Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini010310-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/downloads/symbols Executable search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp3_gdr.090804-1435 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720 Debug session time: Sat Jan 2 23:49:38.750 2010 (GMT+1) System Uptime: 0 days 10:15:34.750 Loading Kernel Symbols ............................................................... ................................................ Loading User Symbols Loading unloaded module list ................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, b428af19, b2778860, 0} Probably caused by : tcpip.sys ( tcpip!CloseTCB+17f ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: b428af19, The address that the exception occurred at Arg3: b2778860, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruksjonen i "0x%08lx" refererte til adresse "0x%08lx". Minnet kunne ikke v re "%s". FAULTING_IP: tcpip!CloseTCB+17f b428af19 ff7704 push dword ptr [edi+4] TRAP_FRAME: b2778860 -- (.trap 0xffffffffb2778860) ErrCode = 00000000 eax=00000000 ebx=806e6900 ecx=00000000 edx=00000000 esi=87b81920 edi=0000000c eip=b428af19 esp=b27788d4 ebp=b27788f4 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 tcpip!CloseTCB+0x17f: b428af19 ff7704 push dword ptr [edi+4] ds:0023:00000010=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: BitLord.exe LAST_CONTROL_TRANSFER: from b427e80a to b428af19 STACK_TEXT: b27788f4 b427e80a f8b81920 b2778900 b2778928 tcpip!CloseTCB+0x17f b2778904 b427e7ee 87b81920 00000040 b2778900 tcpip!TryToCloseTCB+0x38 b2778928 b427a1ac b2778900 00000000 00000002 tcpip!TdiDisconnect+0x205 b2778974 b427a0cb 89ce2850 00000000 8886b688 tcpip!TCPDisconnect+0xfd b2778990 804ef19f 8a83b5e0 89ce2850 89ce2850 tcpip!TCPDispatchInternalDeviceControl+0x14d b27789a0 b41e6cd9 00000000 8886b668 89db44f8 nt!IopfCallDriver+0x31 b27789c4 b41eb2bd 8a83b5e0 88a52eb0 8886b668 afd!AfdBeginAbort+0x1f3 b27789f0 b41e415a 8886b668 88a52ee8 88a52fa3 afd!AfdProcessBufferSend+0x4c b2778a08 804f16c0 88a52e04 00000000 804f16c0 afd!AfdRestartBufferSend+0x28 b2778a44 b4273942 88a52fa0 88a52ee8 8794efc0 nt!IopfCompleteRequest+0xa2 b2778a5c b4299195 88a52ee8 c0000184 00000000 tcpip!TCPDataRequestComplete+0xa6 b2778a8c b42757b6 88a52ee8 8794efe4 88a52eb0 tcpip!TCPSendData+0xa6 b2778aa8 804ef19f 8a83b5e0 88a52ee8 8886b668 tcpip!TCPDispatchInternalDeviceControl+0x51 b2778ab8 b41e42c9 00000000 00000008 b2778b1c nt!IopfCallDriver+0x31 b2778b10 b41da575 89db44f8 0012f484 b41da575 afd!AfdFastConnectionSend+0x209 b2778c5c 80580487 87997028 00000001 0012f3b8 afd!AfdFastIoDeviceControl+0x415 b2778d00 80579274 000016ac 00000228 00000000 nt!IopXxxControlFile+0x255 b2778d34 8054162c 000016ac 00000228 00000000 nt!NtDeviceIoControlFile+0x2a b2778d34 7c90e514 000016ac 00000228 00000000 nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 0012f408 00000000 00000000 00000000 00000000 0x7c90e514 STACK_COMMAND: kb FOLLOWUP_IP: tcpip!CloseTCB+17f b428af19 ff7704 push dword ptr [edi+4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: tcpip!CloseTCB+17f FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 485b99ad FAILURE_BUCKET_ID: 0x8E_tcpip!CloseTCB+17f BUCKET_ID: 0x8E_tcpip!CloseTCB+17f Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: b428af19, The address that the exception occurred at Arg3: b2778860, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruksjonen i "0x%08lx" refererte til adresse "0x%08lx". Minnet kunne ikke v re "%s". FAULTING_IP: tcpip!CloseTCB+17f b428af19 ff7704 push dword ptr [edi+4] TRAP_FRAME: b2778860 -- (.trap 0xffffffffb2778860) ErrCode = 00000000 eax=00000000 ebx=806e6900 ecx=00000000 edx=00000000 esi=87b81920 edi=0000000c eip=b428af19 esp=b27788d4 ebp=b27788f4 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 tcpip!CloseTCB+0x17f: b428af19 ff7704 push dword ptr [edi+4] ds:0023:00000010=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: BitLord.exe LAST_CONTROL_TRANSFER: from b427e80a to b428af19 STACK_TEXT: b27788f4 b427e80a f8b81920 b2778900 b2778928 tcpip!CloseTCB+0x17f b2778904 b427e7ee 87b81920 00000040 b2778900 tcpip!TryToCloseTCB+0x38 b2778928 b427a1ac b2778900 00000000 00000002 tcpip!TdiDisconnect+0x205 b2778974 b427a0cb 89ce2850 00000000 8886b688 tcpip!TCPDisconnect+0xfd b2778990 804ef19f 8a83b5e0 89ce2850 89ce2850 tcpip!TCPDispatchInternalDeviceControl+0x14d b27789a0 b41e6cd9 00000000 8886b668 89db44f8 nt!IopfCallDriver+0x31 b27789c4 b41eb2bd 8a83b5e0 88a52eb0 8886b668 afd!AfdBeginAbort+0x1f3 b27789f0 b41e415a 8886b668 88a52ee8 88a52fa3 afd!AfdProcessBufferSend+0x4c b2778a08 804f16c0 88a52e04 00000000 804f16c0 afd!AfdRestartBufferSend+0x28 b2778a44 b4273942 88a52fa0 88a52ee8 8794efc0 nt!IopfCompleteRequest+0xa2 b2778a5c b4299195 88a52ee8 c0000184 00000000 tcpip!TCPDataRequestComplete+0xa6 b2778a8c b42757b6 88a52ee8 8794efe4 88a52eb0 tcpip!TCPSendData+0xa6 b2778aa8 804ef19f 8a83b5e0 88a52ee8 8886b668 tcpip!TCPDispatchInternalDeviceControl+0x51 b2778ab8 b41e42c9 00000000 00000008 b2778b1c nt!IopfCallDriver+0x31 b2778b10 b41da575 89db44f8 0012f484 b41da575 afd!AfdFastConnectionSend+0x209 b2778c5c 80580487 87997028 00000001 0012f3b8 afd!AfdFastIoDeviceControl+0x415 b2778d00 80579274 000016ac 00000228 00000000 nt!IopXxxControlFile+0x255 b2778d34 8054162c 000016ac 00000228 00000000 nt!NtDeviceIoControlFile+0x2a b2778d34 7c90e514 000016ac 00000228 00000000 nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 0012f408 00000000 00000000 00000000 00000000 0x7c90e514 STACK_COMMAND: kb FOLLOWUP_IP: tcpip!CloseTCB+17f b428af19 ff7704 push dword ptr [edi+4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: tcpip!CloseTCB+17f FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 485b99ad FAILURE_BUCKET_ID: 0x8E_tcpip!CloseTCB+17f BUCKET_ID: 0x8E_tcpip!CloseTCB+17f Followup: MachineOwner --------- 1: kd> lmvm tcpip start end module name b426f000 b42c7480 tcpip (pdb symbols) c:\symbols\tcpip.pdb\5DAF4A45ECAA4DE9B4CA8998CEB472442\tcpip.pdb Loaded symbol image file: tcpip.sys Mapped memory image file: c:\symbols\tcpip.sys\485B99AD58480\tcpip.sys Image path: tcpip.sys Image name: tcpip.sys Timestamp: Fri Jun 20 13:51:09 2008 (485B99AD) CheckSum: 0005ED6B ImageSize: 00058480 File version: 5.1.2600.5625 Product version: 5.1.2600.5625 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: tcpip.sys OriginalFilename: tcpip.sys ProductVersion: 5.1.2600.5625 FileVersion: 5.1.2600.5625 (xpsp_sp3_gdr.080620-1249) FileDescription: TCP/IP Protocol Driver LegalCopyright: © Microsoft Corporation. All rights reserved.