Debugging a Minidump Dump File for a Stop 0xC2 Error

While reinstalling Windows on a Dell Dimension 2400 PC, I kept getting a Blue Screen of Death (BSOD) with a Stop 0xC2 error referring to "BAD_POOL_CALLER".


A problem has been detected and Windows has been shut down to prevent damage
to your computer.

BAD_POOL_CALLER

If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again. follow
these steps:

Check to make sure any new hardware or software is properly insalled.
If this is a new installation, aske your hardwaqre or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical information:

*** STOP: 0x000000C2 (0x00000007,0x00000CD4,0x00340045,0xE1B255E4)


Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.

The dump of physical memory that was generated when the BSOD occurred was being placed in a minidump file in C:\Windows\Minidump.

To debug minidump files generated by a Blue Screen of Death (BSOD) you can use the WinDbg tool from the Debugging Tools for Windows.

Note: the minidump files can usually be found in C:\Windows\minidump with names like Minimmddyy-xx, where mmddyy is the month, day, and year the dump file was creted. The digits at the end specify the order in which dump files were created on that date. E.g. Mini030309-01.dmp would be the first dump file created on March 3, 2009, while Mini030309-02.dmp would be the second.

I took the steps below to analyze the minidump file Mini030809-01.dmp generated and placed in C:\windows\minidump when I tried reinstalling Windows on March 3, 2009.

  1. I ran WinDbg.
  2. I clicked on File.
  3. I selected Symbol File Path.
  4. For this step, if you don't have a directory C:\symbols already, you would need to create one or select some other directory for the symbols, then enter SRV*c:\symbols*http://msdl.microsoft.com/download/symbols for the symbol path. If you aren't using c:\symbols adjust the directory path accordingly. You will need to have network connectivity to http://msdl.microsoft.com/download/symbols to use the Microsoft symbol server. For an explanation of the function of the Microsoft symbol server and information on how to, alternatively, obtain and install the needed symbols on your system rather than download them as needed from the Microsoft symbol server see Debugging Tools and Symbols: Getting Started.

    Symbol Search Path

    You should then see something similar to the following, which is what I saw in this case:

    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [G:\Documents\Minidump\Mini030809-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp.080413-2111
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
    Debug session time: Tue Mar  3 21:06:59.203 2009 (GMT-4)
    System Uptime: 0 days 0:05:55.765
    Loading Kernel Symbols
    ...............................................................
    .............................................
    Loading User Symbols
    Loading unloaded module list
    .............................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C2, {7, cd4, 340045, e11b0cbc}
    
    Unable to load image IntelC53.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for IntelC53.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC53.sys
    *** WARNING: Unable to verify timestamp for IntelC51.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC51.sys
    *** WARNING: Unable to verify timestamp for IntelC52.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC52.sys
    Probably caused by : IntelC53.sys ( IntelC53+1031 )
    
    Followup: MachineOwner
    ---------
    

    If you don't take this step of setting the symbol search path, you will see something like the following:

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y  argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    

  5. I clicked on File.
  6. I selected Open Crash Dump.
  7. I selected the minidump file, i.e. Mini030809-01.dmp, which I had transferred from the system that was crashing to another system for analysis. I had inserted a USB thumb drive in the crashed system and then rebooted that system with a Bart's Preinstalled Environment (BartPE) bootable live Windows CD to transfer the dump file from C:\windows\minidump on the failing system to the USB thumb drive.
  8. When prompted as to whether the program should "save information for workspace", I chose "no".
  9. At the kd> prompt, I typed !reload

    kd> !reload
    Loading Kernel Symbols
    ...............................................................
    .............................................
    Loading User Symbols
    Loading unloaded module list
    .............................................
    

  10. I then typed !analyze -v and saw the following:

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 00000007, Attempt to free pool which was already freed
    Arg2: 00000cd4, (reserved)
    Arg3: 00340045, Memory contents of the pool block
    Arg4: e11b0cbc, Address of the block of pool being deallocated
    
    Debugging Details:
    ------------------
    
    Unable to load image IntelC53.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for IntelC53.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC53.sys
    *** WARNING: Unable to verify timestamp for IntelC51.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC51.sys
    *** WARNING: Unable to verify timestamp for IntelC52.sys
    *** ERROR: Module load completed but symbols could not be loaded for IntelC52.sys
    
    BUGCHECK_STR:  0xc2_7
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  DRIVER_FAULT
    
    PROCESS_NAME:  setup.exe
    
    LAST_CONTROL_TRANSFER:  from 8054c4c1 to 8053380e
    
    STACK_TEXT:  
    f799f60c 8054c4c1 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
    f799f65c 8054be39 e11b0cbc 00000000 f799f6a8 nt!ExFreePoolWithTag+0x2be
    f799f66c f7971031 e11b0cbc 00000018 00000000 nt!ExFreePool+0xf
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f799f6a8 f79714fc f799f6e4 82b131d8 82b131d8 IntelC53+0x1031
    f799f6f0 f7971f1f 82b174f0 f799f724 00000000 IntelC53+0x14fc
    f799f71c f7971e1c 82b131c8 82b131c8 f7970bc3 IntelC53+0x1f1f
    f799f744 f79726f2 02410002 00000023 00000000 IntelC53+0x1e1c
    f799f764 f744b6e6 f7977558 00000023 00000000 IntelC53+0x26f2
    f799f788 f744b913 f75546d0 00000023 00000000 IntelC51+0x46e6
    f799f84c f73da554 8286b140 f73da591 000000fc IntelC51+0x4913
    f799f88c f73b4163 f7414588 82c54df0 82c23a70 IntelC52+0x28554
    f799f8a4 804e37f7 82b26ce0 82c54cf8 82c54e14 IntelC52+0x2163
    f799f8c4 804e37f7 82ad9020 82c54cf8 00000000 nt!IopfCallDriver+0x31
    f799f8d4 f886190c 82da7d20 00000000 82047d00 nt!IopfCallDriver+0x31
    f799f8f4 f8862c51 82ad9020 82c54cf8 00000001 Modem!WaitForLowerDriverToCompleteIrp+0x58
    f799fa30 f8862dd4 82da7d20 82c54cf8 82c54d08 Modem!UniOpenStarter+0x48b
    f799fa4c 804e37f7 82da7c68 82c54cf8 82c54cf8 Modem!UniOpen+0x50
    f799fa5c 8056c712 8294e588 82be19f4 f799fc04 nt!IopfCallDriver+0x31
    f799fb3c 80563fec 8294e5a0 00000000 82be1950 nt!IopParseDevice+0xa12
    f799fbc4 805684da 00000000 f799fc04 00000040 nt!ObpLookupObjectName+0x56a
    f799fc18 8056cbeb 00000000 00000000 c439f001 nt!ObOpenObjectByName+0xeb
    f799fc94 8056ccba 0144a618 c0100080 0144a5b8 nt!IopCreateFile+0x407
    f799fcf0 8056cdf0 0144a618 c0100080 0144a5b8 nt!IoCreateFile+0x8e
    f799fd30 804de7ec 0144a618 c0100080 0144a5b8 nt!NtCreateFile+0x30
    f799fd30 7c90e4f4 0144a618 c0100080 0144a5b8 nt!KiFastCallEntry+0xf8
    0144a610 00000000 00000000 00000000 00000000 0x7c90e4f4
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    IntelC53+1031
    f7971031 ??              ???
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  IntelC53+1031
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: IntelC53
    
    IMAGE_NAME:  IntelC53.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4048d16f
    
    FAILURE_BUCKET_ID:  0xc2_7_IntelC53+1031
    
    BUCKET_ID:  0xc2_7_IntelC53+1031
    
    Followup: MachineOwner
    ---------

From the last step, I could see that the process running when the BSOD occurred was setup.exe, which I would expect, since I was reinstalling Windows. I also saw the following:

BUGCHECK_STR:  0xc2_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  setup.exe

The BUGCHECK_STR is 0xC2_7, which matches the 0xC2 stop error. The _7 at the end of it references the first parameter displayed for that stop error, which was as follows:

*** STOP: 0x000000C2 (0x00000007,0x00000CD4,0x00340045,0xE1B255E4)

At How to Debug "Stop 0xC2" or "Stop 0x000000C2" Error Messages, I found that the 7 parameter means "the pool address being freed is already free." Near the end of the output produced by the !analyze -v command, I saw the following:

SYMBOL_NAME:  IntelC53+1031

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IntelC53

IMAGE_NAME:  IntelC53.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4048d16f

FAILURE_BUCKET_ID:  0xc2_7_IntelC53+1031

BUCKET_ID:  0xc2_7_IntelC53+1031

That led me to believe that the crash was being caused by an attempt to load a driver associated with the IntelC53.sys file. The following lines in the output led me to believe this was a modem driver.

f799f8f4 f8862c51 82ad9020 82c54cf8 00000001 Modem!WaitForLowerDriverToCompleteIrp+0x58
f799fa30 f8862dd4 82da7d20 82c54cf8 82c54d08 Modem!UniOpenStarter+0x48b
f799fa4c 804e37f7 82da7c68 82c54cf8 82c54cf8 Modem!UniOpen+0x50

File.net at IntelC53.sys Windows process - What is it? stated "The process Modem AFE Driver belongs to the software Intel(R) 537EP V9x DFV PCI Modem by Intel Corporation (www.intel.com)." At INTELC53.SYS, Prevx also linked the file to "Intel Corporation; Modem AFE Driver".

I was reinstalling Windows XP Home Edition on the Dell Dimension 2400 PC, but I didn't have the original Windows installation CD that came with the system. Instead, I had a Windows XP Home Edition installation CD that came with another Dell computer, which I suspect was for a different model of Dell computer with that modem. I went to Dell's support site and at the page to lookup information on a system by service tag, I put in the system's Dell service tag. When I checked the system configuration information listed there for the system as it was shipped from the factory, I found the modem for the system described as "Modem, V.92, Data Fax, Internal Donny, Dell Americas Organization". I looked up the part number, X2749, listed for it and found it listed at TechExcess.Net as a "Dell X2749 Dimension Intel 537EPG 56K V.92 Data Fax Modem Card".

I downloaded the "Intel 537E,v.9X,PCI,Modem" driver from Dell's support site, since that was the driver associated with the service tag number I entered. The file I downloaded was R133743.EXE. It was a self-extracting zip file. I extracted its contents and looked in the WinXP directory created when I extracted the contents of the file. I found IntelC51.sys, IntelC52.sys, and IntelC56.sys in that directory, but no IntelC53.sys. When I opened the IntelC51.inf file I found in that directory (that was the only .inf file there), I found a reference to IntelC53, though.


;----------------------------------------------------------------------------
; Modifiable strings used by this INF file
;----------------------------------------------------------------------------
[Strings]
Oem             = "DELL"
ModemName6 = "Intel(R) 537EP V9x DF PCI Modem"
InstDiskName    = "Modem Installation Disk"
UninstallPath   = "Software\Microsoft\Windows\CurrentVersion\Uninstall"
CPdrv           = "IntelC52"
DSPdrv          = "IntelC51"
AFEdrv          = "IntelC53"
MOHdrv          = "mohfilt"
CHIP            = "Intel 537"
COINST          = "IntelCci.dll"
DIAGDLL     = "mhwt.dll"
MOHDLL      = "intelmoh.dll"

The only other reference to "IntelC53", though, in the file was in the following section:

[CopySM6]
IntelC53.sys, IntelC56.sys, , 2

I used WinDbg to check other minidump files created when I received the "BAD_POOL_CALLER" BSOD with "STOP: 0x000000C2". They also pointed to IntelC53.sys as the culprit for the BSOD when I used the !anallyze -v command. Though, I suspect that the problem is due to the setup routine attempting to load an incorrect modem driver for this system, I suppose it is also possible that it is trying to use a corrupted driver file already on the system, since the system had been badly infected by malware prior to my attempt to reinstall Windows without completely wiping the system. I.e., I was trying to avoid having to reload applications, since I didn't have the installation discs for some of the software the user had on the system. I did see IntelC51.sys, IntelC52.sys, and IntelC53.sys in the C:\Windows\system32\drivers directory on the system and also in C:\i386.

I also used the lm n t command in WinDbg after loading the crash dump and checking it with !analyze -v. The lm n t command lists the specified loaded modules. The output includes the status and the path of the module. I saw the following output for the command.

kd> lm n t
start    end        module name
804d7000 806ed680   nt       ntoskrnl.exe Sun Apr 13 15:27:39 2008 (48025EAB)
806ee000 8070e300   hal      halaacpi.dll Sun Apr 13 14:31:27 2008 (4802517F)
bf800000 bf9c2980   win32k   win32k.sys   Sun Apr 13 15:29:46 2008 (48025F2A)
bf9c3000 bf9d4600   dxg      dxg.sys      Sun Apr 13 14:38:27 2008 (48025323)
bff50000 bff52480   framebuf framebuf.dll Sun Apr 13 20:09:59 2008 (4802A0D7)
f73b2000 f7446b60   IntelC52 IntelC52.sys Fri Mar 05 14:15:31 2004 (4048D1D3)
f7447000 f756d6a0   IntelC51 IntelC51.sys Fri Mar 05 14:14:39 2004 (4048D19F)
f760e000 f7631200   USBPORT  USBPORT.SYS  Sun Apr 13 14:45:34 2008 (480254CE)
f77ee000 f784bf00   update   update.sys   Sun Apr 13 14:39:46 2008 (48025372)
f7854000 f7857c80   mssmbios mssmbios.sys Sun Apr 13 14:36:45 2008 (480252BD)
f7874000 f7897180   Fastfat  Fastfat.SYS  Sun Apr 13 15:14:28 2008 (48025B94)
f7970000 f797e220   IntelC53 IntelC53.sys Fri Mar 05 14:13:51 2004 (4048D16F)
f79f4000 f79f7f00   MODEMCSA MODEMCSA.sys Fri Aug 17 16:57:37 2001 (3B7D8541)
f7a70000 f7a7a200   raspppoe raspppoe.sys Sun Apr 13 14:57:31 2008 (4802579B)
f7a90000 f7a9e880   usbhub   usbhub.SYS   Sun Apr 13 14:45:36 2008 (480254D0)
f7b86000 f7b9d900   dump_atapi dump_atapi.sys Sun Apr 13 14:40:29 2008 (4802539D)
f7b9e000 f7bcd820   mfehidk  mfehidk.sys  Thu Aug 16 11:51:29 2007 (46C47281)
f7bce000 f7c3d780   mrxsmb   mrxsmb.sys   Sun Apr 13 15:16:58 2008 (48025C2A)
f7c3e000 f7c68e80   rdbss    rdbss.sys    Sun Apr 13 15:28:38 2008 (48025EE6)
f7c69000 f7c8ab80   afd      afd.sys      Sun Apr 13 15:19:22 2008 (48025CBA)
f7cb3000 f7cdac00   netbt    netbt.sys    Sun Apr 13 15:20:59 2008 (48025D1B)
f7cdb000 f7d00500   ipnat    ipnat.sys    Sun Apr 13 14:57:10 2008 (48025786)
f7d01000 f7d25000   Mpfp     Mpfp.sys     Fri Jul 13 10:20:23 2007 (46978A27)
f7d25000 f7d7d380   tcpip    tcpip.sys    Sun Apr 13 15:20:12 2008 (48025CEC)
f7d7e000 f7d90600   ipsec    ipsec.sys    Sun Apr 13 15:19:42 2008 (48025CCE)
f7dc9000 f7dcb900   Dxapi    Dxapi.sys    Fri Aug 17 16:53:19 2001 (3B7D843F)
f7ecf000 f7edad00   raspptp  raspptp.sys  Sun Apr 13 15:19:47 2008 (48025CD3)
f7eff000 f7f0fe00   psched   psched.sys   Sun Apr 13 14:56:36 2008 (48025764)
f7f10000 f7f26580   ndiswan  ndiswan.sys  Sun Apr 13 15:20:41 2008 (48025D09)
f7f27000 f7f41160   dne2000  dne2000.sys  Thu Jul 24 22:55:48 2003 (3F209C34)
f7f42000 f7f65a80   portcls  portcls.sys  Sun Apr 13 15:19:40 2008 (48025CCC)
f7f66000 f7ff67c0   smwdm    smwdm.sys    Tue Nov 18 11:38:30 2003 (3FBA4B06)
f7ff7000 f800a900   parport  parport.sys  Sun Apr 13 14:40:09 2008 (48025389)
f81ef000 f8211700   ks       ks.sys       Sun Apr 13 15:16:34 2008 (48025C12)
f8236000 f8249f00   VIDEOPRT VIDEOPRT.SYS Sun Apr 13 14:44:39 2008 (48025497)
f8341000 f835ab80   Mup      Mup.sys      Sun Apr 13 15:17:05 2008 (48025C31)
f835b000 f8387980   NDIS     NDIS.sys     Sun Apr 13 15:20:35 2008 (48025D03)
f8388000 f8414600   Ntfs     Ntfs.sys     Sun Apr 13 15:15:49 2008 (48025BE5)
f8415000 f842b880   KSecDD   KSecDD.sys   Sun Apr 13 14:31:40 2008 (4802518C)
f842c000 f8440240   drvmcdb  drvmcdb.sys  Thu Jul 31 20:51:10 2003 (3F29B97E)
f8441000 f8460b00   fltmgr   fltmgr.sys   Sun Apr 13 14:32:58 2008 (480251DA)
f8461000 f8478900   atapi    atapi.sys    Sun Apr 13 14:40:29 2008 (4802539D)
f8479000 f8497880   Ftdisk   Ftdisk.sys   Fri Aug 17 16:52:41 2001 (3B7D8419)
f8498000 f84a8a80   PCI      PCI.sys      Sun Apr 13 14:36:43 2008 (480252BB)
f84a9000 f84d6d80   ACPI     ACPI.sys     Sun Apr 13 14:36:33 2008 (480252B1)
f84f8000 f8501180   isapnp   isapnp.sys   Sun Apr 13 14:36:40 2008 (480252B8)
f8508000 f8512580   MountMgr MountMgr.sys Sun Apr 13 14:39:45 2008 (48025371)
f8518000 f8524c80   VolSnap  VolSnap.sys  Sun Apr 13 14:41:00 2008 (480253BC)
f8528000 f8530e00   disk     disk.sys     Sun Apr 13 14:40:46 2008 (480253AE)
f8538000 f8544180   CLASSPNP CLASSPNP.SYS Sun Apr 13 15:16:21 2008 (48025C05)
f8568000 f8570e00   intelppm intelppm.sys Sun Apr 13 14:31:31 2008 (48025183)
f8598000 f85a4d00   i8042prt i8042prt.sys Sun Apr 13 15:17:59 2008 (48025C67)
f85a8000 f85b7c00   Serial   Serial.SYS   Sun Apr 13 15:15:44 2008 (48025BE0)
f85b8000 f85c2480   imapi    imapi.sys    Sun Apr 13 14:40:57 2008 (480253B9)
f85c8000 f85d7600   cdrom    cdrom.sys    Sun Apr 13 14:40:45 2008 (480253AD)
f85d8000 f85e6100   redbook  redbook.sys  Sun Apr 13 14:40:27 2008 (4802539B)
f85e8000 f85f6b00   drmk     drmk.sys     Sun Apr 13 14:45:12 2008 (480254B8)
f8628000 f8630900   msgpc    msgpc.sys    Sun Apr 13 14:56:32 2008 (48025760)
f8638000 f8641f00   termdd   termdd.sys   Sun Apr 13 14:38:36 2008 (4802532C)
f8648000 f8651e80   NDProxy  NDProxy.SYS  Sun Apr 13 14:57:28 2008 (48025798)
f8678000 f8680080   ipfltdrv ipfltdrv.sys Fri Aug 17 16:55:07 2001 (3B7D84AB)
f8688000 f8690780   netbios  netbios.sys  Sun Apr 13 14:56:01 2008 (48025741)
f86a8000 f86b2880   bcm4sbxp bcm4sbxp.sys Thu May 15 21:09:31 2003 (3EC43A4B)
f86b8000 f86c2e00   Fips     Fips.SYS     Sun Apr 13 14:33:27 2008 (480251F7)
f86d8000 f86e0700   wanarp   wanarp.sys   Sun Apr 13 14:57:20 2008 (48025790)
f86f8000 f8707900   Cdfs     Cdfs.SYS     Sun Apr 13 15:14:21 2008 (48025B8D)
f8718000 f8724880   rasl2tp  rasl2tp.sys  Sun Apr 13 15:19:43 2008 (48025CCF)
f8778000 f877e180   PCIIDEX  PCIIDEX.SYS  Sun Apr 13 14:40:29 2008 (4802539D)
f8780000 f8781000   Fdc      Fdc.sys      unavailable (00000000)
f8788000 f878cd00   PartMgr  PartMgr.sys  Sun Apr 13 14:40:48 2008 (480253B0)
f8790000 f8794e20   PxHelp20 PxHelp20.sys Tue Feb 01 18:23:42 2005 (42000F7E)
f87a8000 f87ad200   vga      vga.sys      Sun Apr 13 14:44:40 2008 (48025498)
f87c8000 f87cca80   Msfs     Msfs.SYS     Sun Apr 13 14:32:38 2008 (480251C6)
f87d0000 f87d4080   raspti   raspti.sys   Fri Aug 17 16:55:32 2001 (3B7D84C4)
f87d8000 f87df880   Npfs     Npfs.SYS     Sun Apr 13 14:32:38 2008 (480251C6)
f87f8000 f87fd000   flpydisk flpydisk.sys Sun Apr 13 14:40:24 2008 (48025398)
f8808000 f880e000   kbdclass kbdclass.sys Sun Apr 13 14:39:46 2008 (48025372)
f8810000 f8815a00   mouclass mouclass.sys Sun Apr 13 14:39:47 2008 (48025373)
f8818000 f881c300   omci     omci.sys     Mon Nov 04 18:05:02 2002 (3DC6FD1E)
f8840000 f8844a80   TDI      TDI.SYS      Sun Apr 13 15:00:04 2008 (48025834)
f8850000 f8854580   ptilink  ptilink.sys  Fri Aug 17 16:49:53 2001 (3B7D8371)
f8858000 f885c500   watchdog watchdog.sys Sun Apr 13 14:44:59 2008 (480254AB)
f8860000 f8867580   Modem    Modem.SYS    Sun Apr 13 15:00:18 2008 (48025842)
f88d0000 f88d7600   usbehci  usbehci.sys  Sun Apr 13 14:45:34 2008 (480254CE)
f88e8000 f88ed080   usbuhci  usbuhci.sys  Sun Apr 13 14:45:34 2008 (480254CE)
f88f8000 f88fdbe0   mohfilt  mohfilt.sys  Fri Mar 05 14:13:37 2004 (4048D161)
f8900000 f8905a80   ssrtln   ssrtln.sys   Mon Jul 14 14:28:21 2003 (3F12F645)
f8908000 f890b000   BOOTVID  BOOTVID.dll  Fri Aug 17 16:49:09 2001 (3B7D8345)
f8988000 f898a180   i2omgmt  i2omgmt.SYS  Sun Apr 13 14:41:22 2008 (480253D2)
f8990000 f8993d80   serenum  serenum.SYS  Sun Apr 13 14:40:12 2008 (4802538C)
f8994000 f8996280   rasacd   rasacd.sys   Fri Aug 17 16:55:39 2001 (3B7D84CB)
f89a0000 f89a31c0   cdrbsdrv cdrbsdrv.SYS Sun Mar 07 22:55:49 2004 (404BEEC5)
f89a8000 f89aa700   GEARAspiWDM GEARAspiWDM.sys Tue Apr 08 15:15:38 2008 (47FBC45A)
f89c0000 f89c2780   ndistapi ndistapi.sys Sun Apr 13 14:57:27 2008 (48025797)
f89f8000 f89f9b80   kdcom    kdcom.dll    Fri Aug 17 16:49:10 2001 (3B7D8346)
f89fa000 f89fb100   WMILIB   WMILIB.SYS   Fri Aug 17 17:07:23 2001 (3B7D878B)
f8a00000 f8a015c0   sscdbhk5 sscdbhk5.sys Mon Jul 14 14:28:38 2003 (3F12F656)
f8a04000 f8a05120   aeaudio  aeaudio.sys  Mon Apr 01 10:39:14 2002 (3CA87112)
f8a0a000 f8a0b100   swenum   swenum.sys   Sun Apr 13 14:39:52 2008 (48025378)
f8a16000 f8a17f00   Fs_Rec   Fs_Rec.SYS   Fri Aug 17 16:49:37 2001 (3B7D8361)
f8a1a000 f8a1b080   Beep     Beep.SYS     Fri Aug 17 16:47:33 2001 (3B7D82E5)
f8a1e000 f8a1f080   mnmdd    mnmdd.SYS    Fri Aug 17 16:57:28 2001 (3B7D8538)
f8a22000 f8a23080   RDPCDD   RDPCDD.sys   Fri Aug 17 16:46:56 2001 (3B7D82C0)
f8a2c000 f8a2d100   dump_WMILIB dump_WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f8a3e000 f8a3f280   USBD     USBD.SYS     Fri Aug 17 17:02:58 2001 (3B7D8682)
f8ac0000 f8ac0d00   PCIIde   PCIIde.sys   Fri Aug 17 16:51:49 2001 (3B7D83E5)
f8b82000 f8b82c00   audstub  audstub.sys  Fri Aug 17 16:59:40 2001 (3B7D85BC)
f8c0b000 f8c0bb80   Null     Null.SYS     Fri Aug 17 16:47:39 2001 (3B7D82EB)
f8c0c000 f8c0cd00   dxgthk   dxgthk.sys   Fri Aug 17 16:53:12 2001 (3B7D8438)

Unloaded modules:
f88a0000 f88a8000   Modem.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8890000 f8896000   mohfilt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7632000 f76c7000   IntelC52.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f76c7000 f77ee000   IntelC51.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7910000 f791f000   IntelC53.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f78bc000 f78c0000   MODEMCSA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7548000 f760e000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8212000 f8236000   USBPORT.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f87c0000 f87c8000   usbehci.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f87b8000 f87be000   usbuhci.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8a10000 f8a12000   USBD.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8658000 f8667000   usbhub.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f87f0000 f87f8000   Modem.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f87e0000 f87e6000   mohfilt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8033000 f80c8000   IntelC52.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f80c8000 f81ef000   IntelC51.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8578000 f8587000   IntelC53.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8588000 f8593000   bcm4sbxp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8023000 f8027000   MODEMCSA.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7e01000 f7e5f000   update.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f89d0000 f89d4000   mssmbios.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8878000 f887d000   omci.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8860000 f8865000   raspti.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8618000 f8624000   raspptp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8608000 f8613000   raspppoe.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f85f8000 f8605000   rasl2tp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7822000 f78e8000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ad8000 f7b9e000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f86a8000 f86b1000   processr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f8698000 f86a3000   p3.sys  
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f88f0000 f88f5000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f800f000 f8012000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7ceb000 f7db1000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d13000 f7dd9000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d13000 f7dd9000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d13000 f7dd9000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d13000 f7dd9000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d13000 f7dd9000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7d3b000 f7e01000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f824a000 f8310000   ialmnt5.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

References:

  1. Blue Screen of Death
    Wikipedia, the free encyclopedia
  2. How to Debug "Stop 0xC2" or "Stop 0x000000C2" Error Messages
    Article ID: 265879
    Last Review: October 23, 2007 - Revision: 5.3
    Microsoft Help and Support
  3. Stop Error When You Upgrade from Windows 2000: Bad_Pool_Caller 0xC2
    Article ID: 310527
    Last Review: March 27, 2007 - Revision: 2.2
    Microsoft Help and Support
  4. Debugging Tools for Windows - Overview
    Microsoft Corporation
  5. Error Message Help Please
    Date: September 20, 2005
    MajorGeeks Support Forums
  6. How to read the small memory dump files that Windows creates for debugging
    Article ID: 315263
    Last Review: March 4, 2009 - Revision: 5.0
    Microsoft Help and Support
  7. HOW TO: Debug Memory Dumps (Figure out what is causing a BSOD
    Date: June 21, 2004
    By: Adrynalyne - Major Geeks Forum Administrator
    MajorGeeks Support Forums
  8. IntelC53.sys Windows process - What is it?
    file.net
  9. INTELC53.SYS
    Prevx Ltd