My XP machine has been rebooting itself after recovering from a serious error. I am never using the machine when this happens. Because several of us use the machine I don't really have a time of reference for when it started, but suspect it started with my new monitor. I believe I had to install new drivers. Can someone help me read this to see if I am even close? Thanks! Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.070227-2254 Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700 Debug session time: Sat Oct 4 13:02:33.855 2008 (GMT-7) System Uptime: 4 days 9:59:49.142 Loading Kernel Symbols .................................................................................................................................................... Loading User Symbols Loading unloaded module list .................................................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {7, cd4, 4100602, e32db3b8} Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+2a3 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 00000007, Attempt to free pool which was already freed Arg2: 00000cd4, (reserved) Arg3: 04100602, Memory contents of the pool block Arg4: e32db3b8, Address of the block of pool being deallocated Debugging Details: ------------------ POOL_ADDRESS: e32db3b8 FREED_POOL_TAG: IoNm BUGCHECK_STR: 0xc2_7_IoNm CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: explorer.exe LAST_CONTROL_TRANSFER: from 8054a583 to 804f9deb STACK_TEXT: ab1832c8 8054a583 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b ab183318 80582037 e32db3b8 00000000 8a9c18e8 nt!ExFreePoolWithTag+0x2a3 ab183400 805bddc0 8a9c1900 00000000 89dfda28 nt!IopParseDevice+0xadb ab183478 805ba448 00000000 ab1834b8 00000040 nt!ObpLookupObjectName+0x53c ab1834cc 80574ec1 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea ab183548 80575838 00fde984 00100020 00fde93c nt!IopCreateFile+0x407 ab1835a4 80578ff7 00fde984 00100020 00fde93c nt!IoCreateFile+0x8e ab1835e4 8054086c 00fde984 00100020 00fde93c nt!NtOpenFile+0x27 ab1835e4 7c90eb94 00fde984 00100020 00fde93c nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 00fdebd0 00000000 00000000 00000000 00000000 0x7c90eb94 STACK_COMMAND: kb FOLLOWUP_IP: nt!ExFreePoolWithTag+2a3 8054a583 8b45f8 mov eax,dword ptr [ebp-8] SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!ExFreePoolWithTag+2a3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrpamp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d FAILURE_BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3 BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3 Followup: MachineOwner --------- 0: kd> !amalyze -v No export amalyze found
You're on the right track. It's likely a driver issue; hit F8 just after the BIOS loads to enter Safe Mode, inside Device Manager, you should be able to uninstall the errant driver.
0C2 errors are caused either by a faulty driver or buggy software. In what you posted it cited the driver ntkrpamp.exe which is a core Windows driver which you definitely don't want to delete. So... 1. Run chkdsk in your Run option in your start-up menu. 2. Run vieus/malware scan; could be with that you might have picked something up because several of you use it. * Let us know of the results.