TechSpot

BSOD: ntkrnlpa.exe

By neo_weapon
Apr 19, 2007
  1. Hi all,

    I'm currently getting a BSOD about twice a week with my system and here is the specs:

    Windows Vista Ultimate
    Penti D 915
    Intel Mobo D865GSAL
    1GB (512x2) kingston value ram DDR 3200
    6600GT AGP eVGA 128MB video card
    320GB seagate sata

    So i read the minidumps using kd -z (pathway) and all of the minidumps say "Probably caused by ntkrnlpa.exe". Does anybody know what ntkrnlpa.exe is?

    I'm currently reading http://www.networkworld.com/news/2005/041105-windows-crash.html?page=1
    but i'm wondering if anybody has any problems before with ntkrnlpa.exe?

    Thanks
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    It is part of the Windows operating system. Can you attach your minidump so that we can read it?
     
  3. neo_weapon

    neo_weapon TS Rookie Topic Starter

    the dump also says "Unable to load image \SystemRoot\system32\ntkrnlpa.exe
     
  4. neo_weapon

    neo_weapon TS Rookie Topic Starter

    ok here's the dumps
     
  5. neo_weapon

    neo_weapon TS Rookie Topic Starter

    oh crap, the dmp is too big. it's 132kb. is there a way to shrink it or mail it? Thanks.
     
  6. neo_weapon

    neo_weapon TS Rookie Topic Starter

    ok, here they are zipped.
     

    Attached Files:

  7. neo_weapon

    neo_weapon TS Rookie Topic Starter

  8. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    I looked at your minidumps but I don't want to venture a guess. There are those I can read and others that need better experienced readers and there are a number here.

    I will say that my suspicion is STRONGLY towards Vista and the drivers of your older hardware, possibly software. Many, many people are having serious issues with Vista and drivers.

    Hang tight, someone might be able to tell you more.
     
  9. neo_weapon

    neo_weapon TS Rookie Topic Starter

    any experts out there? I downloaded the symbols for the debugging tools but everytime it tries to load the symbols, it says it's using the wrong symbols. This is the command i use:

    kd -y c:\windows\symbols -z c:\mini.....

    However, it does say analysis_inconclusive instead of wrong_symbols for bucket_id. any thoughts.?
     
  10. neo_weapon

    neo_weapon TS Rookie Topic Starter

    So this is what i get with the symbols loaded:

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, 85b5902a, 8983dc80, 8983d97c}

    Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

    Followup: MachineOwner
    ---------



    after analyze -v

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 85b5902a, The address that the exception occurred at
    Arg3: 8983dc80, Exception Record Address
    Arg4: 8983d97c, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    +ffffffff85b5902a
    85b5902a 2011 and byte ptr [ecx],dl

    EXCEPTION_RECORD: 8983dc80 -- (.exr ffffffff8983dc80)
    ExceptionAddress: 85b5902a
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000001
    Parameter[1]: 524f4975
    Attempt to write to address 524f4975

    CONTEXT: 8983d97c -- (.cxr ffffffff8983d97c)
    eax=96d5902b ebx=8580f9a0 ecx=524f4975 edx=00000000 esi=85dad828 edi=818fde00
    eip=85b5902a esp=8983dd48 ebp=8983dd7c iopl=0 nv up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
    85b5902a 2011 and byte ptr [ecx],dl ds:0023:524f4975=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from 819315ac
    Unable to read MiSystemVaType memory at 81911780
    524f4975

    BUGCHECK_STR: 0x7E

    DEFAULT_BUCKET_ID: STRING_DEREFERENCE

    LAST_CONTROL_TRANSFER: from 81878e18 to 85b5902a

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8983dd44 81878e18 524f4975 00000000 85dad828 0x85b5902a
    8983dd7c 81a254a8 524f4975 89836680 00000000 nt!ExpWorkerThread+0xfd
    8983ddc0 8189145e 81878d1b 80000000 00000000 nt!PspSystemThreadStartup+0x9d
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: kb

    SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: Unknown_Module

    IMAGE_NAME: Unknown_Image

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    FAILURE_BUCKET_ID: 0x7E_ANALYSIS_INCONCLUSIVE

    BUCKET_ID: 0x7E_ANALYSIS_INCONCLUSIVE

    Followup: MachineOwner
    ---------




    Without the symbols...
     
  11. neo_weapon

    neo_weapon TS Rookie Topic Starter

    xecutable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x81800000 PsLoadedModuleList = 0x81911db0
    Debug session time: Wed Apr 11 20:38:05.085 2007 (GMT-7)
    System Uptime: 0 days 0:13:37.816
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Loading Kernel Symbols
    .............................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, 85b5902a, 8983dc80, 8983d97c}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    Probably caused by : ntkrnlpa.exe ( nt+78e18 )

    Followup: MachineOwner
     
  12. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Neo, believe it or not I just experienced a BSOD with the same thing you are experiencing. Try running a MemTest. by the way, you need to be connectewd to the internet in order for the symbols to load.

    In addition, as I said earlier, a great many number of people are having issues with Vista and older hardware/software drivers.

    "0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
    A system thread generated an exception which the error handler did not
    catch. There are numerous individual causes for this problem, including
    hardware incompatibility, a faulty device driver or system service, or some
    software issues.
    Check Event Viewer (EventVwr.msc) for additional
    information."
     
  13. neo_weapon

    neo_weapon TS Rookie Topic Starter

    thanks, wow, what a coincidence. I have another OS on this system running beryl and ubuntu with no crashes to this day. So it looks like it's pointing to vista. I would like to mention i think my two crashes for vista occured when i was using artec media to watch TV OTA. Thanks. I'll run the memtest to see what's up with the RAM.
     
  14. WAXINGS

    WAXINGS TS Rookie

    Same Issue

    I am getting the same errors when my Laptop goes into sleep mode. Did you ever find a fix to your problem?

    Thanks
     
  15. neo_weapon

    neo_weapon TS Rookie Topic Starter

    I think i ended up replacing the RAM. this was such a long time ago.........
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...