lubester
Welcome to Geeks to Go
I have analysed your first dump file
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16496.amd64fre.win8_gdr.130108-1504
Machine Name:
Kernel base = 0xfffff803`eb804000 PsLoadedModuleList = 0xfffff803`ebacda80
Debug session time: Wed Feb 13 16:15:01.424 2013 (UTC - 5:00)
System Uptime: 0 days 0:03:14.071
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88001cd5f62, Address of the instruction which caused the bugcheck
Arg3: fffff8800eb16b80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
tcpip!TcpCreateListenerWorkQueueRoutine+ba
fffff880`01cd5f62 48898118020000 mov qword ptr [rcx+218h],rax
CONTEXT: fffff8800eb16b80 -- (.cxr 0xfffff8800eb16b80)
rax=fffffa801281ec00 rbx=fffffa801281eb10 rcx=0000000000000000
rdx=fffffa8012f4cb40 rsi=fffffa801281eb10 rdi=0000000000000001
rip=fffff88001cd5f62 rsp=fffff8800eb17580 rbp=fffff8800eb17680
r8=0000000000000000 r9=0000000000000000 r10=fffffa8012ef9920
r11=fffffa801748e010 r12=fffffa801281eb58 r13=0000000000000000
r14=0000000000000000 r15=0000000000000004
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
tcpip!TcpCreateListenerWorkQueueRoutine+0xba:
fffff880`01cd5f62 48898118020000 mov qword ptr [rcx+218h],rax ds:002b:00000000`00000218=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME:
wmpnetwk.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88001cd5c0b to fffff88001cd5f62
STACK_TEXT:
fffff880`0eb17580 fffff880`01cd5c0b : fffffa80`1281eb10 fffffa80`1281eb10 fffff880`0eb17780 fffffa80`1748e010 : tcpip!TcpCreateListenerWorkQueueRoutine+0xba
fffff880`0eb176c0 fffff880`03d67fca : 00000000`00305a02 fffffa80`164323d0 00000000`00000010 fffffa80`172cc390 : tcpip!TcpCreateListener+0x1cb
fffff880`0eb17760 fffff880`03d68248 : fffffa80`16dbee40 fffff880`0eb17b80 00000000`00000000 00000000`00000014 : afd!AfdTLListen+0x8a
fffff880`0eb17800 fffff803`ebc6835f : fffffa80`172cc390 fffffa80`16dbee40 fffffa80`172cc390 00000000`00000001 : afd!AfdStartListen+0x248
fffff880`0eb17890 fffff803`ebc68ce6 : 7fffffff`ffffffff 00000000`00010002 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x7dd
fffff880`0eb17a20 fffff803`eb87d053 : 00000000`00000000 fffffa80`1285c390 fffff6fb`7dbed078 fffff6fb`7da0ff00 : nt!NtDeviceIoControlFile+0x56
fffff880`0eb17a90 000007f8`38802c5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000fa`f042f418 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7f8`38802c5a
FOLLOWUP_IP:
tcpip!TcpCreateListenerWorkQueueRoutine+ba
fffff880`01cd5f62 48898118020000 mov qword ptr [rcx+218h],rax
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: tcpip!TcpCreateListenerWorkQueueRoutine+ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME
: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50fe2daf
STACK_COMMAND: .cxr 0xfffff8800eb16b80 ; kb
FAILURE_BUCKET_ID: X64_0x3B_tcpip!TcpCreateListenerWorkQueueRoutine+ba
BUCKET_ID: X64_0x3B_tcpip!TcpCreateListenerWorkQueueRoutine+ba
I would start with a system file check that is open a cmd prompt withy admin rights and type
sfc /scannow = note space please between sfc and /
The crash actually occurred when using windows media player network resource - that is this
wmpnetwk.exe
and then, as I read it went wrong from there, creating a listener work queue.Whilst I look at another dump - go windows media player after the system file check, click the help tab and check for updates.
EDIT - I have looked at another three they are the same exactly - apart of course from the time element.
Edited by Macboatmaster, 15 February 2013 - 06:38 PM.