Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


blue screen analysis

Posted on 2011-03-17
Medium Priority
Last Modified: 2012-05-11
I have a user who had a failing hard drive.  We imaged the drive, replaced with a new hard drive, then loaded the image.  Everything seems ok, except for a few blue screens in the last couple of days.  The bug check analysis is always the same.  Can anyone point at what could be causing this?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {bec29601, 1c, 0, 80502de2}

Probably caused by : ntkrpamp.exe ( nt!KiWaitSatisfyAll+1c )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arg1: bec29601, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502de2, address which referenced memory

Debugging Details:

READ_ADDRESS:  bec29601


80502de2 8a10            mov     dl,byte ptr [eax]




PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 804fae40 to 80502de2

a71eab64 804fae40 ff6c3fff 00000001 00000000 nt!KiWaitSatisfyAll+0x1c
a71eab9c 8063acac 00000000 80558800 00000000 nt!KeWaitForMultipleObjects+0x362
a71eabec 80638b12 00000000 00000000 a71eac14 nt!CmpFileWrite+0x1a2
a71eac68 8063203d e1037008 00000000 00000000 nt!HvWriteHive+0x264
a71eac8c 80620b72 e10352d8 00002020 a71eacc0 nt!CmDumpKey+0x71
a71eacac 805413fc e5594b50 00002020 00000004 nt!NtSaveKeyEx+0x98
a71eacac 80500d5d e5594b50 00002020 00000004 nt!KiFastCallEntry+0xfc
a71ead30 80620b3d 00001f00 00002020 00000004 nt!ZwSaveKeyEx+0x11
a71ead50 805413fc 00001f00 00002020 00000004 nt!NtSaveKeyEx+0x63
a71ead50 7c90e514 00001f00 00002020 00000004 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0134ee18 00000000 00000000 00000000 00000000 0x7c90e514


80502de2 8a10            mov     dl,byte ptr [eax]


SYMBOL_NAME:  nt!KiWaitSatisfyAll+1c

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  ntkrpamp.exe


FAILURE_BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

BUCKET_ID:  0xA_nt!KiWaitSatisfyAll+1c

Followup: MachineOwner
Question by:AxISQS
  • 3
  • 2

Expert Comment

ID: 35157359
A blue screen with errorcode 1000000A ussually indicates a faulty hdd. In some cases it is caused by datacorruption wich is not corrected due to a faulty hdd-cable or port on the mainboard. Also a smal mailfunction in the memory could by the cause of the bsod.

I would suggest to try another hdd-cable, plug in into another port on the mobo, and if possible try a known good memory module in an unused memory slot.

As a last result i would try to do a clean re-install of the OS, not an image, to see if this resolves the issue.

I hope this will help you in your quest to resolve your issue

Accepted Solution

Ashok Dewan earned 2000 total points
ID: 35157508
I also suggest you to check hdd error and bad sectors. download that hdd utility which belongs to same company of hdd that you are using. and also run sfc /scan command.

If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions may not work, or Windows may crash. The System File Checker tool (SFC.exe) scans for missing or corrupted system files and repairs them.


Because i have seen your analysis. I noticed svchost.exe also responss\ible for bsod.

Expert Comment

by:Ashok Dewan
ID: 35157539
SFC /scannow replace  the corrupted file
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 35157589
will give it a shot. thanks

Expert Comment

by:Ashok Dewan
ID: 35157622
if your problem resolve then close this question by accepting an answer.thank you

Author Closing Comment

ID: 35173888
no more blue screens reported since sfc made repairs. thanks.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
This lesson discusses how to use a Mainform + Subforms in Microsoft Access to find and enter data for payments on orders. The sample data comes from a custom shop that builds and sells movable storage structures that are delivered to your property. …
Suggested Courses
Course of the Month15 days, 23 hours left to enroll

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question