insanegain
asked on
bsod - ntkrnlmp.exe
HI again Experts,
Another problem with a bsod, got the minidump file here..
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\host\Desktop\Herm ann Dump files\Mini011507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1 519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Mon Jan 15 02:15:06.075 2007 (GMT-8)
System Uptime: 0 days 12:54:21.666
Loading Kernel Symbols
.......................... .......... .......... .......... .......... .......... .......... .......... .......... .......... .......... ......
Loading User Symbols
Loading unloaded module list
................
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {ffff21a8, 1, 804e1928, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!NtWaitForMultipleObject s+2e1 )
Followup: MachineOwner
***********End of Report******************** ********** *****
So what is this ntkrnl.exe file? Should I be reinstalling nvidia drivers or maybe looking at ACPI stuff?
Thanks!
Running
XP MCE
Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
1024 DDR
NVIDIA GeForce4 MX 4000 (64 MB)
Another problem with a bsod, got the minidump file here..
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\host\Desktop\Herm
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Mon Jan 15 02:15:06.075 2007 (GMT-8)
System Uptime: 0 days 12:54:21.666
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {ffff21a8, 1, 804e1928, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!NtWaitForMultipleObject
Followup: MachineOwner
***********End of Report********************
So what is this ntkrnl.exe file? Should I be reinstalling nvidia drivers or maybe looking at ACPI stuff?
Thanks!
Running
XP MCE
Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
1024 DDR
NVIDIA GeForce4 MX 4000 (64 MB)
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
wait, you typed it wrong. It should be ntkrnlmp.exe.
Disregard the spyware warning above. Do a !analyze -v like merowinger said and post the results.
Disregard the spyware warning above. Do a !analyze -v like merowinger said and post the results.
ASKER
No, this PC has not been upgraded, it has had a number of fresh OS installs. Checking for Bios update and running Analyze....
ASKER
OK Heres the new report:
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
PAGE_FAULT_IN_NONPAGED_ARE A (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffff21a8, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804e1928, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: ffff21a8
FAULTING_IP:
nt!ObfDereferenceObject+1c
804e1928 f00fc13e lock xadd dword ptr [esi],edi
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
LAST_CONTROL_TRANSFER: from 8056de92 to 804e1928
STACK_TEXT:
ec20b9dc 8056de92 ec20bd64 01e4fedc 8056dca1 nt!ObfDereferenceObject+0x 1c
ec20bd48 804dd99f 00000002 01e4fee8 00000001 nt!NtWaitForMultipleObject s+0x2e1
ec20bd48 7c90eb94 00000002 01e4fee8 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
01e4ff5c 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtWaitForMultipleObject s+2e1
8056de92 ebe9 jmp nt!NtWaitForMultipleObject s+0x2e1 (8056de7d)
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtWaitForMultipleObject s+2e1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
FAILURE_BUCKET_ID: 0x50_W_nt!NtWaitForMultipl eObjects+2 e1
BUCKET_ID: 0x50_W_nt!NtWaitForMultipl eObjects+2 e1
Followup: MachineOwner
---------
**********************End of Report******************** ********** **
Any thoughts?
**************************
* *
* Bugcheck Analysis *
* *
**************************
PAGE_FAULT_IN_NONPAGED_ARE
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffff21a8, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804e1928, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: ffff21a8
FAULTING_IP:
nt!ObfDereferenceObject+1c
804e1928 f00fc13e lock xadd dword ptr [esi],edi
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
LAST_CONTROL_TRANSFER: from 8056de92 to 804e1928
STACK_TEXT:
ec20b9dc 8056de92 ec20bd64 01e4fedc 8056dca1 nt!ObfDereferenceObject+0x
ec20bd48 804dd99f 00000002 01e4fee8 00000001 nt!NtWaitForMultipleObject
ec20bd48 7c90eb94 00000002 01e4fee8 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
01e4ff5c 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtWaitForMultipleObject
8056de92 ebe9 jmp nt!NtWaitForMultipleObject
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtWaitForMultipleObject
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0x50_W_nt!NtWaitForMultipl
BUCKET_ID: 0x50_W_nt!NtWaitForMultipl
Followup: MachineOwner
---------
**********************End of Report********************
Any thoughts?
Check your system memory out:
Create a bootable cd from either
http://www.memtest.org
or
use the Windows Memory Diagnostic:
http://oca.microsoft.com/en/windiag.asp
The best advice is to check one stick of ram at a time - for example with memtest+, run 2-3 full passes, and check for red entries - these show bad memory blocks.
Create a bootable cd from either
http://www.memtest.org
or
use the Windows Memory Diagnostic:
http://oca.microsoft.com/en/windiag.asp
The best advice is to check one stick of ram at a time - for example with memtest+, run 2-3 full passes, and check for red entries - these show bad memory blocks.
Have you upgraded any drivers lately? How about installed new hardware?
ASKER
No recent upgrades have been made. This system has experienced this error ever since the original build. Will attempt Memtest86 and report back.
ASKER
Crazy!
Memtest86 reported lots of error on one module and only one on the other after running the test for a period of only 1 hour (2x512)
Is is possible that both modules are faulty or is that not likely?
Memtest86 reported lots of error on one module and only one on the other after running the test for a period of only 1 hour (2x512)
Is is possible that both modules are faulty or is that not likely?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Technically - this was a bad memory problem - (this was pointed out by the possible forced accept)
Hence - the points should not have been shared. My comment (ID 19679822) should have been the sole accepted comment.
If you need help with accepting comments as answers in the future - look here:
https://www.experts-exchange.com/help.jsp#hi68
Hence - the points should not have been shared. My comment (ID 19679822) should have been the sole accepted comment.
If you need help with accepting comments as answers in the future - look here:
https://www.experts-exchange.com/help.jsp#hi68
ASKER
Sorry to disappoint you, I thought all the comments made on this issue were quite valid in terms of the process required to identify the problem.
Thank you all for your help on this matter. Very sorry for the delay to get back to this forum.
Thank you all for your help on this matter. Very sorry for the delay to get back to this forum.
ntkrnlmp.exe is a kernel driver used by Windows for using more than 1 processor.
Has this PC been upgraded from a previous OS recently?