Loading Dump File [G:\AV nowe\Dumpy\Mini100510-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\symbole*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt Built by: 2600.xpsp_sp2_gdr.100216-1441 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a6a0 Debug session time: Tue Oct 5 21:17:56.875 2010 (GMT+2) System Uptime: 0 days 0:05:28.473 Loading Kernel Symbols ............................................................... ................................................................ .. Loading User Symbols Loading unloaded module list .. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1902fe, f795e694, f795e390, f73828ce} *** WARNING: Unable to verify timestamp for ???????????????????????????? s????? *** ERROR: Module load completed but symbols could not be loaded for ???????????????????????????? s????? Probably caused by : hardware ( Ntfs!NtfsCommonWrite+c30 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 001902fe Arg2: f795e694 Arg3: f795e390 Arg4: f73828ce Debugging Details: ------------------ EXCEPTION_RECORD: f795e694 -- (.exr 0xfffffffff795e694) ExceptionAddress: f73828ce (Ntfs!NtfsCommonWrite+0x00000c30) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 6c13c66a Attempt to write to address 6c13c66a CONTEXT: f795e390 -- (.cxr 0xfffffffff795e390) eax=000c0000 ebx=e113c648 ecx=82ab8928 edx=e113c580 esi=f795e944 edi=804ec696 eip=f73828ce esp=f795e75c ebp=f795e934 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 Ntfs!NtfsCommonWrite+0xc30: f73828ce 87a32200008b xchg esp,dword ptr [ebx-74FFFFDEh] ds:0023:6c13c66a=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 6c13c66a WRITE_ADDRESS: 6c13c66a FOLLOWUP_IP: Ntfs!NtfsCommonWrite+c30 f73828ce 87a32200008b xchg esp,dword ptr [ebx-74FFFFDEh] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from f7382c24 to f73828ce MISALIGNED_IP: Ntfs!NtfsCommonWrite+c30 f73828ce 87a32200008b xchg esp,dword ptr [ebx-74FFFFDEh] STACK_TEXT: f795e934 f7382c24 f795e944 823cb5c0 0110070a Ntfs!NtfsCommonWrite+0xc30 f795eaa8 804e3807 82f25020 823cb5c0 823cb5c0 Ntfs!NtfsFsdWrite+0xf3 f795eab8 f742909e 823cb5c0 82f0a9f8 823cb774 nt!IopfCallDriver+0x31 f795eae4 804e3807 82bb9020 823cb5c0 00000000 fltMgr!FltpDispatch+0x152 f795eaf4 b5f1c8ac 821dc038 8272d880 821d1d48 nt!IopfCallDriver+0x31 WARNING: Stack unwind information not available. Following frames may be wrong. f795eb18 b5f1683c 821d1d48 003cb5c0 804e3807 _____________________________s______+0x68ac f795eb48 804ed2cc 821dc00a f795eb70 f795ec04 _____________________________s______+0x83c f795ec24 804ec241 e1100ec0 e1100f00 e1100f00 nt!MiFlushSectionInternal+0x38b f795ec60 804ed990 82470d98 e1100ec0 000000b0 nt!MmFlushSection+0x1b5 f795ece8 804ec088 00010000 00000000 00000001 nt!CcFlushCache+0x372 f795ed2c 804e4f2d 82fb2288 805616c0 82fb3b30 nt!CcWriteBehind+0xdc f795ed74 804e427b 82fb2288 00000000 82fb3b30 nt!CcWorkerThread+0x126 f795edac 8057d363 82fb2288 00000000 00000000 nt!ExpWorkerThread+0x100 f795eddc 804f828a 804e41a6 00000000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsCommonWrite+c30 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: .cxr 0xfffffffff795e390 ; kb MODULE_NAME: hardware FAILURE_BUCKET_ID: IP_MISALIGNED_Ntfs.sys BUCKET_ID: IP_MISALIGNED_Ntfs.sys Followup: MachineOwner ---------