Symbols could not be loaded for win32k.sys

[jcgriff2]

Brilliant! I never would have thought to run it from the .zip itself. Nice find!!

I'll have to test that out, too.

Note that you get a checksum error on win32k when running from unextracted zip.

Also.... only win32k PDB downloads, not win32k SYS symbols.

 

[writhziden]

Used the same method, but received different results:

Read More:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.




Loading Dump File [C:\Users\Mike\AppData\Local\Temp\[color=red]Temp1_081612-18673-01.zip[/color]\081612-18673-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


Symbol search path is: SRV*c:\symbols2*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0324d000 PsLoadedModuleList = 0xfffff800`03491670
Debug session time: Thu Aug 16 02:19:45.505 2012 (UTC - 6:00)
System Uptime: 0 days 0:44:23.941
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck A, {a, 2, 1, fffff800032d81a8}


Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
[color=red]*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys[/color]
Probably caused by : mfehidk.sys ( mfehidk+54028 )


Followup: MachineOwner
---------


0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000000a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032d81a8, address which referenced memory


Debugging Details:
------------------




WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fb100
 000000000000000a 


CURRENT_IRQL:  2


FAULTING_IP: 
nt!KeExpandKernelStackAndCalloutEx+43c
fffff800`032d81a8 4889442478      mov     qword ptr [rsp+78h],rax


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT


BUGCHECK_STR:  0xA


PROCESS_NAME:  System


TRAP_FRAME:  fffff88009335c70 -- (.trap 0xfffff88009335c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=800000005e1d2963 rbx=0000000000000000 rcx=fffff6fc40045098
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032d81a8 rsp=fffff88009335e00 rbp=fffff88009336200
 r8=fffff6fc400450c8  r9=0000000000000000 r10=fffff8000344cc80
r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeExpandKernelStackAndCalloutEx+0x43c:
fffff800`032d81a8 4889442478      mov     qword ptr [rsp+78h],rax ss:0018:fffff880`09335e78=8000000058617963
Resetting default scope


LAST_CONTROL_TRANSFER:  from fffff800032cb769 to fffff800032cc1c0


STACK_TEXT:  
fffff880`09335b28 fffff800`032cb769 : 00000000`0000000a 00000000`0000000a 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09335b30 fffff800`032ca3e0 : 00000000`00000000 fffffa80`0320d8d0 f8a00e33`8c100400 fffffa80`08451610 : nt!KiBugCheckDispatch+0x69
fffff880`09335c70 fffff800`032d81a8 : fffff800`034feb00 00000000`00000002 fffffa80`08451610 00000000`00000001 : nt!KiPageFault+0x260
fffff880`09335e00 fffff880`01243d42 : fffff880`01243cb0 fffff880`09335fa0 fffff6fc`400450c8 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x43c
fffff880`09335ee0 fffff880`012e2a04 : fffff880`09335fb0 fffff880`09335fb0 fffff880`09335fb0 00000000`00000004 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`09335f50 fffff880`0104fbcf : fffff880`09335fb0 fffffa80`05708c10 fffffa80`05708fb0 fffffa80`074e8710 : Ntfs!NtfsFsdCleanup+0x144
fffff880`093361c0 fffff880`0104e6df : fffffa80`05105a40 00000000`00000000 fffffa80`04f69c00 fffffa80`05708c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09336250 fffff800`035cf69f : fffffa80`05708c10 fffffa80`04196450 00000000`00000000 fffffa80`0756ed20 : fltmgr!FltpDispatch+0xcf
fffff880`093362b0 fffff800`035bedc4 : 00000000`00000001 fffffa80`07de8060 00000000`000003d8 00000000`00000000 : nt!IopCloseFile+0x11f
fffff880`09336340 fffff800`035beb81 : fffffa80`07de8060 fffffa80`00000001 fffff8a0`000017e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`093363c0 fffff800`035bf144 : 00000000`00000964 fffffa80`07de8060 fffff8a0`000017e0 00000000`00000964 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`09336450 fffff800`032cb453 : fffffa80`08451610 fffff880`09336520 fffffa80`06737930 fffff880`0105f2c2 : nt!ObpCloseHandle+0x94
fffff880`093364a0 fffff800`032c7a10 : fffff880`01136028 fffff880`09336678 00000000`00000000 fffffa80`05121a10 : nt!KiSystemServiceCopyEnd+0x13
fffff880`09336638 fffff880`01136028 : fffff880`09336678 00000000`00000000 fffffa80`05121a10 00000000`00000000 : nt!KiServiceLinkage
fffff880`09336640 fffff880`09336678 : 00000000`00000000 fffffa80`05121a10 00000000`00000000 00000000`c000000d : mfehidk+0x54028
fffff880`09336648 00000000`00000000 : fffffa80`05121a10 00000000`00000000 00000000`c000000d fffff880`03bcd655 : 0xfffff880`09336678




STACK_COMMAND:  kb


FOLLOWUP_IP: 
mfehidk+54028
fffff880`01136028 ??              ???


SYMBOL_STACK_INDEX:  e


SYMBOL_NAME:  mfehidk+54028


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: mfehidk


IMAGE_NAME:  mfehidk.sys


DEBUG_FLR_IMAGE_TIMESTAMP:  4e5805bc


FAILURE_BUCKET_ID:  X64_0xA_mfehidk+54028


BUCKET_ID:  X64_0xA_mfehidk+54028


Followup: MachineOwner
---------


0: kd> [color=red]!lmi win32k.sys[/color]
Loaded Module Info: [win32k.sys] 
Cannot read Image header @ fffff96000020000
    [color=red]Load Report: no symbols loaded[/color]

 

[jcgriff2]

1 difference...

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

I got:

*** WARNING: Unable to verify checksum for win32k.sys

 

[usasma]

This is way beyond my ability to understand - you need a WinDbg/kd expert
Anyone want to address it to the WinDbg External Feedback folks (email link is from March of 2010)? windbgfb (at) microsoft.com

 

[Shintaro]

So that means that when the information is being written from RAM to disk it is being corrupted? Can core system drivers be paged to disk?

This might be useful:http://www.google.com/patents?id=2G...ol store&pg=PA8#v=onepage&q=directory&f=false

EDIT: So I am wondering if the real problem of the crash is faulty RAM or HD corruption? Are you guys able to verify that the disks and RAM are Ok?

 

[jcgriff2]

​

Info on Paged and Nonpaged Pool - http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

EDIT: So I am wondering if the real problem of the crash is faulty RAM or HD corruption? Are you guys able to verify that the disks and RAM are Ok?

Dump files are incapable of ruling in/out hardware failure.

At best, dump info may point us in a hardware failure direction such as exception 0xc0000185 = I/O error.

 

[Shintaro]

My apologies for my lack of clarity.
I do not mean that the dump files are pointing to the fault. I am saying that the hardware maybe causing the trouble with the changed timestamp and checksum problems you are seeing.
As per post #34 it doesn't appear the the dump file is created/written correctly. Hence causing the trouble with Win32K.sys.

 

[jcgriff2]

Dumpchk can be run to verify the integrity of a dump file.

Command:

cd /d "K:\WinDDK\7600.16385.1\Debuggers"

dumpchk -v -y SRV*a:\symbols*http://msdl.microsoft.com/download/symbols 081612-18673-01.dmp

Output:

Read More:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [K:\WinDDK\7600.16385.1\Debuggers\081612-18673-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*a:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0324d000 PsLoadedModuleList = 0xfffff800`03491670
Debug session time: Thu Aug 16 04:19:45.505 2012 (UTC - 4:00)
System Uptime: 0 days 0:44:23.941
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
......
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {a, 2, 1, fffff800032d81a8}

Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : mfehidk.sys ( mfehidk+54028 )

Followup: MachineOwner
---------

----- 64 bit Kernel Mini Dump Analysis

DUMP_HEADER64:
MajorVersion        0000000f
MinorVersion        00001db1
KdSecondaryVersion  00000000
DirectoryTableBase  00000000`00187000
PfnDataBase         fffff800`034fb278
PsLoadedModuleList  fffff800`03491670
PsActiveProcessHead fffff800`03473370
MachineImageType    00008664
NumberProcessors    00000004
BugCheckCode        0000000a
BugCheckParameter1  00000000`0000000a
BugCheckParameter2  00000000`00000002
BugCheckParameter3  00000000`00000001
BugCheckParameter4  fffff800`032d81a8
KdDebuggerDataBlock fffff800`0343d0a0
ProductType         00000001
SuiteMask           00000310
WriterStatus        00000000
MiniDumpFields      00000cff 

TRIAGE_DUMP64:
ServicePackBuild      00000100 
SizeOfDump            00040000 
ValidOffset           0003fffc 
ContextOffset         00000348 
ExceptionOffset       00000f00 
MmOffset              00002080 
UnloadedDriversOffset 000020d0 
PrcbOffset            00002228 
ProcessOffset         00006f28 
ThreadOffset          000073f8 
CallStackOffset       000078a0 
SizeOfCallStack       00001000 
DriverListOffset      00008be0 
DriverCount           000000b1 
StringPoolOffset      0000ef70 
StringPoolSize        00003ba0 
BrokenDriverOffset    00000000 
TriageOptions         ffffffff 
TopOfStack            fffff880`09335b28 
BStoreOffset          00000000 
SizeOfBStore          00000000 
LimitOfBStore         00000000`00000000 
DebuggerDataOffset    000088a0 
DebuggerDataSize      00000340 
DataBlocksOffset      00012b10 
DataBlocksCount       00000011 
  fffff800`03491ac0 - fffff800`03491b5b at offset 00012c20
  fffff800`03479928 - fffff800`0347992b at offset 00012cbc
  fffff800`03479924 - fffff800`03479927 at offset 00012cc0
  fffff800`03402880 - fffff800`0340297f at offset 00012cc4
  fffff800`032d8000 - fffff800`032d8fff at offset 00012dc4
  fffff800`034c83e0 - fffff800`034c83e3 at offset 00013dc4
  fffff800`034c7fe0 - fffff800`034c804f at offset 00013dc8
  fffff800`034fb07c - fffff800`034fb07f at offset 00013e38
  fffff800`034fb068 - fffff800`034fb06b at offset 00013e3c
  fffffa80`04164e10 - fffffa80`04164ff7 at offset 00013e40
  fffffa80`04164a10 - fffffa80`04164bf7 at offset 00014028
  fffffa80`04cf1808 - fffffa80`04cf3807 at offset 00014210
  fffff800`03465280 - fffff800`03465287 at offset 00016210
  fffff800`03465288 - fffff800`0346528f at offset 00016218
  fffffa80`08451000 - fffffa80`08451fff at offset 00016220
  fffff880`09335000 - fffff880`09335fff at offset 00017220
  fffff800`032cc000 - fffff800`032ccfff at offset 00018220
  Max offset 19220, 2b4a0 from end of file


Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0324d000 PsLoadedModuleList = 0xfffff800`03491670
Debug session time: Thu Aug 16 04:19:45.505 2012 (UTC - 4:00)
System Uptime: 0 days 0:44:23.941
start             end                 module name
fffff800`00b9e000 fffff800`00ba8000   kdcom     Sat Feb 05 11:52:49 2011 (4D4D8061)
fffff800`03204000 fffff800`0324d000   hal       Sat Nov 20 08:00:25 2010 (4CE7C669)
fffff800`0324d000 fffff800`03835000   nt        Fri May 04 04:18:59 2012 (4FA390F3)
fffff880`00c00000 fffff880`00c5c000   volmgrx   Sat Nov 20 04:20:43 2010 (4CE792EB)
fffff880`00c5c000 fffff880`00c76000   mountmgr  Sat Nov 20 04:19:21 2010 (4CE79299)
fffff880`00c76000 fffff880`00c7f000   atapi     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00c7f000 fffff880`00c8f000   PCIIDEX   Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`00c93000 fffff880`00ce2000   mcupdate_GenuineIntel  Sat Nov 20 08:03:51 2010 (4CE7C737)
fffff880`00ce2000 fffff880`00cf6000   PSHED     Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`00cf6000 fffff880`00d54000   CLFS      Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d54000 fffff880`00d87000   pci       Sat Nov 20 04:19:11 2010 (4CE7928F)
fffff880`00d87000 fffff880`00d9c000   partmgr   Sat Mar 17 01:06:09 2012 (4F641BC1)
fffff880`00d9c000 fffff880`00da8000   BATTC     Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`00da8000 fffff880`00dbd000   volmgr    Sat Nov 20 04:19:28 2010 (4CE792A0)
fffff880`00dbd000 fffff880`00de7000   ataport   Sat Nov 20 04:19:15 2010 (4CE79293)
fffff880`00de7000 fffff880`00df2000   msahci    Sat Nov 20 05:33:58 2010 (4CE7A416)
fffff880`00df2000 fffff880`00dfd000   amdxata   Fri Mar 19 12:18:18 2010 (4BA3A3CA)
fffff880`00e06000 fffff880`00ec6000   CI        Sat Nov 20 08:12:36 2010 (4CE7C944)
fffff880`00ec6000 fffff880`00f6a000   Wdf01000  Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f6a000 fffff880`00f79000   WDFLDR    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00f79000 fffff880`00fd0000   ACPI      Sat Nov 20 04:19:16 2010 (4CE79294)
fffff880`00fd0000 fffff880`00fd9000   WMILIB    Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fd9000 fffff880`00fe3000   msisadrv  Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`00fe3000 fffff880`00ff0000   vdrvroot  Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`00ff0000 fffff880`00ff9000   compbatt  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`01000000 fffff880`0102a000   cdrom     Sat Nov 20 04:19:20 2010 (4CE79298)
fffff880`0102a000 fffff880`01038000   vga       Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0104d000 fffff880`01099000   fltmgr    Sat Nov 20 04:19:24 2010 (4CE7929C)
fffff880`01099000 fffff880`010ad000   fileinfo  Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010ad000 fffff880`010e2000   MpFilter  Fri Mar 09 06:05:26 2012 (4F59E3F6)
fffff880`010e2000 fffff880`0117c680   mfehidk   Fri Aug 26 16:44:44 2011 (4E5805BC)
fffff880`0117d000 fffff880`01188e00   PxHlpa64  Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`01189000 fffff880`011e7000   msrpc     Sat Nov 20 04:21:56 2010 (4CE79334)
fffff880`01200000 fffff880`0122a000   ksecpkg   Fri Jun 01 23:27:11 2012 (4FC9880F)
fffff880`01235000 fffff880`013d8000   Ntfs      Thu Mar 10 22:39:39 2011 (4D79997B)
fffff880`013d8000 fffff880`013f3000   ksecdd    Fri Jun 01 22:50:23 2012 (4FC97F6F)
fffff880`01400000 fffff880`014f3000   ndis      Sat Nov 20 04:23:30 2010 (4CE79392)
fffff880`014fa000 fffff880`0156c000   cng       Fri Jun 01 23:25:51 2012 (4FC987BF)
fffff880`0156c000 fffff880`0157d000   pcw       Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`0157d000 fffff880`01587000   Fs_Rec    Wed Feb 29 22:41:06 2012 (4F4EEFD2)
fffff880`01587000 fffff880`015e7000   NETIO     Sat Nov 20 04:23:13 2010 (4CE79381)
fffff880`015e7000 fffff880`015f0000   Null      Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`015f0000 fffff880`015f7000   Beep      Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`01600000 fffff880`0161d000   usbccgp   Thu Mar 24 23:29:14 2011 (4D8C0C0A)
fffff880`0162e000 fffff880`01831000   tcpip     Fri Mar 30 04:34:26 2012 (4F757012)
fffff880`01831000 fffff880`0187b000   fwpkclnt  Sat Nov 20 04:21:37 2010 (4CE79321)
fffff880`0187b000 fffff880`018be380   mfewfpk   Fri Aug 26 16:45:00 2011 (4E5805CC)
fffff880`018bf000 fffff880`0190b000   volsnap   Sat Nov 20 04:20:08 2010 (4CE792C8)
fffff880`0190b000 fffff880`01913000   stdflt    Thu Jul 16 11:36:50 2009 (4A5F4912)
fffff880`01913000 fffff880`0191b000   spldr     Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0191b000 fffff880`01955000   rdyboost  Sat Nov 20 04:43:10 2010 (4CE7982E)
fffff880`01955000 fffff880`01967000   mup       Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01967000 fffff880`01970000   hwpolicy  Sat Nov 20 04:18:54 2010 (4CE7927E)
fffff880`01970000 fffff880`019aa000   fvevol    Sat Nov 20 04:24:06 2010 (4CE793B6)
fffff880`019aa000 fffff880`019c0000   disk      Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`019c0000 fffff880`019f0000   CLASSPNP  Sat Nov 20 04:19:23 2010 (4CE7929B)
fffff880`01e00000 fffff880`01e53000   nwifi     Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`01e53000 fffff880`01e66000   ndisuio   Sat Nov 20 05:50:08 2010 (4CE7A7E0)
fffff880`01e66000 fffff880`01e7e000   rspndr    Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`01e7e000 fffff880`01e85000   TurboB    Mon Nov 02 15:47:34 2009 (4AEF4566)
fffff880`01ee5000 fffff880`01f12280   usbvideo  Sat Nov 20 05:44:34 2010 (4CE7A692)
fffff880`01f13000 fffff880`01f3d2a0   CtClsFlt  Mon Jun 15 01:06:41 2009 (4A35D6E1)
fffff880`01f3e000 fffff880`01f4c000   crashdmp  Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`01f4c000 fffff880`01f58000   dump_dumpata  Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`01f58000 fffff880`01f63000   dump_msahci  Sat Nov 20 05:33:58 2010 (4CE7A416)
fffff880`01f63000 fffff880`01f76000   dump_dumpfve  Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`01f76000 fffff880`01f84000   monitor   Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`01f84000 fffff880`01fa7000   luafv     Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`01fa7000 fffff880`01fc8000   WudfPf    Sat Nov 20 05:42:44 2010 (4CE7A624)
fffff880`01fc8000 fffff880`01fdd000   lltdio    Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`02c00000 fffff880`02c89000   afd       Tue Dec 27 22:59:20 2011 (4EFA9418)
fffff880`02c89000 fffff880`02c92000   wfplwf    Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02c92000 fffff880`02cb8000   pacer     Sat Nov 20 05:52:18 2010 (4CE7A862)
fffff880`02cb8000 fffff880`02cce000   vwififlt  Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`02cce000 fffff880`02cda000   Dxapi     Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`02cdb000 fffff880`02d00000   VIDEOPRT  Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`02d00000 fffff880`02d10000   watchdog  Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`02d10000 fffff880`02d19000   RDPCDD    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d19000 fffff880`02d22000   rdpencdd  Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d22000 fffff880`02d2b000   rdprefmp  Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`02d2b000 fffff880`02d36000   Msfs      Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`02d36000 fffff880`02d47000   Npfs      Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02d47000 fffff880`02d69000   tdx       Sat Nov 20 04:21:54 2010 (4CE79332)
fffff880`02d69000 fffff880`02d76000   TDI       Sat Nov 20 04:22:06 2010 (4CE7933E)
fffff880`02d76000 fffff880`02dbb000   netbt     Sat Nov 20 04:23:18 2010 (4CE79386)
fffff880`02dbb000 fffff880`02dca000   netbios   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02dca000 fffff880`02de5000   wanarp    Sat Nov 20 05:52:36 2010 (4CE7A874)
fffff880`02de5000 fffff880`02df9000   termdd    Sat Nov 20 06:03:40 2010 (4CE7AB0C)
fffff880`03a00000 fffff880`03a46000   atikmpag  Tue Jun 01 21:42:47 2010 (4C05B717)
fffff880`03a46000 fffff880`03a52000   ndistapi  Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`03a52000 fffff880`03a81000   ndiswan   Sat Nov 20 05:52:32 2010 (4CE7A870)
fffff880`03a81000 fffff880`03a9c000   raspppoe  Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03a9c000 fffff880`03abd000   raspptp   Sat Nov 20 05:52:31 2010 (4CE7A86F)
fffff880`03abd000 fffff880`03ad7000   rassstp   Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03ad7000 fffff880`03ae4000   mouhid    Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`03ae4000 fffff880`03af2000   kbdhid    Sat Nov 20 05:33:25 2010 (4CE7A3F5)
fffff880`03af3000 fffff880`03b44000   rdbss     Sat Nov 20 04:27:51 2010 (4CE79497)
fffff880`03b44000 fffff880`03b50000   nsiproxy  Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff880`03b50000 fffff880`03b5b000   mssmbios  Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`03b5b000 fffff880`03b6a000   discache  Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`03b6a000 fffff880`03b88000   dfsc      Sat Nov 20 04:26:31 2010 (4CE79447)
fffff880`03b88000 fffff880`03b99000   blbdrive  Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`03b99000 fffff880`03bbf000   tunnel    Sat Nov 20 05:51:50 2010 (4CE7A846)
fffff880`03bbf000 fffff880`03bf4e00   mfeavfk   Fri Aug 26 16:46:03 2011 (4E58060B)
fffff880`04000000 fffff880`04056000   USBPORT   Thu Mar 24 23:29:12 2011 (4D8C0C08)
fffff880`04056000 fffff880`04065000   mouclass  Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04065000 fffff880`04066480   swenum    Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`0406a000 fffff880`0415e000   dxgkrnl   Sat Nov 20 04:50:50 2010 (4CE799FA)
fffff880`0415e000 fffff880`041a4000   dxgmms1   Sat Nov 20 04:49:53 2010 (4CE799C1)
fffff880`041a4000 fffff880`041c8000   HDAudBus  Sat Nov 20 05:43:42 2010 (4CE7A65E)
fffff880`041c8000 fffff880`041d9000   HECIx64   Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`041d9000 fffff880`041ea000   usbehci   Thu Mar 24 23:29:04 2011 (4D8C0C00)
fffff880`041ea000 fffff880`041f7000   GEARAspiWDM  Mon May 18 08:17:04 2009 (4A1151C0)
fffff880`041f7000 fffff880`04200000   wmiacpi   Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`04800000 fffff880`04885000   Rt64win7  Fri Jun 10 02:33:15 2011 (4DF1BAAB)
fffff880`04885000 fffff880`048a9e00   Impcd     Mon Oct 12 22:00:51 2009 (4AD3DF53)
fffff880`048aa000 fffff880`048b6000   Acceler   Fri Jun 26 16:56:34 2009 (4A453602)
fffff880`048b6000 fffff880`048cc000   intelppm  Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`048cc000 fffff880`048dc000   CompositeBus  Sat Nov 20 05:33:17 2010 (4CE7A3ED)
fffff880`048e4000 fffff880`04fc0000   atikmdag  Tue Jun 01 21:37:54 2010 (4C05B5F2)
fffff880`04fc0000 fffff880`04fd6000   AgileVpn  Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`04fd6000 fffff880`04ffa000   rasl2tp   Sat Nov 20 05:52:34 2010 (4CE7A872)
fffff880`05000000 fffff880`0503d000   portcls   Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`0503d000 fffff880`0505f000   drmk      Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`0505f000 fffff880`05064200   ksthunk   Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`05065000 fffff880`050e4000   stwrt64   Thu Jan 21 05:15:11 2010 (4B58292F)
fffff880`050e9000 fffff880`0512c000   ks        Sat Nov 20 05:33:23 2010 (4CE7A3F3)
fffff880`0512c000 fffff880`0513e000   umbus     Sat Nov 20 05:44:37 2010 (4CE7A695)
fffff880`0513e000 fffff880`05198000   usbhub    Thu Mar 24 23:29:25 2011 (4D8C0C15)
fffff880`05198000 fffff880`051ad000   NDProxy   Sat Nov 20 05:52:20 2010 (4CE7A864)
fffff880`051ad000 fffff880`051c8000   AtihdW76  Fri May 11 04:25:40 2012 (4FACCD04)
fffff880`051c8000 fffff880`051d6000   hidusb    Sat Nov 20 05:43:49 2010 (4CE7A665)
fffff880`051d6000 fffff880`051ef000   HIDCLASS  Sat Nov 20 05:43:49 2010 (4CE7A665)
fffff880`051ef000 fffff880`051f7080   HIDPARSE  Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`05600000 fffff880`0560f000   kbdclass  Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`0560f000 fffff880`0565a000   SynTP     Mon Aug 24 13:37:05 2009 (4A92CFC1)
fffff880`0565a000 fffff880`0565bf00   USBD      Thu Mar 24 23:28:59 2011 (4D8C0BFB)
fffff880`0565c000 fffff880`05d09000   NETw5s64  Tue Sep 15 15:40:39 2009 (4AAFEDB7)
fffff880`05d09000 fffff880`05d16000   vwifibus  Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`05d16000 fffff880`05d2f000   risdpe64  Wed Jul 01 05:31:57 2009 (4A4B2D0D)
fffff880`05d2f000 fffff880`05d48000   rimspe64  Wed Jul 01 19:54:49 2009 (4A4BF749)
fffff880`05d48000 fffff880`05d9e000   rixdpe64  Sat Jul 04 06:27:00 2009 (4A4F2E74)
fffff880`05d9e000 fffff880`05ddc000   1394ohci  Sat Nov 20 05:44:56 2010 (4CE7A6A8)
fffff880`05ddc000 fffff880`05dfa000   i8042prt  Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05dfa000 fffff880`05dfe500   CmBatt    Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`06222000 fffff880`062eb000   HTTP      Sat Nov 20 04:24:30 2010 (4CE793CE)
fffff880`062eb000 fffff880`06309000   bowser    Tue Feb 22 23:55:04 2011 (4D649328)
fffff880`06309000 fffff880`06321000   mpsdrv    Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`06321000 fffff880`0634e000   mrxsmb    Tue Apr 26 22:40:38 2011 (4DB78226)
fffff880`0634e000 fffff880`0639c000   mrxsmb10  Fri Jul 08 22:46:28 2011 (4E17C104)
fffff880`0639c000 fffff880`063c0000   mrxsmb20  Tue Apr 26 22:39:37 2011 (4DB781E9)
fffff880`063c0000 fffff880`063d8000   BTHUSB    Wed Apr 27 23:54:56 2011 (4DB8E510)
fffff880`08231000 fffff880`082bd000   bthport   Fri Jul 06 16:07:41 2012 (4FF7458D)
fffff880`082bd000 fffff880`082c7000   vwifimp   Mon Jul 13 20:07:28 2009 (4A5BCC40)
fffff880`082c7000 fffff880`082f3000   rfcomm    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`082f3000 fffff880`08303000   BthEnum   Mon Jul 13 20:06:52 2009 (4A5BCC1C)
fffff880`08303000 fffff880`08323000   bthpan    Mon Jul 13 20:07:00 2009 (4A5BCC24)
fffff880`08323000 fffff880`0833f000   NisDrvWFP  Fri Mar 09 06:05:35 2012 (4F59E3FF)
fffff880`0833f000 fffff880`0835d000   hidbth    Mon Jul 13 20:06:52 2009 (4A5BCC1C)
fffff880`0835d000 fffff880`083e3000   btwaudio  Wed Jul 01 09:54:56 2009 (4A4B6AB0)
fffff880`08800000 fffff880`0887b000   btwavdt   Thu Jun 25 01:50:13 2009 (4A431015)
fffff880`0887b000 fffff880`08887000   btwl2cap  Fri Apr 03 20:28:45 2009 (49D6A9BD)
fffff880`08887000 fffff880`0888a880   btwrchid  Thu Jun 25 01:51:37 2009 (4A431069)
fffff880`0888b000 fffff880`0889e000   LHidFilt  Wed Jun 17 12:49:39 2009 (4A391EA3)
fffff880`0889e000 fffff880`088b2000   LMouFilt  Wed Jun 17 12:49:43 2009 (4A391EA7)
fffff880`088b2000 fffff880`088bd000   secdrv    Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`088e6000 fffff880`0898c000   peauth    Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`0898c000 fffff880`089bd000   srvnet    Thu Apr 28 23:05:35 2011 (4DBA2AFF)
fffff880`089bd000 fffff880`089cf000   tcpipreg  Sat Nov 20 05:51:48 2010 (4CE7A844)
fffff880`09000000 fffff880`09036000   fastfat   Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`090a4000 fffff880`0910d000   srv2      Thu Apr 28 23:05:46 2011 (4DBA2B0A)
fffff880`0910d000 fffff880`091a5000   srv       Thu Apr 28 23:06:06 2011 (4DBA2B1E)
fffff880`091db000 fffff880`091ffe00   mfeapfk   Fri Aug 26 16:45:37 2011 (4E5805F1)
fffff960`00020000 fffff960`00335000   win32k    unavailable (00000000)
fffff960`00560000 fffff960`0056a000   TSDDD     unavailable (00000000)
fffff960`00750000 fffff960`00777000   cdd       unavailable (00000000)
fffff960`00970000 fffff960`009d1000   ATMFD     unavailable (00000000)

Unloaded modules:
fffff880`09ef4000 fffff880`09f65000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00071000
fffff880`091a5000 fffff880`091db000   mfeavfk01.sy
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00036000
fffff880`019f0000 fffff880`019fe000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`01600000 fffff880`0160c000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`0160c000 fffff880`01617000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
fffff880`01617000 fffff880`0162a000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {a, 2, 1, fffff800032d81a8}

Probably caused by : mfehidk.sys ( mfehidk+54028 )

Followup: MachineOwner
---------

Finished dump check

http://support.microsoft.com/kb/315271
http://technet.microsoft.com/en-us/library/ee424340(v=ws.10).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/ff560109(v=vs.85).aspx