Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082910-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:/Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Aug 29 07:32:59.806 2010 (GMT+2)
System Uptime: 0 days 0:03:15.413
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, b4b883bc, b4b880b8, ba67c6ff}

Unable to load image aswMon2.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMon2.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswMon2.SYS
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: b4b883bc
Arg3: b4b880b8
Arg4: ba67c6ff

Debugging Details:
------------------


EXCEPTION_RECORD:  b4b883bc -- (.exr 0xffffffffb4b883bc)
ExceptionAddress: ba67c6ff (Ntfs!NtfsUpdateFcbInfoFromDisk)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 1e298f9c
Attempt to read from address 1e298f9c

CONTEXT:  b4b880b8 -- (.cxr 0xffffffffb4b880b8)
eax=b4b884a4 ebx=e34dbcc8 ecx=8a6d75f0 edx=e14bbc90 esi=e14bbd20 edi=b4b887d4
eip=ba67c6ff esp=b4b88484 ebp=b4b88558 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsUpdateFcbInfoFromDisk:
ba67c6ff 62646848        bound   esp,qword ptr [eax+ebp*2+48h] ds:0023:1e298f9c=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  1e298f9c

READ_ADDRESS:  1e298f9c 

FOLLOWUP_IP: 
Ntfs!NtfsUpdateFcbInfoFromDisk+0
ba67c6ff 62646848        bound   esp,qword ptr [eax+ebp*2+48h]

FAULTING_IP: 
Ntfs!NtfsUpdateFcbInfoFromDisk+0
ba67c6ff 62646848        bound   esp,qword ptr [eax+ebp*2+48h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from ba67c35c to ba67c6ff

STACK_TEXT:  
b4b88480 ba67c35c b4b887d4 00000001 e34dbcc8 Ntfs!NtfsUpdateFcbInfoFromDisk
b4b88558 ba67c6f5 b4b887d4 8a47b610 8a47b7e8 Ntfs!NtfsOpenFile+0x2e6
b4b887b0 ba66c042 b4b887d4 8a47b610 b4b88904 Ntfs!NtfsCommonCreate+0x134a
b4b8895c ba705f70 8a47b610 b4b88c00 8a6d73b0 Ntfs!NtfsNetworkOpenCreate+0x8a
b4b8897c ba7130e8 8a47b610 b4b88c00 8a641498 sr!SrFastIoQueryOpen+0x40
b4b8899c ba71fc27 000000f2 00000000 b4b889d4 fltMgr!FltpPerformFastIoCall+0x300
b4b889f4 b4ea82ba 8a47b610 b4b88c00 8a30d620 fltMgr!FltpFastIoQueryOpen+0xa1
WARNING: Stack unwind information not available. Following frames may be wrong.
b4b88a18 805830fe 8a47b610 b4b88c00 8a3be7c8 aswMon2+0x72ba
b4b88b04 805bf434 8a703900 00000000 89975148 nt!IopParseDevice+0x916
b4b88b7c 805bb9c0 00000000 b4b88bbc 00000040 nt!ObpLookupObjectName+0x53c
b4b88bd0 80576fc7 00000000 00000000 80513a01 nt!ObOpenObjectByName+0xea
b4b88d54 8054163c 021dea20 021de9f8 021dea4c nt!NtQueryAttributesFile+0xf1
b4b88d54 7c90e514 021dea20 021de9f8 021dea4c nt!KiFastCallEntry+0xfc
021dea4c 00000000 00000000 00000000 00000000 0x7c90e514


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    ba67c6ff - Ntfs!NtfsUpdateFcbInfoFromDisk
	[ 6a:62 ]
1 error : !Ntfs (ba67c6ff)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xffffffffb4b880b8 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------