Forum Home
Press F1
 
Thread ID: 84177 2007-10-27 00:12:00 Blue Screen Of Death (BSOD) aklthomas (12936) Press F1
Post ID Timestamp Content User
605726 2007-10-27 00:12:00 Hi there,

Recently, I've had three BSOD happened on either startup or shutdown . I installed the WinDbg tool, analyzed the dump file and found the possible cause is a file called: ntkrnlmp . exe .

I know this is a Windows nt & system kernel file, but I can't find this file on my computer . All I can find are the ntkrnlpa . exe and ntoskrnl . exe . My OS is Win Vista Ultimate .

Is there anybody out there can help me out on this issue? The following is the log file generated by WinDbg:

--------------------------------------------------------------------------
WARNING: Inaccessible path: 'C:\windows\system\System32'
WARNING: Whitespace at start of path element

Microsoft (R) Windows Debugger Version 6 . 8 . 0004 . 0 X86
Copyright (c) Microsoft Corporation . All rights reserved .


Loading Dump File [C:\Program Files\Debugging Tools for Windows\Mini102707-01 . dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\DumpFileSymbols* . microsoft . com/download/symbols" target="_blank">msdl . microsoft . com
Executable search path is: C:\Windows\System32;C:\windows\system\System32; . alexander . com/SymServe" target="_blank">www . alexander . com
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000 . 16514 . x86fre . vista_gdr . 070627-1500
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d08ab0
Debug session time: Fri Oct 26 20:19:57 . 938 2007 (GMT+13)
System Uptime: 0 days 12:24:03 . 949
Loading Kernel Symbols
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Loading User Symbols
Loading unloaded module list
. . . . . . .
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information .

BugCheck D1, {14002ff, 2, 0, 85a0960d}



Probably caused by : ntkrnlmp . exe ( nt!KiTrap0E+2ac )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high . This is usually
caused by drivers using improper addresses .
If kernel debugger is available get stack backtrace .
Arguments:
Arg1: 014002ff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 85a0960d, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from 81d275a0
Unable to read MiSystemVaType memory at 81d08680
014002ff

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffff85a0960d
85a0960d ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: 981b1ca4 -- ( . trap 0xffffffff981b1ca4)
ErrCode = 00000000
eax=00000000 ebx=8573eac8 ecx=8675100c edx=014002ff esi=86751008 edi=00000000
eip=85a0960d esp=981b1d18 ebp=84c6a2a8 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
85a0960d ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 85a0960d to 81c49254

STACK_TEXT:
981b1ca4 85a0960d badb0d00 014002ff 0000001f nt!KiTrap0E+0x2ac
WARNING: Frame IP not in any known module . Following frames may be wrong .
981b1d14 c0000140 86751008 ca70a400 00000084 0x85a0960d
981b1d44 81c6b50a 8424b478 00000000 86e54178 0xc0000140
981b1dc0 81c9a196 81c6b40d 80000001 00000000 nt!ExpWorkerThread+0xfd
981b1dc4 81c6b40d 80000001 00000000 00000000 nt!KiThreadStartup+0x16
981b1dc8 80000001 00000000 00000000 00000000 nt!ExpWorkerThread
981b1dcc 00000000 00000000 00000000 00000000 0x80000001


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+2ac
81c49254 833de0f7d18100 cmp dword ptr [nt!KiFreezeFlag (81d1f7e0)],0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+2ac

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp . exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4683084f

FAILURE_BUCKET_ID: 0xD1_nt!KiTrap0E+2ac

BUCKET_ID: 0xD1_nt!KiTrap0E+2ac

Followup: MachineOwner
--------------------------------------------------------------------------
Thanks in advanced! 		aklthomas (12936)
605727 2007-10-28 00:31:00 As you have had no replies:
Put your Vista Install DVD in and start-up the machine, chose language, then click Repair. 		PENTIUM (426)
605728 2007-10-28 00:51:00 Before you do repair Make SURE you have backup all your data. stu161204 (123)
605729 2007-10-28 02:08:00 Thanks, I've searched on the net and seems to me that a lot of people are having the same problem but no clear answer for this kind of issue. So, I've done the complete pc restoration and see what would happen. If I keep getting this BSOD then I may have to do a clean installation again. aklthomas (12936)
605730 2007-10-28 03:45:00 I've had three BSOD happened on either startup or shutdown .

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
This is usually caused by drivers using improper addresses .


VISTA_DRIVER_FAULT


Its a driver error . 		pctek (84)
1