Quelques informations supplémentaires que j'ai récupéré en farfouinant...
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17017.amd64fre.win7_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`0304e000 PsLoadedModuleList = 0xfffff800`0328ae70
Debug session time: Tue Jul 3 08:28:08.863 2012 (UTC + 2:00)
System Uptime: 0 days 0:03:19.800
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdc018). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a01e864854, 0, fffff880012a2a35, 2}
Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveScb+bd )
Followup: MachineOwner
---------
4: kd> !analyze –v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a01e864854, 0, fffff880012a2a35, 2}
Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveScb+bd )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a01e864854, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880012a2a35, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a01e864854 Paged pool
FAULTING_IP:
Ntfs!NtfsRemoveScb+bd
fffff880`012a2a35 f7400400010200 test dword ptr [rax+4],20100h
MM_INTERNAL_CODE: 2
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d
MODULE_NAME: Ntfs
FAULTING_MODULE: fffff88001210000 Ntfs
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88006e6e890 -- (.trap 0xfffff88006e6e890)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a01e864850 rbx=0000000000000000 rcx=fffffa8009025780
rdx=fffff8a00e864980 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012a2a35 rsp=fffff88006e6ea20 rbp=fffffa80073dec00
r8=0000000000000000 r9=0000000000000000 r10=fffffa8009025780
r11=fffff88006e6eaf0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
Ntfs!NtfsRemoveScb+0xbd:
fffff880`012a2a35 f7400400010200 test dword ptr [rax+4],20100h ds:008c:4854=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000313c452 to fffff800030be040
STACK_TEXT:
fffff880`06e6e728 fffff800`0313c452 : 00000000`00000050 fffff8a0`1e864854 00000000`00000000 fffff880`06e6e890 : nt!KeBugCheckEx
fffff880`06e6e730 fffff800`030bc12e : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`01220e8b : nt! ?? ::FNODOBFM::`string'+0x40940
fffff880`06e6e890 fffff880`012a2a35 : fffff8a0`0e864850 00000000`00000000 00000000`00000001 fffff880`012baf56 : nt!KiPageFault+0x16e
fffff880`06e6ea20 fffff880`01218a50 : fffff8a0`0e864880 fffff8a0`0e864980 fffffa80`073dec00 fffff880`012af4cf : Ntfs!NtfsRemoveScb+0xbd
fffff880`06e6ea60 fffff880`012a03ec : fffff8a0`0e864850 fffffa80`073dec60 fffff880`06e6eb98 fffffa80`09025780 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`06e6ea90 fffff880`012b7196 : fffffa80`09025780 fffff880`06745470 fffffa80`09025780 fffffa80`09025700 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`06e6eb10 fffff880`0122198d : fffffa80`09025780 fffffa80`073dec60 fffff880`06745470 fffffa80`08d43000 : Ntfs!NtfsCommonCreate+0x21ff
fffff880`06e6ecf0 fffff800`030b5ec7 : fffff880`067453e0 00700075`003c003e 00650074`00610064 0070006d`006f0043 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`06e6ed20 fffff800`030b5e81 : 00000000`00000000 fffffa80`08d43060 fffff880`06e6f000 fffff800`030cd88a : nt!KxSwitchKernelStackCallout+0x27
fffff880`067452b0 fffff800`030cd88a : fffffa80`073dec00 fffffa80`08d43060 00000000`00000000 fffff880`012af08d : nt!KiSwitchKernelStackContinue
fffff880`067452d0 fffff880`012218af : fffff880`01221970 fffff880`067453e0 fffff880`06745400 fffff880`012c040d : nt!KeExpandKernelStackAndCalloutEx+0x29a
fffff880`067453b0 fffff880`012bbaa0 : 00000000`00000000 00000000`00000000 fffff880`06745600 fffffa80`073dec60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`06745410 fffff880`0103d23f : fffffa80`07791030 fffffa80`073dec60 fffffa80`09a21100 fffffa80`076a3b60 : Ntfs!NtfsFsdCreate+0x1b0
fffff880`067455c0 fffff880`0105c2b9 : fffffa80`073dec60 fffffa80`06719800 fffffa80`073dec00 fffffa80`076a3b60 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`06745650 fffff800`033bb947 : 00000000`00000005 fffff800`033bb3a0 fffffa80`09c7e010 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`06745700 fffff800`033b2294 : fffffa80`07673940 00000000`00000000 fffffa80`09ca3740 00000000`00000701 : nt!IopParseDevice+0x5a7
fffff880`06745890 fffff800`033b6f8d : fffffa80`09ca3740 fffff880`067459f0 00000000`00000040 fffffa80`067039f0 : nt!ObpLookupObjectName+0x585
fffff880`06745990 fffff800`033bda57 : fffff880`030f9180 00000000`00000001 fffffa80`0a134301 fffff880`06745a58 : nt!ObOpenObjectByName+0x1cd
fffff880`06745a40 fffff800`033d6204 : 00000000`00baf7b0 fffff8a0`00000080 00000000`02b62290 00000000`00baf810 : nt!IopCreateFile+0x2b7
fffff880`06745ae0 fffff800`030bd293 : ffffffff`ffffffff fffffa80`089df280 00000000`00baf758 fffff880`00000004 : nt!NtOpenFile+0x58
fffff880`06745b70 00000000`7782f9ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00baf778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7782f9ea
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs!NtfsRemoveScb+bd
fffff880`012a2a35 f7400400010200 test dword ptr [rax+4],20100h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Ntfs!NtfsRemoveScb+bd
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: X64_0x50_Ntfs!NtfsRemoveScb+bd
BUCKET_ID: X64_0x50_Ntfs!NtfsRemoveScb+bd
Followup: MachineOwner
---------