so hier ich hoffe das is so richtig :
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\030611-22838-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0284f000 PsLoadedModuleList = 0xfffff800`02a8ce50
Debug session time: Sun Mar 6 17:26:00.514 2011 (UTC + 2:00)
System Uptime: 0 days 3:06:16.538
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 18, {fffffa8006a55200, fffffa80081209a0, 1, fffffffeffffffff}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+463ba )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: fffffa8006a55200, Object type of the object whose reference count is being lowered
Arg2: fffffa80081209a0, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: fffffffeffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the objects reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: MOM.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002856f85 to fffff800028bf740
STACK_TEXT:
fffff880`078c7ad8 fffff800`02856f85 : 00000000`00000018 fffffa80`06a55200 fffffa80`081209a0 00000000`00000001 : nt!KeBugCheckEx
fffff880`078c7ae0 fffff800`02bd3354 : fffffa80`09150b30 00000000`00000000 fffffa80`097ff3f0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x463ba
fffff880`078c7b40 fffff800`02bd3254 : 00000000`0000080c fffffa80`09150b30 fffff8a0`0280c720 00000000`0000080c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078c7bd0 fffff800`028be993 : fffffa80`097ff3f0 fffff880`078c7ca0 00000000`1ae6ec70 fffffa80`097fc7f0 : nt!ObpCloseHandle+0x94
fffff880`078c7c20 00000000`7703f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ae6e838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7703f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+463ba
fffff800`02856f85 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+463ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+463ba
Followup: MachineOwner
---------
3: kd> analyze -v