help!

alcoahd
alcoahd used Ask the Experts™
on

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\lalexander\My Documents\Mini072009-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jul 20 11:13:54.875 2009 (GMT-4)
System Uptime: 0 days 0:02:47.593
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8063741b, b56d096c, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : ntoskrnl.exe ( nt+16041b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8063741b, The address that the exception occurred at
Arg3: b56d096c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt+16041b
8063741b 8b4304          mov     eax,dword ptr [ebx+4]

TRAP_FRAME:  b56d096c -- (.trap 0xffffffffb56d096c)
ErrCode = 00000000
eax=00000a40 ebx=00000a40 ecx=8afee2a0 edx=00000043 esi=e1038008 edi=000006e8
eip=8063741b esp=b56d09e0 ebp=b56d0a28 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt+0x16041b:
8063741b 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00000a44=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

LAST_CONTROL_TRANSFER:  from 8062c74e to 8063741b

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
b56d0a28 8062c74e e1038008 086a46e8 dc12c664 nt+0x16041b
b56d0a44 8062cf16 e1038008 b56d0ad8 086a46e8 nt+0x15574e
b56d0a64 8062d246 e1038008 b56d0ad8 0000005a nt+0x155f16
b56d0a8c 8062d385 e1038008 00000058 b56d0ad8 nt+0x156246
b56d0ab4 8062de25 ffffffff dc12c394 00899b70 nt+0x156385
b56d0af4 80639874 01038008 0069e720 00899b70 nt+0x156e25
b56d0b2c 8063996b e1262000 00000400 00000002 nt+0x162874
b56d0b5c 8062606c e1038008 001b45a0 e1038008 nt+0x16296b
b56d0ccc 80621964 00010002 b56d0d64 b56d0ce8 nt+0x14f06c
b56d0cdc 8054162c 00000004 b56d0d64 8050047d nt+0x14a964
b56d0ce8 8050047d badb0d00 b56d0d60 000a001f nt+0x6a62c
b56d0d64 7c90e514 badb0d00 0007f874 b56d0d98 nt+0x2947d
b56d0d68 badb0d00 0007f874 b56d0d98 b56d0dcc 0x7c90e514
b56d0d6c 0007f874 b56d0d98 b56d0dcc 00000000 0xbadb0d00
b56d0d70 b56d0d98 b56d0dcc 00000000 00000000 0x7f874
b56d0d74 b56d0dcc 00000000 00000000 00000000 0xb56d0d98
b56d0d98 00000000 7c90e514 0007fcb0 00000000 0xb56d0dcc


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt+16041b
8063741b 8b4304          mov     eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+16041b

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2011
Top Expert 2011

Commented:
First of all, you need to yse the right symbols....
Paste this into Windbg
.sympath SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Make sure there is a folder called C:\Symbols
enter...
.reload
Then redo your !analyze -v

Commented:
You can also upgrade all non-MS drivers. It helps :)
But do not stop to find right cause using WinDBG. Configuring symbols is really useful.
*** Hopeleonie ***IT Manager

Commented:
can you post your mini.dmp? vhange the extension to .txt from .dmp

Author

Commented:
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8063741b, The address that the exception occurred at
Arg3: b56d096c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8063741b 8b4304          mov     eax,dword ptr [ebx+4]

TRAP_FRAME:  b56d096c -- (.trap 0xffffffffb56d096c)
ErrCode = 00000000
eax=00000a40 ebx=00000a40 ecx=8afee2a0 edx=00000043 esi=e1038008 edi=000006e8
eip=8063741b esp=b56d09e0 ebp=b56d0a28 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!HvpGetCellMapped+0x5f:
8063741b 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00000a44=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  services.exe

LAST_CONTROL_TRANSFER:  from 8062c74e to 8063741b

STACK_TEXT:  
b56d0a28 8062c74e e1038008 086a46e8 dc12c664 nt!HvpGetCellMapped+0x5f
b56d0a44 8062cf16 e1038008 b56d0ad8 086a46e8 nt!CmpDoCompareKeyName+0x12
b56d0a64 8062d246 e1038008 b56d0ad8 0000005a nt!CmpCompareInIndex+0xd0
b56d0a8c 8062d385 e1038008 00000058 b56d0ad8 nt!CmpFindSubKeyInLeaf+0x52
b56d0ab4 8062de25 ffffffff dc12c394 00899b70 nt!CmpAddToLeaf+0xdb
b56d0af4 80639874 01038008 0069e720 00899b70 nt!CmpAddSubKey+0x24d
b56d0b2c 8063996b e1262000 00000400 00000002 nt!CmpCopySyncTree2+0x270
b56d0b5c 8062606c e1038008 001b45a0 e1038008 nt!CmpCopySyncTree+0x4f
b56d0ccc 80621964 00010002 b56d0d64 b56d0ce8 nt!CmpSaveBootControlSet+0x2b0
b56d0cdc 8054162c 00000004 b56d0d64 8050047d nt!NtInitializeRegistry+0x5e
b56d0cdc 8050047d 00000004 b56d0d64 8050047d nt!KiFastCallEntry+0xfc
b56d0d58 8054162c 00000004 0007f8b0 7c90e514 nt!ZwInitializeRegistry+0x11
b56d0d58 7c90e514 00000004 0007f8b0 7c90e514 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f8b0 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8063741b 8b4304          mov     eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!HvpGetCellMapped+5f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

Author

Commented:
Here is the dump file
Mini072009-05.txt

Commented:
Run system app "verifier.exe", select standard settings and from names list - select all non-MS drivers. Then reboot.
This will not prevent crash but gives us more accurate info about true cause.
*** Hopeleonie ***IT Manager

Commented:
all drivers up to date?
all hotfixes and service packs installed?
if no = do it please
if yes:
Can you test your harddisc ram and cpu for errors with: http://www.ultimatebootcd.com/ ?
Memory Tests with: Memtest86
CPU Tests with: CPU Burn-in, Mersenne Prime Test & StressCPU
Hard Disk Diagnostic with: your Hard Disk Manufacturers tool. (Drive Fitness Test (IBM/Hitachi) works with most)
If evrything passes, I would try removing all of your component down to just the cpu, ram & hd  and see if that helps.

Commented:
As I write before it's probably poorly written driver. Did you change drivers / installed new hardware or antivirus last days? If so - you may search within this area.
If not - try to upgrade everything you can and if this not helps - play with verifier.exe

Author

Commented:
The other issue is that, when you try to login to this machine, with any userID. That is when the machine Blue Screens.

Will verifier.exe run in safe mode or are there other methods for this application to run?

Commented:
Yes will run in safe mode.
If you suffer BSODs during logon, try to press and hold Shift key during logon in normal mode. This makes some apps are not starting and probably you not start app causing your crashes.
Hi -
The bugcheck on the BSOD -
0x8e (0xc0000005,,,), the probable cause = NT
The verifier is a great idea - I would have requested the same since the dump is only giving us the NT kernel on the stack text ( !nt ).  I would suggest some guidelines when running the Driver Verifier - http://www.techsupportforum.com/1871981-post2.html
The bugcheck 0x8e = kernel mode app threw an exception, which is 0xc0000005 =  memory access violation.  
The dump may have actually spoken indirectly by providing that exception code.  You will be the ultimate judge here.  I would look at your Trend Micro firewall before running the driver verifier as I think it will BSOD your system immediately.  Two of the Trend Micro drivers found in the dump - one old and one very new.  If you have been running Trend Micro for a while, it is likely that the 1st driver below was literally just updated based on its 5-21-09 last modified date.

TmPreFlt.sys     Thu May 21 09:59:20 2009 (4A158868)
timntr.sys         Thu Oct 11 00:25:49 2007 (470DCFFD)
The 0xc...5 exception is usually cause by either a personal firewall or an existing bad driver  bad b/c it is now too old or too new and does not mix well with the existing/ updated drivers in the kernel.
The dbug log is below in the code box.
Regards. . .
jcgriff2
 
 

BUGCHECK    0x8e  w/ 0xc00000005 exception
jcgriff2   07-20-2009
 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [D:\!_Kernel_Dumps\EE_\Mini072009-05.txt.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jul 20 08:13:54.875 2009 (GMT-7)
System Uptime: 0 days 0:02:47.593
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 1000008E, {c0000005, 8063741b, b56d096c, 0}
 
Probably caused by : ntkrpamp.exe ( nt!HvpGetCellMapped+5f )
 
Followup: MachineOwner
---------
 
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8063741b, The address that the exception occurred at
Arg3: b56d096c, Trap Frame
Arg4: 00000000
 
Debugging Details:
------------------
 
 
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
 
FAULTING_IP: 
nt!HvpGetCellMapped+5f
8063741b 8b4304          mov     eax,dword ptr [ebx+4]
 
TRAP_FRAME:  b56d096c -- (.trap 0xffffffffb56d096c)
ErrCode = 00000000
eax=00000a40 ebx=00000a40 ecx=8afee2a0 edx=00000043 esi=e1038008 edi=000006e8
eip=8063741b esp=b56d09e0 ebp=b56d0a28 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!HvpGetCellMapped+0x5f:
8063741b 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00000a44=????????
Resetting default scope
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
BUGCHECK_STR:  0x8E
 
PROCESS_NAME:  services.exe
 
LAST_CONTROL_TRANSFER:  from 8062c74e to 8063741b
 
STACK_TEXT:  
b56d0a28 8062c74e e1038008 086a46e8 dc12c664 nt!HvpGetCellMapped+0x5f
b56d0a44 8062cf16 e1038008 b56d0ad8 086a46e8 nt!CmpDoCompareKeyName+0x12
b56d0a64 8062d246 e1038008 b56d0ad8 0000005a nt!CmpCompareInIndex+0xd0
b56d0a8c 8062d385 e1038008 00000058 b56d0ad8 nt!CmpFindSubKeyInLeaf+0x52
b56d0ab4 8062de25 ffffffff dc12c394 00899b70 nt!CmpAddToLeaf+0xdb
b56d0af4 80639874 01038008 0069e720 00899b70 nt!CmpAddSubKey+0x24d
b56d0b2c 8063996b e1262000 00000400 00000002 nt!CmpCopySyncTree2+0x270
b56d0b5c 8062606c e1038008 001b45a0 e1038008 nt!CmpCopySyncTree+0x4f
b56d0ccc 80621964 00010002 b56d0d64 b56d0ce8 nt!CmpSaveBootControlSet+0x2b0
b56d0cdc 8054162c 00000004 b56d0d64 8050047d nt!NtInitializeRegistry+0x5e
b56d0cdc 8050047d 00000004 b56d0d64 8050047d nt!KiFastCallEntry+0xfc
b56d0d58 8054162c 00000004 0007f8b0 7c90e514 nt!ZwInitializeRegistry+0x11
b56d0d58 7c90e514 00000004 0007f8b0 7c90e514 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f8b0 00000000 00000000 00000000 00000000 0x7c90e514
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
nt!HvpGetCellMapped+5f
8063741b 8b4304          mov     eax,dword ptr [ebx+4]
 
SYMBOL_STACK_INDEX:  0
 
SYMBOL_NAME:  nt!HvpGetCellMapped+5f
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: nt
 
IMAGE_NAME:  ntkrpamp.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3
 
FAILURE_BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f
 
BUCKET_ID:  0x8E_nt!HvpGetCellMapped+5f
 
Followup: MachineOwner
---------
 
1: kd> lmvm nt
start    end        module name
804d7000 806e4000   nt       # (pdb symbols)          c:\symbols\ntkrpamp.pdb\909FE6B806E4444B9230BAAF21EC5C271\ntkrpamp.pdb
    Loaded symbol image file: ntkrpamp.exe
    Mapped memory image file: c:\symbols\ntkrpamp.exe\498C11D320d000\ntkrpamp.exe
    Image path: ntkrpamp.exe
    Image name: ntkrpamp.exe
    Timestamp:        Fri Feb 06 02:32:51 2009 (498C11D3)
    CheckSum:         001F9D43
    ImageSize:        0020D000
    File version:     5.1.2600.5755
    Product version:  5.1.2600.5755
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0405.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Opera
ní systém Microsoft® Windows®
    InternalName:     ntkrpamp.exe
    OriginalFilename: ntkrpamp.exe
    ProductVersion:   5.1.2600.5755
    FileVersion:      5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. Vaechna práva vyhrazena.
1: kd> kv
ChildEBP RetAddr  Args to Child              
b56d0a28 8062c74e e1038008 086a46e8 dc12c664 nt!HvpGetCellMapped+0x5f (FPO: [Non-Fpo])
b56d0a44 8062cf16 e1038008 b56d0ad8 086a46e8 nt!CmpDoCompareKeyName+0x12 (FPO: [3,2,4])
b56d0a64 8062d246 e1038008 b56d0ad8 0000005a nt!CmpCompareInIndex+0xd0 (FPO: [5,0,4])
b56d0a8c 8062d385 e1038008 00000058 b56d0ad8 nt!CmpFindSubKeyInLeaf+0x52 (FPO: [4,0,4])
b56d0ab4 8062de25 ffffffff dc12c394 00899b70 nt!CmpAddToLeaf+0xdb (FPO: [4,1,4])
b56d0af4 80639874 01038008 0069e720 00899b70 nt!CmpAddSubKey+0x24d (FPO: [3,7,0])
b56d0b2c 8063996b e1262000 00000400 00000002 nt!CmpCopySyncTree2+0x270 (FPO: [7,6,0])
b56d0b5c 8062606c e1038008 001b45a0 e1038008 nt!CmpCopySyncTree+0x4f (FPO: [6,0,0])
b56d0ccc 80621964 00010002 b56d0d64 b56d0ce8 nt!CmpSaveBootControlSet+0x2b0 (FPO: [1,81,4])
b56d0cdc 8054162c 00000004 b56d0d64 8050047d nt!NtInitializeRegistry+0x5e (FPO: [1,0,4])
b56d0cdc 8050047d 00000004 b56d0d64 8050047d nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b56d0ce8)
b56d0d58 8054162c 00000004 0007f8b0 7c90e514 nt!ZwInitializeRegistry+0x11 (FPO: [1,0,0])
b56d0d58 7c90e514 00000004 0007f8b0 7c90e514 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b56d0d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f8b0 00000000 00000000 00000000 00000000 0x7c90e514
1: kd> r
eax=00000a40 ebx=00000a40 ecx=8afee2a0 edx=00000043 esi=e1038008 edi=000006e8
eip=8063741b esp=b56d09e0 ebp=b56d0a28 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!HvpGetCellMapped+0x5f:
8063741b 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00000a44=????????
1: kd> lmn
start    end        module name
804d7000 806e4000   nt       ntkrpamp.exe
806e4000 80704d00   hal      halmacpi.dll
b554e000 b5570100   RDPWD    RDPWD.SYS   
b58e1000 b5921a80   HTTP     HTTP.sys    
b5b16000 b5b19580   KAPFA    KAPFA.SYS   
b5c92000 b5e51180   tm_cfw   tm_cfw.sys  
b5ea2000 b5ec2280   tmcomm   tmcomm.sys  
b6233000 b6284880   srv      srv.sys     
b6465000 b6491180   mrxdav   mrxdav.sys  
b669a000 b66e2000   TmXPFlt  TmXPFlt.sys 
b670a000 b68323c0   VSApiNt  VSApiNt.sys 
b683b000 b683e900   ndisuio  ndisuio.sys 
b6b73000 b6b8a900   dump_atapi dump_atapi.sys
b6c6b000 b6c74340   tifsfilt tifsfilt.sys
b6c7b000 b6cea280   mrxsmb   mrxsmb.sys  
b6ceb000 b6d15e80   rdbss    rdbss.sys   
b6d16000 b6d48e80   truecrypt truecrypt.sys
b6d49000 b6d6ad00   afd      afd.sys     
b6d6b000 b6d90500   ipnat    ipnat.sys   
b6dad000 b6daf900   Dxapi    Dxapi.sys   
b6db9000 b6de0c00   netbt    netbt.sys   
b6de1000 b6e39480   tcpip    tcpip.sys   
b6e3a000 b6e4c600   ipsec    ipsec.sys   
b6ea5000 b6ea8b00   usbscan  usbscan.sys 
b6eb1000 b6eb3f80   mouhid   mouhid.sys  
b6eb5000 b6eb7880   hidusb   hidusb.sys  
b6ebd000 b6ee0a80   portcls  portcls.sys 
b6ee1000 b7389000   RtkHDAud RtkHDAud.sys
b94b1000 b950ef00   update   update.sys  
b95f9000 b9628e80   rdpdr    rdpdr.sys   
b9629000 b9639e00   psched   psched.sys  
b963a000 b9650580   ndiswan  ndiswan.sys 
b9651000 b9673700   ks       ks.sys      
b9674000 b9687900   parport  parport.sys 
b9688000 b96a4980   Rtnicxp  Rtnicxp.sys 
b96a5000 b96c8200   USBPORT  USBPORT.SYS 
b96c9000 b96f1000   HDAudBus HDAudBus.sys
b96f1000 b9704f00   VIDEOPRT VIDEOPRT.SYS
b9705000 b9cebd20   nv4_mini nv4_mini.sys
ba524000 ba527c80   mssmbios mssmbios.sys
ba540000 ba542780   ndistapi ndistapi.sys
ba564000 ba57db80   Mup      Mup.sys     
ba57e000 ba59cca0   snapman  snapman.sys 
ba59d000 ba607380   timntr   timntr.sys  
ba608000 ba634980   NDIS     NDIS.sys    
ba635000 ba6c1600   Ntfs     Ntfs.sys    
ba6c2000 ba6d8880   KSecDD   KSecDD.sys  
ba6d9000 ba6eaf00   sr       sr.sys      
ba6eb000 ba70ab00   fltmgr   fltmgr.sys  
ba70b000 ba722900   atapi    atapi.sys   
ba723000 ba748700   dmio     dmio.sys    
ba749000 ba767880   ftdisk   ftdisk.sys  
ba768000 ba778a80   pci      pci.sys     
ba779000 ba7a6d80   ACPI     ACPI.sys    
ba8a8000 ba8b1180   isapnp   isapnp.sys  
ba8b8000 ba8c2580   MountMgr MountMgr.sys
ba8c8000 ba8d4c80   VolSnap  VolSnap.sys 
ba8d8000 ba8e0e00   disk     disk.sys    
ba8e8000 ba8f4180   CLASSPNP CLASSPNP.SYS
ba948000 ba950780   netbios  netbios.sys 
ba958000 ba960700   wanarp   wanarp.sys  
ba968000 ba972e00   Fips     Fips.SYS    
ba978000 ba985000   TmPreFlt TmPreFlt.sys
ba988000 ba997900   Cdfs     Cdfs.SYS    
ba998000 ba9a1000   HIDCLASS HIDCLASS.SYS
baa28000 baa30e00   intelppm intelppm.sys
baa38000 baa44d00   i8042prt i8042prt.sys
baa48000 baa57c00   serial   serial.sys  
baa58000 baa62480   imapi    imapi.sys   
baa68000 baa77600   cdrom    cdrom.sys   
baa78000 baa86100   redbook  redbook.sys 
baa88000 baa92000   GEARAspiWDM GEARAspiWDM.sys
baa98000 baaa4880   rasl2tp  rasl2tp.sys 
baaa8000 baab2200   raspppoe raspppoe.sys
baab8000 baac3d00   raspptp  raspptp.sys 
baac8000 baad0900   msgpc    msgpc.sys   
baad8000 baae1f00   termdd   termdd.sys  
baae8000 baaf1e80   NDProxy  NDProxy.SYS 
bab08000 bab16b00   drmk     drmk.sys    
bab18000 bab26880   usbhub   usbhub.sys  
bab28000 bab2e180   PCIIDEX  PCIIDEX.SYS 
bab30000 bab34d00   PartMgr  PartMgr.sys 
babb0000 babb5500   TDTCP    TDTCP.SYS   
babc0000 babc5080   usbuhci  usbuhci.sys 
babc8000 babcf600   usbehci  usbehci.sys 
babd0000 babd4300   usbohci  usbohci.sys 
babd8000 babd9000   fdc      fdc.sys     
babe0000 babe6000   kbdclass kbdclass.sys
babe8000 babeca80   TDI      TDI.SYS     
babf0000 babf4580   ptilink  ptilink.sys 
babf8000 babfc080   raspti   raspti.sys  
bac00000 bac05a00   mouclass mouclass.sys
bac08000 bac0d000   flpydisk flpydisk.sys
bac18000 bac1e180   HIDPARSE HIDPARSE.SYS
bac20000 bac25200   vga      vga.sys     
bac28000 bac2ca80   Msfs     Msfs.SYS    
bac30000 bac37880   Npfs     Npfs.SYS    
bac38000 bac3cf80   HidBatt  HidBatt.sys 
bac40000 bac46700   USBSTOR  USBSTOR.SYS 
bac48000 bac4fd80   usbccgp  usbccgp.sys 
bac50000 bac56500   usbprint usbprint.sys
bac58000 bac5c500   watchdog watchdog.sys
bac78000 bac7c7e0   BrPar    BrPar.sys   
bacb8000 bacbb000   BOOTVID  BOOTVID.dll 
bacbc000 bacbe800   compbatt compbatt.sys
bacc0000 bacc3780   BATTC    BATTC.SYS   
bad98000 bad9a280   rasacd   rasacd.sys  
bada0000 bada3d80   serenum  serenum.sys 
bada8000 bada9b80   kdcom    kdcom.dll   
badaa000 badab100   WMILIB   WMILIB.SYS  
badac000 badad700   dmload   dmload.sys  
badbe000 badbf100   swenum   swenum.sys  
badc4000 badc5280   USBD     USBD.SYS    
badc6000 badc7f00   Fs_Rec   Fs_Rec.SYS  
badc8000 badc9080   Beep     Beep.SYS    
badca000 badcb080   mnmdd    mnmdd.SYS   
badcc000 badcd080   RDPCDD   RDPCDD.sys  
badce000 badcf100   dump_WMILIB dump_WMILIB.SYS
badfe000 badffa80   ParVdm   ParVdm.SYS  
bae70000 bae70d00   pciide   pciide.sys  
baf06000 baf06b80   Null     Null.SYS    
bafba000 bafbad00   dxgthk   dxgthk.sys  
bafc3000 bafc3c00   audstub  audstub.sys 
bf800000 bf9c2f80   win32k   win32k.sys  
bf9c3000 bf9d4600   dxg      dxg.sys     
bf9d5000 bffb2300   nv4_disp nv4_disp.dll
bffb3000 bfff8c00   ATMFD    ATMFD.DLL   
 
Unloaded modules:
b5859000 b5867000   TSUSB2.sys
bad94000 bad98000   kbdhid.sys
bac10000 bac15000   Cdaudio.SYS
bad90000 bad93000   Sfloppy.SYS
1: kd> lmnt
start    end        module name
804d7000 806e4000   nt       ntkrpamp.exe Fri Feb 06 02:32:51 2009 (498C11D3)
806e4000 80704d00   hal      halmacpi.dll Sun Apr 13 11:31:27 2008 (4802517F)
b554e000 b5570100   RDPWD    RDPWD.SYS    Sun Apr 13 11:38:40 2008 (48025330)
b58e1000 b5921a80   HTTP     HTTP.sys     Sun Apr 13 11:53:48 2008 (480256BC)
b5b16000 b5b19580   KAPFA    KAPFA.SYS    Fri Mar 21 12:23:51 2008 (47E40B47)
b5c92000 b5e51180   tm_cfw   tm_cfw.sys   Wed Feb 28 01:07:39 2007 (45E5465B)
b5ea2000 b5ec2280   tmcomm   tmcomm.sys   Mon Dec 24 01:36:35 2007 (476F7DA3)
b6233000 b6284880   srv      srv.sys      Thu Dec 11 02:57:07 2008 (4940F203)
b6465000 b6491180   mrxdav   mrxdav.sys   Sun Apr 13 11:32:42 2008 (480251CA)
b669a000 b66e2000   TmXPFlt  TmXPFlt.sys  Thu May 21 09:59:20 2009 (4A158868)
b670a000 b68323c0   VSApiNt  VSApiNt.sys  Thu May 21 09:40:25 2009 (4A1583F9)
b683b000 b683e900   ndisuio  ndisuio.sys  Sun Apr 13 11:55:57 2008 (4802573D)
b6b73000 b6b8a900   dump_atapi dump_atapi.sys Sun Apr 13 11:40:29 2008 (4802539D)
b6c6b000 b6c74340   tifsfilt tifsfilt.sys Thu Oct 11 00:24:22 2007 (470DCFA6)
b6c7b000 b6cea280   mrxsmb   mrxsmb.sys   Fri Oct 24 04:21:07 2008 (4901AFA3)
b6ceb000 b6d15e80   rdbss    rdbss.sys    Sun Apr 13 12:28:38 2008 (48025EE6)
b6d16000 b6d48e80   truecrypt truecrypt.sys Mon Dec 01 09:08:55 2008 (49341A27)
b6d49000 b6d6ad00   afd      afd.sys      Thu Aug 14 03:04:35 2008 (48A40333)
b6d6b000 b6d90500   ipnat    ipnat.sys    Sun Apr 13 11:57:10 2008 (48025786)
b6dad000 b6daf900   Dxapi    Dxapi.sys    Fri Aug 17 13:53:19 2001 (3B7D843F)
b6db9000 b6de0c00   netbt    netbt.sys    Sun Apr 13 12:20:59 2008 (48025D1B)
b6de1000 b6e39480   tcpip    tcpip.sys    Fri Jun 20 04:51:09 2008 (485B99AD)
b6e3a000 b6e4c600   ipsec    ipsec.sys    Sun Apr 13 12:19:42 2008 (48025CCE)
b6ea5000 b6ea8b00   usbscan  usbscan.sys  Sun Apr 13 11:45:34 2008 (480254CE)
b6eb1000 b6eb3f80   mouhid   mouhid.sys   Fri Aug 17 13:47:57 2001 (3B7D82FD)
b6eb5000 b6eb7880   hidusb   hidusb.sys   Sun Apr 13 11:45:27 2008 (480254C7)
b6ebd000 b6ee0a80   portcls  portcls.sys  Sun Apr 13 12:19:40 2008 (48025CCC)
b6ee1000 b7389000   RtkHDAud RtkHDAud.sys Wed Mar 26 03:37:09 2008 (47EA2755)
b94b1000 b950ef00   update   update.sys   Sun Apr 13 11:39:46 2008 (48025372)
b95f9000 b9628e80   rdpdr    rdpdr.sys    Sun Apr 13 11:32:50 2008 (480251D2)
b9629000 b9639e00   psched   psched.sys   Sun Apr 13 11:56:36 2008 (48025764)
b963a000 b9650580   ndiswan  ndiswan.sys  Sun Apr 13 12:20:41 2008 (48025D09)
b9651000 b9673700   ks       ks.sys       Sun Apr 13 12:16:34 2008 (48025C12)
b9674000 b9687900   parport  parport.sys  Sun Apr 13 11:40:09 2008 (48025389)
b9688000 b96a4980   Rtnicxp  Rtnicxp.sys  Wed Oct 29 23:10:49 2008 (49094FE9)
b96a5000 b96c8200   USBPORT  USBPORT.SYS  Sun Apr 13 11:45:34 2008 (480254CE)
b96c9000 b96f1000   HDAudBus HDAudBus.sys Thu May 26 08:46:29 2005 (4295EF55)
b96f1000 b9704f00   VIDEOPRT VIDEOPRT.SYS Sun Apr 13 11:44:39 2008 (48025497)
b9705000 b9cebd20   nv4_mini nv4_mini.sys Wed Nov 12 15:43:50 2008 (491B6A36)
ba524000 ba527c80   mssmbios mssmbios.sys Sun Apr 13 11:36:45 2008 (480252BD)
ba540000 ba542780   ndistapi ndistapi.sys Sun Apr 13 11:57:27 2008 (48025797)
ba564000 ba57db80   Mup      Mup.sys      Sun Apr 13 12:17:05 2008 (48025C31)
ba57e000 ba59cca0   snapman  snapman.sys  Tue Apr 01 13:16:21 2008 (47F29815)
ba59d000 ba607380   timntr   timntr.sys   Thu Oct 11 00:25:49 2007 (470DCFFD)
ba608000 ba634980   NDIS     NDIS.sys     Sun Apr 13 12:20:35 2008 (48025D03)
ba635000 ba6c1600   Ntfs     Ntfs.sys     Sun Apr 13 12:15:49 2008 (48025BE5)
ba6c2000 ba6d8880   KSecDD   KSecDD.sys   Sun Apr 13 11:31:40 2008 (4802518C)
ba6d9000 ba6eaf00   sr       sr.sys       Sun Apr 13 11:36:50 2008 (480252C2)
ba6eb000 ba70ab00   fltmgr   fltmgr.sys   Sun Apr 13 11:32:58 2008 (480251DA)
ba70b000 ba722900   atapi    atapi.sys    Sun Apr 13 11:40:29 2008 (4802539D)
ba723000 ba748700   dmio     dmio.sys     Sun Apr 13 11:44:45 2008 (4802549D)
ba749000 ba767880   ftdisk   ftdisk.sys   Fri Aug 17 13:52:41 2001 (3B7D8419)
ba768000 ba778a80   pci      pci.sys      Sun Apr 13 11:36:43 2008 (480252BB)
ba779000 ba7a6d80   ACPI     ACPI.sys     Sun Apr 13 11:36:33 2008 (480252B1)
ba8a8000 ba8b1180   isapnp   isapnp.sys   Sun Apr 13 11:36:40 2008 (480252B8)
ba8b8000 ba8c2580   MountMgr MountMgr.sys Sun Apr 13 11:39:45 2008 (48025371)
ba8c8000 ba8d4c80   VolSnap  VolSnap.sys  Sun Apr 13 11:41:00 2008 (480253BC)
ba8d8000 ba8e0e00   disk     disk.sys     Sun Apr 13 11:40:46 2008 (480253AE)
ba8e8000 ba8f4180   CLASSPNP CLASSPNP.SYS Sun Apr 13 12:16:21 2008 (48025C05)
ba948000 ba950780   netbios  netbios.sys  Sun Apr 13 11:56:01 2008 (48025741)
ba958000 ba960700   wanarp   wanarp.sys   Sun Apr 13 11:57:20 2008 (48025790)
ba968000 ba972e00   Fips     Fips.SYS     Sun Apr 13 11:33:27 2008 (480251F7)
ba978000 ba985000   TmPreFlt TmPreFlt.sys Thu May 21 09:59:20 2009 (4A158868)
ba988000 ba997900   Cdfs     Cdfs.SYS     Sun Apr 13 12:14:21 2008 (48025B8D)
ba998000 ba9a1000   HIDCLASS HIDCLASS.SYS Sun Apr 13 11:45:25 2008 (480254C5)
baa28000 baa30e00   intelppm intelppm.sys Sun Apr 13 11:31:31 2008 (48025183)
baa38000 baa44d00   i8042prt i8042prt.sys Sun Apr 13 12:17:59 2008 (48025C67)
baa48000 baa57c00   serial   serial.sys   Sun Apr 13 12:15:44 2008 (48025BE0)
baa58000 baa62480   imapi    imapi.sys    Sun Apr 13 11:40:57 2008 (480253B9)
baa68000 baa77600   cdrom    cdrom.sys    Sun Apr 13 11:40:45 2008 (480253AD)
baa78000 baa86100   redbook  redbook.sys  Sun Apr 13 11:40:27 2008 (4802539B)
baa88000 baa92000   GEARAspiWDM GEARAspiWDM.sys Thu Mar 19 08:32:37 2009 (49C26595)
baa98000 baaa4880   rasl2tp  rasl2tp.sys  Sun Apr 13 12:19:43 2008 (48025CCF)
baaa8000 baab2200   raspppoe raspppoe.sys Sun Apr 13 11:57:31 2008 (4802579B)
baab8000 baac3d00   raspptp  raspptp.sys  Sun Apr 13 12:19:47 2008 (48025CD3)
baac8000 baad0900   msgpc    msgpc.sys    Sun Apr 13 11:56:32 2008 (48025760)
baad8000 baae1f00   termdd   termdd.sys   Sun Apr 13 11:38:36 2008 (4802532C)
baae8000 baaf1e80   NDProxy  NDProxy.SYS  Sun Apr 13 11:57:28 2008 (48025798)
bab08000 bab16b00   drmk     drmk.sys     Sun Apr 13 11:45:12 2008 (480254B8)
bab18000 bab26880   usbhub   usbhub.sys   Sun Apr 13 11:45:36 2008 (480254D0)
bab28000 bab2e180   PCIIDEX  PCIIDEX.SYS  Sun Apr 13 11:40:29 2008 (4802539D)
bab30000 bab34d00   PartMgr  PartMgr.sys  Sun Apr 13 11:40:48 2008 (480253B0)
babb0000 babb5500   TDTCP    TDTCP.SYS    Sun Apr 13 11:38:35 2008 (4802532B)
babc0000 babc5080   usbuhci  usbuhci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
babc8000 babcf600   usbehci  usbehci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
babd0000 babd4300   usbohci  usbohci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
babd8000 babd9000   fdc      fdc.sys      unavailable (00000000)
babe0000 babe6000   kbdclass kbdclass.sys Sun Apr 13 11:39:46 2008 (48025372)
babe8000 babeca80   TDI      TDI.SYS      Sun Apr 13 12:00:04 2008 (48025834)
babf0000 babf4580   ptilink  ptilink.sys  Fri Aug 17 13:49:53 2001 (3B7D8371)
babf8000 babfc080   raspti   raspti.sys   Fri Aug 17 13:55:32 2001 (3B7D84C4)
bac00000 bac05a00   mouclass mouclass.sys Sun Apr 13 11:39:47 2008 (48025373)
bac08000 bac0d000   flpydisk flpydisk.sys Sun Apr 13 11:40:24 2008 (48025398)
bac18000 bac1e180   HIDPARSE HIDPARSE.SYS Sun Apr 13 11:45:22 2008 (480254C2)
bac20000 bac25200   vga      vga.sys      Sun Apr 13 11:44:40 2008 (48025498)
bac28000 bac2ca80   Msfs     Msfs.SYS     Sun Apr 13 11:32:38 2008 (480251C6)
bac30000 bac37880   Npfs     Npfs.SYS     Sun Apr 13 11:32:38 2008 (480251C6)
bac38000 bac3cf80   HidBatt  HidBatt.sys  Sun Apr 13 11:36:37 2008 (480252B5)
bac40000 bac46700   USBSTOR  USBSTOR.SYS  Sun Apr 13 11:45:37 2008 (480254D1)
bac48000 bac4fd80   usbccgp  usbccgp.sys  Sun Apr 13 11:45:38 2008 (480254D2)
bac50000 bac56500   usbprint usbprint.sys Sun Apr 13 11:47:37 2008 (48025549)
bac58000 bac5c500   watchdog watchdog.sys Sun Apr 13 11:44:59 2008 (480254AB)
bac78000 bac7c7e0   BrPar    BrPar.sys    Mon Jul 24 11:18:46 2000 (397C8886)
bacb8000 bacbb000   BOOTVID  BOOTVID.dll  Fri Aug 17 13:49:09 2001 (3B7D8345)
bacbc000 bacbe800   compbatt compbatt.sys Sun Apr 13 11:36:36 2008 (480252B4)
bacc0000 bacc3780   BATTC    BATTC.SYS    Sun Apr 13 11:36:32 2008 (480252B0)
bad98000 bad9a280   rasacd   rasacd.sys   Fri Aug 17 13:55:39 2001 (3B7D84CB)
bada0000 bada3d80   serenum  serenum.sys  Sun Apr 13 11:40:12 2008 (4802538C)
bada8000 bada9b80   kdcom    kdcom.dll    Fri Aug 17 13:49:10 2001 (3B7D8346)
badaa000 badab100   WMILIB   WMILIB.SYS   Fri Aug 17 14:07:23 2001 (3B7D878B)
badac000 badad700   dmload   dmload.sys   Fri Aug 17 13:58:15 2001 (3B7D8567)
badbe000 badbf100   swenum   swenum.sys   Sun Apr 13 11:39:52 2008 (48025378)
badc4000 badc5280   USBD     USBD.SYS     Fri Aug 17 14:02:58 2001 (3B7D8682)
badc6000 badc7f00   Fs_Rec   Fs_Rec.SYS   Fri Aug 17 13:49:37 2001 (3B7D8361)
badc8000 badc9080   Beep     Beep.SYS     Fri Aug 17 13:47:33 2001 (3B7D82E5)
badca000 badcb080   mnmdd    mnmdd.SYS    Fri Aug 17 13:57:28 2001 (3B7D8538)
badcc000 badcd080   RDPCDD   RDPCDD.sys   Fri Aug 17 13:46:56 2001 (3B7D82C0)
badce000 badcf100   dump_WMILIB dump_WMILIB.SYS Fri Aug 17 14:07:23 2001 (3B7D878B)
badfe000 badffa80   ParVdm   ParVdm.SYS   Fri Aug 17 13:49:49 2001 (3B7D836D)
bae70000 bae70d00   pciide   pciide.sys   Fri Aug 17 13:51:49 2001 (3B7D83E5)
baf06000 baf06b80   Null     Null.SYS     Fri Aug 17 13:47:39 2001 (3B7D82EB)
bafba000 bafbad00   dxgthk   dxgthk.sys   Fri Aug 17 13:53:12 2001 (3B7D8438)
bafc3000 bafc3c00   audstub  audstub.sys  Fri Aug 17 13:59:40 2001 (3B7D85BC)
bf800000 bf9c2f80   win32k   win32k.sys   Fri Apr 17 05:26:26 2009 (49E87572)
bf9c3000 bf9d4600   dxg      dxg.sys      Sun Apr 13 11:38:27 2008 (48025323)
bf9d5000 bffb2300   nv4_disp nv4_disp.dll Wed Nov 12 15:38:39 2008 (491B68FF)
bffb3000 bfff8c00   ATMFD    ATMFD.DLL    Sun Apr 13 17:09:55 2008 (4802A0D3)
 
Unloaded modules:
b5859000 b5867000   TSUSB2.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bad94000 bad98000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bac10000 bac15000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bad90000 bad93000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
1: kd> lmnsmt
start    end        module name
ba779000 ba7a6d80   ACPI     ACPI.sys     Sun Apr 13 11:36:33 2008 (480252B1)
b6d49000 b6d6ad00   afd      afd.sys      Thu Aug 14 03:04:35 2008 (48A40333)
ba70b000 ba722900   atapi    atapi.sys    Sun Apr 13 11:40:29 2008 (4802539D)
bffb3000 bfff8c00   ATMFD    ATMFD.DLL    Sun Apr 13 17:09:55 2008 (4802A0D3)
bafc3000 bafc3c00   audstub  audstub.sys  Fri Aug 17 13:59:40 2001 (3B7D85BC)
bacc0000 bacc3780   BATTC    BATTC.SYS    Sun Apr 13 11:36:32 2008 (480252B0)
badc8000 badc9080   Beep     Beep.SYS     Fri Aug 17 13:47:33 2001 (3B7D82E5)
bacb8000 bacbb000   BOOTVID  BOOTVID.dll  Fri Aug 17 13:49:09 2001 (3B7D8345)
bac78000 bac7c7e0   BrPar    BrPar.sys    Mon Jul 24 11:18:46 2000 (397C8886)
ba988000 ba997900   Cdfs     Cdfs.SYS     Sun Apr 13 12:14:21 2008 (48025B8D)
baa68000 baa77600   cdrom    cdrom.sys    Sun Apr 13 11:40:45 2008 (480253AD)
ba8e8000 ba8f4180   CLASSPNP CLASSPNP.SYS Sun Apr 13 12:16:21 2008 (48025C05)
bacbc000 bacbe800   compbatt compbatt.sys Sun Apr 13 11:36:36 2008 (480252B4)
ba8d8000 ba8e0e00   disk     disk.sys     Sun Apr 13 11:40:46 2008 (480253AE)
ba723000 ba748700   dmio     dmio.sys     Sun Apr 13 11:44:45 2008 (4802549D)
badac000 badad700   dmload   dmload.sys   Fri Aug 17 13:58:15 2001 (3B7D8567)
bab08000 bab16b00   drmk     drmk.sys     Sun Apr 13 11:45:12 2008 (480254B8)
b6b73000 b6b8a900   dump_atapi dump_atapi.sys Sun Apr 13 11:40:29 2008 (4802539D)
badce000 badcf100   dump_WMILIB dump_WMILIB.SYS Fri Aug 17 14:07:23 2001 (3B7D878B)
b6dad000 b6daf900   Dxapi    Dxapi.sys    Fri Aug 17 13:53:19 2001 (3B7D843F)
bf9c3000 bf9d4600   dxg      dxg.sys      Sun Apr 13 11:38:27 2008 (48025323)
bafba000 bafbad00   dxgthk   dxgthk.sys   Fri Aug 17 13:53:12 2001 (3B7D8438)
babd8000 babd9000   fdc      fdc.sys      unavailable (00000000)
ba968000 ba972e00   Fips     Fips.SYS     Sun Apr 13 11:33:27 2008 (480251F7)
bac08000 bac0d000   flpydisk flpydisk.sys Sun Apr 13 11:40:24 2008 (48025398)
ba6eb000 ba70ab00   fltmgr   fltmgr.sys   Sun Apr 13 11:32:58 2008 (480251DA)
badc6000 badc7f00   Fs_Rec   Fs_Rec.SYS   Fri Aug 17 13:49:37 2001 (3B7D8361)
ba749000 ba767880   ftdisk   ftdisk.sys   Fri Aug 17 13:52:41 2001 (3B7D8419)
baa88000 baa92000   GEARAspiWDM GEARAspiWDM.sys Thu Mar 19 08:32:37 2009 (49C26595)
806e4000 80704d00   hal      halmacpi.dll Sun Apr 13 11:31:27 2008 (4802517F)
b96c9000 b96f1000   HDAudBus HDAudBus.sys Thu May 26 08:46:29 2005 (4295EF55)
bac38000 bac3cf80   HidBatt  HidBatt.sys  Sun Apr 13 11:36:37 2008 (480252B5)
ba998000 ba9a1000   HIDCLASS HIDCLASS.SYS Sun Apr 13 11:45:25 2008 (480254C5)
bac18000 bac1e180   HIDPARSE HIDPARSE.SYS Sun Apr 13 11:45:22 2008 (480254C2)
b6eb5000 b6eb7880   hidusb   hidusb.sys   Sun Apr 13 11:45:27 2008 (480254C7)
b58e1000 b5921a80   HTTP     HTTP.sys     Sun Apr 13 11:53:48 2008 (480256BC)
baa38000 baa44d00   i8042prt i8042prt.sys Sun Apr 13 12:17:59 2008 (48025C67)
baa58000 baa62480   imapi    imapi.sys    Sun Apr 13 11:40:57 2008 (480253B9)
baa28000 baa30e00   intelppm intelppm.sys Sun Apr 13 11:31:31 2008 (48025183)
b6d6b000 b6d90500   ipnat    ipnat.sys    Sun Apr 13 11:57:10 2008 (48025786)
b6e3a000 b6e4c600   ipsec    ipsec.sys    Sun Apr 13 12:19:42 2008 (48025CCE)
ba8a8000 ba8b1180   isapnp   isapnp.sys   Sun Apr 13 11:36:40 2008 (480252B8)
b5b16000 b5b19580   KAPFA    KAPFA.SYS    Fri Mar 21 12:23:51 2008 (47E40B47)
babe0000 babe6000   kbdclass kbdclass.sys Sun Apr 13 11:39:46 2008 (48025372)
bada8000 bada9b80   kdcom    kdcom.dll    Fri Aug 17 13:49:10 2001 (3B7D8346)
b9651000 b9673700   ks       ks.sys       Sun Apr 13 12:16:34 2008 (48025C12)
ba6c2000 ba6d8880   KSecDD   KSecDD.sys   Sun Apr 13 11:31:40 2008 (4802518C)
badca000 badcb080   mnmdd    mnmdd.SYS    Fri Aug 17 13:57:28 2001 (3B7D8538)
bac00000 bac05a00   mouclass mouclass.sys Sun Apr 13 11:39:47 2008 (48025373)
b6eb1000 b6eb3f80   mouhid   mouhid.sys   Fri Aug 17 13:47:57 2001 (3B7D82FD)
ba8b8000 ba8c2580   MountMgr MountMgr.sys Sun Apr 13 11:39:45 2008 (48025371)
b6465000 b6491180   mrxdav   mrxdav.sys   Sun Apr 13 11:32:42 2008 (480251CA)
b6c7b000 b6cea280   mrxsmb   mrxsmb.sys   Fri Oct 24 04:21:07 2008 (4901AFA3)
bac28000 bac2ca80   Msfs     Msfs.SYS     Sun Apr 13 11:32:38 2008 (480251C6)
baac8000 baad0900   msgpc    msgpc.sys    Sun Apr 13 11:56:32 2008 (48025760)
ba524000 ba527c80   mssmbios mssmbios.sys Sun Apr 13 11:36:45 2008 (480252BD)
ba564000 ba57db80   Mup      Mup.sys      Sun Apr 13 12:17:05 2008 (48025C31)
ba608000 ba634980   NDIS     NDIS.sys     Sun Apr 13 12:20:35 2008 (48025D03)
ba540000 ba542780   ndistapi ndistapi.sys Sun Apr 13 11:57:27 2008 (48025797)
b683b000 b683e900   ndisuio  ndisuio.sys  Sun Apr 13 11:55:57 2008 (4802573D)
b963a000 b9650580   ndiswan  ndiswan.sys  Sun Apr 13 12:20:41 2008 (48025D09)
baae8000 baaf1e80   NDProxy  NDProxy.SYS  Sun Apr 13 11:57:28 2008 (48025798)
ba948000 ba950780   netbios  netbios.sys  Sun Apr 13 11:56:01 2008 (48025741)
b6db9000 b6de0c00   netbt    netbt.sys    Sun Apr 13 12:20:59 2008 (48025D1B)
bac30000 bac37880   Npfs     Npfs.SYS     Sun Apr 13 11:32:38 2008 (480251C6)
804d7000 806e4000   nt       ntkrpamp.exe Fri Feb 06 02:32:51 2009 (498C11D3)
ba635000 ba6c1600   Ntfs     Ntfs.sys     Sun Apr 13 12:15:49 2008 (48025BE5)
baf06000 baf06b80   Null     Null.SYS     Fri Aug 17 13:47:39 2001 (3B7D82EB)
bf9d5000 bffb2300   nv4_disp nv4_disp.dll Wed Nov 12 15:38:39 2008 (491B68FF)
b9705000 b9cebd20   nv4_mini nv4_mini.sys Wed Nov 12 15:43:50 2008 (491B6A36)
b9674000 b9687900   parport  parport.sys  Sun Apr 13 11:40:09 2008 (48025389)
bab30000 bab34d00   PartMgr  PartMgr.sys  Sun Apr 13 11:40:48 2008 (480253B0)
badfe000 badffa80   ParVdm   ParVdm.SYS   Fri Aug 17 13:49:49 2001 (3B7D836D)
ba768000 ba778a80   pci      pci.sys      Sun Apr 13 11:36:43 2008 (480252BB)
bae70000 bae70d00   pciide   pciide.sys   Fri Aug 17 13:51:49 2001 (3B7D83E5)
bab28000 bab2e180   PCIIDEX  PCIIDEX.SYS  Sun Apr 13 11:40:29 2008 (4802539D)
b6ebd000 b6ee0a80   portcls  portcls.sys  Sun Apr 13 12:19:40 2008 (48025CCC)
b9629000 b9639e00   psched   psched.sys   Sun Apr 13 11:56:36 2008 (48025764)
babf0000 babf4580   ptilink  ptilink.sys  Fri Aug 17 13:49:53 2001 (3B7D8371)
bad98000 bad9a280   rasacd   rasacd.sys   Fri Aug 17 13:55:39 2001 (3B7D84CB)
baa98000 baaa4880   rasl2tp  rasl2tp.sys  Sun Apr 13 12:19:43 2008 (48025CCF)
baaa8000 baab2200   raspppoe raspppoe.sys Sun Apr 13 11:57:31 2008 (4802579B)
baab8000 baac3d00   raspptp  raspptp.sys  Sun Apr 13 12:19:47 2008 (48025CD3)
babf8000 babfc080   raspti   raspti.sys   Fri Aug 17 13:55:32 2001 (3B7D84C4)
b6ceb000 b6d15e80   rdbss    rdbss.sys    Sun Apr 13 12:28:38 2008 (48025EE6)
badcc000 badcd080   RDPCDD   RDPCDD.sys   Fri Aug 17 13:46:56 2001 (3B7D82C0)
b95f9000 b9628e80   rdpdr    rdpdr.sys    Sun Apr 13 11:32:50 2008 (480251D2)
b554e000 b5570100   RDPWD    RDPWD.SYS    Sun Apr 13 11:38:40 2008 (48025330)
baa78000 baa86100   redbook  redbook.sys  Sun Apr 13 11:40:27 2008 (4802539B)
b6ee1000 b7389000   RtkHDAud RtkHDAud.sys Wed Mar 26 03:37:09 2008 (47EA2755)
b9688000 b96a4980   Rtnicxp  Rtnicxp.sys  Wed Oct 29 23:10:49 2008 (49094FE9)
bada0000 bada3d80   serenum  serenum.sys  Sun Apr 13 11:40:12 2008 (4802538C)
baa48000 baa57c00   serial   serial.sys   Sun Apr 13 12:15:44 2008 (48025BE0)
ba57e000 ba59cca0   snapman  snapman.sys  Tue Apr 01 13:16:21 2008 (47F29815)
ba6d9000 ba6eaf00   sr       sr.sys       Sun Apr 13 11:36:50 2008 (480252C2)
b6233000 b6284880   srv      srv.sys      Thu Dec 11 02:57:07 2008 (4940F203)
badbe000 badbf100   swenum   swenum.sys   Sun Apr 13 11:39:52 2008 (48025378)
b6de1000 b6e39480   tcpip    tcpip.sys    Fri Jun 20 04:51:09 2008 (485B99AD)
babe8000 babeca80   TDI      TDI.SYS      Sun Apr 13 12:00:04 2008 (48025834)
babb0000 babb5500   TDTCP    TDTCP.SYS    Sun Apr 13 11:38:35 2008 (4802532B)
baad8000 baae1f00   termdd   termdd.sys   Sun Apr 13 11:38:36 2008 (4802532C)
b6c6b000 b6c74340   tifsfilt tifsfilt.sys Thu Oct 11 00:24:22 2007 (470DCFA6)
ba59d000 ba607380   timntr   timntr.sys   Thu Oct 11 00:25:49 2007 (470DCFFD)
b5c92000 b5e51180   tm_cfw   tm_cfw.sys   Wed Feb 28 01:07:39 2007 (45E5465B)
b5ea2000 b5ec2280   tmcomm   tmcomm.sys   Mon Dec 24 01:36:35 2007 (476F7DA3)
ba978000 ba985000   TmPreFlt TmPreFlt.sys Thu May 21 09:59:20 2009 (4A158868)
b669a000 b66e2000   TmXPFlt  TmXPFlt.sys  Thu May 21 09:59:20 2009 (4A158868)
b6d16000 b6d48e80   truecrypt truecrypt.sys Mon Dec 01 09:08:55 2008 (49341A27)
b94b1000 b950ef00   update   update.sys   Sun Apr 13 11:39:46 2008 (48025372)
bac48000 bac4fd80   usbccgp  usbccgp.sys  Sun Apr 13 11:45:38 2008 (480254D2)
badc4000 badc5280   USBD     USBD.SYS     Fri Aug 17 14:02:58 2001 (3B7D8682)
babc8000 babcf600   usbehci  usbehci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
bab18000 bab26880   usbhub   usbhub.sys   Sun Apr 13 11:45:36 2008 (480254D0)
babd0000 babd4300   usbohci  usbohci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
b96a5000 b96c8200   USBPORT  USBPORT.SYS  Sun Apr 13 11:45:34 2008 (480254CE)
bac50000 bac56500   usbprint usbprint.sys Sun Apr 13 11:47:37 2008 (48025549)
b6ea5000 b6ea8b00   usbscan  usbscan.sys  Sun Apr 13 11:45:34 2008 (480254CE)
bac40000 bac46700   USBSTOR  USBSTOR.SYS  Sun Apr 13 11:45:37 2008 (480254D1)
babc0000 babc5080   usbuhci  usbuhci.sys  Sun Apr 13 11:45:34 2008 (480254CE)
bac20000 bac25200   vga      vga.sys      Sun Apr 13 11:44:40 2008 (48025498)
b96f1000 b9704f00   VIDEOPRT VIDEOPRT.SYS Sun Apr 13 11:44:39 2008 (48025497)
ba8c8000 ba8d4c80   VolSnap  VolSnap.sys  Sun Apr 13 11:41:00 2008 (480253BC)
b670a000 b68323c0   VSApiNt  VSApiNt.sys  Thu May 21 09:40:25 2009 (4A1583F9)
ba958000 ba960700   wanarp   wanarp.sys   Sun Apr 13 11:57:20 2008 (48025790)
bac58000 bac5c500   watchdog watchdog.sys Sun Apr 13 11:44:59 2008 (480254AB)
bf800000 bf9c2f80   win32k   win32k.sys   Fri Apr 17 05:26:26 2009 (49E87572)
badaa000 badab100   WMILIB   WMILIB.SYS   Fri Aug 17 14:07:23 2001 (3B7D878B)
 
Unloaded modules:
b5859000 b5867000   TSUSB2.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bad94000 bad98000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bac10000 bac15000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bad90000 bad93000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
1: kd> x *!
start    end        module name
804d7000 806e4000   nt       # (pdb symbols)          c:\symbols\ntkrpamp.pdb\909FE6B806E4444B9230BAAF21EC5C271\ntkrpamp.pdb
806e4000 80704d00   hal        (deferred)             
b554e000 b5570100   RDPWD      (deferred)             
b58e1000 b5921a80   HTTP       (deferred)             
b5b16000 b5b19580   KAPFA      (deferred)             
b5c92000 b5e51180   tm_cfw     (deferred)             
b5ea2000 b5ec2280   tmcomm     (deferred)             
b6233000 b6284880   srv        (deferred)             
b6465000 b6491180   mrxdav     (deferred)             
b669a000 b66e2000   TmXPFlt    (deferred)             
b670a000 b68323c0   VSApiNt    (deferred)             
b683b000 b683e900   ndisuio    (deferred)             
b6b73000 b6b8a900   dump_atapi   (deferred)             
b6c6b000 b6c74340   tifsfilt   (deferred)             
b6c7b000 b6cea280   mrxsmb     (deferred)             
b6ceb000 b6d15e80   rdbss      (deferred)             
b6d16000 b6d48e80   truecrypt   (deferred)             
b6d49000 b6d6ad00   afd        (deferred)             
b6d6b000 b6d90500   ipnat      (deferred)             
b6dad000 b6daf900   Dxapi      (deferred)             
b6db9000 b6de0c00   netbt      (deferred)             
b6de1000 b6e39480   tcpip      (deferred)             
b6e3a000 b6e4c600   ipsec      (deferred)             
b6ea5000 b6ea8b00   usbscan    (deferred)             
b6eb1000 b6eb3f80   mouhid     (deferred)             
b6eb5000 b6eb7880   hidusb     (deferred)             
b6ebd000 b6ee0a80   portcls    (deferred)             
b6ee1000 b7389000   RtkHDAud   (deferred)             
b94b1000 b950ef00   update     (deferred)             
b95f9000 b9628e80   rdpdr      (deferred)             
b9629000 b9639e00   psched     (deferred)             
b963a000 b9650580   ndiswan    (deferred)             
b9651000 b9673700   ks         (deferred)             
b9674000 b9687900   parport    (deferred)             
b9688000 b96a4980   Rtnicxp    (deferred)             
b96a5000 b96c8200   USBPORT    (deferred)             
b96c9000 b96f1000   HDAudBus   (deferred)             
b96f1000 b9704f00   VIDEOPRT   (deferred)             
b9705000 b9cebd20   nv4_mini   (deferred)             
ba524000 ba527c80   mssmbios   (deferred)             
ba540000 ba542780   ndistapi   (deferred)             
ba564000 ba57db80   Mup        (deferred)             
ba57e000 ba59cca0   snapman    (deferred)             
ba59d000 ba607380   timntr     (deferred)             
ba608000 ba634980   NDIS       (deferred)             
ba635000 ba6c1600   Ntfs       (deferred)             
ba6c2000 ba6d8880   KSecDD     (deferred)             
ba6d9000 ba6eaf00   sr         (deferred)             
ba6eb000 ba70ab00   fltmgr     (deferred)             
ba70b000 ba722900   atapi      (deferred)             
ba723000 ba748700   dmio       (deferred)             
ba749000 ba767880   ftdisk     (deferred)             
ba768000 ba778a80   pci        (deferred)             
ba779000 ba7a6d80   ACPI       (deferred)             
ba8a8000 ba8b1180   isapnp     (deferred)             
ba8b8000 ba8c2580   MountMgr   (deferred)             
ba8c8000 ba8d4c80   VolSnap    (deferred)             
ba8d8000 ba8e0e00   disk       (deferred)             
ba8e8000 ba8f4180   CLASSPNP   (deferred)             
ba948000 ba950780   netbios    (deferred)             
ba958000 ba960700   wanarp     (deferred)             
ba968000 ba972e00   Fips       (deferred)             
ba978000 ba985000   TmPreFlt   (deferred)             
ba988000 ba997900   Cdfs       (deferred)             
ba998000 ba9a1000   HIDCLASS   (deferred)             
baa28000 baa30e00   intelppm   (deferred)             
baa38000 baa44d00   i8042prt   (deferred)             
baa48000 baa57c00   serial     (deferred)             
baa58000 baa62480   imapi      (deferred)             
baa68000 baa77600   cdrom      (deferred)             
baa78000 baa86100   redbook    (deferred)             
baa88000 baa92000   GEARAspiWDM   (deferred)             
baa98000 baaa4880   rasl2tp    (deferred)             
baaa8000 baab2200   raspppoe   (deferred)             
baab8000 baac3d00   raspptp    (deferred)             
baac8000 baad0900   msgpc      (deferred)             
baad8000 baae1f00   termdd     (deferred)             
baae8000 baaf1e80   NDProxy    (deferred)             
bab08000 bab16b00   drmk       (deferred)             
bab18000 bab26880   usbhub     (deferred)             
bab28000 bab2e180   PCIIDEX    (deferred)             
bab30000 bab34d00   PartMgr    (deferred)             
babb0000 babb5500   TDTCP      (deferred)             
babc0000 babc5080   usbuhci    (deferred)             
babc8000 babcf600   usbehci    (deferred)             
babd0000 babd4300   usbohci    (deferred)             
babd8000 babd9000   fdc        (deferred)             
babe0000 babe6000   kbdclass   (deferred)             
babe8000 babeca80   TDI        (deferred)             
babf0000 babf4580   ptilink    (deferred)             
babf8000 babfc080   raspti     (deferred)             
bac00000 bac05a00   mouclass   (deferred)             
bac08000 bac0d000   flpydisk   (deferred)             
bac18000 bac1e180   HIDPARSE   (deferred)             
bac20000 bac25200   vga        (deferred)             
bac28000 bac2ca80   Msfs       (deferred)             
bac30000 bac37880   Npfs       (deferred)             
bac38000 bac3cf80   HidBatt    (deferred)             
bac40000 bac46700   USBSTOR    (deferred)             
bac48000 bac4fd80   usbccgp    (deferred)             
bac50000 bac56500   usbprint   (deferred)             
bac58000 bac5c500   watchdog   (deferred)             
bac78000 bac7c7e0   BrPar      (deferred)             
bacb8000 bacbb000   BOOTVID    (deferred)             
bacbc000 bacbe800   compbatt   (deferred)             
bacc0000 bacc3780   BATTC      (deferred)             
bad98000 bad9a280   rasacd     (deferred)             
bada0000 bada3d80   serenum    (deferred)             
bada8000 bada9b80   kdcom      (deferred)             
badaa000 badab100   WMILIB     (deferred)             
badac000 badad700   dmload     (deferred)             
badbe000 badbf100   swenum     (deferred)             
badc4000 badc5280   USBD       (deferred)             
badc6000 badc7f00   Fs_Rec     (deferred)             
badc8000 badc9080   Beep       (deferred)             
badca000 badcb080   mnmdd      (deferred)             
badcc000 badcd080   RDPCDD     (deferred)             
badce000 badcf100   dump_WMILIB   (deferred)             
badfe000 badffa80   ParVdm     (deferred)             
bae70000 bae70d00   pciide     (deferred)             
baf06000 baf06b80   Null       (deferred)             
bafba000 bafbad00   dxgthk     (deferred)             
bafc3000 bafc3c00   audstub    (deferred)             
bf800000 bf9c2f80   win32k     (deferred)             
bf9c3000 bf9d4600   dxg        (deferred)             
bf9d5000 bffb2300   nv4_disp   (deferred)             
bffb3000 bfff8c00   ATMFD      (deferred)             
 
Unloaded modules:
b5859000 b5867000   TSUSB2.sys
bad94000 bad98000   kbdhid.sys
bac10000 bac15000   Cdaudio.SYS
bad90000 bad93000   Sfloppy.SYS
1: kd> dds
8063741b  a804438b
8063741f  a8457508
80637423  6a237504
80637427  e0458d01
8063742b  0c75ff50
8063742f  508de856
80637433  c085ffff
80637437  8e8b167d
8063743b  00000230
8063743f  f0f500e8
80637443  0103e9ff
80637447  438b0000
8063744b  e0458908
8063744f  ff0c75ff
80637453  e856e075
80637457  ffff4a79
8063745b  00087e83
8063745f  458b1274
80637463  2040ffe0
80637467  00087e83
8063746b  86ff0674
8063746f  0000025c
80637473  02308e8b
80637477  c6e80000
8063747b  8bfff0f4
8063747f  d4458903
80637483  4589c703
80637487  fc6583d8
8063748b  89088b00
8063748f  c985dc4d
80637493  d9f7057d
80637497  8bdc4d89
1: kd> dd
8063749b  e0830443 c84589f0 3b39148d 1f760850
806374ab  02308e8b 6ee80000 f6fff0f4 75080443
806374bb  087e8375 8b7b7400 4bff085b 8b67eb20
806374cb  ca03d855 8dc44d89 000fff87 f0002500
806374db  4503ffff d04589d4 0c73c13b 5d88188a
806374eb  100005e7 edeb0000 fffc4d83 01547e83
806374fb  428d0575 8d4ceb08 47eb0442 c340c033
8063750b  8be8658b 8e8b0875 00000230 f0f408e8
1: kd> dd
8063751b  cc458bff 080440f6 7e830c75 12740008
8063752b  ff08408b 7e832048 06740008 025c8eff
8063753b  8e8b0000 00000230 f0f3fce8 fc4d83ff
8063754b  e8c033ff fff04678 cc0008c2 cccccccc
8063755b  55ff8bcc 3d80ec8b 8067d3f4 33047501
8063756b  8b4bebc0 4d8b0c45 c1d08b08 d2691fea
8063757b  000000dc 5c0a548b f08b5756 efc1f88b
8063758b  15eec10c 03ffe681 148b0000 ffe781b2
1: kd> dd
8063759b  c1000001 ff2504e7 0300000f 79833a04
806375ab  5e5f0154 c0830575 8303eb08 c25d04c0
806375bb  cccc0008 8bcccccc ec8b55ff 08758b56
806375cb  0c75ff57 fd47e856 f88bffff 3e74ff85
806375db  8508468b ff0674c0 ff560c75 c1078bd0
806375eb  834803f8 197210f8 3d04e8c1 000000ff
806375fb  176a0576 0f0aeb58 989880be c083804d
8063760b  1075ff10 0c75ff50 7c79e856 5e5f0000
1: kd> ddd
0000000d  ???????? ???????? ???????? ????????
0000001d  ???????? ???????? ???????? ????????
0000002d  ???????? ???????? ???????? ????????
0000003d  ???????? ???????? ???????? ????????
0000004d  ???????? ???????? ???????? ????????
0000005d  ???????? ???????? ???????? ????????
0000006d  ???????? ???????? ???????? ????????
0000007d  ???????? ???????? ???????? ????????
1: kd> dd
0000008d  ???????? ???????? ???????? ????????
0000009d  ???????? ???????? ???????? ????????
000000ad  ???????? ???????? ???????? ????????
000000bd  ???????? ???????? ???????? ????????
000000cd  ???????? ???????? ???????? ????????
000000dd  ???????? ???????? ???????? ????????
000000ed  ???????? ???????? ???????? ????????
000000fd  ???????? ???????? ???????? ????????
1: kd> dd
0000010d  ???????? ???????? ???????? ????????
0000011d  ???????? ???????? ???????? ????????
0000012d  ???????? ???????? ???????? ????????
0000013d  ???????? ???????? ???????? ????????
0000014d  ???????? ???????? ???????? ????????
0000015d  ???????? ???????? ???????? ????????
0000016d  ???????? ???????? ???????? ????????
0000017d  ???????? ???????? ???????? ????????
1: kd> x *!
start    end        module name
804d7000 806e4000   nt       # (pdb symbols)          c:\symbols\ntkrpamp.pdb\909FE6B806E4444B9230BAAF21EC5C271\ntkrpamp.pdb
806e4000 80704d00   hal        (deferred)             
b554e000 b5570100   RDPWD      (deferred)             
b58e1000 b5921a80   HTTP       (deferred)             
b5b16000 b5b19580   KAPFA      (deferred)             
b5c92000 b5e51180   tm_cfw     (deferred)             
b5ea2000 b5ec2280   tmcomm     (deferred)             
b6233000 b6284880   srv        (deferred)             
b6465000 b6491180   mrxdav     (deferred)             
b669a000 b66e2000   TmXPFlt    (deferred)             
b670a000 b68323c0   VSApiNt    (deferred)             
b683b000 b683e900   ndisuio    (deferred)             
b6b73000 b6b8a900   dump_atapi   (deferred)             
b6c6b000 b6c74340   tifsfilt   (deferred)             
b6c7b000 b6cea280   mrxsmb     (deferred)             
b6ceb000 b6d15e80   rdbss      (deferred)             
b6d16000 b6d48e80   truecrypt   (deferred)             
b6d49000 b6d6ad00   afd        (deferred)             
b6d6b000 b6d90500   ipnat      (deferred)             
b6dad000 b6daf900   Dxapi      (deferred)             
b6db9000 b6de0c00   netbt      (deferred)             
b6de1000 b6e39480   tcpip      (deferred)             
b6e3a000 b6e4c600   ipsec      (deferred)             
b6ea5000 b6ea8b00   usbscan    (deferred)             
b6eb1000 b6eb3f80   mouhid     (deferred)             
b6eb5000 b6eb7880   hidusb     (deferred)             
b6ebd000 b6ee0a80   portcls    (deferred)             
b6ee1000 b7389000   RtkHDAud   (deferred)             
b94b1000 b950ef00   update     (deferred)             
b95f9000 b9628e80   rdpdr      (deferred)             
b9629000 b9639e00   psched     (deferred)             
b963a000 b9650580   ndiswan    (deferred)             
b9651000 b9673700   ks         (deferred)             
b9674000 b9687900   parport    (deferred)             
b9688000 b96a4980   Rtnicxp    (deferred)             
b96a5000 b96c8200   USBPORT    (deferred)             
b96c9000 b96f1000   HDAudBus   (deferred)             
b96f1000 b9704f00   VIDEOPRT   (deferred)             
b9705000 b9cebd20   nv4_mini   (deferred)             
ba524000 ba527c80   mssmbios   (deferred)             
ba540000 ba542780   ndistapi   (deferred)             
ba564000 ba57db80   Mup        (deferred)             
ba57e000 ba59cca0   snapman    (deferred)             
ba59d000 ba607380   timntr     (deferred)             
ba608000 ba634980   NDIS       (deferred)             
ba635000 ba6c1600   Ntfs       (deferred)             
ba6c2000 ba6d8880   KSecDD     (deferred)             
ba6d9000 ba6eaf00   sr         (deferred)             
ba6eb000 ba70ab00   fltmgr     (deferred)             
ba70b000 ba722900   atapi      (deferred)             
ba723000 ba748700   dmio       (deferred)             
ba749000 ba767880   ftdisk     (deferred)             
ba768000 ba778a80   pci        (deferred)             
ba779000 ba7a6d80   ACPI       (deferred)             
ba8a8000 ba8b1180   isapnp     (deferred)             
ba8b8000 ba8c2580   MountMgr   (deferred)             
ba8c8000 ba8d4c80   VolSnap    (deferred)             
ba8d8000 ba8e0e00   disk       (deferred)             
ba8e8000 ba8f4180   CLASSPNP   (deferred)             
ba948000 ba950780   netbios    (deferred)             
ba958000 ba960700   wanarp     (deferred)             
ba968000 ba972e00   Fips       (deferred)             
ba978000 ba985000   TmPreFlt   (deferred)             
ba988000 ba997900   Cdfs       (deferred)             
ba998000 ba9a1000   HIDCLASS   (deferred)             
baa28000 baa30e00   intelppm   (deferred)             
baa38000 baa44d00   i8042prt   (deferred)             
baa48000 baa57c00   serial     (deferred)             
baa58000 baa62480   imapi      (deferred)             
baa68000 baa77600   cdrom      (deferred)             
baa78000 baa86100   redbook    (deferred)             
baa88000 baa92000   GEARAspiWDM   (deferred)             
baa98000 baaa4880   rasl2tp    (deferred)             
baaa8000 baab2200   raspppoe   (deferred)             
baab8000 baac3d00   raspptp    (deferred)             
baac8000 baad0900   msgpc      (deferred)             
baad8000 baae1f00   termdd     (deferred)             
baae8000 baaf1e80   NDProxy    (deferred)             
bab08000 bab16b00   drmk       (deferred)             
bab18000 bab26880   usbhub     (deferred)             
bab28000 bab2e180   PCIIDEX    (deferred)             
bab30000 bab34d00   PartMgr    (deferred)             
babb0000 babb5500   TDTCP      (deferred)             
babc0000 babc5080   usbuhci    (deferred)             
babc8000 babcf600   usbehci    (deferred)             
babd0000 babd4300   usbohci    (deferred)             
babd8000 babd9000   fdc        (deferred)             
babe0000 babe6000   kbdclass   (deferred)             
babe8000 babeca80   TDI        (deferred)             
babf0000 babf4580   ptilink    (deferred)             
babf8000 babfc080   raspti     (deferred)             
bac00000 bac05a00   mouclass   (deferred)             
bac08000 bac0d000   flpydisk   (deferred)             
bac18000 bac1e180   HIDPARSE   (deferred)             
bac20000 bac25200   vga        (deferred)             
bac28000 bac2ca80   Msfs       (deferred)             
bac30000 bac37880   Npfs       (deferred)             
bac38000 bac3cf80   HidBatt    (deferred)             
bac40000 bac46700   USBSTOR    (deferred)             
bac48000 bac4fd80   usbccgp    (deferred)             
bac50000 bac56500   usbprint   (deferred)             
bac58000 bac5c500   watchdog   (deferred)             
bac78000 bac7c7e0   BrPar      (deferred)             
bacb8000 bacbb000   BOOTVID    (deferred)             
bacbc000 bacbe800   compbatt   (deferred)             
bacc0000 bacc3780   BATTC      (deferred)             
bad98000 bad9a280   rasacd     (deferred)             
bada0000 bada3d80   serenum    (deferred)             
bada8000 bada9b80   kdcom      (deferred)             
badaa000 badab100   WMILIB     (deferred)             
badac000 badad700   dmload     (deferred)             
badbe000 badbf100   swenum     (deferred)             
badc4000 badc5280   USBD       (deferred)             
badc6000 badc7f00   Fs_Rec     (deferred)             
badc8000 badc9080   Beep       (deferred)             
badca000 badcb080   mnmdd      (deferred)             
badcc000 badcd080   RDPCDD     (deferred)             
badce000 badcf100   dump_WMILIB   (deferred)             
badfe000 badffa80   ParVdm     (deferred)             
bae70000 bae70d00   pciide     (deferred)             
baf06000 baf06b80   Null       (deferred)             
bafba000 bafbad00   dxgthk     (deferred)             
bafc3000 bafc3c00   audstub    (deferred)             
bf800000 bf9c2f80   win32k     (deferred)             
bf9c3000 bf9d4600   dxg        (deferred)             
bf9d5000 bffb2300   nv4_disp   (deferred)             
bffb3000 bfff8c00   ATMFD      (deferred)             
 
Unloaded modules:
b5859000 b5867000   TSUSB2.sys
bad94000 bad98000   kbdhid.sys
bac10000 bac15000   Cdaudio.SYS
bad90000 bad93000   Sfloppy.SYS
1: kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 8063741b b56d096c 00000000

Open in new window

One other item - you are running XP SP3 and based on the dates of the NT Kernel and DirectX  Graphics Kernel drivers, you appear to be up to date with Windows Updates.  As was mentioned in this thread, it can never hurt to make sure - click on the link for a Windows Updates check -  http://update.microsoft.com/microsoftupdate/v6/vistadefault.aspx?ln=en-us
 
Most Valuable Expert 2011
Top Expert 2011

Commented:
Exactly what point in the login is it crashing, at the CAD screen, hitting enter after the psw is entered?
Sys uptime =  0 days 0:02:47.593  when BSOD #5 hit  
Given XP, I would say 2.5 seconds = at or beyond logon screen.
Most Valuable Expert 2011
Top Expert 2011

Commented:
Yea, thats a given, but is it idle, keystrokes being made etc? Dump cant tell us that....
The crash occurred while CPU1 was running services.exe
It may be Trend Micro a/v that gets the blame.  Their drivers are the newest found in the dumps and may be clashing with older, out-dated drivers -
TmXPFlt.sys  Thu May 21 09:59:20 2009 (4A158868)
VSApiNt.sys  Thu May 21 09:40:25 2009 (4A1583F9)
TmPreFlt.sys Thu May 21 09:59:20 2009 (4A158868)

Or, it may be the Brother driver from 2000 - which has a removal tool from Brother - http://solutions.brother.com/uninstall/en_us/
BrPar.sys    Mon Jul 24 11:18:46 2000 (397C8886)
Regardless, I would have given the same suggestions as you did - run the driver verifier.
Thanks... JC