blue screen memory dump please help Kirsten 13.07.2007 14:36:02 I have been getting the blue screen and memory dump. I ran the debugger and it showed that the probable cause was ntkrpamp.exe. When I found that on my machine it looks like it might be a sp2 file. The only two things that I have installed recently are a trial of Microsoft expressions web and harry potter and the order of the phoenix game. Of course, regular updates have been automatically installed. I will include what I got when I debugged. I would really appreciate any help Here is what I got when I ran the debugger: Microsoft (R) Windows Debugger Version 6.7.0005.1 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\websymbols\Mini071207-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.070227-2254 Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700 Debug session time: Thu Jul 12 16:33:46.687 2007 (GMT-5) System Uptime: 0 days 9:43:32.405 Loading Kernel Symbols ........................................................................................................................................................................................................ Loading User Symbols Loading unloaded module list ................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000000A, {0, 1c, 1, 804faee4} Probably caused by : ntkrpamp.exe ( nt!KeWaitForSingleObject+186 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 00000000, memory referenced Arg2: 0000001c, IRQL Arg3: 00000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: 804faee4, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: 00000000 CURRENT_IRQL: 1c FAULTING_IP: nt!KeWaitForSingleObject+186 804faee4 8939 mov dword ptr [ecx],edi CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System LAST_CONTROL_TRANSFER: from 806e496b to 804faee4 STACK_TEXT: f793dcd4 806e496b 00000000 00000000 00000000 nt!KeWaitForSingleObject+0x186 f793dcf4 804ed874 8578ef58 855f1e84 8578ef50 hal!ExAcquireFastMutex+0x2b f793dd08 f72cf808 e5bfaeb8 855f1c28 e5bfaeb8 nt!FsRtlRemovePerStreamContext+0x1e f793dd34 f72d0d56 855f1c28 86b3c1a8 8526a818 fltmgr!FltpDeleteAllStreamListCtrls+0x62 f793dd50 f72c35f7 855f1cac 00000008 86b3c1a8 fltmgr!FltpFreeVolume+0xa4 f793dd68 f72c734e 8526a818 00000008 8056375c fltmgr!FltpCleanupDeviceObject+0x61 f793dd7c 805379bd 86b3c1a8 00000000 871c1b30 fltmgr!FltpFastIoDetachDeviceWorker+0x14 f793ddac 805ce84c 86b3c1a8 00000000 00000000 nt!ExpWorkerThread+0xef f793dddc 8054532e 805378ce 00000001 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!KeWaitForSingleObject+186 804faee4 8939 mov dword ptr [ecx],edi SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!KeWaitForSingleObject+186 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrpamp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

Re: blue screen memory dump please help Richard Hein <richhein[ at ]heincomputilng.com> 13.07.2007 14:48:37 Have you tried a system restore?

Re: blue screen memory dump please help Kirsten 13.07.2007 17:26:10 Restore to what? Do you mean to restore to a previous registry? I'm not sure what day to do? "Richard Hein" wrote: [Quoted Text] > Have you tried a system restore? >

Re: blue screen memory dump please help "Jim" <j.n[ at ]nospam.com> 13.07.2007 19:07:46 "Kirsten" <Kirsten[ at ]discussions.microsoft.com> wrote in message news:E38E544A-0B48-4283-930A-28DE954E017B[ at ]microsoft.com... [Quoted Text] > Restore to what? Do you mean to restore to a previous registry? I'm not > sure what day to do? > No, he means use the system restore facility which restores the operating system to a previous state. You get to system restore (on my Dell laptop anyway) via Help & Support. To do this, open Help & Support from the Start Menu. Under "Pick a Task" you will see an item called "undo changes to your system with System Restore" Click on System Restore and follow the instructions on the screen. Jim > "Richard Hein" wrote: > >> Have you tried a system restore? >>