!!! Pc Won't Write Crash Dumps !!!

By BlackScarlet
Aug 17, 2007
  1. I am very frustrated with my pc as of late, I am getting BSODs all over the place, often as many as four within ten minutes, and perhaps seven or eight in a day. It is so I can't leave the house without expecting a blue screen of death waiting for me when I get home.
    I haven't installed any new hardware or anything lately that would indicate such a problem, but I have a feeling it has to do with drivers...

    The problem is, I can't debug it, because my pc isn't creating crash dumps! C:\Wiondows\Minidumps is not being written to, and the is no other dump locations. I don't know why it is not creating dumps.

    Randomly however, on the seventh, it did create a dump, however, perhaps one time out of thirty or more crashes in the last few weeks, and analyzing it with windbg I found that it was probably a driver called ntkrnlpa.exe, whatever that is. Because I only have that one dump I cannot tell if that was the primary and consistent cause, or even if it was accurate, but I have included the bang analyze dash v and lmv results for this debug, if anyone can add any wisdom to this irritating problem.

    So yeah, I'd like to get to the bottom of what is causing these crashes, and more importantly, why my pc is constipated and won't dump.



    (the lmv results extend much farther, but I only included the info relevant to the driver hinted by !analyze -v...)


    kd> !analyze -v
    * *
    * Bugcheck Analysis *
    * *

    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arg1: 71a5df52, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000008, value 0 = read operation, 1 = write operation
    Arg4: 71a5df52, address which referenced memory

    Debugging Details:

    READ_ADDRESS: 71a5df52


    71a5df52 ?? ???




    LAST_CONTROL_TRANSFER: from 71a5df52 to 8053fa73

    71a5df52 ?? ???

    ed767d64 71a5df52 badb0d00 7c90eb94 ed767d98 nt!KiTrap0E+0x233
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0093f158 00000000 00000000 00000000 00000000 0x71a5df52


    8053fa73 f7457000000200 test dword ptr [ebp+70h],20000h


    SYMBOL_NAME: nt!KiTrap0E+233

    FOLLOWUP_NAME: MachineOwner


    IMAGE_NAME: ntkrnlpa.exe



    BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

    Followup: MachineOwner

    kd> lmv
    start end module name
    804d7000 806cd580 nt # (pdb symbols) c:\symbols\ntkrnlpa.pdb\F612363DB38C423CB08559DDBCA9F2F71\ntkrnlpa.pdb
    Loaded symbol image file: ntkrnlpa.exe
    Mapped memory image file: c:\symbols\ntkrnlpa.exe\45E53F9C1f6580\ntkrnlpa.exe
    Image path: ntkrnlpa.exe
    Image name: ntkrnlpa.exe
    Timestamp: Wed Feb 28 00:38:52 2007 (45E53F9C)
    CheckSum: 00200031
    ImageSize: 001F6580
    File version: 5.1.2600.3093
    Product version: 5.1.2600.3093
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0411.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft(R) Windows(R) Operating System
    InternalName: ntkrnlpa.exe
    OriginalFilename: ntkrnlpa.exe
    ProductVersion: 5.1.2600.3093
    FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
    FileDescription: NT Kernel & System
    LegalCopyright: (C) Microsoft Corporation. All rights reserved.
  2. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,244   +234

    Start trouibleshooting the BSOD by testing or swapping out your memory. ntkrnlpa.exe is a Windows System file. The debug pointer is very generic. We always recommend that the memory be checked first
  3. raybay

    raybay TS Evangelist Posts: 7,241   +10

    Bad memory module. Bad or incorrect driver. Perhaps other stuff as well. Run MemTest86. Free and good. Run it for four hours or 7 passes. I don't see any references to antispyware or antivirus either, so perhaps you have an infestation.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...