PC Won't Write Crash Dumps

Discussion in 'General Hardware' started by BlackScarletLove, Aug 17, 2007.

  1. BlackScarletLove

    BlackScarletLove Status:In Post-Production

    Messages:
    146
    Location:
    Victoria, BC, Canada
    I am very frustrated with my pc as of late, I am getting BSODs all over the place, often as many as four within ten minutes, and perhaps seven or eight in a day. It is so I can't leave the house without expecting a blue screen of death waiting for me when I get home.
    I haven't installed any new hardware or anything lately that would indicate such a problem, but I have a feeling it has to do with drivers...

    The problem is, I can't debug it, because my pc isn't creating crash dumps! C:\Wiondows\Minidumps is not being written to, and the is no other dump locations. I don't know why it is not creating dumps.



    Randomly however, on the seventh, it did create a dump, however, perhaps one time out of thirty or more crashes in the last few weeks, and analyzing it with windbg I found that it was probably a driver called ntkrnlpa.exe, whatever that is. Because I only have that one dump I cannot tell if that was the primary and consistent cause, or even if it was accurate, but I have included the bang analyze dash v and lmv results for this debug, if anyone can add any wisdom to this irritating problem.

    So yeah, I'd like to get to the bottom of what is causing these crashes, and more importantly, why my pc is constipated and won't dump.





    Thanks,

    Scarlet


    (the lmv results extend much farther, but I only included the info relevant to the driver hinted by !analyze -v...)

    --

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 71a5df52, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000008, value 0 = read operation, 1 = write operation
    Arg4: 71a5df52, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 71a5df52

    CURRENT_IRQL: 2

    FAULTING_IP:
    +71a5df52
    71a5df52 ?? ???

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT


    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from 71a5df52 to 8053fa73

    FAILED_INSTRUCTION_ADDRESS:
    +71a5df52
    71a5df52 ?? ???

    STACK_TEXT:
    ed767d64 71a5df52 badb0d00 7c90eb94 ed767d98 nt!KiTrap0E+0x233
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0093f158 00000000 00000000 00000000 00000000 0x71a5df52


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiTrap0E+233
    8053fa73 f7457000000200 test dword ptr [ebp+70h],20000h

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!KiTrap0E+233

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c

    FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

    BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

    Followup: MachineOwner
    ---------

    kd> lmv
    start end module name
    804d7000 806cd580 nt # (pdb symbols) c:\symbols\ntkrnlpa.pdb\F612363DB38C423CB08559DDBCA9F2F71\ntkrnlpa.pdb
    Loaded symbol image file: ntkrnlpa.exe
    Mapped memory image file: c:\symbols\ntkrnlpa.exe\45E53F9C1f6580\ntkrnlpa.exe
    Image path: ntkrnlpa.exe
    Image name: ntkrnlpa.exe
    Timestamp: Wed Feb 28 00:38:52 2007 (45E53F9C)
    CheckSum: 00200031
    ImageSize: 001F6580
    File version: 5.1.2600.3093
    Product version: 5.1.2600.3093
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0411.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft(R) Windows(R) Operating System
    InternalName: ntkrnlpa.exe
    OriginalFilename: ntkrnlpa.exe
    ProductVersion: 5.1.2600.3093
    FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
    FileDescription: NT Kernel & System
    LegalCopyright: (C) Microsoft Corporation. All rights reserved.
     
  2. LordOfLA

    LordOfLA Godlike!

    Messages:
    7,027
    Location:
    Maidenhead, Berkshire, UK
    Re: !!! Pc Won't Write Crash Dumps !!!

    Next time it crashes make a note of the content of the BSOD itself.

    Though this type of crash (DRIVER_IRQL_NOT_LESS_OR_EQUAL) is usually attributable to video drivers.

    However if the bsod mentions a file name write it down and also the 0x00000000 number before the ones in the brackets. These are much more helpful than a crash dump :)
     
  3. BlackScarletLove

    BlackScarletLove Status:In Post-Production

    Messages:
    146
    Location:
    Victoria, BC, Canada
    Hmm, ok, well here is a shot of the screen after it crashed once today. (then failed to boot windows 5 or six times, then crashed again with the same bsod when it did boot windows)
     

    Attached Files:

  4. LordOfLA

    LordOfLA Godlike!

    Messages:
    7,027
    Location:
    Maidenhead, Berkshire, UK
    If you are an intel user:

    You need new ram or the memory controler on the chipset is dead/dying.

    If you are an AMD user:

    You need new ram or the ram controller in the CPU is dead/dying.

    Get ahold of the Microsoft memory tester at http://oca.microsoft.com/en/windiag.asp and see what it turns up.