Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen Of Death - Help Analysing Error (ntkrnlmp.exe)


  • Please log in to reply
3 replies to this topic

#1 FatCake

FatCake

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:59 PM

Posted 03 February 2018 - 08:45 AM

Hi,

Recently i have been experiencing frequent Blue Screens.

I have included some of the dump files

 

https://drive.google.com/open?id=1vgrDMN-RBw-xjGp9EglbXj8ZjkKKyiwd

https://drive.google.com/open?id=1IUfccVHCITRD42cS58wdZFXFWiFq2qQl

https://drive.google.com/open?id=1DG6s2Gj1cPscY4YWodmqhMcrlUTVdfTA

https://drive.google.com/open?id=1cVD3qkzXLtNwgnaClL1IElCNkWmyuRnZ

https://drive.google.com/open?id=1IxkRG4HuB-OB43leoVL7l2biQ-4DIcbX

 

I believe what's cause in is something called "ntkrnlmp.exe". However i don't know what this is.

I would love any feedback or thoughts concerning what caused this error and how i can fix it please?



BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:59 PM

Posted 03 February 2018 - 04:45 PM

ntoskrnl.exe (also seen as ntkrnlpa.exe, ntkrnlmp.exe, or ntkrpamp.exe) is the kernel (core) of the Windows operating system.  It is protected by security features and the Windows System File Checker.  As such, if ntoskrnl.exe was to blame, you'd be experiencing many more problems other than the occasional BSOD.

In most cases ntoskrnl.exe was blamed because a driver (typically a 3rd party driver) has corrupted the memory space that ntoskrnl.exe considers as it's own.  When this happens, ntoskrnl.exe typically finds unknown data (from the 3rd party driver) in it's memory space.  At this point the OS panics and throws a BSOD to prevent damage to the system.

If the culprit (the offending 3rd party driver) hasn't exited yet, then a BSOD analyst may be able to find traces of it in the reports/dumps.  If the culprit has exited, then the chase is on and further tests/reports will be needed to help identify what actually caused it.

More info here:  https://en.wikipedia.org/wiki/Ntoskrnl.exe
------------------------------------------------------------------------------------------------------------------------
Please run this report collecting tool so that we can provide a complete analysis: (from the pinned topic at the top of the forum)   http://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/
NOTE:  On problem systems it can take up to 20 minutes for the log files to complete.  Please be patient and let it run.

If you still have problems with it running, there's an alternate tool here (direct download link):  https://github.com/blueelvis/BSOD-Inspector/releases/download/1.0.5/BSODInspector-1.0.5.exe

NOTE:
Please zip up the (.ZIP) files - do not use .RAR, .7z or other compression utilities. 
.ZIP is the type file that can be uploaded to the forums.
------------------------------------------------------------------------------------------------------------------------

Your UEFI/BIOS (version P1.00) dates from 2012.  Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system.  If you are able to install the update through Windows (without booting from an external drive), then go ahead and update it.  WARNING - if the computer might shut down during this procedure, please don't do it, as this may physically damage the computer and prevent it from booting.
FYI - W8 and W10 communicate more with the UEFI/BIOS than previous versions of Windows, so it's important to ensure that the UEFI/BIOS is kept up to date (and the outdated UEFI/BIOS' may be the cause of some compatibility issues).

Out of 5 memory dumps there were 3 different BSOD  (aka STOP or BugCheck) error codes.  The differing error codes are usually symptomatic of a lower level problem within the system. They are usually caused by one of these things (the list is not in any sort of order):
- borked (broken) hardware (several different procedures used to isolate the problem device)
- BIOS issues (check for updates at the motherboard manufacturer's website)
- overclocking/overheating - You'll know if you're overclocking or not. If uncertain we can suggest things to check.
- dirt/dust/hair/fur/crud inside the case.  Blow out the case/vents with canned air (DO NOT use an air compressor or vacuum as they can cause damage to the system)
- missing Windows Updates
- compatibility issues (3rd party hardware/drivers), older systems, or even pirated systems
- overfull hard drives (drives with less than 15% free space)
- low-level driver problems
- or even malware (scanned for when we ask for hardware diagnostics from http://www.carrona.org/initdiag.html or http://www.carrona.org/hwdiag.html ).

Please get a head start on the hardware diagnostics - they are located here:  http://www.carrona.org/hwdiag.html
Please finish ALL of them and let us know the results.

FYI - These are the tests and what we usually see for the reports:

 

1 - Antivirus/antimalware scans:  In short, if there are Trojans or other serious malware - start over in the Am I Infected forums
2 - Memory diagnostics:  Run MemTest86+ for at least 3 passes.  If booting from UEFI, run MemTest86 instead.  Let us know if there were any errors reported
3 - Hard Drive diagnostics:  Don't sweat the details here.  In short, run the Seagate Seatools Long/Extended test from a bootable disk.  If unable to run it from a bootable disk (UEFI and some others), then run the Seagate Seatools for Windows from within Windows.  There are no diagnostics for SSD's, just run the Crystal Mark tests and let us know if there were any failures
4 - Furmark:  run the test until the temperature stabilizes.  Don't let it get much over 90ºC.  Let us know the temp it stabilizes at and if there were any problems running the test (other than slowness).
5 - Prime95:  run the Blend test for 24 hours (this may not be possible, but run it as long as you can.  Look for errors in the output, or for problems running the test (freezes/crashes)
6 - Video 2 (other video tests):  there's several tests here.  Run all of them.  I'm especially interested in the Video Memory Test.  Let us know the results of the test(s)
  - A - simtek.org memtest
  - B - Video memory stress test
  - C - Artifact Locator
  - D - OCCT - 4 built in tests for CPU, GPU, PSU
  - E - Video Memory Stress Test
7 - CPU tests:  run at least one test on your CPU and let us know the result.



Please update these older drivers.  Links are provided in order to assist you with looking up the source of the drivers.  
If unable to find an update, please uninstall the program that is responsible for that driver.  

DO NOT manually delete/rename the driver as it may make the system unbootable!!!:

netr28ux.sys                Thu May 28 10:28:52 2015 (55672624)
Ralink RT2870 series USB802.11n Wireless Adapter Driver (you may have a different manufacturer) http://www.mediatek.com/en/downloads/
http://www.carrona.org/drivers/driver.php?id=netr28ux.sys
 
 


Analysis:
The following is for information purposes only.
The following information contains the relevant information from the blue screen analysis:
**************************Sat Feb  3 08:37:34.495 2018 (UTC - 5:00)**************************
Loading Dump File [C:\Users\john\SysnativeBSODApps\020318-5984-01.dmp]
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Built by: 16299.15.amd64fre.rs3_release.170928-1534
System Uptime:0 days 0:03:53.217
Probably caused by :ntkrnlmp.exe ( nt!KxWaitForLockOwnerShipWithIrql+12 )
BugCheck 3B, {c0000005, fffff800509700f2, ffffc9083e94efc0, 0}
BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800509700f2, Address of the instruction which caused the bugcheck
Arg3: ffffc9083e94efc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  vegas130.exe
FAILURE_BUCKET_ID: 0x3B_nt!KxWaitForLockOwnerShipWithIrql
  BIOS Version                  P1.00
  BIOS Release Date             10/17/2012
  Manufacturer                  To Be Filled By O.E.M.
  Baseboard Manufacturer        ASRock
  Product Name                  To Be Filled By O.E.M.
  Baseboard Product             970 Extreme3 R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sat Feb  3 08:32:57.198 2018 (UTC - 5:00)**************************
Loading Dump File [C:\Users\john\SysnativeBSODApps\020318-6906-01.dmp]
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Built by: 16299.15.amd64fre.rs3_release.170928-1534
System Uptime:0 days 1:48:36.919
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck 3B, {c0000005, fffff80322b7a0f2, fffffd01e9d8de70, 0}
BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80322b7a0f2, Address of the instruction which caused the bugcheck
Arg3: fffffd01e9d8de70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  services.exe
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
  BIOS Version                  P1.00
  BIOS Release Date             10/17/2012
  Manufacturer                  To Be Filled By O.E.M.
  Baseboard Manufacturer        ASRock
  Product Name                  To Be Filled By O.E.M.
  Baseboard Product             970 Extreme3 R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Feb  1 12:12:29.666 2018 (UTC - 5:00)**************************
Loading Dump File [C:\Users\john\SysnativeBSODApps\020118-6296-01.dmp]
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Built by: 16299.15.amd64fre.rs3_release.170928-1534
System Uptime:3 days 21:25:01.387
*** ERROR: Module load completed but symbols could not be loaded for NTFS.sys
Probably caused by :memory_corruption
BugCheck 3B, {c0000005, fffff802744a3424, ffffa08ee68517c0, 0}
BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff802744a3424, Address of the instruction which caused the bugcheck
Arg3: ffffa08ee68517c0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
BUGCHECK_STR:  0x3B
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
PROCESS_NAME:  OneDriveSetup.exe
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
  BIOS Version                  P1.00
  BIOS Release Date             10/17/2012
  Manufacturer                  To Be Filled By O.E.M.
  Baseboard Manufacturer        ASRock
  Product Name                  To Be Filled By O.E.M.
  Baseboard Product             970 Extreme3 R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Jan 28 14:46:52.700 2018 (UTC - 5:00)**************************
Loading Dump File [C:\Users\john\SysnativeBSODApps\012818-8812-01.dmp]
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Built by: 16299.15.amd64fre.rs3_release.170928-1534
System Uptime:1 days 7:03:52.423
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by :memory_corruption
BugCheck 1000007E, {ffffffffc0000005, fffff802158ab424, ffffa3876f061508, ffffa3876f060d50}
BugCheck Info: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802158ab424, The address that the exception occurred at
Arg3: ffffa3876f061508, Exception Record Address
Arg4: ffffa3876f060d50, Context Record Address
PROCESS_NAME:  System
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
  BIOS Version                  P1.00
  BIOS Release Date             10/17/2012
  Manufacturer                  To Be Filled By O.E.M.
  Baseboard Manufacturer        ASRock
  Product Name                  To Be Filled By O.E.M.
  Baseboard Product             970 Extreme3 R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sat Jan 27 07:42:15.366 2018 (UTC - 5:00)**************************
Loading Dump File [C:\Users\john\SysnativeBSODApps\012718-7437-01.dmp]
Windows 10 Kernel Version 16299 MP (8 procs) Free x64
Built by: 16299.15.amd64fre.rs3_release.170928-1534
System Uptime:0 days 0:38:38.089
*** ERROR: Module load completed but symbols could not be loaded for NTFS.sys
Probably caused by :memory_corruption
BugCheck 1E, {ffffffffc0000005, fffff80099d37424, 0, ffffffffffffffff}
BugCheck Info: KMODE_EXCEPTION_NOT_HANDLED (1e)
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80099d37424, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
BUGCHECK_STR:  0x1E_c0000005_R
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
  BIOS Version                  P1.00
  BIOS Release Date             10/17/2012
  Manufacturer                  To Be Filled By O.E.M.
  Baseboard Manufacturer        ASRock
  Product Name                  To Be Filled By O.E.M.
  Baseboard Product             970 Extreme3 R2.0
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`


3rd Party Drivers:
The following is for information purposes only.
My recommendations were given above. The drivers that follow belong to software or devices that were not developed by Microsoft.  You can find links to the driver information and where to update the drivers in the section after the code box:

**************************Sat Feb  3 08:37:34.495 2018 (UTC - 5:00)**************************
MpKsl032d7f12.sys           Mon Feb 27 20:54:41 1989 (2409FBE1)
MpKsl23587243.sys           Mon Feb 27 20:54:41 1989 (2409FBE1)
MpKsl47771133.sys           Mon Feb 27 20:54:41 1989 (2409FBE1)
MpKsla8a680c4.sys           Mon Feb 27 20:54:41 1989 (2409FBE1)
netr28ux.sys                Thu May 28 10:28:52 2015 (55672624)
rt640x64.sys                Wed Oct  5 09:32:55 2016 (57F50107)
nvlddmkm.sys                Mon Nov 14 04:42:35 2016 (5829870B)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Feb  1 12:12:29.666 2018 (UTC - 5:00)**************************
MpKsl25dff64e.sys           Mon Feb 27 20:54:41 1989 (2409FBE1)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Jan 28 14:46:52.700 2018 (UTC - 5:00)**************************
exfat.SYS                   Mon Mar 21 01:41:07 1977 (0D9381F3)

MpKsl032d7f12.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
MpKsl23587243.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
MpKsl47771133.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
MpKsla8a680c4.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=netr28ux.sys
http://www.carrona.org/drivers/driver.php?id=rt640x64.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
MpKsl25dff64e.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=exfat.SYS

 


Edited by usasma, 03 February 2018 - 04:47 PM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 FatCake

FatCake
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:59 PM

Posted 04 February 2018 - 10:11 AM

Hi,

 

Thank you for this response,

 

currently what i have done so far is that i have went to my motherboards website and downloaded all the drivers so they should be up to date.

 

Where should i start with your response, what would you reccomend first?



#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:59 PM

Posted 05 February 2018 - 06:18 AM

My suggestion is to read each line/paragraph of my previous post and then follow those suggestions.

Keep us informed of what you've done and we'll advise you from there.


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users