blue screen analysis

Posted on 2011-03-17
Last Modified: 2012-05-11
I have a user who had a failing hard drive.  We imaged the drive, replaced with a new hard drive, then loaded the image.  Everything seems ok, except for a few blue screens in the last couple of days.  The bug check analysis is always the same.  Can anyone point at what could be causing this?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {bec29601, 1c, 0, 80502de2}

Probably caused by : ntkrpamp.exe ( nt!KiWaitSatisfyAll+1c )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arg1: bec29601, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502de2, address which referenced memory

Debugging Details:

READ_ADDRESS:  bec29601


80502de2 8a10            mov     dl,byte ptr [eax]




PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 804fae40 to 80502de2

a71eab64 804fae40 ff6c3fff 00000001 00000000 nt!KiWaitSatisfyAll+0x1c
a71eab9c 8063acac 00000000 80558800 00000000 nt!KeWaitForMultipleObjects+0x362
a71eabec 80638b12 00000000 00000000 a71eac14 nt!CmpFileWrite+0x1a2
a71eac68 8063203d e1037008 00000000 00000000 nt!HvWriteHive+0x264
a71eac8c 80620b72 e10352d8 00002020 a71eacc0 nt!CmDumpKey+0x71
a71eacac 805413fc e5594b50 00002020 00000004 nt!NtSaveKeyEx+0x98
a71eacac 80500d5d e5594b50 00002020 00000004 nt!KiFastCallEntry+0xfc
a71ead30 80620b3d 00001f00 00002020 00000004 nt!ZwSaveKeyEx+0x11
a71ead50 805413fc 00001f00 00002020 00000004 nt!NtSaveKeyEx+0x63
a71ead50 7c90e514 00001f00 00002020 00000004 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0134ee18 00000000 00000000 00000000 00000000 0x7c90e514


80502de2 8a10            mov     dl,byte ptr [eax]


SYMBOL_NAME:  nt!KiWaitSatisfyAll+1c

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  ntkrpamp.exe


FAILURE_BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

Followup: MachineOwner
Question by:AxISQS
  • 3
  • 2

Expert Comment

ID: 35157359
A blue screen with errorcode 1000000A ussually indicates a faulty hdd. In some cases it is caused by datacorruption wich is not corrected due to a faulty hdd-cable or port on the mainboard. Also a smal mailfunction in the memory could by the cause of the bsod.

I would suggest to try another hdd-cable, plug in into another port on the mobo, and if possible try a known good memory module in an unused memory slot.

As a last result i would try to do a clean re-install of the OS, not an image, to see if this resolves the issue.

I hope this will help you in your quest to resolve your issue

Accepted Solution

Ashok Dewan earned 500 total points
ID: 35157508
I also suggest you to check hdd error and bad sectors. download that hdd utility which belongs to same company of hdd that you are using. and also run sfc /scan command.

If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash. The System File Checker tool (SFC.exe) scans for missing or corrupted system files and repairs them.

Because i have seen your analysis. I noticed svchost.exe also responss\ible for bsod.

Expert Comment

by:Ashok Dewan
ID: 35157539
SFC /scannow replace  the corrupted file
U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.


Author Comment

ID: 35157589
will give it a shot. thanks

Expert Comment

by:Ashok Dewan
ID: 35157622
if your problem resolve then close this question by accepting an answer.thank you

Author Closing Comment

ID: 35173888
no more blue screens reported since sfc made repairs. thanks.

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
Ok I have been working on this for some time having learned and gained certification in XenDesktop 4 along came version 5 which was released last month. Since then I have been working to deploy XenDesktop 5 in a small environment with only 2 virt…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question