!!! PC WON'T WRITE CRASH DUMPS !!!

Discussion in 'other software & services' started by BlackScarletLove, Aug 17, 2007.

Thread Status:
Not open for further replies.
  1. BlackScarletLove

    BlackScarletLove Registered Member

    Joined:
    Jul 12, 2007
    Posts:
    63
    I am very frustrated with my pc as of late, I am getting BSODs all over the place, often as many as four within ten minutes, and perhaps seven or eight in a day. It is so I can't leave the house without expecting a blue screen of death waiting for me when I get home.
    I haven't installed any new hardware or anything lately that would indicate such a problem, but I have a feeling it has to do with drivers...

    The problem is, I can't debug it, because my pc isn't creating crash dumps! C:\Wiondows\Minidumps is not being written to, and the is no other dump locations. I don't know why it is not creating dumps.



    Randomly however, on the seventh, it did create a dump, however, perhaps one time out of thirty or more crashes in the last few weeks, and analyzing it with windbg I found that it was probably a driver called ntkrnlpa.exe, whatever that is. Because I only have that one dump I cannot tell if that was the primary and consistent cause, or even if it was accurate, but I have included the bang analyze dash v and lmv results for this debug, if anyone can add any wisdom to this irritating problem.

    So yeah, I'd like to get to the bottom of what is causing these crashes, and more importantly, why my pc is constipated and won't dump.





    Thanks,

    Scarlet


    (the lmv results extend much farther, but I only included the info relevant to the driver hinted by !analyze -v...)

    --

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 71a5df52, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000008, value 0 = read operation, 1 = write operation
    Arg4: 71a5df52, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 71a5df52

    CURRENT_IRQL: 2

    FAULTING_IP:
    +71a5df52
    71a5df52 ?? o_O

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT


    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 71a5df52 to 8053fa73

    FAILED_INSTRUCTION_ADDRESS:
    +71a5df52
    71a5df52 ?? o_O

    STACK_TEXT:
    ed767d64 71a5df52 badb0d00 7c90eb94 ed767d98 nt!KiTrap0E+0x233
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0093f158 00000000 00000000 00000000 00000000 0x71a5df52


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiTrap0E+233
    8053fa73 f7457000000200 test dword ptr [ebp+70h],20000h

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!KiTrap0E+233

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c

    FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

    BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

    Followup: MachineOwner
    ---------

    kd> lmv
    start end module name
    804d7000 806cd580 nt # (pdb symbols) c:\symbols\ntkrnlpa.pdb\F612363DB38C423CB08559DDBCA9F2F71\ntkrnlpa.pdb
    Loaded symbol image file: ntkrnlpa.exe
    Mapped memory image file: c:\symbols\ntkrnlpa.exe\45E53F9C1f6580\ntkrnlpa.exe
    Image path: ntkrnlpa.exe
    Image name: ntkrnlpa.exe
    Timestamp: Wed Feb 28 00:38:52 2007 (45E53F9C)
    CheckSum: 00200031
    ImageSize: 001F6580
    File version: 5.1.2600.3093
    Product version: 5.1.2600.3093
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0411.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft(R) Windows(R) Operating System
    InternalName: ntkrnlpa.exe
    OriginalFilename: ntkrnlpa.exe
    ProductVersion: 5.1.2600.3093
    FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
    FileDescription: NT Kernel & System
    LegalCopyright: (C) Microsoft Corporation. All rights reserved.
     
  2. WSFuser

    WSFuser Registered Member

    Joined:
    Oct 7, 2004
    Posts:
    10,632
  3. Climenole

    Climenole Look 'n' Stop Expert

    Joined:
    Jun 3, 2005
    Posts:
    1,640
    Hi BlackScarletLove :)

    1)

    A mini-dump is created IF you choose a partial image dump. If it's a complete image dump, the dump file is in C:\WINDOWS\System32... Check your system parameters in Control Panel | System ...

    2)

    0x0000000A: IRQL_NOT_LESS_OR_EQUAL
    First possible cause: overheating...
    Check for the dust and if the fans are working.

    You may removed the dust with compressed air can.
    Check also the heat sink of the CPU.

    3)

    Check this web site: http://www.aumha.org/a/stop.htm


    :)
     
  4. Niels

    Niels Registered Member

    Joined:
    Jul 29, 2005
    Posts:
    466
    Location:
    Belgium
    Normally all blue screens or errors are written in events: start,run,type eventvwr press enter. Now open application and windows there you will find also when a problem occured. To be sure that the option to write a crash dump is selected go to start,my computer,rightclick on my computer choose properties,advanced,reboot and repairsettings,normally write system dump must be selected. Don't forget to confirm by pressing on apply and ok.
     
Loading...
Thread Status:
Not open for further replies.