blue screen analysis

Posted on 2011-03-17
Last Modified: 2012-05-11
I have a user who had a failing hard drive.  We imaged the drive, replaced with a new hard drive, then loaded the image.  Everything seems ok, except for a few blue screens in the last couple of days.  The bug check analysis is always the same.  Can anyone point at what could be causing this?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {bec29601, 1c, 0, 80502de2}

Probably caused by : ntkrpamp.exe ( nt!KiWaitSatisfyAll+1c )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arg1: bec29601, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502de2, address which referenced memory

Debugging Details:

READ_ADDRESS:  bec29601


80502de2 8a10            mov     dl,byte ptr [eax]




PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 804fae40 to 80502de2

a71eab64 804fae40 ff6c3fff 00000001 00000000 nt!KiWaitSatisfyAll+0x1c
a71eab9c 8063acac 00000000 80558800 00000000 nt!KeWaitForMultipleObjects+0x362
a71eabec 80638b12 00000000 00000000 a71eac14 nt!CmpFileWrite+0x1a2
a71eac68 8063203d e1037008 00000000 00000000 nt!HvWriteHive+0x264
a71eac8c 80620b72 e10352d8 00002020 a71eacc0 nt!CmDumpKey+0x71
a71eacac 805413fc e5594b50 00002020 00000004 nt!NtSaveKeyEx+0x98
a71eacac 80500d5d e5594b50 00002020 00000004 nt!KiFastCallEntry+0xfc
a71ead30 80620b3d 00001f00 00002020 00000004 nt!ZwSaveKeyEx+0x11
a71ead50 805413fc 00001f00 00002020 00000004 nt!NtSaveKeyEx+0x63
a71ead50 7c90e514 00001f00 00002020 00000004 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0134ee18 00000000 00000000 00000000 00000000 0x7c90e514


80502de2 8a10            mov     dl,byte ptr [eax]


SYMBOL_NAME:  nt!KiWaitSatisfyAll+1c

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  ntkrpamp.exe


FAILURE_BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

Followup: MachineOwner
Question by:AxISQS
  • 3
  • 2

Expert Comment

ID: 35157359
A blue screen with errorcode 1000000A ussually indicates a faulty hdd. In some cases it is caused by datacorruption wich is not corrected due to a faulty hdd-cable or port on the mainboard. Also a smal mailfunction in the memory could by the cause of the bsod.

I would suggest to try another hdd-cable, plug in into another port on the mobo, and if possible try a known good memory module in an unused memory slot.

As a last result i would try to do a clean re-install of the OS, not an image, to see if this resolves the issue.

I hope this will help you in your quest to resolve your issue

Accepted Solution

Ashok Dewan earned 500 total points
ID: 35157508
I also suggest you to check hdd error and bad sectors. download that hdd utility which belongs to same company of hdd that you are using. and also run sfc /scan command.

If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash. The System File Checker tool (SFC.exe) scans for missing or corrupted system files and repairs them.

Because i have seen your analysis. I noticed svchost.exe also responss\ible for bsod.

Expert Comment

by:Ashok Dewan
ID: 35157539
SFC /scannow replace  the corrupted file
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.


Author Comment

ID: 35157589
will give it a shot. thanks

Expert Comment

by:Ashok Dewan
ID: 35157622
if your problem resolve then close this question by accepting an answer.thank you

Author Closing Comment

ID: 35173888
no more blue screens reported since sfc made repairs. thanks.

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
You are currently not connected to any networks 3 1,167
How to stop a Microsoft scheduled Windows 10 upgrade 16 127
different catridges 8 100
Windows 7 and Pro update issues 5 94
If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question