logje van windbg:
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\Mini010309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0x81c50000 PsLoadedModuleList = 0x81d67c70
Debug session time: Sat Jan 3 09:07:36.628 2009 (GMT+1)
System Uptime: 0 days 0:00:59.690
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffff4, 0, 81e96b31, 0}
Probably caused by : ntkrpamp.exe ( nt!ObpDeleteNameCheck+c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff4, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81e96b31, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 81d87868
Unable to read MiSystemVaType memory at 81d67420
fffffff4
FAULTING_IP:
nt!ObpDeleteNameCheck+c
81e96b31 8a43f4 mov al,byte ptr [ebx-0Ch]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: 9b131be4 -- (.trap 0xffffffff9b131be4)
ErrCode = 00000000
eax=88561438 ebx=00000000 ecx=91cf0005 edx=91ce0004 esi=84392d40 edi=882d0790
eip=81e96b31 esp=9b131c58 ebp=9b131c84 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nt!ObpDeleteNameCheck+0xc:
81e96b31 8a43f4 mov al,byte ptr [ebx-0Ch] ds:0023:fffffff4=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 81caab54 to 81cf50f5
STACK_TEXT:
9b131bcc 81caab54 00000000 fffffff4 00000000 nt!MmAccessFault+0x10a
9b131bcc 81e96b31 00000000 fffffff4 00000000 nt!KiTrap0E+0xdc
9b131c84 81e6d667 00000000 88626030 8863b5d8 nt!ObpDeleteNameCheck+0xc
9b131cc4 81e6d4e0 882d0790 00392d40 000e0080 nt!ObpDecrementHandleCount+0x15d
9b131d14 81e6d6f0 81083bd8 81088880 882d0790 nt!ObpCloseHandleTableEntry+0x234
9b131d44 81e6d915 882d0790 88626001 88626001 nt!ObpCloseHandle+0x73
9b131d58 81ca7a1a 00000440 01b5f09c 771f9a94 nt!NtClose+0x20
9b131d58 771f9a94 00000440 01b5f09c 771f9a94 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01b5f09c 00000000 00000000 00000000 00000000 0x771f9a94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObpDeleteNameCheck+c
81e96b31 8a43f4 mov al,byte ptr [ebx-0Ch]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!ObpDeleteNameCheck+c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1b7fa
FAILURE_BUCKET_ID: 0x50_nt!ObpDeleteNameCheck+c
BUCKET_ID: 0x50_nt!ObpDeleteNameCheck+c
Followup: MachineOwner
---------
wat ik op internet vond:
0x50 - Probable Cause "ntkrpamp.exe" - Normally caused by Defective Memory (L2 Cache, RAM, Video RAM) or Incompatible Software including Anti-Virus software.
