Need help analyzing dumpchk file

Posted on 2006-11-10
Medium Priority
Last Modified: 2008-02-26
I have an HP Pavilion xf335 laptop that crashes after Windows

loads.  I see the desktop for 15 or 20 seconds, then it blue

screens and restarts.  Not always.  It's random.  It flashes

too fast too read what it says.  It always makes it to the

Windows login screen, but not far after that.   Sometimes it

will run for hours without a crash.  It is running SP2, with

an AMD 1500+ and 256MB of memory.  I ran the HP e-diag

diagnostic utility, and everything was fine.  I also ran

another hard drive utility, the Windows memory test, and

Memtest.  No hardware problems detected.

Here is the dumpchk file.  

Loading Dump File [c:\windows\minidump\mini110906-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are


Symbol search path is: c:\windows\symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86

Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Nov  9 20:22:44.872 2006 (GMT-8)
System Uptime: 0 days 0:00:36.442
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols

Loading User Symbols
Loading unloaded module list
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys


*                        Bugcheck Analysis                    




Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f419b538, f419b234, 80501f91}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+46 )

Followup: MachineOwner

----- 32 bit Kernel Mini Dump Analysis

MajorVersion        0000000f
MinorVersion        00000a28
KdSecondaryVersion  00000000
DirectoryTableBase  004b8000
PfnDataBase         81800000
PsLoadedModuleList  8055a420
PsActiveProcessHead 805604d8
MachineImageType    0000014c
NumberProcessors    00000001
BugCheckCode        00000024
BugCheckParameter1  001902fe
BugCheckParameter2  f419b538
BugCheckParameter3  f419b234
BugCheckParameter4  80501f91
PaeEnabled          00000000
KdDebuggerDataBlock 8054c060
SecondaryDataState  00000000
ProductType         00000001
SuiteMask           00000310
MiniDumpFields      00000dff

ServicePackBuild      00000200
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002728
CallStackOffset       00002980
SizeOfCallStack       00001054
DriverListOffset      00003c68
DriverCount           0000007b
StringPoolOffset      000060f0
StringPoolSize        000010e8
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            f419afac
DebuggerDataOffset    000039d8
DebuggerDataSize      00000290
DataBlocksOffset      000071d8
DataBlocksCount       00000007
  00190000 - 00190fff at offset 00007248
  f419b000 - f419bfff at offset 00008248
  80501000 - 80501fff at offset 00009248
  80533000 - 80533fff at offset 0000a248
  81a8c000 - 81a8cfff at offset 0000b248
  c0000000 - c0000fff at offset 0000c248
  ffdff000 - ffdfffff at offset 0000d248
  Max offset e248, 5db8 from end of file

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86

Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Nov  9 20:22:44.872 2006 (GMT-8)
System Uptime: 0 days 0:00:36.442
start    end        module name
804d7000 806eb100   nt        Tue Mar 01 16:59:37 2005

806ec000 806ffd80   hal       Tue Aug 03 22:59:04 2004

bf800000 bf9c1180   win32k    Wed Oct 05 17:05:44 2005

bf9c2000 bf9d3580   dxg       Tue Aug 03 23:00:51 2004

bf9d4000 bfa2b000   s3gnb     Fri May 03 18:09:26 2002

f41d4000 f41eb1a0   tfsnudfa  Thu Mar 14 14:26:43 2002

f41ec000 f4201a80   tfsnudf   Thu Mar 14 14:24:30 2002

f420e000 f4211280   ndisuio   Tue Aug 03 23:03:10 2004

f4252000 f4262280   Udfs      Tue Aug 03 23:00:27 2004

f4263000 f42b5680   BsUDF     Mon Jun 10 20:40:14 2002

f7b97000 f7bae480   dump_atapi  Tue Aug 03 22:59:41 2004

f7baf000 f7bcff00   ipnat     Wed Sep 29 15:28:36 2004

f7bd0000 f7c3ea00   mrxsmb    Fri May 05 02:41:42 2006

f7c3f000 f7c69a00   rdbss     Fri May 05 02:47:55 2006

f7c6a000 f7c8bd00   afd       Tue Aug 03 23:14:13 2004

f7c8c000 f7cb3c00   netbt     Tue Aug 03 23:14:36 2004

f7cb4000 f7d0bd80   tcpip     Thu Apr 20 04:51:47 2006

f7d0c000 f7d1e400   ipsec     Tue Aug 03 23:14:27 2004

f8dc7000 f8dcf780   tfsncofs  Thu Mar 14 14:25:25 2002

f8dd7000 f8de3de0   tfsnifs   Thu Mar 14 14:23:59 2002

f8de7000 f8df03e0   drvnddm   Tue Feb 12 14:56:08 2002

f8eb3000 f8ee6200   update    Tue Aug 03 22:58:32 2004

f8ee7000 f8ef7e00   psched    Tue Aug 03 23:04:16 2004

f8ef8000 f8f0e680   ndiswan   Tue Aug 03 23:14:30 2004

f8f0f000 f8fb4f80   HSF_CNXT  Tue Oct 14 07:05:45 2003

f8fb5000 f90b3a80   HSF_DP    Tue Oct 14 07:04:04 2003

f90b4000 f90e3100   HSFHWVIA  Tue Oct 14 07:09:16 2003

f90e4000 f9107980   portcls   Tue Aug 03 23:15:47 2004

f9108000 f91567c0   cviaaud   Tue Feb 26 12:01:07 2002

f9157000 f918be20   cviahal   Tue Feb 26 12:07:29 2002

f918c000 f91aee80   USBPORT   Tue Aug 03 23:08:34 2004

f91af000 f91d1680   ks        Tue Aug 03 23:15:20 2004

f91d2000 f91e5900   parport   Tue Aug 03 22:59:04 2004

f91e6000 f91f9780   VIDEOPRT  Tue Aug 03 23:07:04 2004

f91fa000 f921c800   s3gnbm    Fri May 03 18:09:32 2002

f9225000 f92285e0   tfsnopio  Thu Mar 14 14:25:43 2002

f9231000 f9233900   Dxapi     Fri Aug 17 13:53:19 2001

f9626000 f9628580   ndistapi  Fri Aug 17 13:55:29 2001

f962a000 f962c580   hpci      Thu Jul 26 17:09:32 2001

f9632000 f9635120   KBFiltr   Thu Sep 06 01:15:04 2001

f9636000 f9639700   CmBatt    Tue Aug 03 23:07:39 2004

f966e000 f9688580   Mup       Tue Aug 03 23:15:20 2004

f9689000 f96b5a80   NDIS      Tue Aug 03 23:14:27 2004

f96b6000 f9742480   Ntfs      Tue Aug 03 23:15:06 2004

f9743000 f9759780   KSecDD    Tue Aug 03 22:59:45 2004

f975a000 f976c8c0   drvmcdb   Fri Feb 15 13:04:57 2002

f976d000 f977ef00   sr        Tue Aug 03 23:06:22 2004

f977f000 f979e780   fltmgr    Mon Aug 21 02:14:57 2006

f979f000 f97b6480   atapi     Tue Aug 03 22:59:41 2004

f97b7000 f97d5880   ftdisk    Fri Aug 17 13:52:41 2001

f97d6000 f97f3480   pcmcia    Tue Aug 03 23:07:45 2004

f97f4000 f9804a80   pci       Tue Aug 03 23:07:45 2004

f9805000 f9832d80   ACPI      Tue Aug 03 23:07:35 2004

f9854000 f985cc00   isapnp    Fri Aug 17 13:58:01 2001

f9864000 f986e500   MountMgr  Tue Aug 03 22:58:29 2004

f9874000 f9880c80   VolSnap   Tue Aug 03 23:00:14 2004

f9884000 f988ce00   disk      Tue Aug 03 22:59:53 2004

f9894000 f98a0200   CLASSPNP  Tue Aug 03 23:14:26 2004

f98a4000 f98ae500   viaagp    Tue Aug 03 23:07:42 2004

f98b4000 f98c3e00   IoloFltr  Fri Oct 21 18:45:55 2005

f98c4000 f98cd480   NDProxy   Fri Aug 17 13:55:30 2001

f98f4000 f9902100   usbhub    Tue Aug 03 23:08:40 2004

f9904000 f990c360   aswTdi    Mon Sep 25 08:39:01 2006

f9914000 f991c700   netbios   Tue Aug 03 23:03:19 2004

f9934000 f993c880   Fips      Fri Aug 17 18:31:49 2001

f9944000 f994c700   wanarp    Tue Aug 03 23:04:57 2004

f9964000 f9973900   Cdfs      Tue Aug 03 23:14:09 2004

f9a04000 f9a0d200   amdk7     Tue Aug 03 22:59:19 2004

f9a14000 f9a20e00   i8042prt  Tue Aug 03 23:14:36 2004

f9a24000 f9a2e380   Imapi     Tue Aug 03 23:00:12 2004

f9a34000 f9a40180   cdrom     Tue Aug 03 22:59:52 2004

f9a44000 f9a52080   redbook   Tue Aug 03 22:59:34 2004

f9a54000 f9a62b80   drmk      Tue Aug 03 23:07:54 2004

f9a64000 f9a70880   rasl2tp   Tue Aug 03 23:14:21 2004

f9a74000 f9a7e200   raspppoe  Tue Aug 03 23:05:06 2004

f9a84000 f9a8fd00   raspptp   Tue Aug 03 23:14:26 2004

f9a94000 f9a9c900   msgpc     Tue Aug 03 23:04:11 2004

f9aa4000 f9aadf00   termdd    Tue Aug 03 22:58:52 2004

f9ad4000 f9ada200   PCIIDEX   Tue Aug 03 22:59:40 2004

f9adc000 f9ae0900   PartMgr   Fri Aug 17 18:32:23 2001

f9b9c000 f9ba1a00   mouclass  Tue Aug 03 22:58:32 2004

f9ba4000 f9baa000   kbdclass  Tue Aug 03 22:58:32 2004

f9bac000 f9bad000   fdc       unavailable (00000000)
f9bb4000 f9bba400   MxlW2k    Fri Jan 30 16:09:18 2004

f9bbc000 f9bc1000   usbuhci   Tue Aug 03 23:08:34 2004

f9bc4000 f9bcb580   Modem     Tue Aug 03 23:08:04 2004

f9bcc000 f9bd2a00   fetnd5    Fri Jul 20 04:40:24 2001

f9bd4000 f9bd8880   TDI       Tue Aug 03 23:07:47 2004

f9bdc000 f9be0580   ptilink   Fri Aug 17 13:49:53 2001

f9be4000 f9be8080   raspti    Fri Aug 17 13:55:32 2001

f9bfc000 f9c01980   ssrtln    Mon Jan 28 17:03:17 2002

f9c04000 f9c09200   vga       Tue Aug 03 23:07:06 2004

f9c0c000 f9c10a80   Msfs      Tue Aug 03 23:00:37 2004

f9c14000 f9c1b880   Npfs      Tue Aug 03 23:00:38 2004

f9c24000 f9c29b00   Aavmker4  Mon Sep 25 08:37:48 2006

f9c34000 f9c38500   watchdog  Tue Aug 03 23:07:32 2004

f9c44000 f9c49c00   tfsnboio  Thu Mar 14 14:24:36 2002

f9c64000 f9c67000   BOOTVID   Fri Aug 17 13:49:09 2001

f9c68000 f9c6a480   compbatt  Fri Aug 17 13:57:58 2001

f9c6c000 f9c6f700   BATTC     Fri Aug 17 13:57:52 2001

f9c70000 f9c72d80   ACPIEC    Fri Aug 17 13:57:55 2001

f9c74000 f9c77d60   PxHelp20  Tue Feb 26 15:24:54 2002

f9c78000 f9c7a480   bsstor    Wed Jun 05 23:41:41 2002

f9cf8000 f9cfbc80   mssmbios  Tue Aug 03 23:07:47 2004

f9d20000 f9d22280   rasacd    Fri Aug 17 13:55:39 2001

f9d54000 f9d55b80   kdcom     Fri Aug 17 13:49:10 2001

f9d56000 f9d57100   WMILIB    Fri Aug 17 14:07:23 2001

f9d58000 f9d59500   viaide    Tue Aug 03 22:59:42 2004

f9d8e000 f9d8f100   swenum    Tue Aug 03 22:58:41 2004

f9d90000 f9d91280   USBD      Fri Aug 17 14:02:58 2001

f9d92000 f9d935a0   sscdbhk5  Mon Jan 28 17:04:02 2002

f9d94000 f9d95f00   Fs_Rec    Fri Aug 17 13:49:37 2001

f9d96000 f9d97080   Beep      Fri Aug 17 13:47:33 2001

f9d98000 f9d99080   mnmdd     Fri Aug 17 13:57:28 2001

f9d9a000 f9d9b080   RDPCDD    Fri Aug 17 13:46:56 2001

f9d9e000 f9d9f100   dump_WMILIB  Fri Aug 17 14:07:23 2001

f9da8000 f9da9880   tfsnpool  Thu Mar 14 14:24:13 2002

f9e1c000 f9e1cd80   OPRGHDLR  Fri Aug 17 13:57:55 2001

f9e8b000 f9e8bc00   audstub   Fri Aug 17 13:59:40 2001

f9e94000 f9e94d00   dxgthk    Fri Aug 17 13:53:12 2001

f9f3f000 f9f3fb80   Null      Fri Aug 17 13:47:39 2001

f9f68000 f9f68860   tfsndres  Thu Mar 14 14:27:04 2002

f9f6c000 f9f6cfe0   tfsndrct  Thu Mar 14 14:25:39 2002


Unloaded modules:
f9924000 f992d000   processr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f9bf4000 f9bf9000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000


*                        Bugcheck Analysis                    




Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f419b538, f419b234, 80501f91}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+46 )

Followup: MachineOwner

Finished dump check

Any ideas on this one?  Thanks.
Question by:bleujaegel
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 3
  • +1

Assisted Solution

jsvor earned 1000 total points
ID: 17916964
You can turn off the 'feature' in XP that will reboot your machine if there is a system failure.  To stop it from rebooting  your computer right-click My Computer and select Properties.  Click on the 'Advanced' tab and then click the 'Settings' button under the Startup and Recovery section.  Remove the check from 'Automatically restart' under the System failure section.  Now when you get a BSOD it will stay on the screen and you can grab all the info you want from it.

You can usually get the BSOD error reports from the Event logs, too.

When was the last time you did a defrag?  Just wondering if it gave you any sector errors or ntfs errors.
LVL 66

Accepted Solution

johnb6767 earned 1000 total points
ID: 17917058
More than likely driver related, but change the recovery options as jsvor asked, and go from there....

Author Comment

ID: 17917712
Already ran a defrag with no problems.  Chkdsk /r has no issues either.  All drive utilities test it as good.  Am fairly certain it's a software issue (unless bad memory would cause this even though I've tested it many times with different utilities).

I will do that and get back.  Thanks.
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.


Expert Comment

ID: 17919981
I would check the motherboard and power supply capacitors:


Author Comment

ID: 17920101
Excellent comments from the both of you.  Thanks for the tip on 'automatically restart'.  Didn't realize that's what that did.  It appears it is a driver issue.  The blue screen gave me:

STOP: 0x000000c4
Parameter1 0x00000000
p2              0x00000001
p3              0x00000001
p4              0x00000000

I did a search and found out about the Windows verifier.  Anyway, I tried this and got it to crash consistently, thereby eliminating hardware as the cause.  When booting in safe mode, it seemed to hang on a driver named 'ioloflt.sys' for quite a while.  After booting, I cut this file out of the drivers folder, and pasted it on the desktop.  After that, it didn't crash after rebooting.  As soon as I added back to the drivers folder and restarted, same stop error above appeared.

I'm fairly certain this will solve the problem, but I will reserve judgement for a day or two.  As with computers, sometimes you think you've figured out the problem, only to have it resurface after you're convinced the problem was solved.  

Here's the link to the 'verifier' post if anyone is interested, it's almost half way down the page:


Expert Comment

ID: 17923923
Glad to hear you narrowed it down.

Author Comment

ID: 17960238
It was indeed the iolofltr.sys file, which I believe is a driver for System Mechanic.  Thanks for everyones assistance on this.

Author Comment

ID: 17960343
BTW, I split the points between two of you.  I accepted the answer from johnb6767 because he had the actual answer, even though jsvor had extremely valuable troubleshooting information.  So I guess john got it on a technicality.  Not trying to dis you jsvor.  Thanks again.
LVL 66

Expert Comment

ID: 17960681
I appreciate that, But in all fairness, I think you did most of the legwork and pinpointed the actual driver.  Dont get me wrong, I appreciate the award, but I think that jsvor had the better information to get you started.....

Author Comment

ID: 17960924
Is there a way to change the accepted answer then?
LVL 66

Expert Comment

ID: 17961001

Leave a zero-point question in Community Support explaining what happened. The Moderators will "unaccept" your selection and re-open the question. Then you can reassign the points again.......

Have a great day!!

Expert Comment

ID: 17961839
Thanks for the points johnb.  Splitting the points was fine by me - you did suggest the driver right off the bat.  I'm just glad when things like this get resolved.
LVL 66

Expert Comment

ID: 17963156
No prob.  likie ot add to other people ideas, but I dont necessarily want the credit for something I didnt offer. Just like to keep it fun!!

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question