blue screen analysis

Posted on 2011-03-17
Last Modified: 2012-05-11
I have a user who had a failing hard drive.  We imaged the drive, replaced with a new hard drive, then loaded the image.  Everything seems ok, except for a few blue screens in the last couple of days.  The bug check analysis is always the same.  Can anyone point at what could be causing this?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {bec29601, 1c, 0, 80502de2}

Probably caused by : ntkrpamp.exe ( nt!KiWaitSatisfyAll+1c )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arg1: bec29601, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502de2, address which referenced memory

Debugging Details:

READ_ADDRESS:  bec29601


80502de2 8a10            mov     dl,byte ptr [eax]




PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 804fae40 to 80502de2

a71eab64 804fae40 ff6c3fff 00000001 00000000 nt!KiWaitSatisfyAll+0x1c
a71eab9c 8063acac 00000000 80558800 00000000 nt!KeWaitForMultipleObjects+0x362
a71eabec 80638b12 00000000 00000000 a71eac14 nt!CmpFileWrite+0x1a2
a71eac68 8063203d e1037008 00000000 00000000 nt!HvWriteHive+0x264
a71eac8c 80620b72 e10352d8 00002020 a71eacc0 nt!CmDumpKey+0x71
a71eacac 805413fc e5594b50 00002020 00000004 nt!NtSaveKeyEx+0x98
a71eacac 80500d5d e5594b50 00002020 00000004 nt!KiFastCallEntry+0xfc
a71ead30 80620b3d 00001f00 00002020 00000004 nt!ZwSaveKeyEx+0x11
a71ead50 805413fc 00001f00 00002020 00000004 nt!NtSaveKeyEx+0x63
a71ead50 7c90e514 00001f00 00002020 00000004 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0134ee18 00000000 00000000 00000000 00000000 0x7c90e514


80502de2 8a10            mov     dl,byte ptr [eax]


SYMBOL_NAME:  nt!KiWaitSatisfyAll+1c

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  ntkrpamp.exe


FAILURE_BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

Followup: MachineOwner
Question by:AxISQS
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2

Expert Comment

ID: 35157359
A blue screen with errorcode 1000000A ussually indicates a faulty hdd. In some cases it is caused by datacorruption wich is not corrected due to a faulty hdd-cable or port on the mainboard. Also a smal mailfunction in the memory could by the cause of the bsod.

I would suggest to try another hdd-cable, plug in into another port on the mobo, and if possible try a known good memory module in an unused memory slot.

As a last result i would try to do a clean re-install of the OS, not an image, to see if this resolves the issue.

I hope this will help you in your quest to resolve your issue

Accepted Solution

Ashok Dewan earned 500 total points
ID: 35157508
I also suggest you to check hdd error and bad sectors. download that hdd utility which belongs to same company of hdd that you are using. and also run sfc /scan command.

If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash. The System File Checker tool (SFC.exe) scans for missing or corrupted system files and repairs them.

Because i have seen your analysis. I noticed svchost.exe also responss\ible for bsod.

Expert Comment

by:Ashok Dewan
ID: 35157539
SFC /scannow replace  the corrupted file
Salesforce Has Never Been Easier

Improve and reinforce salesforce training & adoption using WalkMe's digital adoption platform. Start saving on costly employee training by creating fast intuitive Walk-Thrus for Salesforce. Claim your Free Account Now


Author Comment

ID: 35157589
will give it a shot. thanks

Expert Comment

by:Ashok Dewan
ID: 35157622
if your problem resolve then close this question by accepting an answer.thank you

Author Closing Comment

ID: 35173888
no more blue screens reported since sfc made repairs. thanks.

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question