Machine Hangs

N

Nickul

Member
My vista installation keeps hanging and its driving me up the wall.

Vista-64 Home Premium SP2 on a desktop Core i7 6gig ram, ATI HD 4870. Dual boot with Ubuntu

Kaspersky AV (KIS v9)

Purchased just over a year ago with Vista installed

I'm pretty sure I have never had it freeze under Ubuntu.

It follows no pattern, it can be after several hours of having the machine on, or after a few minutes, With no loading or with a full load.

I have run it all weekend with the processor and GPU fully loaded and its been fine.

I have had new RAM from my supplier and this has not helped. Ubuntu has a memory checking program in the boot menu and this finds no problems.

I have reseated the memory modules and cards.

I have tried with no peripherals attached and an old ps2 keyboard and a different mouse.

What makes it difficult is that it will be fine for almost 2 months and then I'll have a bout of 5-10 freezes in two weeks.

It is never a BSOD , the desktop just hangs, occasionally it will reboot itself.

The one and only minidump file is over 6 months old.

I have just tried changing the power plan from "Power Saver" to "High Performance" as I found a webpage suggesting that this may be the cause. Any thoughts on this ?

Reliability Monitor reports "Disruptive Shutdown - The computer was not shut down properly" for each instance

Event viewer for a typical day reports four errors. 2 CAPI2 ID11 events , 1 Service Control Manager Eventlog Provider ID 7026 and 1 WMI ID 10.

I have followed the BSOD instructions and the relevant files are zipped up and attached.
 
Last edited:

My Computer

System One

Two days ago , i uninstalled Kaspersky and put Avira on. Avira moaned about Windows defender also running so I disabled defender.

I had my fingers crossed but to no avail it has just hung on me now.

Any help would be really appreciated, I have looked through the results of Performance monitor but I cannot see any problems. Could anybody tell me what I'm looking for?

Thanks
 

My Computer

System One

You will have to associate the freezes with the time so we can examine the event logs more closely.
As it stands now, the errors that are present aren't all that revealing.

I'd suggest reinstalling Windows clean to see if that helps - but that's an awfully drastic course of action at this point.
 

My Computer

System One

Ok, so using Reliability Monitor, all it gives me is a date for the "Disruptive Shutdown Events"
Picking the last five hangs
1. 18/10/2010
2. 16/10/2010
3. 09/10/2010
4. 05/10/2010
5. 07/09/2010

using my own log of events (times are a bit woolly)
1. 18/10/2010 17:20pm
2. 16/10/2010 15:10pm
3a. 13/10/2010 03:00am rebooted itself
3b. 09/10/2010 10:20am
4 05/10/2010 13:35pm
5. 07/09/2010 7:00am

interestingly Hang No.3a has not registered in the reliability monitor, but I remember coming to the machine and it had rebooted.

Trying to look in Event viewer to find each instance of Event 6008 is proving difficult because MMC keeps crashing on me every time I try to sort the events...
Anywho finding the last five 6008 events
1. 18/10/2010 17:58:31 - Unexpected Shutdown @ 17:24:26
2. 16/10/2010 15:06:39 - Unexpected Shutdown @ 15:02:17
3. 09/10/2010 10:24:36 - Unexpected Shutdown @ 10:22:17
4. 05/10/2010 13:36:22 - Unexpected Shutdown @ 13:33:39
5. 07/09/2010 18:59:51 - Unexpected Shutdown @ 18:55:18

Had a few WMI errors (Event ID 10) which I fixed yesterday using the tutorial on this site. All I've got today (errors) is a couple of 7026's, USB driver ?? from what I've read.

Is this the information that is needed ?

Thanks
 

My Computer

System One

Are these the times of the last hangs?
using my own log of events (times are a bit woolly)
1. 18/10/2010 17:20pm
2. 16/10/2010 15:10pm
3a. 13/10/2010 03:00am rebooted itself
3b. 09/10/2010 10:20am
4 05/10/2010 13:35pm
5. 07/09/2010 7:00am
Click to expand...
 

My Computer

System One

The time for each of the hangs that I logged myself is not that accurate as I often come to my machine well after it has hung. So the time recorded in the event 6008 in the event viewer, I thought, would be more accurate hence I have included them.

Hence the following times;

1. 18/10/2010 17:58:31 - Unexpected Shutdown @ 17:24:26
2. 16/10/2010 15:06:39 - Unexpected Shutdown @ 15:02:17
3. 09/10/2010 10:24:36 - Unexpected Shutdown @ 10:22:17
4. 05/10/2010 13:36:22 - Unexpected Shutdown @ 13:33:39
5. 07/09/2010 18:59:51 - Unexpected Shutdown @ 18:55:18

Thanks
 
Last edited:

My Computer

System One

There are lot's of instances of the event log service being stopped for several days.
This will complicate any troubleshooting (as the errors won't be caught by the system)

But, I was able to see a series of these events:
Event[2866]:
Log Name: System
Source: Microsoft-Windows-Kernel-Processor-Power
Date: 2010-10-09T10:24:27.891
Event ID: 4
Task: N/A
Level: Information
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: NickDesk
Description:
Processor 0 exposes the following:

1 idle state(s)
10 performance state(s)
0 throttle state(s)
Click to expand...
And it was followed by this one after the unexpected shutdown:
Event[2847]:
Log Name: System
Source: Microsoft-Windows-WHEA-Logger
Date: 2010-10-09T10:24:44.275
Event ID: 19
Task: N/A
Level: Warning
Opcode: Info
Keyword: N/A
User: S-1-5-19
User Name: NT AUTHORITY\LOCAL SERVICE
Computer: NickDesk
Description:
A corrected hardware error occurred.

Error Source: Corrected Machine Check

Error Type: Internal Timer Error

Processor ID Valid: Yes
Processor ID: 0x7
Bank Number: 5
Transaction Type: N/A
Processor Participation: N/A
Request Type: N/A
Memory/Io: N/A
Memory Hierarchy Level: N/A
Timeout: N/A
Click to expand...
Try this free stress test to see if it causes any issues or if it catches any errors:
Prime95 download site: Free Software - GIMPS
Prime95 Setup:
- extract the contents of the zip file to a location of your choice
- double click on the executable file
- select "Just stress testing"
- select the "Blend" test. If you've already run MemTest overnight you may want to run the "Small FFTs" test instead. (run all 3 if you find a problem and note how long it takes to error out with each)
- "Number of torture test threads to run" should equal the number of CPU's times 2 (if you're using hyperthreading).
The easiest way to figure this out is to go to Task Manager...Performance tab - and see the number of boxes under CPU Usage History
Then run the test for 6 to 24 hours - or until you get errors (whichever comes first).
This won't necessarily crash the system - but check the output in the test window for errors.
The Test selection box and the stress.txt file describes what components that the program stresses.
Click to expand...
 

My Computer

System One

So I started Prime95 yesterday at approximately 13:00 (Saturday) and it ran fine until 02:15am in the morning, at which point I had another hang. The results file is attached. Event log gives me another 6008 event;

24/10/10 13:09 - Unexpected Shutdown @ 02:15 i.e this event has been logged when I next switched the machine on, Sunday lunchtime, but its still able to trigger this event at 02:15am when the machine hung which is interesting.

I only have four events of interest from yesterday 10:00am till now...
Error 24/10/2010 13:11:01 Service Control Manager 7026 None
Error 24/10/2010 13:09:22 Eventlog 1101 Event processing
Error 24/10/2010 13:09:20 EventLog 6008 None
Error 23/10/2010 10:44:03 Service Control Manager 7026 None

I'm not sure what to make of Event ID 4 that you highlighted. But I had come across a technet article suggesting that Event ID 19 is a false alarm for a Vista / Core i 7 combination, http://support.microsoft.com/kb/961080 , and that I apply a hotfix. I have not done this.
 

Attachments

My Computer

System One

Well that just shows the randomness of this as it has just hung on me again..

24/10/2010 14:24 - Unexpected shutdown @ 14:21

Logged back in under the Admin account and it has popped up a dialogue box "Windows has recovered from an unexpected shutdown"

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 2057

Additional information about the problem:
BCCode: 124
BCP1: 0000000000000000
BCP2: FFFFFA800853B030
BCP3: 00000000BE000000
BCP4: 0000000000800400
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\Mini102410-01.dmp
C:\Users\Admin\AppData\Local\Temp\WER-430141-0.sysdata.xml
C:\Users\Admin\AppData\Local\Temp\WER25B8.tmp.version.txt

Attached is the minidump file that it generated, I can't find the other two files , they are not in that folder.


Thanks
 

Attachments

My Computer

System One

The Temp files were probably deleted after the report was sent to Microsoft. That's OK though as the information is all contained in the memory dump file.

The KB article is for Vista w/SP1
Since you have SP2 I'd presume that that fix was included. To check, please see if these are the specifications for these files on your system (table is from the KB article):
For all supported 64-bit versions of Windows Server 2008 and of Windows Vista

File name File version File size Date Time Platform
Hal.dll 6.0.6001.22386 231,904 26-Feb-2009 04:55 x64
Hal.inf Not Applicable 2,926 25-Feb-2009 23:34 Not Applicable
Whealogr.dll 6.0.6001.22386 33,280 26-Feb-2009 04:52 x64
Click to expand...
Well, Prime95 didn't find anything, even when the system crashed
And you have a STOP 0x124 error.
This is most likely a hardware problem, although it's possible that there's a compatibility issue or a Windows problem.

Have you added equipment to the system in the last year? I'm wondering about your PSU and it's ability to handle added load. What's the make and model of your system - and the make and wattage of your PSU?

FWIW - I've found that identifying errors by Event ID number is misleading. Then entire error message is significant - so please include all messages (to include Information and Warning messages also).

Since this issue has p***ed me off, I'm going to get more aggressive with it. Hopefully this will fix it.

Please update your ATK0110 ACPI Utility driver and your Asus PC Probe/AISuite utilities. Those drivers are older and should be updated:
Code: 
ASACPI.sys   Mon Oct 30 22:09:12 2006 (4546B048) - ATK0110 ACPI Utility driver
AsIO.sys     Mon Dec 17 04:11:49 2007 (47663D55) - PCProbe/AISuite driver
Also, please update your Wacom Mouse driver as that's older also:
Code: 
wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
And there appears to be a remnant of Kaspersky on your system. Please use this free tool to remove it: Removal tool for Kaspersky Lab products
Code: 
kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
Once it's gone, please check in C:\Windows\System32\drivers to ensure that it is gone. Also check your current antivirus to ensure that it's working.

In short, I think it's the Kaspersky that's causing this - but it could be the Asus drivers that I mentioned earlier. Also, there's a chance that it's a hardware, compatibility, or Windows issue that we haven't discovered yet - so let's just keep working on it.

Here's the analysis of the memory dump. Please note that it's a STOP 0x124 error (WHEA_UNCORRECTABLE_ERROR). It's an error that's caught by your CPU and forwarded to Windows. As such there's not a whole bunch of information that's useful to us. I'd suggest that you check the tips at this link to troubleshoot it further (although it's a Win7 article, it also applies to Win Vista): Stop 0x124 - what it means and what to try - Windows 7 Forums
Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\Mini102410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18267.amd64fre.vistasp2_gdr.100608-0458
Machine Name:
Kernel base = 0xfffff800`04663000 PsLoadedModuleList = 0xfffff800`04827dd0
Debug session time: Sat Oct 23 21:16:39.813 2010 (UTC - 4:00)
System Uptime: 0 days 15:34:38.397
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 124, {0, fffffa800853b030, be000000, 800400}

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
Probably caused by : hardware

Followup: MachineOwner
---------

3: kd> !analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;.logclose;q
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800853b030, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER                ***
***                                                                   ***
*************************************************************************

BUGCHECK_STR:  0x124_GenuineIntel

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  prime95.exe

CURRENT_IRQL:  f

STACK_TEXT:  
fffffa60`017df958 fffff800`046248ba : 00000000`00000124 00000000`00000000 fffffa80`0853b030 00000000`be000000 : nt!KeBugCheckEx
fffffa60`017df960 fffff800`047840a3 : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000001 : hal!HalBugCheckSystem+0x12e
fffffa60`017df9d0 fffff800`046241bc : fffffa60`00000c3e fffffa60`017dfbb0 fffffa60`017dfc30 00000000`00000000 : nt!WheaReportHwError+0x243
fffffa60`017dfa30 fffff800`046bc731 : fffffa60`09e33c00 fffffa60`017dfc30 fffffa80`05906f00 00000000`00000000 : hal!HalpMcaExceptionHandler+0x114
fffffa60`017dfa70 fffff800`046bc575 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x71
fffffa60`017dfbb0 fffff800`0462811e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0xf5
fffffa60`09e33b78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalpQueryHpetCount+0x1c


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0x124_GenuineIntel__UNKNOWN

BUCKET_ID:  X64_0x124_GenuineIntel__UNKNOWN

Followup: MachineOwner
---------

rax=0000000000800400 rbx=fffffa800853b030 rcx=0000000000000124
rdx=0000000000000000 rsi=fffffa800853b150 rdi=0000000000000002
rip=fffff800046bd4d0 rsp=fffffa60017df958 rbp=fffffa800853b000
 r8=fffffa800853b030  r9=00000000be000000 r10=dbf3c493f1165eb6
r11=fffff8000461d000 r12=fffffa8006404010 r13=fffffa8008513720
r14=fffffa80064014e8 r15=0000000000000003
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
nt!KeBugCheckEx:
fffff800`046bd4d0 48894c2408      mov     qword ptr [rsp+8],rcx ss:fffffa60`017df960=0000000000000124
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffffa60`017df958 fffff800`046248ba : 00000000`00000124 00000000`00000000 fffffa80`0853b030 00000000`be000000 : nt!KeBugCheckEx
fffffa60`017df960 fffff800`047840a3 : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000001 : hal!HalBugCheckSystem+0x12e
fffffa60`017df9d0 fffff800`046241bc : fffffa60`00000c3e fffffa60`017dfbb0 fffffa60`017dfc30 00000000`00000000 : nt!WheaReportHwError+0x243
fffffa60`017dfa30 fffff800`046bc731 : fffffa60`09e33c00 fffffa60`017dfc30 fffffa80`05906f00 00000000`00000000 : hal!HalpMcaExceptionHandler+0x114
fffffa60`017dfa70 fffff800`046bc575 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x71
fffffa60`017dfbb0 fffff800`0462811e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0xf5 (TrapFrame @ fffffa60`017dfbb0)
fffffa60`09e33b78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalpQueryHpetCount+0x1c
start             end                 module name
fffff800`0461d000 fffff800`04663000   hal      hal.dll      Sat Apr 11 03:04:56 2009 (49E04118)
fffff800`04663000 fffff800`04b7a000   nt       ntkrnlmp.exe Tue Jun 08 10:59:47 2010 (4C0E5AE3)
fffff960`000f0000 fffff960`003a4000   win32k   win32k.sys   Tue Aug 31 10:57:22 2010 (4C7D1852)
fffff960`004f0000 fffff960`004fa000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`006e0000 fffff960`006f1000   cdd      cdd.dll      Thu Sep 24 21:26:38 2009 (4ABC1C4E)
fffffa60`00605000 fffffa60`0060f000   kdcom    kdcom.dll    Sat Apr 11 03:07:57 2009 (49E041CD)
fffffa60`0060f000 fffffa60`0064a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Apr 11 03:05:41 2009 (49E04145)
fffffa60`0064a000 fffffa60`0065e000   PSHED    PSHED.dll    Sat Apr 11 03:08:17 2009 (49E041E1)
fffffa60`0065e000 fffffa60`006bb000   CLFS     CLFS.SYS     Sat Apr 11 00:54:21 2009 (49E0227D)
fffffa60`006bb000 fffffa60`0076d000   CI       CI.dll       Sat Apr 11 03:08:09 2009 (49E041D9)
fffffa60`0076d000 fffffa60`007d3000   volmgrx  volmgrx.sys  Sat Apr 11 01:35:14 2009 (49E02C12)
fffffa60`007d3000 fffffa60`007f7000   ataport  ataport.SYS  Sat Apr 11 01:34:25 2009 (49E02BE1)
fffffa60`00801000 fffffa60`008db000   Wdf01000 Wdf01000.sys Sat Jan 19 01:33:27 2008 (479199B7)
fffffa60`008db000 fffffa60`008e9000   WDFLDR   WDFLDR.SYS   Sat Jan 19 01:32:33 2008 (47919981)
fffffa60`008e9000 fffffa60`0093f000   acpi     acpi.sys     Sat Apr 11 01:03:26 2009 (49E0249E)
fffffa60`0093f000 fffffa60`00948000   WMILIB   WMILIB.SYS   Sat Jan 19 01:33:45 2008 (479199C9)
fffffa60`00948000 fffffa60`00952000   msisadrv msisadrv.sys Sat Jan 19 01:02:50 2008 (4791928A)
fffffa60`00952000 fffffa60`00982000   pci      pci.sys      Sat Apr 11 01:03:33 2009 (49E024A5)
fffffa60`00982000 fffffa60`00997000   partmgr  partmgr.sys  Sat Apr 11 01:34:51 2009 (49E02BFB)
fffffa60`00997000 fffffa60`009ab000   volmgr   volmgr.sys   Sat Apr 11 01:34:49 2009 (49E02BF9)
fffffa60`009ab000 fffffa60`009b2000   pciide   pciide.sys   Sat Apr 11 01:34:28 2009 (49E02BE4)
fffffa60`009b2000 fffffa60`009c2000   PCIIDEX  PCIIDEX.SYS  Sat Apr 11 01:34:22 2009 (49E02BDE)
fffffa60`009c2000 fffffa60`009d5000   mountmgr mountmgr.sys Sat Jan 19 01:28:01 2008 (47919871)
fffffa60`009d5000 fffffa60`009dd000   atapi    atapi.sys    Sat Apr 11 01:34:19 2009 (49E02BDB)
fffffa60`00a00000 fffffa60`00a47000   fltmgr   fltmgr.sys   Sat Apr 11 00:54:38 2009 (49E0228E)
fffffa60`00a47000 fffffa60`00a5b000   fileinfo fileinfo.sys Sat Jan 19 01:05:23 2008 (47919323)
fffffa60`00a5b000 fffffa60`00ae2000   ksecdd   ksecdd.sys   Mon Jun 15 09:15:18 2009 (4A364966)
fffffa60`00ae2000 fffffa60`00b32000   msrpc    msrpc.sys    Sat Apr 11 01:32:13 2009 (49E02B5D)
fffffa60`00b32000 fffffa60`00b8b000   NETIO    NETIO.SYS    Sat Apr 11 01:43:34 2009 (49E02E06)
fffffa60`00b8b000 fffffa60`00b9e000   intelppm intelppm.sys Sat Jan 19 00:52:45 2008 (4791902D)
fffffa60`00b9e000 fffffa60`00bd9000   atikmpag atikmpag.sys Tue May 04 21:23:24 2010 (4BE0C88C)
fffffa60`00bd9000 fffffa60`00bfb000   AtiHdmi  AtiHdmi.sys  Tue Mar 09 05:08:21 2010 (4B961E15)
fffffa60`00c00000 fffffa60`00c09000   tunmp    tunmp.sys    Sat Jan 19 01:36:30 2008 (47919A6E)
fffffa60`00c09000 fffffa60`00dcc000   ndis     ndis.sys     Sat Apr 11 01:43:15 2009 (49E02DF3)
fffffa60`00dcc000 fffffa60`00df8000   CLASSPNP CLASSPNP.SYS Sat Apr 11 01:34:15 2009 (49E02BD7)
fffffa60`00e00000 fffffa60`00e0d000   tunnel   tunnel.sys   Thu Feb 18 06:59:46 2010 (4B7D2BB2)
fffffa60`00e0d000 fffffa60`00f83000   tcpip    tcpip.sys    Wed Jun 16 10:51:56 2010 (4C18E50C)
fffffa60`00f83000 fffffa60`00faf000   fwpkclnt fwpkclnt.sys Sat Apr 11 01:42:44 2009 (49E02DD4)
fffffa60`00faf000 fffffa60`00fdb000   ecache   ecache.sys   Sat Apr 11 01:36:18 2009 (49E02C52)
fffffa60`00fdb000 fffffa60`00fef000   disk     disk.sys     Sat Apr 11 01:34:38 2009 (49E02BEE)
fffffa60`0100f000 fffffa60`0118f000   Ntfs     Ntfs.sys     Sat Apr 11 00:55:38 2009 (49E022CA)
fffffa60`0118f000 fffffa60`011d3000   volsnap  volsnap.sys  Sat Apr 11 01:35:33 2009 (49E02C25)
fffffa60`011d3000 fffffa60`011db000   spldr    spldr.sys    Mon Jan 12 16:51:29 2009 (496BBB61)
fffffa60`011db000 fffffa60`011ed000   mup      mup.sys      Sat Apr 11 00:54:47 2009 (49E02297)
fffffa60`011ed000 fffffa60`011f7000   crcdisk  crcdisk.sys  Sat Jan 19 01:30:12 2008 (479198F4)
fffffa60`02200000 fffffa60`0225d000   storport storport.sys Sat Apr 11 01:34:45 2009 (49E02BF5)
fffffa60`0225d000 fffffa60`0226a000   TDI      TDI.SYS      Sat Apr 11 01:44:14 2009 (49E02E2E)
fffffa60`0226a000 fffffa60`0228d000   rasl2tp  rasl2tp.sys  Sat Apr 11 01:43:37 2009 (49E02E09)
fffffa60`0228d000 fffffa60`02299000   ndistapi ndistapi.sys Sat Jan 19 01:37:22 2008 (47919AA2)
fffffa60`02299000 fffffa60`022ca000   ndiswan  ndiswan.sys  Sat Apr 11 01:43:39 2009 (49E02E0B)
fffffa60`022ca000 fffffa60`022da000   raspppoe raspppoe.sys Sat Apr 11 01:43:33 2009 (49E02E05)
fffffa60`022da000 fffffa60`022f8000   raspptp  raspptp.sys  Sat Apr 11 01:43:38 2009 (49E02E0A)
fffffa60`022f8000 fffffa60`02310000   rassstp  rassstp.sys  Sat Apr 11 01:43:46 2009 (49E02E12)
fffffa60`02310000 fffffa60`02323000   termdd   termdd.sys   Sat Apr 11 01:48:13 2009 (49E02F1D)
fffffa60`02323000 fffffa60`02331000   kbdclass kbdclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`02331000 fffffa60`0233d000   mouclass mouclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`0233d000 fffffa60`0233e480   swenum   swenum.sys   Thu Nov 02 05:37:33 2006 (4549BC5D)
fffffa60`0233f000 fffffa60`02373000   ks       ks.sys       Sat Apr 11 01:33:51 2009 (49E02BBF)
fffffa60`02373000 fffffa60`0237e000   mssmbios mssmbios.sys Sat Jan 19 01:02:54 2008 (4791928E)
fffffa60`0237e000 fffffa60`0238e000   umbus    umbus.sys    Sat Jan 19 01:34:16 2008 (479199E8)
fffffa60`0238e000 fffffa60`023d6000   usbhub   usbhub.sys   Sat Apr 11 01:39:52 2009 (49E02D28)
fffffa60`023d6000 fffffa60`023e1000   mouhid   mouhid.sys   Sat Jan 19 01:28:10 2008 (4791987A)
fffffa60`023e1000 fffffa60`023e9000   wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
fffffa60`023e9000 fffffa60`023fd000   NDProxy  NDProxy.SYS  Sat Jan 19 01:37:26 2008 (47919AA6)
fffffa60`02609000 fffffa60`02cd4000   atikmdag atikmdag.sys Tue May 04 21:41:02 2010 (4BE0CCAE)
fffffa60`02cd4000 fffffa60`02db7000   dxgkrnl  dxgkrnl.sys  Thu Sep 24 21:27:15 2009 (4ABC1C73)
fffffa60`02db7000 fffffa60`02dc7000   watchdog watchdog.sys Sat Apr 11 01:09:16 2009 (49E025FC)
fffffa60`02dc7000 fffffa60`02e00000   msiscsi  msiscsi.sys  Sat Apr 11 01:36:09 2009 (49E02C49)
fffffa60`02e00000 fffffa60`02e07b80   HIDPARSE HIDPARSE.SYS Sat Jan 19 01:33:51 2008 (479199CF)
fffffa60`02e0e000 fffffa60`02efb000   HDAudBus HDAudBus.sys Sat Apr 11 01:39:38 2009 (49E02D1A)
fffffa60`02efb000 fffffa60`02f07000   usbuhci  usbuhci.sys  Sat Jan 19 01:33:56 2008 (479199D4)
fffffa60`02f07000 fffffa60`02f4d000   USBPORT  USBPORT.SYS  Sat Apr 11 01:39:39 2009 (49E02D1B)
fffffa60`02f4d000 fffffa60`02f5e000   usbehci  usbehci.sys  Sat Apr 11 01:39:36 2009 (49E02D18)
fffffa60`02f5e000 fffffa60`02fa4000   Rtlh64   Rtlh64.sys   Sun Nov 15 22:13:26 2009 (4B00C356)
fffffa60`02fa4000 fffffa60`02fb5b00   ohci1394 ohci1394.sys Sat Apr 11 01:39:49 2009 (49E02D25)
fffffa60`02fb6000 fffffa60`02fc5f00   1394BUS  1394BUS.SYS  Sat Jan 19 01:34:04 2008 (479199DC)
fffffa60`02fc6000 fffffa60`02fce000   ASACPI   ASACPI.sys   Mon Oct 30 22:09:12 2006 (4546B048)
fffffa60`02fce000 fffffa60`02fea000   cdrom    cdrom.sys    Sat Apr 11 01:34:39 2009 (49E02BEF)
fffffa60`02fea000 fffffa60`02feca00   wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
fffffa60`02fed000 fffffa60`02fff000   HIDCLASS HIDCLASS.SYS Sat Apr 11 01:39:32 2009 (49E02D14)
fffffa60`04808000 fffffa60`04843000   portcls  portcls.sys  Sat Apr 11 01:39:36 2009 (49E02D18)
fffffa60`04843000 fffffa60`04866000   drmk     drmk.sys     Sat Jan 19 02:20:04 2008 (4791A4A4)
fffffa60`04866000 fffffa60`0486b180   ksthunk  ksthunk.sys  Sat Jan 19 01:28:14 2008 (4791987E)
fffffa60`0486c000 fffffa60`048b5000   HdAudio  HdAudio.sys  Sat Apr 11 01:39:51 2009 (49E02D27)
fffffa60`048b5000 fffffa60`048bf000   Fs_Rec   Fs_Rec.SYS   Sat Jan 19 00:53:41 2008 (47919065)
fffffa60`048bf000 fffffa60`048c8000   Null     Null.SYS     Thu Nov 02 05:37:15 2006 (4549BC4B)
fffffa60`048e9000 fffffa60`048f7000   vga      vga.sys      Sat Jan 19 01:32:21 2008 (47919975)
fffffa60`048f7000 fffffa60`0491c000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 01:32:25 2008 (47919979)
fffffa60`0491c000 fffffa60`04925000   RDPCDD   RDPCDD.sys   Sat Jan 19 01:42:04 2008 (47919BBC)
fffffa60`04925000 fffffa60`0492e000   rdpencdd rdpencdd.sys Sat Jan 19 01:42:03 2008 (47919BBB)
fffffa60`0492e000 fffffa60`04939000   Msfs     Msfs.SYS     Sat Jan 19 00:53:55 2008 (47919073)
fffffa60`04939000 fffffa60`0494a000   Npfs     Npfs.SYS     Sat Apr 11 00:54:22 2009 (49E0227E)
fffffa60`0494a000 fffffa60`04953000   rasacd   rasacd.sys   Sat Jan 19 01:37:30 2008 (47919AAA)
fffffa60`04953000 fffffa60`04970000   tdx      tdx.sys      Sat Apr 11 01:43:00 2009 (49E02DE4)
fffffa60`04970000 fffffa60`049b4000   netbt    netbt.sys    Sat Apr 11 01:42:31 2009 (49E02DC7)
fffffa60`049b4000 fffffa60`049cf000   smb      smb.sys      Sat Apr 11 01:42:19 2009 (49E02DBB)
fffffa60`049cf000 fffffa60`049ee000   mrxsmb20 mrxsmb20.sys Tue Feb 23 06:32:20 2010 (4B83BCC4)
fffffa60`04a0c000 fffffa60`04f35000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffffa60`04f35000 fffffa60`04fa0000   afd      afd.sys      Sat Apr 11 01:44:21 2009 (49E02E35)
fffffa60`04fa0000 fffffa60`04fbe000   pacer    pacer.sys    Sat Apr 11 01:42:56 2009 (49E02DE0)
fffffa60`04fbe000 fffffa60`04fcd000   netbios  netbios.sys  Sat Jan 19 01:36:35 2008 (47919A73)
fffffa60`04fcd000 fffffa60`04fe8000   wanarp   wanarp.sys   Sat Apr 11 01:43:38 2009 (49E02E0A)
fffffa60`0500d000 fffffa60`0505a000   rdbss    rdbss.sys    Sat Apr 11 00:55:21 2009 (49E022B9)
fffffa60`0505a000 fffffa60`05066000   nsiproxy nsiproxy.sys Sat Jan 19 01:36:45 2008 (47919A7D)
fffffa60`05066000 fffffa60`05083000   dfsc     dfsc.sys     Sat Apr 11 00:54:44 2009 (49E02294)
fffffa60`05083000 fffffa60`050a5000   avipbb   avipbb.sys   Mon Feb 22 05:08:50 2010 (4B8257B2)
fffffa60`050a5000 fffffa60`050ac000   AsIO     AsIO.sys     Mon Dec 17 04:11:49 2007 (47663D55)
fffffa60`050ac000 fffffa60`050c8000   usbccgp  usbccgp.sys  Sat Jan 19 01:34:04 2008 (479199DC)
fffffa60`050c8000 fffffa60`050c9e00   USBD     USBD.SYS     Sat Jan 19 01:33:53 2008 (479199D1)
fffffa60`050ca000 fffffa60`050d3000   hidusb   hidusb.sys   Sat Apr 11 01:39:32 2009 (49E02D14)
fffffa60`050d3000 fffffa60`050de000   kbdhid   kbdhid.sys   Sat Apr 11 01:33:40 2009 (49E02BB4)
fffffa60`050de000 fffffa60`050ec000   crashdmp crashdmp.sys Sat Apr 11 01:34:31 2009 (49E02BE7)
fffffa60`050ec000 fffffa60`050f8000   dump_dumpata dump_dumpata.sys Sat Apr 11 01:34:22 2009 (49E02BDE)
fffffa60`050f8000 fffffa60`05100000   dump_atapi dump_atapi.sys Sat Apr 11 01:34:19 2009 (49E02BDB)
fffffa60`05109000 fffffa60`05119000   usbscan  usbscan.sys  Sat Jan 19 02:09:56 2008 (4791A244)
fffffa60`05119000 fffffa60`05125000   Dxapi    Dxapi.sys    Sat Jan 19 01:08:00 2008 (479193C0)
fffffa60`05125000 fffffa60`05138000   monitor  monitor.sys  Sat Jan 19 01:32:34 2008 (47919982)
fffffa60`05138000 fffffa60`0515a000   luafv    luafv.sys    Sat Jan 19 00:59:06 2008 (479191AA)
fffffa60`0515a000 fffffa60`05177000   avgntflt avgntflt.sys Thu Feb 11 10:12:02 2010 (4B741E42)
fffffa60`05177000 fffffa60`051a0000   mrxsmb   mrxsmb.sys   Tue Feb 23 06:32:22 2010 (4B83BCC6)
fffffa60`051a0000 fffffa60`051e9000   mrxsmb10 mrxsmb10.sys Tue Feb 23 06:32:21 2010 (4B83BCC5)
fffffa60`06c00000 fffffa60`06c9a000   spsys    spsys.sys    Tue Mar 10 13:16:43 2009 (49B6A07B)
fffffa60`06c9a000 fffffa60`06cae000   lltdio   lltdio.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`06cae000 fffffa60`06cc6000   rspndr   rspndr.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`06cc6000 fffffa60`06d69000   HTTP     HTTP.sys     Sat Feb 20 16:30:05 2010 (4B80545D)
fffffa60`06d69000 fffffa60`06d92000   srvnet   srvnet.sys   Mon Sep 06 11:33:48 2010 (4C8509DC)
fffffa60`06d92000 fffffa60`06db0000   bowser   bowser.sys   Sat Jan 19 00:54:51 2008 (479190AB)
fffffa60`06db0000 fffffa60`06dca000   mpsdrv   mpsdrv.sys   Sat Jan 19 01:35:28 2008 (47919A30)
fffffa60`06dca000 fffffa60`06df1000   mrxdav   mrxdav.sys   Sat Apr 11 00:55:42 2009 (49E022CE)
fffffa60`07605000 fffffa60`07637000   srv2     srv2.sys     Mon Sep 06 11:33:50 2010 (4C8509DE)
fffffa60`07637000 fffffa60`076cb000   srv      srv.sys      Mon Sep 06 11:34:12 2010 (4C8509F4)
fffffa60`076cb000 fffffa60`076d6000   asyncmac asyncmac.sys Sat Jan 19 01:37:27 2008 (47919AA7)
fffffa60`076d6000 fffffa60`0778c000   peauth   peauth.sys   Mon Oct 23 07:57:00 2006 (453CAE0C)
fffffa60`0778c000 fffffa60`07797000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffffa60`07797000 fffffa60`077a7000   tcpipreg tcpipreg.sys Tue Dec 08 12:55:32 2009 (4B1E9314)
fffffa60`077a7000 fffffa60`077c3000   cdfs     cdfs.sys     Sat Jan 19 00:53:45 2008 (47919069)

Unloaded modules:
fffffa60`05100000 fffffa60`05109000   wacmoumonito
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffffa60`01000000 fffffa60`0100e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffffa60`00fef000 fffffa60`00ffb000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffffa60`011f7000 fffffa60`011ff000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffffa60`048d3000 fffffa60`048e9000   i8042prt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffffa60`048c8000 fffffa60`048d3000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
start             end                 module name
fffffa60`02fb6000 fffffa60`02fc5f00   1394BUS  1394BUS.SYS  Sat Jan 19 01:34:04 2008 (479199DC)
fffffa60`008e9000 fffffa60`0093f000   acpi     acpi.sys     Sat Apr 11 01:03:26 2009 (49E0249E)
fffffa60`04f35000 fffffa60`04fa0000   afd      afd.sys      Sat Apr 11 01:44:21 2009 (49E02E35)
fffffa60`02fc6000 fffffa60`02fce000   ASACPI   ASACPI.sys   Mon Oct 30 22:09:12 2006 (4546B048)
fffffa60`050a5000 fffffa60`050ac000   AsIO     AsIO.sys     Mon Dec 17 04:11:49 2007 (47663D55)
fffffa60`076cb000 fffffa60`076d6000   asyncmac asyncmac.sys Sat Jan 19 01:37:27 2008 (47919AA7)
fffffa60`009d5000 fffffa60`009dd000   atapi    atapi.sys    Sat Apr 11 01:34:19 2009 (49E02BDB)
fffffa60`007d3000 fffffa60`007f7000   ataport  ataport.SYS  Sat Apr 11 01:34:25 2009 (49E02BE1)
fffffa60`00bd9000 fffffa60`00bfb000   AtiHdmi  AtiHdmi.sys  Tue Mar 09 05:08:21 2010 (4B961E15)
fffffa60`02609000 fffffa60`02cd4000   atikmdag atikmdag.sys Tue May 04 21:41:02 2010 (4BE0CCAE)
fffffa60`00b9e000 fffffa60`00bd9000   atikmpag atikmpag.sys Tue May 04 21:23:24 2010 (4BE0C88C)
fffffa60`0515a000 fffffa60`05177000   avgntflt avgntflt.sys Thu Feb 11 10:12:02 2010 (4B741E42)
fffffa60`05083000 fffffa60`050a5000   avipbb   avipbb.sys   Mon Feb 22 05:08:50 2010 (4B8257B2)
fffffa60`06d92000 fffffa60`06db0000   bowser   bowser.sys   Sat Jan 19 00:54:51 2008 (479190AB)
fffff960`006e0000 fffff960`006f1000   cdd      cdd.dll      Thu Sep 24 21:26:38 2009 (4ABC1C4E)
fffffa60`077a7000 fffffa60`077c3000   cdfs     cdfs.sys     Sat Jan 19 00:53:45 2008 (47919069)
fffffa60`02fce000 fffffa60`02fea000   cdrom    cdrom.sys    Sat Apr 11 01:34:39 2009 (49E02BEF)
fffffa60`006bb000 fffffa60`0076d000   CI       CI.dll       Sat Apr 11 03:08:09 2009 (49E041D9)
fffffa60`00dcc000 fffffa60`00df8000   CLASSPNP CLASSPNP.SYS Sat Apr 11 01:34:15 2009 (49E02BD7)
fffffa60`0065e000 fffffa60`006bb000   CLFS     CLFS.SYS     Sat Apr 11 00:54:21 2009 (49E0227D)
fffffa60`050de000 fffffa60`050ec000   crashdmp crashdmp.sys Sat Apr 11 01:34:31 2009 (49E02BE7)
fffffa60`011ed000 fffffa60`011f7000   crcdisk  crcdisk.sys  Sat Jan 19 01:30:12 2008 (479198F4)
fffffa60`05066000 fffffa60`05083000   dfsc     dfsc.sys     Sat Apr 11 00:54:44 2009 (49E02294)
fffffa60`00fdb000 fffffa60`00fef000   disk     disk.sys     Sat Apr 11 01:34:38 2009 (49E02BEE)
fffffa60`04843000 fffffa60`04866000   drmk     drmk.sys     Sat Jan 19 02:20:04 2008 (4791A4A4)
fffffa60`050f8000 fffffa60`05100000   dump_atapi dump_atapi.sys Sat Apr 11 01:34:19 2009 (49E02BDB)
fffffa60`050ec000 fffffa60`050f8000   dump_dumpata dump_dumpata.sys Sat Apr 11 01:34:22 2009 (49E02BDE)
fffffa60`05119000 fffffa60`05125000   Dxapi    Dxapi.sys    Sat Jan 19 01:08:00 2008 (479193C0)
fffffa60`02cd4000 fffffa60`02db7000   dxgkrnl  dxgkrnl.sys  Thu Sep 24 21:27:15 2009 (4ABC1C73)
fffffa60`00faf000 fffffa60`00fdb000   ecache   ecache.sys   Sat Apr 11 01:36:18 2009 (49E02C52)
fffffa60`00a47000 fffffa60`00a5b000   fileinfo fileinfo.sys Sat Jan 19 01:05:23 2008 (47919323)
fffffa60`00a00000 fffffa60`00a47000   fltmgr   fltmgr.sys   Sat Apr 11 00:54:38 2009 (49E0228E)
fffffa60`048b5000 fffffa60`048bf000   Fs_Rec   Fs_Rec.SYS   Sat Jan 19 00:53:41 2008 (47919065)
fffffa60`00f83000 fffffa60`00faf000   fwpkclnt fwpkclnt.sys Sat Apr 11 01:42:44 2009 (49E02DD4)
fffff800`0461d000 fffff800`04663000   hal      hal.dll      Sat Apr 11 03:04:56 2009 (49E04118)
fffffa60`02e0e000 fffffa60`02efb000   HDAudBus HDAudBus.sys Sat Apr 11 01:39:38 2009 (49E02D1A)
fffffa60`0486c000 fffffa60`048b5000   HdAudio  HdAudio.sys  Sat Apr 11 01:39:51 2009 (49E02D27)
fffffa60`02fed000 fffffa60`02fff000   HIDCLASS HIDCLASS.SYS Sat Apr 11 01:39:32 2009 (49E02D14)
fffffa60`02e00000 fffffa60`02e07b80   HIDPARSE HIDPARSE.SYS Sat Jan 19 01:33:51 2008 (479199CF)
fffffa60`050ca000 fffffa60`050d3000   hidusb   hidusb.sys   Sat Apr 11 01:39:32 2009 (49E02D14)
fffffa60`06cc6000 fffffa60`06d69000   HTTP     HTTP.sys     Sat Feb 20 16:30:05 2010 (4B80545D)
fffffa60`00b8b000 fffffa60`00b9e000   intelppm intelppm.sys Sat Jan 19 00:52:45 2008 (4791902D)
fffffa60`02323000 fffffa60`02331000   kbdclass kbdclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`050d3000 fffffa60`050de000   kbdhid   kbdhid.sys   Sat Apr 11 01:33:40 2009 (49E02BB4)
fffffa60`00605000 fffffa60`0060f000   kdcom    kdcom.dll    Sat Apr 11 03:07:57 2009 (49E041CD)
fffffa60`04a0c000 fffffa60`04f35000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffffa60`0233f000 fffffa60`02373000   ks       ks.sys       Sat Apr 11 01:33:51 2009 (49E02BBF)
fffffa60`00a5b000 fffffa60`00ae2000   ksecdd   ksecdd.sys   Mon Jun 15 09:15:18 2009 (4A364966)
fffffa60`04866000 fffffa60`0486b180   ksthunk  ksthunk.sys  Sat Jan 19 01:28:14 2008 (4791987E)
fffffa60`06c9a000 fffffa60`06cae000   lltdio   lltdio.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`05138000 fffffa60`0515a000   luafv    luafv.sys    Sat Jan 19 00:59:06 2008 (479191AA)
fffffa60`0060f000 fffffa60`0064a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Apr 11 03:05:41 2009 (49E04145)
fffffa60`05125000 fffffa60`05138000   monitor  monitor.sys  Sat Jan 19 01:32:34 2008 (47919982)
fffffa60`02331000 fffffa60`0233d000   mouclass mouclass.sys Sat Jan 19 01:28:05 2008 (47919875)
fffffa60`023d6000 fffffa60`023e1000   mouhid   mouhid.sys   Sat Jan 19 01:28:10 2008 (4791987A)
fffffa60`009c2000 fffffa60`009d5000   mountmgr mountmgr.sys Sat Jan 19 01:28:01 2008 (47919871)
fffffa60`06db0000 fffffa60`06dca000   mpsdrv   mpsdrv.sys   Sat Jan 19 01:35:28 2008 (47919A30)
fffffa60`06dca000 fffffa60`06df1000   mrxdav   mrxdav.sys   Sat Apr 11 00:55:42 2009 (49E022CE)
fffffa60`05177000 fffffa60`051a0000   mrxsmb   mrxsmb.sys   Tue Feb 23 06:32:22 2010 (4B83BCC6)
fffffa60`051a0000 fffffa60`051e9000   mrxsmb10 mrxsmb10.sys Tue Feb 23 06:32:21 2010 (4B83BCC5)
fffffa60`049cf000 fffffa60`049ee000   mrxsmb20 mrxsmb20.sys Tue Feb 23 06:32:20 2010 (4B83BCC4)
fffffa60`0492e000 fffffa60`04939000   Msfs     Msfs.SYS     Sat Jan 19 00:53:55 2008 (47919073)
fffffa60`00948000 fffffa60`00952000   msisadrv msisadrv.sys Sat Jan 19 01:02:50 2008 (4791928A)
fffffa60`02dc7000 fffffa60`02e00000   msiscsi  msiscsi.sys  Sat Apr 11 01:36:09 2009 (49E02C49)
fffffa60`00ae2000 fffffa60`00b32000   msrpc    msrpc.sys    Sat Apr 11 01:32:13 2009 (49E02B5D)
fffffa60`02373000 fffffa60`0237e000   mssmbios mssmbios.sys Sat Jan 19 01:02:54 2008 (4791928E)
fffffa60`011db000 fffffa60`011ed000   mup      mup.sys      Sat Apr 11 00:54:47 2009 (49E02297)
fffffa60`00c09000 fffffa60`00dcc000   ndis     ndis.sys     Sat Apr 11 01:43:15 2009 (49E02DF3)
fffffa60`0228d000 fffffa60`02299000   ndistapi ndistapi.sys Sat Jan 19 01:37:22 2008 (47919AA2)
fffffa60`02299000 fffffa60`022ca000   ndiswan  ndiswan.sys  Sat Apr 11 01:43:39 2009 (49E02E0B)
fffffa60`023e9000 fffffa60`023fd000   NDProxy  NDProxy.SYS  Sat Jan 19 01:37:26 2008 (47919AA6)
fffffa60`04fbe000 fffffa60`04fcd000   netbios  netbios.sys  Sat Jan 19 01:36:35 2008 (47919A73)
fffffa60`04970000 fffffa60`049b4000   netbt    netbt.sys    Sat Apr 11 01:42:31 2009 (49E02DC7)
fffffa60`00b32000 fffffa60`00b8b000   NETIO    NETIO.SYS    Sat Apr 11 01:43:34 2009 (49E02E06)
fffffa60`04939000 fffffa60`0494a000   Npfs     Npfs.SYS     Sat Apr 11 00:54:22 2009 (49E0227E)
fffffa60`0505a000 fffffa60`05066000   nsiproxy nsiproxy.sys Sat Jan 19 01:36:45 2008 (47919A7D)
fffff800`04663000 fffff800`04b7a000   nt       ntkrnlmp.exe Tue Jun 08 10:59:47 2010 (4C0E5AE3)
fffffa60`0100f000 fffffa60`0118f000   Ntfs     Ntfs.sys     Sat Apr 11 00:55:38 2009 (49E022CA)
fffffa60`048bf000 fffffa60`048c8000   Null     Null.SYS     Thu Nov 02 05:37:15 2006 (4549BC4B)
fffffa60`02fa4000 fffffa60`02fb5b00   ohci1394 ohci1394.sys Sat Apr 11 01:39:49 2009 (49E02D25)
fffffa60`04fa0000 fffffa60`04fbe000   pacer    pacer.sys    Sat Apr 11 01:42:56 2009 (49E02DE0)
fffffa60`00982000 fffffa60`00997000   partmgr  partmgr.sys  Sat Apr 11 01:34:51 2009 (49E02BFB)
fffffa60`00952000 fffffa60`00982000   pci      pci.sys      Sat Apr 11 01:03:33 2009 (49E024A5)
fffffa60`009ab000 fffffa60`009b2000   pciide   pciide.sys   Sat Apr 11 01:34:28 2009 (49E02BE4)
fffffa60`009b2000 fffffa60`009c2000   PCIIDEX  PCIIDEX.SYS  Sat Apr 11 01:34:22 2009 (49E02BDE)
fffffa60`076d6000 fffffa60`0778c000   peauth   peauth.sys   Mon Oct 23 07:57:00 2006 (453CAE0C)
fffffa60`04808000 fffffa60`04843000   portcls  portcls.sys  Sat Apr 11 01:39:36 2009 (49E02D18)
fffffa60`0064a000 fffffa60`0065e000   PSHED    PSHED.dll    Sat Apr 11 03:08:17 2009 (49E041E1)
fffffa60`0494a000 fffffa60`04953000   rasacd   rasacd.sys   Sat Jan 19 01:37:30 2008 (47919AAA)
fffffa60`0226a000 fffffa60`0228d000   rasl2tp  rasl2tp.sys  Sat Apr 11 01:43:37 2009 (49E02E09)
fffffa60`022ca000 fffffa60`022da000   raspppoe raspppoe.sys Sat Apr 11 01:43:33 2009 (49E02E05)
fffffa60`022da000 fffffa60`022f8000   raspptp  raspptp.sys  Sat Apr 11 01:43:38 2009 (49E02E0A)
fffffa60`022f8000 fffffa60`02310000   rassstp  rassstp.sys  Sat Apr 11 01:43:46 2009 (49E02E12)
fffffa60`0500d000 fffffa60`0505a000   rdbss    rdbss.sys    Sat Apr 11 00:55:21 2009 (49E022B9)
fffffa60`0491c000 fffffa60`04925000   RDPCDD   RDPCDD.sys   Sat Jan 19 01:42:04 2008 (47919BBC)
fffffa60`04925000 fffffa60`0492e000   rdpencdd rdpencdd.sys Sat Jan 19 01:42:03 2008 (47919BBB)
fffffa60`06cae000 fffffa60`06cc6000   rspndr   rspndr.sys   Sat Jan 19 01:35:48 2008 (47919A44)
fffffa60`02f5e000 fffffa60`02fa4000   Rtlh64   Rtlh64.sys   Sun Nov 15 22:13:26 2009 (4B00C356)
fffffa60`0778c000 fffffa60`07797000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffffa60`049b4000 fffffa60`049cf000   smb      smb.sys      Sat Apr 11 01:42:19 2009 (49E02DBB)
fffffa60`011d3000 fffffa60`011db000   spldr    spldr.sys    Mon Jan 12 16:51:29 2009 (496BBB61)
fffffa60`06c00000 fffffa60`06c9a000   spsys    spsys.sys    Tue Mar 10 13:16:43 2009 (49B6A07B)
fffffa60`07637000 fffffa60`076cb000   srv      srv.sys      Mon Sep 06 11:34:12 2010 (4C8509F4)
fffffa60`07605000 fffffa60`07637000   srv2     srv2.sys     Mon Sep 06 11:33:50 2010 (4C8509DE)
fffffa60`06d69000 fffffa60`06d92000   srvnet   srvnet.sys   Mon Sep 06 11:33:48 2010 (4C8509DC)
fffffa60`02200000 fffffa60`0225d000   storport storport.sys Sat Apr 11 01:34:45 2009 (49E02BF5)
fffffa60`0233d000 fffffa60`0233e480   swenum   swenum.sys   Thu Nov 02 05:37:33 2006 (4549BC5D)
fffffa60`00e0d000 fffffa60`00f83000   tcpip    tcpip.sys    Wed Jun 16 10:51:56 2010 (4C18E50C)
fffffa60`07797000 fffffa60`077a7000   tcpipreg tcpipreg.sys Tue Dec 08 12:55:32 2009 (4B1E9314)
fffffa60`0225d000 fffffa60`0226a000   TDI      TDI.SYS      Sat Apr 11 01:44:14 2009 (49E02E2E)
fffffa60`04953000 fffffa60`04970000   tdx      tdx.sys      Sat Apr 11 01:43:00 2009 (49E02DE4)
fffffa60`02310000 fffffa60`02323000   termdd   termdd.sys   Sat Apr 11 01:48:13 2009 (49E02F1D)
fffff960`004f0000 fffff960`004fa000   TSDDD    TSDDD.dll    unavailable (00000000)
fffffa60`00c00000 fffffa60`00c09000   tunmp    tunmp.sys    Sat Jan 19 01:36:30 2008 (47919A6E)
fffffa60`00e00000 fffffa60`00e0d000   tunnel   tunnel.sys   Thu Feb 18 06:59:46 2010 (4B7D2BB2)
fffffa60`0237e000 fffffa60`0238e000   umbus    umbus.sys    Sat Jan 19 01:34:16 2008 (479199E8)
fffffa60`050ac000 fffffa60`050c8000   usbccgp  usbccgp.sys  Sat Jan 19 01:34:04 2008 (479199DC)
fffffa60`050c8000 fffffa60`050c9e00   USBD     USBD.SYS     Sat Jan 19 01:33:53 2008 (479199D1)
fffffa60`02f4d000 fffffa60`02f5e000   usbehci  usbehci.sys  Sat Apr 11 01:39:36 2009 (49E02D18)
fffffa60`0238e000 fffffa60`023d6000   usbhub   usbhub.sys   Sat Apr 11 01:39:52 2009 (49E02D28)
fffffa60`02f07000 fffffa60`02f4d000   USBPORT  USBPORT.SYS  Sat Apr 11 01:39:39 2009 (49E02D1B)
fffffa60`05109000 fffffa60`05119000   usbscan  usbscan.sys  Sat Jan 19 02:09:56 2008 (4791A244)
fffffa60`02efb000 fffffa60`02f07000   usbuhci  usbuhci.sys  Sat Jan 19 01:33:56 2008 (479199D4)
fffffa60`048e9000 fffffa60`048f7000   vga      vga.sys      Sat Jan 19 01:32:21 2008 (47919975)
fffffa60`048f7000 fffffa60`0491c000   VIDEOPRT VIDEOPRT.SYS Sat Jan 19 01:32:25 2008 (47919979)
fffffa60`00997000 fffffa60`009ab000   volmgr   volmgr.sys   Sat Apr 11 01:34:49 2009 (49E02BF9)
fffffa60`0076d000 fffffa60`007d3000   volmgrx  volmgrx.sys  Sat Apr 11 01:35:14 2009 (49E02C12)
fffffa60`0118f000 fffffa60`011d3000   volsnap  volsnap.sys  Sat Apr 11 01:35:33 2009 (49E02C25)
fffffa60`023e1000 fffffa60`023e9000   wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
fffffa60`02fea000 fffffa60`02feca00   wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
fffffa60`04fcd000 fffffa60`04fe8000   wanarp   wanarp.sys   Sat Apr 11 01:43:38 2009 (49E02E0A)
fffffa60`02db7000 fffffa60`02dc7000   watchdog watchdog.sys Sat Apr 11 01:09:16 2009 (49E025FC)
fffffa60`00801000 fffffa60`008db000   Wdf01000 Wdf01000.sys Sat Jan 19 01:33:27 2008 (479199B7)
fffffa60`008db000 fffffa60`008e9000   WDFLDR   WDFLDR.SYS   Sat Jan 19 01:32:33 2008 (47919981)
fffff960`000f0000 fffff960`003a4000   win32k   win32k.sys   Tue Aug 31 10:57:22 2010 (4C7D1852)
fffffa60`0093f000 fffffa60`00948000   WMILIB   WMILIB.SYS   Sat Jan 19 01:33:45 2008 (479199C9)

Unloaded modules:
fffffa60`05100000 fffffa60`05109000   wacmoumonito
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffffa60`01000000 fffffa60`0100e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffffa60`00fef000 fffffa60`00ffb000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffffa60`011f7000 fffffa60`011ff000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffffa60`048d3000 fffffa60`048e9000   i8042prt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffffa60`048c8000 fffffa60`048d3000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
Bugcheck code 00000124
Arguments 00000000`00000000 fffffa80`0853b030 00000000`be000000 00000000`00800400
 

My Computer

System One

Ah hah - sp1 / sp2 good spot.

So finding the files on my computer, it looks like they are a little later than the ones from the table; (Not sure how to check for the x64 on the end)
hal.dll 6.0.6002.18005 227KB 11/04/2009
hal.inf N/A 2.85KB 28/05/2009
Whealogr.dll 6.0.6002.18005 32.5KB 11/04/2009

System
Its a 550W Cooler Master PSU and case , Asus P6TSE motherboard and an ATI HD7840, with 6 gig of ram. I haven't changed any of the main hardware since buying the pc. I have added peripherals, Wacom Tablet / 3d Spacemouse / Canon Scanner, but these are all USB so not really a huge power draw (?)

Asus Suite Drivers
Have to bear with me here , Asus's site is horribily slow at the moment
I did also try to update my BIOS as well, but the bios utility (when in bios ) would not read the file, so it looks like I need to revisit these two areas.

Wacom Tablet
Tablet driver updated

Kaspersky
Tool has run
Had use the "Remove all known products choice"
Having run that, Avira popped up with 19 instances of malware found, realting to "UnKIS.vbs..."
I can confirm that the file kl1 has been removed having checked in the directory

Ok I'll check the STOP 0x124 link.

Thanks
 
Last edited:

My Computer

System One

Yes, I was having trouble with the Asus website myself.
What make is the 550 watt PSU?

If your version numbers and dates are later on the files - then you've got the updates.
It's not easy to check for the x64 (and not necessary as you have an x64 OS).

Don't forget to check in C:\Windows\System32\driver to be sure that the Kaspersky driver is gone.
If kl1.sys is still there, rename it to kl1.BAK, reboot, and check to make sure that it hasn't respawned itself.

EDIT: FWIW - my P6T Deluxe mobo had power issues for the longest time (I used it with the beta of Win7). I finally upgraded to the P6T Deluxe v2 and my issues are gone.
 

My Computer

System One

It is a Cooler Master 500 RS-500 PCAP-A3 in a Coolermaster chassis as well.

I have looked for the kl1 file in the system32/drivers folder, just to double check that its driverS i.e. plural, I can find no driver (singular) folder on my machine as per your post ! :D and yes it has gone.

Thankyou so much for your help so far, I'm away until the back end of this week from now , so I'll get onto the Asus stuff when I get back
 

My Computer

System One

So in order of the last couple of days events...

Machine hung, so the previous changes seem not to have fixed the problem.

Ran full scan using Avira - Nothing found
Ran scan using Malwarebytes - Nothing found
Ran ccleaner - fixed various issues

Updated ATK0110 driver
Driver Date 05/05/2009 Version 1043.6.0.0 I managed to do this in Device Manager

Updated Asus suite
Have tried to update my BIOS, I'm on verison 0402 but each time I try read the file it say "Boot block is not valid" Tried redownloading file but I get the same problem.

Machine did not hang but rather rebooted itself while idle

Installed latest version of PCProbe, installed ok but went to start it and I got an "Abnormal program termination" This is under my user log in, it works under my Admin account but not my normal user.

Regarding ASACPI.sys and AsIO.sys , I can't find these files on my computer, I've searched C:\ for *.sys and only three .sys files turn up neither of which are these files.

I have looked at the "STOP 0x124 link" and amongst other thing I need to update my BIOS, I need to get past this invalid Boot block.
 

My Computer

System One

managed to get past the boot block. It seems that it gives this error when you try to read from the harddrive, I copied it to a USB stick and it read fine. I think I'm updated to the latest bios then (0808).
 

My Computer

System One

You must log in or register to reply here.
Back
Top