BleepingComputer.com: BSOD keeps popping up- help required!

BSOD keeps popping up- help required!
It has popped up 4 times in the past week, and I do not think I have done anything out of the norm.
I have downloaded the debugging tool and hwere is what I have.


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini062311-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100427-1636
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jun 23 15:40:35.390 2011 (UTC + 1:00)
System Uptime: 0 days 8:28:02.999
Loading Kernel Symbols
...............................................................
.............................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {9931cb9c, 1c, 1, 80502cd8}

Probably caused by : ntkrpamp.exe ( nt!KiUnlinkThread+e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9931cb9c, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502cd8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 9931cb9c

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 80502d38 to 80502cd8

STACK_TEXT:
b4345ccc 80502d38 89040660 00000000 0000001e nt!KiUnlinkThread+0xe
b4345ce0 804fa28d 00000001 00000000 00000000 nt!KiUnwaitThread+0x12
b4345cfc 8060eaf8 89517878 00000001 00000000 nt!KeSetEvent+0x49
b4345d54 8054164c 00000208 00000000 024ffc58 nt!NtSetEvent+0x72
b4345d54 7c90e514 00000208 00000000 024ffc58 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
024ffc58 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiUnlinkThread+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4bd6e0e8

FAILURE_BUCKET_ID: 0xA_nt!KiUnlinkThread+e

BUCKET_ID: 0xA_nt!KiUnlinkThread+e

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9931cb9c, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502cd8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 9931cb9c

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 80502d38 to 80502cd8

STACK_TEXT:
b4345ccc 80502d38 89040660 00000000 0000001e nt!KiUnlinkThread+0xe
b4345ce0 804fa28d 00000001 00000000 00000000 nt!KiUnwaitThread+0x12
b4345cfc 8060eaf8 89517878 00000001 00000000 nt!KeSetEvent+0x49
b4345d54 8054164c 00000208 00000000 024ffc58 nt!NtSetEvent+0x72
b4345d54 7c90e514 00000208 00000000 024ffc58 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
024ffc58 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiUnlinkThread+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4bd6e0e8

FAILURE_BUCKET_ID: 0xA_nt!KiUnlinkThread+e

BUCKET_ID: 0xA_nt!KiUnlinkThread+e

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9931cb9c, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502cd8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 9931cb9c

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 80502d38 to 80502cd8

STACK_TEXT:
b4345ccc 80502d38 89040660 00000000 0000001e nt!KiUnlinkThread+0xe
b4345ce0 804fa28d 00000001 00000000 00000000 nt!KiUnwaitThread+0x12
b4345cfc 8060eaf8 89517878 00000001 00000000 nt!KeSetEvent+0x49
b4345d54 8054164c 00000208 00000000 024ffc58 nt!NtSetEvent+0x72
b4345d54 7c90e514 00000208 00000000 024ffc58 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
024ffc58 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnlinkThread+e
80502cd8 897204 mov dword ptr [edx+4],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiUnlinkThread+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4bd6e0e8

FAILURE_BUCKET_ID: 0xA_nt!KiUnlinkThread+e

BUCKET_ID: 0xA_nt!KiUnlinkThread+e

Followup: MachineOwner
---------



I have no idea what any of it means!!!

Any help is greatly appreciated.
Nikki

Sorry its a Dell Vostro 2oo if that helps!

Theanks, Nikki

Have you tried using this utility program to better understand the BSOD you're experiencing?

Other helpful articles you could review:

http://forums.pcper.com/showthread.php?t=447620

http://forums.overclockers.com.au/showthread.php?t=728785

Let's try this.

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file. This will start the autoscan feature.

When the automatic scanning is done and the screen appears, click Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

Louis

Ok, thanks for that.

So i think ntkrpamp.exe is the problem.
Am i right in thinking it's something to do with Anti-Virus software??

Where do i find an id10ts guide of how to fix it?

I seem to be missing something in the technical jargon, and can't work out what exactly I'm meant to be downloading, or how to go about it.

I know i'm a nightmare, but I really can;t seem to see the wood for the trees!!

Thankyou for trying to help me out.
I appreciate the effort

Nikki

For Louis

Thankyou!!!!

==================================================
Dump File : Mini062311-01.dmp
Crash Time : 23/06/2011 15:43:29
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x9931cb9c
Parameter 2 : 0x0000001c
Parameter 3 : 0x00000001
Parameter 4 : 0x80502cd8
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+2bcd8
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Crash Address : ntoskrnl.exe+2bcd8
Stack Address 1 : ntoskrnl.exe+2328d
Stack Address 2 : ntoskrnl.exe+137af8
Stack Address 3 : ntoskrnl.exe+6a64c
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062311-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
Dump File Size : 90,112
==================================================

==================================================
Dump File : Mini062011-01.dmp
Crash Time : 20/06/2011 06:58:05
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0x805c0721
Parameter 3 : 0xb35cbc94
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+e9721
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Crash Address : ntoskrnl.exe+e9721
Stack Address 1 : ntoskrnl.exe+6a64c
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062011-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
Dump File Size : 90,112
==================================================

==================================================
Dump File : Mini061611-01.dmp
Crash Time : 16/06/2011 09:19:23
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xf000e819
Parameter 2 : 0x00000008
Parameter 3 : 0xf000e819
Parameter 4 : 0x00000002
Caused By Driver : aswSnx.SYS
Caused By Address : aswSnx.SYS+376c1
File Description : avast! Virtualization Driver
Product Name : avast! Antivirus System
Company : AVAST Software
File Version : 6.0.1125.0
Processor : 32-bit
Crash Address :
Stack Address 1 : ntoskrnl.exe+e53c1
Stack Address 2 : ntoskrnl.exe+e54f9
Stack Address 3 : aswSP.SYS+12903
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini061611-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
Dump File Size : 90,112
==================================================

==================================================
Dump File : Mini051111-01.dmp
Crash Time : 11/05/2011 08:26:36
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : 0xc0000005
Parameter 2 : 0x804ef773
Parameter 3 : 0xba4fbbec
Parameter 4 : 0xba4fb8e8
Caused By Driver : afd.sys
Caused By Address : afd.sys+2cfa
File Description : Ancillary Function Driver for WinSock
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5657 (xpsp_sp3_gdr.080814-1236)
Processor : 32-bit
Crash Address : ntoskrnl.exe+18773
Stack Address 1 : afd.sys+2cfa
Stack Address 2 : afd.sys+2de9
Stack Address 3 : afd.sys+3a8e
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini051111-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
Dump File Size : 90,112
==================================================

==================================================
Dump File : Mini050811-01.dmp
Crash Time : 08/05/2011 09:00:44
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0x9a3fb9cc
Parameter 2 : 0x00000000
Parameter 3 : 0x805bcc0c
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+e5c0c
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Crash Address : ntoskrnl.exe+e5c0c
Stack Address 1 : ntoskrnl.exe+136bbe
Stack Address 2 : ntoskrnl.exe+e7108
Stack Address 3 : ntoskrnl.exe+139f10
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini050811-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
Dump File Size : 90,112
==================================================

I would try...uninstalling...then reinstalling Avast, as a first step. Update it after reinstalling, then run a full scan of the system.

There is also some thought that video drivers might be the problem, but leave those alone for the moment.

Are there any other malware-defense programs installed on this system?

Louis

Hi Louis,

No just avast.

It does also seem to happen when video is streaming though.
It just stops and crashes.
I thought it might be because I am running too many things at once, and switching between them.
What do you think??

I will try re-installing Avast now.

Thanks

Uninstall the video drivers also...then reinstall them.

It can't hurt anything to do so .

Louis

Hello!!!

I've done all of that, so fingers crossed!!!

Any chance you have any tips on getting rid of all the junk files I seem to have accumulated. Problem being, I don’t know which ones are junk, or where they would be stored, and don’t want to delete anything inadvertently.

Thank you for all your help!

Well...do you have a hard drive space problem?

With today's drives, there's really no reason to delete much of anything that isn't causing problems.

As for "junk files", I'm not sure what you mean. The only junk files I think of...are temporary files or files which have been recovered after a chkdsk. I have a lot of duplicate files on my systems that I have created for one resson or another...so I'm really not the person to advise anyone to delete anything .

My theory...leave it alone if it's not causing problems. Remove it when necessary.

Louis

Fair enough.

The reason for me wanting to "clear out the junk" is that any backups I do seem to take hours.
I'm wanting to take backups just in case of crashes so, but don't want to take the junk with it.
I'm trying to make an exact copy so that if anything happens I can be up and running on a new computer with no issues.
My hard drive was shredded 6 months ago and not only was it very time consuming and expensive to repair, but there was a lot of stuff that I lost, and typically it was mostly junk that was recoverable. Ever since it has left me with a slower response time and a consistant printer driver error issue that no amount of uninstalling or installing seems to fix.
Thats why the BSOD freaked me out so much!

Now I'm wary of anything that may have a similar effect, and want to avoid it if possible.

Thanks for all your help. So far today no issues!!!!

My philosophy is to remove programs I've installed but which have gone months without usage...not so much because I think they are "junk" but i see no reason to have them installed if I don't use them.

Since you haven't defined what "junk" means in your world, I cannot give you a more definitive response than those which I have given.

As for backup strategy...IMO, routine partition/disk images (made to s different hard drive) provide the best backups. Since my systems seldom have problems, I don't make such routinely...but I do make one after I've done a clean install and then installed all applicable critical updates and base programs that I use. I then replace that image...whenever I feel like it...with one made at a later date. I have about 8 internal hard drives lying around, so I store the image on one of those, I don't see the need for external hard drives (I have two systems).

Louis