BSOD caused by ntkrnlmp.exe
Hi I am facing a similar problem with Windows 7 64bit Professional Edition. I have a Complete memory Dump file of my BSOD and i analyzed lttle bit of that. It shows the issue is caused bcoz of the "nt!IopDeleteFile+168 fffff800`02d99458 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h]" SInce the "nt" is Windows base OS dll file i think this could be an Microsoft issue. Below is my BSOD report Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\PAR\R410\1-J59PBR\SHM-WindowsCrash-2500TYPSCMIMPORT\crash1\MEMORY.DMP] Kernel Complete Dump File: Full address space is available WARNING: Inaccessible path: 'C:\websymbols\symbols' WARNING: Whitespace at start of path element Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols;C:\websymbols;C:\websymbols\symbols; Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16385.amd64fre.win7_rtm.090713-1255 Machine Name: Kernel base = 0xfffff800`02a14000 PsLoadedModuleList = 0xfffff800`02c51e50 Debug session time: Mon Mar 7 14:27:50.942 2011 (GMT+6) System Uptime: 0 days 2:07:11.908 Loading Kernel Symbols ............................................................... ................................................................ ................ Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {7, 1097, 650075, fffff8a0043050f0} Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+168 ) Followup: MachineOwner --------- 1: kd> .reload Loading Kernel Symbols ............................................................... ................................................................ ................ Loading User Symbols Loading unloaded module list .... 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 0000000000000007, Attempt to free pool which was already freed Arg2: 0000000000001097, (reserved) Arg3: 0000000000650075, Memory contents of the pool block Arg4: fffff8a0043050f0, Address of the block of pool being deallocated Debugging Details: ------------------ POOL_ADDRESS: fffff8a0043050f0 Paged pool BUGCHECK_STR: 0xc2_7 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002bb760e to fffff80002a85f00 STACK_TEXT: fffff880`02fffa18 fffff800`02bb760e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`00650075 : nt!KeBugCheckEx fffff880`02fffa20 fffff800`02d99458 : fffffa80`033e0290 00000000`00000001 fffffa80`0348a030 fffffa80`033e0290 : nt!ExFreePool+0xccb fffff880`02fffad0 fffff800`02a8b0b4 : 00000000`00000000 00000000`00000000 fffffa80`02520080 00000000`00000000 : nt!IopDeleteFile+0x168 fffff880`02fffb60 fffff800`02d73f39 : 00000000`00000000 00000000`00084081 fffffa80`04a22e70 fffffa80`00084081 : nt!ObfDereferenceObject+0xd4 fffff880`02fffbc0 fffff800`02babf6b : fffffa80`04a22e78 00000000`00000001 00000000`00000000 00000000`00000631 : nt!MiSegmentDelete+0xa1 fffff880`02fffc00 fffff800`02bac5dd : 00000000`00000000 00000000`00000080 fffffa80`02453990 00000000`00000012 : nt!MiProcessDereferenceList+0x23b fffff880`02fffcc0 fffff800`02d29166 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d fffff880`02fffd40 fffff800`02a64486 : fffff800`02bfee80 fffffa80`024d4040 fffff800`02c0cc40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`02fffd80 00000000`00000000 : fffff880`03000000 fffff880`02ffa000 fffff880`02fff800 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!IopDeleteFile+168 fffff800`02d99458 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h] SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nt!IopDeleteFile+168 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600 FAILURE_BUCKET_ID: X64_0xc2_7_nt!IopDeleteFile+168 BUCKET_ID: X64_0xc2_7_nt!IopDeleteFile+168 Followup: MachineOwner --------- 1: kd> lmvm nt start end module name fffff800`02a14000 fffff800`02ff1000 nt (pdb symbols) c:\websymbols\ntkrnlmp.pdb\F8E2A8B5C9B74BF4A6E4A48F180099942\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Timestamp: Tue Jul 14 05:10:48 2009 (4A5BC600) CheckSum: 0054B487 ImageSize: 005DD000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: NT Kernel & System LegalCopyright: © Microsoft Corporation. All rights reserved. So can anyone help me to get a resolution from this issue. Regards ======= B.AkbarB.Akbar
March 30th, 2011 3:47am

Hi B.Akbar, This forum is dedicated to Windows Forms technology. I'm moving this thread from Base "Windows Forms" to Windows 7 IT Pro Forums, since this issue is related to it. There are more Windows 7 IT experts in that forum. Best Regards,Helen Zhou [MSFT] MSDN Community Support | Feedback to us Get or Request Code Sample from Microsoft Please remember to mark the replies as answers if they help and unmark them if they provide no help.
Free Windows Admin Tool Kit Click here and download it now
March 30th, 2011 5:38am

nt!IopDeleteFile this looks like file system issue. Run chkdsk C: /r /f to detect and fix NTFS file system issues."A programmer is just a tool which converts caffeine into code" I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
March 30th, 2011 9:37am

when the notskrnl is named this means the main NT kernel has crashed but if that file was at fault you would be having far more problems than a few bluescreens Printer Support|Computer Repair
Free Windows Admin Tool Kit Click here and download it now
March 31st, 2011 5:54am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics