Same thing here: I have the Kernel dump (134 MB in size) (40 MB zipped) here is the debug out put:
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: set _NT_SYMBOL_PATH=srv*D:\applications\windows\symbols*http://msdl.microsoft.com/download/symbols
:\Applications\Symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Fri Jul 4 17:19:57.015 2008 (GMT+2)
System Uptime: 0 days 8:23:13.752
Loading Kernel Symbols
...
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Loading unloaded module list
....................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 8E, {c0000005, 8056ca09, b55aeb8c, 0}
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Probably caused by : aswSP.SYS ( aswSP+854a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8056ca09, The address that the exception occurred at
Arg3: b55aeb8c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!SeCreateAccessStateEx+36
8056ca09 f3ab rep stos dword ptr es:[edi]
TRAP_FRAME: b55aeb8c -- (.trap 0xffffffffb55aeb8c)
ErrCode = 00000002
eax=00000000 ebx=00000001 ecx=0000001d edx=000000d6 esi=8a7b2630 edi=00000001
eip=8056ca09 esp=b55aec00 ebp=b55aec10 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!SeCreateAccessStateEx+0x36:
8056ca09 f3ab rep stos dword ptr es:[edi] es:0023:00000001=?
?
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: iexplore.exe
LAST_CONTROL_TRANSFER: from 805221e9 to 80537672
STACK_TEXT:
b55ae754 805221e9 0000008e c0000005 8056ca09 nt!KeBugCheckEx+0x1b
b55aeb1c 804de3f3 b55aeb38 00000000 b55aeb8c nt!KiDispatchException+0x3b1
b55aeb84 804de3a4 b55aec10 8056ca09 badb0d00 nt!CommonDispatchException+0x4d
b55aec10 8056ca93 88f2b190 890f7c88 00000001 nt!Kei386EoiHelper+0x18a
b55aec10 8056ca93 88f2b190 890f7c88 00000001 nt!SeCreateAccessState+0x28
b55aec30 805703a9 00000001 8a7b2630 00000000 nt!SeCreateAccessState+0x28
b55aec60 80572cfe 00000000 8a7b25c8 00000001 nt!ObOpenObjectByName+0x8f
b55aed34 b76f054a 01aec804 00000001 01aec770 nt!NtOpenKey+0x1af
WARNING: Stack unwind information not available. Following frames may be wrong.
b55aed50 804dd98f 01aec804 00000001 01aec770 aswSP+0x854a
b55aed50 7c90e4f4 01aec804 00000001 01aec770 nt!KiFastCallEntry+0xfc
01aec7b0 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
aswSP+854a
b76f054a ff75fc push dword ptr [ebp-4]
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: aswSP+854a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: aswSP
IMAGE_NAME: aswSP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 482cc53e
FAILURE_BUCKET_ID: 0x8E_aswSP+854a
BUCKET_ID: 0x8E_aswSP+854a
Followup: MachineOwner
---------
0: kd> .trap 0xffffffffb55aeb8c
ErrCode = 00000002
eax=00000000 ebx=00000001 ecx=0000001d edx=000000d6 esi=8a7b2630 edi=00000001
eip=8056ca09 esp=b55aec00 ebp=b55aec10 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!SeCreateAccessStateEx+0x36:
8056ca09 f3ab rep stos dword ptr es:[edi] es:0023:00000001=?
?
0: kd> lmvm aswSP
start end module name
b76e8000 b76ff000 aswSP (no symbols)
Loaded symbol image file: aswSP.SYS
Image path: \SystemRoot\System32\Drivers\aswSP.SYS
Image name: aswSP.SYS
Timestamp: Fri May 16 01:20:30 2008 (482CC53E)
CheckSum: 00022AA0
ImageSize: 00017000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
