BSOD apparently caused by ntkrpamp.exe

[Tom]

Hello,

I am currently experiencing alot of PAGE_FAULT_IN_NONE_PAGED_AREA BSODs with
minidumps that refer to ntkrpamp.exe. Replaced the RAM modules so there is
not a RAM fault so what can be causing it?

Heres the WinDBG output:

*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e56f9000, 0, 8063e036, 1}


Could not read faulting driver name


Probably caused by : ntkrpamp.exe ( nt!CmpQueryKeyValueData+2d4 )

Followup: MachineOwner
---------

0: kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: e56f9000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8063e036, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name



READ_ADDRESS: e56f9000

FAULTING_IP:
nt!CmpQueryKeyValueData+2d4
8063e036 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: agent.exe

LAST_CONTROL_TRANSFER: from 8062f9f7 to 8063e036

STACK_TEXT:
b4198c38 8062f9f7 e1a83b60 e571c3f4 e55775ac nt!CmpQueryKeyValueData+0x2d4
b4198c9c 8062048a e50acb00 020a001c 7ffdec00 nt!CmQueryValueKey+0xb9
b4198d44 8054086c 000001f4 7ffdebf8 00000002 nt!NtQueryValueKey+0x2cc
b4198d44 7c90eb94 000001f4 7ffdebf8 00000002 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013eee8 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpQueryKeyValueData+2d4
8063e036 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CmpQueryKeyValueData+2d4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

Followup: MachineOwner
---------

0: kd> !analyse -v;r;kv;lmtn
No export analyse found
eax=00200004 ebx=e55775b4 ecx=0001f96e edx=00000001 esi=e56f9000 edi=01501a78
eip=8063e036 esp=b4198c1c ebp=b4198c38 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpQueryKeyValueData+0x2d4:
8063e036 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
es:0023:01501a78=00000000 ds:0023:e56f9000=????????
ChildEBP RetAddr Args to Child
b4198c38 8062f9f7 e1a83b60 e571c3f4 e55775ac nt!CmpQueryKeyValueData+0x2d4
(FPO: [Non-Fpo])
b4198c9c 8062048a e50acb00 020a001c 7ffdec00 nt!CmQueryValueKey+0xb9 (FPO:
[Non-Fpo])
b4198d44 8054086c 000001f4 7ffdebf8 00000002 nt!NtQueryValueKey+0x2cc (FPO:
[Non-Fpo])
b4198d44 7c90eb94 000001f4 7ffdebf8 00000002 nt!KiFastCallEntry+0xfc (FPO:
[0,0] TrapFrame @ b4198d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013eee8 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806e2000 nt ntkrpamp.exe Wed Feb 28 08:38:53 2007 (45E53F9D)
806e2000 80702d00 hal halmacpi.dll Wed Aug 04 06:59:09 2004 (41107B2D)
b3dc8000 b3e08280 HTTP HTTP.sys Fri Mar 17 00:33:09 2006 (441A03C5)
b4417000 b441a100 vstor2_ws60 vstor2-ws60.sys Mon Apr 09 21:44:20 2007
(461AA5A4)
b45f3000 b45f5d00 vstor2 vstor2.sys Fri Mar 23 17:02:01 2007 (46040809)
b48f3000 b4944480 srv srv.sys Mon Aug 14 11:34:39 2006 (44E051BF)
b55f8000 b56728c0 amon amon.sys Fri May 11 07:22:58 2007 (46440BC2)
b569b000 b5702500 vmx86 vmx86.sys Wed May 02 05:10:13 2007 (46380F25)
b572b000 b5757400 mrxdav mrxdav.sys Wed Aug 04 07:00:49 2004 (41107B91)
b5978000 b5983000 hcmon hcmon.sys Wed May 02 05:39:31 2007 (46381603)
b5aa2000 b5acc180 kmixer kmixer.sys Wed Jun 14 09:47:45 2006 (448FCD31)
b5af0000 b5b04400 wdmaud wdmaud.sys Wed Jun 14 10:00:44 2006 (448FD03C)
b5c55000 b5c63d80 sysaudio sysaudio.sys Wed Aug 04 07:15:54 2004 (41107F1A)
b5ef1000 b5ef4900 ndisuio ndisuio.sys Wed Apr 20 00:54:03 2005 (42659A1B)
b6205000 b621c480 dump_atapi dump_atapi.sys Wed Aug 04 06:59:41 2004
(41107B4D)
b621d000 b6240000 Fastfat Fastfat.SYS Wed Aug 04 07:14:15 2004 (41107EB7)
b6268000 b62d6a00 mrxsmb mrxsmb.sys Fri May 05 10:41:42 2006 (445B1DD6)
b62d7000 b6301a00 rdbss rdbss.sys Fri May 05 10:47:55 2006 (445B1F4B)
b6302000 b632e340 truecrypt truecrypt.sys Thu May 03 20:21:33 2007
(463A363D)
b632f000 b6350d00 afd afd.sys Wed Aug 04 07:14:13 2004 (41107EB5)
b6379000 b63d7ce0 vsdatant vsdatant.sys Fri Mar 09 06:29:37 2007 (45F0FED1)
b63d8000 b640f180 tcpip6 tcpip6.sys Wed Aug 16 10:37:30 2006 (44E2E75A)
b6410000 b6430f00 ipnat ipnat.sys Wed Sep 29 23:28:36 2004 (415B3714)
b6431000 b6458c00 netbt netbt.sys Wed Aug 04 07:14:36 2004 (41107ECC)
b6459000 b64b0d80 tcpip tcpip.sys Thu Apr 20 12:51:47 2006 (444775D3)
b64b1000 b64c3400 ipsec ipsec.sys Wed Aug 04 07:14:27 2004 (41107EC3)
b64f8000 b64fa900 Dxapi Dxapi.sys Fri Aug 17 21:53:19 2001 (3B7D843F)
b6534000 b6557980 portcls portcls.sys Wed Aug 04 07:15:47 2004 (41107F13)
b6558000 b69ee000 RtkHDAud RtkHDAud.sys Thu Dec 20 10:00:00 2007 (476A3D20)
b8afe000 b8b00f00 ws2ifsl ws2ifsl.sys Fri Aug 17 21:55:58 2001 (3B7D84DE)
b8b16000 b8b6ee80 update update.sys Mon Apr 23 11:32:54 2007 (462C8B56)
b8b6f000 b8b91680 ks ks.sys Wed Aug 04 07:15:20 2004 (41107EF8)
b8b92000 b8ba2e00 psched psched.sys Wed Aug 04 07:04:16 2004 (41107C60)
b8ba3000 b8bb9680 ndiswan ndiswan.sys Wed Aug 04 07:14:30 2004 (41107EC6)
b8bba000 b8bf7280 yk51x86 yk51x86.sys Thu Nov 02 16:21:29 2006 (454A1B09)
b8bf8000 b8c1d000 HDAudBus HDAudBus.sys Sat Jan 08 01:07:15 2005 (41DF3243)
b8c1d000 b8c3fe80 USBPORT USBPORT.SYS Wed Aug 04 07:08:34 2004 (41107D62)
b8c40000 b8c53780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 07:07:04 2004 (41107D08)
b8c54000 b9362a00 nv4_mini nv4_mini.sys Tue Oct 09 17:12:37 2007 (470BA875)
b93b3000 b93bb880 Fips Fips.SYS Sat Aug 18 02:31:49 2001 (3B7DC585)
b943a000 b943f480 vmnetbridge vmnetbridge.sys Fri Mar 16 10:06:36 2007
(45FA6C2C)
b9442000 b9446920 AegisP AegisP.sys Tue May 17 21:22:56 2005 (428A52A0)
b946a000 b946e500 watchdog watchdog.sys Wed Aug 04 07:07:32 2004 (41107D24)
b964e000 b9656700 netbios netbios.sys Wed Aug 04 07:03:19 2004 (41107C27)
b965e000 b966cd80 arp1394 arp1394.sys Wed Aug 04 06:58:28 2004 (41107B04)
b966e000 b9676700 wanarp wanarp.sys Wed Aug 04 07:04:57 2004 (41107C89)
b968e000 b9697680 AFS2K AFS2K.SYS Sat Feb 14 23:01:29 2004 (402EA8C9)
b9777000 b9779a00 VMNET VMNET.SYS Fri Mar 16 10:05:31 2007 (45FA6BEB)
b977b000 b977d680 vmnetadapter vmnetadapter.sys Fri Mar 16 10:06:08 2007
(45FA6C10)
b977f000 b9782c80 mssmbios mssmbios.sys Wed Aug 04 07:07:47 2004 (41107D33)
b978b000 b978d580 ndistapi ndistapi.sys Fri Aug 17 21:55:29 2001 (3B7D84C1)
b978f000 b9792700 VMkbd VMkbd.sys Wed May 02 05:52:21 2007 (46381905)
b9793000 b9796080 tunmp tunmp.sys Wed Aug 04 07:03:15 2004 (41107C23)
b9c17000 b9c31580 Mup Mup.sys Wed Aug 04 07:15:20 2004 (41107EF8)
b9c32000 b9c42140 snapman snapman.sys Mon Feb 03 08:42:17 2003 (3E3E2B69)
b9c43000 b9c57000 srescan srescan.sys Wed Oct 17 19:36:24 2007 (47165628)
b9c57000 b9d2b400 SysLang SysLang.sys Sat Jul 28 03:02:57 2007 (46AAA3D1)
b9d2c000 b9d58a80 NDIS NDIS.sys Wed Aug 04 07:14:27 2004 (41107EC3)
b9d59000 b9de5400 Ntfs Ntfs.sys Fri Feb 09 11:10:31 2007 (45CC56A7)
b9de6000 b9dfc780 KSecDD KSecDD.sys Wed Aug 04 06:59:45 2004 (41107B51)
b9dfd000 b9e0ef00 sr sr.sys Wed Aug 04 07:06:22 2004 (41107CDE)
b9e0f000 b9e2e780 fltMgr fltMgr.sys Mon Aug 21 10:14:57 2006 (44E97991)
b9e2f000 b9e46480 atapi atapi.sys Wed Aug 04 06:59:41 2004 (41107B4D)
b9e47000 b9e65880 ftdisk ftdisk.sys Fri Aug 17 21:52:41 2001 (3B7D8419)
b9e66000 b9e7d800 SCSIPORT SCSIPORT.SYS Wed Aug 04 06:59:39 2004 (41107B4B)
b9f68000 b9f78a80 pci pci.sys Wed Aug 04 07:07:45 2004 (41107D31)
b9f79000 b9fa6d80 ACPI ACPI.sys Wed Aug 04 07:07:35 2004 (41107D27)
ba0a8000 ba0b0c00 isapnp isapnp.sys Fri Aug 17 21:58:01 2001 (3B7D8559)
ba0b8000 ba0c2500 MountMgr MountMgr.sys Wed Aug 04 06:58:29 2004 (41107B05)
ba0c8000 ba0d4c80 VolSnap VolSnap.sys Wed Aug 04 07:00:14 2004 (41107B6E)
ba0d8000 ba0e4300 jraid jraid.sys Thu May 24 11:30:10 2007 (46556932)
ba0e8000 ba0f0e00 disk disk.sys Wed Aug 04 06:59:53 2004 (41107B59)
ba0f8000 ba104200 CLASSPNP CLASSPNP.SYS Wed Aug 04 07:14:26 2004 (41107EC2)
ba108000 ba110b80 PxHelp20 PxHelp20.sys Fri Feb 02 21:23:57 2007 (45C3ABED)
ba118000 ba126e80 ohci1394 ohci1394.sys Wed Aug 04 07:10:05 2004 (41107DBD)
ba128000 ba135000 1394BUS 1394BUS.SYS Wed Aug 04 07:10:03 2004 (41107DBB)
ba138000 ba143580 gagp30kx gagp30kx.sys Wed Aug 04 07:07:43 2004 (41107D2F)
ba168000 ba177180 nic1394 nic1394.sys Wed Aug 04 06:58:28 2004 (41107B04)
ba178000 ba186b80 drmk drmk.sys Wed Aug 04 07:07:54 2004 (41107D3A)
ba268000 ba270d00 intelppm intelppm.sys Wed Aug 04 06:59:19 2004 (41107B37)
ba278000 ba284e00 i8042prt i8042prt.sys Wed Aug 04 07:14:36 2004 (41107ECC)
ba288000 ba294880 rasl2tp rasl2tp.sys Wed Aug 04 07:14:21 2004 (41107EBD)
ba298000 ba2a2200 raspppoe raspppoe.sys Wed Aug 04 07:05:06 2004 (41107C92)
ba2a8000 ba2b3d00 raspptp raspptp.sys Wed Aug 04 07:14:26 2004 (41107EC2)
ba2b8000 ba2c0900 msgpc msgpc.sys Wed Aug 04 07:04:11 2004 (41107C5B)
ba2c8000 ba2d1f00 termdd termdd.sys Wed Aug 04 06:58:52 2004 (41107B1C)
ba2d8000 ba2e1480 NDProxy NDProxy.SYS Fri Aug 17 21:55:30 2001 (3B7D84C2)
ba308000 ba316100 usbhub usbhub.sys Wed Aug 04 07:08:40 2004 (41107D68)
ba328000 ba32e200 PCIIDEX PCIIDEX.SYS Wed Aug 04 06:59:40 2004 (41107B4C)
ba330000 ba334900 PartMgr PartMgr.sys Sat Aug 18 02:32:23 2001 (3B7DC5A7)
ba338000 ba33dd80 SysBoot SysBoot.sys Sat Jul 28 03:02:51 2007 (46AAA3CB)
ba3d8000 ba3dd000 usbuhci usbuhci.sys Wed Aug 04 07:08:34 2004 (41107D62)
ba3e0000 ba3e6800 usbehci usbehci.sys Wed Aug 04 07:08:34 2004 (41107D62)
ba3e8000 ba3e9000 fdc fdc.sys unavailable (00000000)
ba3f0000 ba3f5a00 mouclass mouclass.sys Wed Aug 04 06:58:32 2004 (41107B08)
ba3f8000 ba3fe000 kbdclass kbdclass.sys Wed Aug 04 06:58:32 2004 (41107B08)
ba400000 ba404880 TDI TDI.SYS Wed Aug 04 07:07:47 2004 (41107D33)
ba408000 ba40c580 ptilink ptilink.sys Fri Aug 17 21:49:53 2001 (3B7D8371)
ba410000 ba414080 raspti raspti.sys Fri Aug 17 21:55:32 2001 (3B7D84C4)
ba418000 ba41d000 flpydisk flpydisk.sys Wed Aug 04 06:59:24 2004 (41107B3C)
ba430000 ba436180 HIDPARSE HIDPARSE.SYS Wed Aug 04 07:08:15 2004 (41107D4F)
ba438000 ba43d200 vga vga.sys Wed Aug 04 07:07:06 2004 (41107D0A)
ba440000 ba444a80 Msfs Msfs.SYS Wed Aug 04 07:00:37 2004 (41107B85)
ba448000 ba44f880 Npfs Npfs.SYS Wed Aug 04 07:00:38 2004 (41107B86)
ba450000 ba457180 Ip6Fw Ip6Fw.sys Wed Aug 04 07:00:04 2004 (41107B64)
ba458000 ba45fb80 usbccgp usbccgp.sys Wed Aug 04 07:08:45 2004 (41107D6D)
ba470000 ba476500 usbprint usbprint.sys Wed Aug 04 07:01:23 2004 (41107BB3)
ba478000 ba47e780 USBSTOR USBSTOR.SYS Wed Aug 04 07:08:44 2004 (41107D6C)
ba498000 ba49c780 vmnetuserif vmnetuserif.sys Wed May 02 05:41:19 2007
(4638166F)
ba4b8000 ba4bb000 BOOTVID BOOTVID.dll Fri Aug 17 21:49:09 2001 (3B7D8345)
ba4bc000 ba4bed00 SDbgMsg SDbgMsg.sys Sat Jul 28 03:03:02 2007 (46AAA3D6)
ba4c0000 ba4c3320 Gernuwa Gernuwa.sys Mon Apr 21 18:00:31 2003 (3EA423AF)
ba574000 ba5771c0 cdrbsdrv cdrbsdrv.SYS Mon Mar 08 03:55:49 2004 (404BEEC5)
ba57c000 ba57e820 awlegacy awlegacy.sys Mon Nov 17 23:06:47 2003 (3FB95487)
ba580000 ba582280 rasacd rasacd.sys Fri Aug 17 21:55:39 2001 (3B7D84CB)
ba5a8000 ba5a9b80 kdcom kdcom.dll Fri Aug 17 21:49:10 2001 (3B7D8346)
ba5aa000 ba5ab100 WMILIB WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
ba5ac000 ba5ad500 viaide viaide.sys Wed Aug 04 06:59:42 2004 (41107B4E)
ba5ae000 ba5af580 intelide intelide.sys Wed Aug 04 06:59:40 2004 (41107B4C)
ba5b0000 ba5b1480 speedfan speedfan.sys Sun Sep 24 14:28:47 2006 (4516880F)
ba5f8000 ba5f9100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 22:07:23 2001
(3B7D878B)
ba610000 ba611100 swenum swenum.sys Wed Aug 04 06:58:41 2004 (41107B11)
ba612000 ba613280 USBD USBD.SYS Fri Aug 17 22:02:58 2001 (3B7D8682)
ba618000 ba619f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 21:49:37 2001 (3B7D8361)
ba61a000 ba61b080 Beep Beep.SYS Fri Aug 17 21:47:33 2001 (3B7D82E5)
ba61c000 ba61dd80 awechomd awechomd.sys Mon Oct 10 19:09:38 2005 (434AAE62)
ba61e000 ba61f080 mnmdd mnmdd.SYS Fri Aug 17 21:57:28 2001 (3B7D8538)
ba620000 ba621080 RDPCDD RDPCDD.sys Fri Aug 17 21:46:56 2001 (3B7D82C0)
ba626000 ba627de0 nod32drv nod32drv.sys Fri May 11 07:23:05 2007 (46440BC9)
ba670000 ba670d00 pciide pciide.sys Fri Aug 17 21:51:49 2001 (3B7D83E5)
ba671000 ba671680 giveio giveio.sys Thu Apr 04 03:33:25 1996 (316334F5)
ba70d000 ba70db80 Null Null.SYS Fri Aug 17 21:47:39 2001 (3B7D82EB)
ba735000 ba735a80 PQNTDrv PQNTDrv.SYS Thu May 06 04:48:39 2004 (4099B597)
ba75c000 ba75cd00 dxgthk dxgthk.sys Fri Aug 17 21:53:12 2001 (3B7D8438)
ba797000 ba797c00 audstub audstub.sys Fri Aug 17 21:59:40 2001 (3B7D85BC)
bf000000 bf011580 dxg dxg.sys Wed Aug 04 07:00:51 2004 (41107B93)
bf012000 bf58f180 nv4_disp nv4_disp.dll Tue Oct 09 17:08:40 2007 (470BA788)
bf800000 bf9c2180 win32k win32k.sys Thu Mar 08 13:47:34 2007 (45F013F6)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 08:56:56 2004 (411096C8)

Unloaded modules:
b5c35000 b5c42000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b5c45000 b5c53000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba5da000 ba5dc000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba77b000 ba77c000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b5acd000 b5af0000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba420000 ba427000 VMparport.sy
Timestamp: unavailable (00000000)
Checksum: 00000000
b56ef000 b5703000 parport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9e7e000 b9f68000 sptd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b960e000 b9619000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b961e000 b962d000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b962e000 b9637000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b963e000 b964e000 serial.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba578000 ba57c000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba428000 ba42d000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b967e000 b968b000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b9ba7000 b9baa000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000


How can I fix this? Should I assume that ntkrpamp.exe is corrupted and try
to restore it from the one on my XP CD or is something else causing it?

Thanks,

Tom

 

[nass]

Hello,

I am currently experiencing alot of PAGE_FAULT_IN_NONE_PAGED_AREA BSODs with
minidumps that refer to ntkrpamp.exe. Replaced the RAM modules so there is
not a RAM fault so what can be causing it?

Hi Tom,
Did you install the Same Model of the RAM (ie identical ones?), try to start
just with one stick of RAM and Note the behaviour.
Also could you please let us know some info about your Operating system
anti-virus/firewall/anti-spyware you may have installed on this machine,
other software for backup, managing your Desktop or the Internet....please
all.
Run a thorough scan on your system with up2date security software on from an
online scanners.

Check your devices in the Device Manager for any conflict or Malfunctioning.

You receive a "System Has Recovered from a Serious Error" message after
every restart
http://support.microsoft.com/kb/317277

Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

Lastly, try to download the Diagnostic tools from your Hard Drive
manufacturer and test the health of your HDD, it my be failing.
HTH.
nass

 

[Tom]

Just submitted the error report from one of the crashes but I just got:

"Corrupted error report

Unfortunately, the error report you submitted is corrupted and cannot be
analyzed. Corrupted error reports are rare. They can be caused by hardware or
software problems, and they usually indicate a serious problem with your
computer."

Ill attempt to send one again next time it crashes.

The RAM sticks are identical and if it helps they are a pair of GeIL Ultra
low latency 800Mhz dual channel DDR2 sticks running at 2.1v

OS: Windows XP Home Edition SP2
Anti-virus: NOD32
Firewall: ZoneAlarm Pro
Internet browser: Firefox 3 Beta 2

System Specs:

Intel Core 2 Quad Q6600
Abit IP35 ATX Motherboard
BFG OC2 8800GT PCI-E Graphics card
Corsair HX520w Modular Power Supply
2x GeIL ultra low latency DDR2 800Mhz Dual Channel RAM
Antec Nine Hundred case

No issues in the device manager.

No events logged for around the time of the crashes however the are errors
before it:

Event Type: Error
Event Source: sptd
Event Category: None
Event ID: 4
Date: 30/12/2007
Time: 15:25:48
User: N/A
Computer: HOME-AE313F85D0
Description:
Driver detected an internal error in its data structures for .

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 52 00 ......R.
0008: 00 00 00 00 04 00 04 c0 .......À
0010: b8 00 00 00 00 00 00 00 ¸.......
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

------------------

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 30/12/2007
Time: 15:28:08
User: N/A
Computer: HOME-AE313F85D0
Description:
Error code 10000050, parameter1 e1661000, parameter2 00000000, parameter3
8063e036, parameter4 00000001.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 35 1000005
0020: 30 20 20 50 61 72 61 6d 0 Param
0028: 65 74 65 72 73 20 65 31 eters e1
0030: 36 36 31 30 30 30 2c 20 661000,
0038: 30 30 30 30 30 30 30 30 00000000
0040: 2c 20 38 30 36 33 65 30 , 8063e0
0048: 33 36 2c 20 30 30 30 30 36, 0000
0050: 30 30 30 31 0001

------------------------

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 30/12/2007
Time: 15:28:52
User: N/A
Computer: HOME-AE313F85D0
Description:
The following boot-start or system-start driver(s) failed to load:
sptd

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

------------------------

Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 28
Date: 30/12/2007
Time: 15:05:53
User: N/A
Computer: HOME-AE313F85D0
Description:
WinMgmt could not initialize the core parts. This could be due to a badly
installed version of WinMgmt, WinMgmt repository upgrade failure,
insufficient disk space or insufficient memory.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--------------------------

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 30/12/2007
Time: 15:05:53
User: N/A
Computer: HOME-AE313F85D0
Description:
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 01 10 04 80 ...€

--------------------------

Event Type: Warning
Event Source: EventSystem
Event Category: (52)
Event ID: 4356
Date: 30/12/2007
Time: 13:56:28
User: N/A
Computer: HOME-AE313F85D0
Description:
The COM+ Event System failed to create an instance of the subscriber
partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}. CoGetObject returned HRESULT 800401E4.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

---------------------------

Event Type: Warning
Event Source: EventSystem
Event Category: (54)
Event ID: 4353
Date: 30/12/2007
Time: 13:56:28
User: N/A
Computer: HOME-AE313F85D0
Description:
The COM+ Event System attempted to fire the
EventObjectChange::ChangedSubscription event but received a bad return code.
HRESULT was 80040201.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks,

Tom

Hello,

I am currently experiencing alot of PAGE_FAULT_IN_NONE_PAGED_AREA BSODs with
minidumps that refer to ntkrpamp.exe. Replaced the RAM modules so there is
not a RAM fault so what can be causing it?

Hi Tom,
Did you install the Same Model of the RAM (ie identical ones?), try to start
just with one stick of RAM and Note the behaviour.
Also could you please let us know some info about your Operating system
anti-virus/firewall/anti-spyware you may have installed on this machine,
other software for backup, managing your Desktop or the Internet....please
all.
Run a thorough scan on your system with up2date security software on from an
online scanners.

Check your devices in the Device Manager for any conflict or Malfunctioning.

You receive a "System Has Recovered from a Serious Error" message after
every restart
http://support.microsoft.com/kb/317277

Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

Lastly, try to download the Diagnostic tools from your Hard Drive
manufacturer and test the health of your HDD, it my be failing.
HTH.
nass

 

[nass]

Hi Tom,
Please find my reply under each Error message:

Event Type: Error
Event Source: sptd
Event Category: None
Event ID: 4
Date: 30/12/2007
Time: 15:25:48
User: N/A
Computer: HOME-AE313F85D0
Description:
Driver detected an internal error in its data structures for .

SPTD Driver detected an internal error in its data structures
http://www.daemon-tools.cc/dtcc/archive/sptd-driver-detected-internal-error-t11718.html

Event ID 4 may be logged after you convert a hard disk to a dynamic hard disk
http://support.microsoft.com/kb/885686


Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 30/12/2007
Time: 15:28:08
User: N/A
Computer: HOME-AE313F85D0
Description:
Error code 10000050, parameter1 e1661000, parameter2 00000000, parameter3
8063e036, parameter4 00000001.

Event ID 1003
http://support.microsoft.com/kb/889082/
Test the memory, by starting with one stick of RAM.


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 30/12/2007
Time: 15:28:52
User: N/A
Computer: HOME-AE313F85D0
Description:
The following boot-start or system-start driver(s) failed to load:
sptd
daemon tools
http://www.daemon-tools.cc/dtcc/archive/daemon-tools-4-vista-build-t9386.html


Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 28
Date: 30/12/2007
Time: 15:05:53
User: N/A
Computer: HOME-AE313F85D0
Description:
WinMgmt could not initialize the core parts. This could be due to a badly
installed version of WinMgmt, WinMgmt repository upgrade failure,
insufficient disk space or insufficient memory.

Event ID 28 — WMI Service Availability
http://technet2.microsoft.com/windo...93a0-417f-bbdc-369758ebd15f1033.mspx?mfr=true

http://www.eventid.net/display.asp?eventid=28&eventno=1320&source=WinMgmt&phase=1



Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 30/12/2007
Time: 15:05:53
User: N/A
Computer: HOME-AE313F85D0
Description:
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

The error about MS Security Center not being able to track or recognize your
anti-virus, check that the Firewall service for ZA
is Enabled Auto and working in the Services control panel.



Event Type: Warning
Event Source: EventSystem
Event Category: (52)
Event ID: 4356
Date: 30/12/2007
Time: 13:56:28
User: N/A
Computer: HOME-AE313F85D0
Description:
The COM+ Event System failed to create an instance of the subscriber
partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}. CoGetObject returned HRESULT 800401E4.

Message Queuing messages intermittently may fail to be delivered when the
COM+ component is WSC:
http://support.microsoft.com/kb/331697
Event ID 4100 appears repeatedly in Event Viewer
http://support.microsoft.com/kb/289650

http://www.eventid.net/display.asp?eventid=4356&eventno=1035&source=EventSystem&phase=1


Event Type: Warning
Event Source: EventSystem
Event Category: (54)
Event ID: 4353
Date: 30/12/2007
Time: 13:56:28
User: N/A
Computer: HOME-AE313F85D0
Description:
The COM+ Event System attempted to fire the
EventObjectChange::ChangedSubscription event but received a bad return code.
HRESULT was 80040201.

Make sure this service: TCP/IP NetBIOS Helper service is started
Automatically.

HTH.
nass