This is from the large memory dump which was probably created by it:
(Kinda weird... normally it's only minidump... maybe settings where changed
or maybe this is extra):
Can't upload it ofcourse to big 512 MB or so..
I see minidump available too, will post in second posting and link there to
file
too.
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
SRV*c:\Tools\WinDbg\WebSymbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free
x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.100216-1301
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d4140
Debug session time: Thu Dec 16 11:48:32.250 2010 (GMT+1)
System Uptime: 0 days 13:48:53.194
Loading Kernel Symbols
................................................................
.................................................................
........................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for
details
Loading unloaded module list
...............................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800012c1308, 0, ffffffffffffffff}
Page ad2a1 not present in the dump file. Type ".hh dbgerr004" for details
Page ad50e not present in the dump file. Type ".hh dbgerr004" for details
*** ERROR: Module load completed but symbols could not be loaded for
sptd.sys
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for
details
Probably caused by : sptd.sys ( sptd+57a0f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800012c1308, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
Page ad2a1 not present in the dump file. Type ".hh dbgerr004" for details
Page ad50e not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for
details
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!PspGetSetContextInternal+203
fffff800`012c1308 488b58f8 mov rbx,qword ptr [rax-8]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: ffffffffffffffff
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: TestApplication
CURRENT_IRQL: 1
EXCEPTION_RECORD: fffffadf8848be40 -- (.exr 0xfffffadf8848be40)
ExceptionAddress: fffff800012c1308
(nt!PspGetSetContextInternal+0x0000000000000203)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffffadf8848bed0 -- (.trap 0xfffffadf8848bed0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00fffffadf8ffe9a rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800012c1308 rsp=fffffadf8848c060 rbp=fffffadf8778db10
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!PspGetSetContextInternal+0x203:
fffff800`012c1308 488b58f8 mov rbx,qword ptr [rax-8]
ds:c0c0:fe92=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001080e86 to fffff8000102e890
STACK_TEXT:
fffffadf`8848b748 fffff800`01080e86 : 00000000`0000001e ffffffff`c0000005
fffff800`012c1308 00000000`00000000 : nt!KeBugCheckEx
fffffadf`8848b750 fffff800`0102e6af : fffffadf`8848be40 fffffa80`00a8d6a0
fffffadf`8848bed0 fffffadf`00000000 : nt!KiDispatchException+0x128
fffffadf`8848bd50 fffff800`0102d30d : fffffadf`9c000910 fffff800`0103efc9
fffffa80`00c7eed8 ffffffff`00000000 : nt!KiExceptionExit
fffffadf`8848bed0 fffff800`012c1308 : 00000000`00000000 00000000`00000000
fffffadf`8848cc70 fffffadf`8778d5c0 : nt!KiGeneralProtectionFault+0xcd
fffffadf`8848c060 fffff800`0104236b : fffffadf`996270e0 00000000`00000000
fffffadf`99627128 00000000`00000000 : nt!PspGetSetContextInternal+0x203
fffffadf`8848c5b0 fffff800`01027eb1 : 00000000`00000000 fffffadf`99627158
00000000`00000000 fffffadf`99627128 : nt!PspGetSetContextSpecialApc+0xab
fffffadf`8848c6c0 fffff800`0103bf97 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x215
fffffadf`8848c760 fffff800`0102828e : 00000000`00000000 00000000`00000000
fffffadf`99627178 fffffadf`996270e0 : nt!KiSwapThread+0x3e9
fffffadf`8848c7c0 fffff800`0101f88c : 00000000`00000000 00000000`00000005
fffffadf`9ca0b700 fffff800`0101f500 : nt!KeWaitForSingleObject+0x5a6
fffffadf`8848c840 fffff800`0101f51b : 00000000`00000000 fffffadf`97d36b50
00000000`00000000 00000000`00000000 : nt!KiSuspendThread+0x2c
fffffadf`8848c880 fffff800`010747df : fffffadf`97ed9590 00000000`00000000
fffff800`0101f860 00000000`00000000 : nt!KiDeliverApc+0x2d3
fffffadf`8848c920 fffffadf`90315a0f : fffffadf`9033d301 fffffadf`9c162000
fffffadf`97d36b00 fffffadf`9824f280 : nt!KeLeaveCriticalRegion+0x46
fffffadf`8848c950 fffffadf`902ffa65 : fffffadf`9033d3d8 fffffadf`97d36b50
00000000`00000000 fffff800`011a98fd : sptd+0x57a0f
fffffadf`8848c980 fffffadf`9c1622ee : fffffadf`97d36b50 00000000`00000000
fffffadf`9c162000 fffffadf`8848ca58 : sptd+0x41a65
fffffadf`8848ca30 fffffadf`97d36b50 : 00000000`00000000 fffffadf`9c162000
fffffadf`8848ca58 fffffadf`9c92c040 : 0xfffffadf`9c1622ee
fffffadf`8848ca38 00000000`00000000 : fffffadf`9c162000 fffffadf`8848ca58
fffffadf`9c92c040 00000000`00000000 : 0xfffffadf`97d36b50
STACK_COMMAND: kb
FOLLOWUP_IP:
sptd+57a0f
fffffadf`90315a0f 488b742438 mov rsi,qword ptr [rsp+38h]
SYMBOL_STACK_INDEX: c
SYMBOL_NAME: sptd+57a0f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: sptd
IMAGE_NAME: sptd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47cf3c13
FAILURE_BUCKET_ID: X64_0x1E_sptd+57a0f
BUCKET_ID: X64_0x1E_sptd+57a0f
Followup: MachineOwner
---------
windbg> .hh dbgerr004