Answered by:
Help with multiple BSOD from ntoskrnl.exe and ntkrnlmp.exe?

Question
-
I've received multiple BSOD originating from the same driver 'ntoskrnl.exe'. First I received a IQRL_IS_NOT_OR_LESS_EQUAL, and now I have received a PROCESS_HAS_LOCKED_PAGES.
Here is the whocrashed data on both types of crashes:
System Information (local)
--------------------------------------------------------------------------------
computer name: TAYLORPC
windows version: Windows 7 , 6.1, build: 7600
windows dir: C:\windows
CPU: GenuineIntel Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 4084047872 total
VM: 2147352576, free: 1986031616
--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------
Crash dump directory: C:\windows\Minidump
Crash dumps are enabled on your computer.
On Sun 10/20/2013 8:40:56 PM GMT your computer crashed
crash dump file: C:\windows\Minidump\102013-43259-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x6F880)
Bugcheck code: 0x76 (0x0, 0xFFFFFA8003F033D0, 0x2, 0x0)
Error: PROCESS_HAS_LOCKED_PAGES
file path: C:\windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a driver failed to release locked pages after an I/O operation, or that it attempted to unlock pages that were already unlocked.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
On Sun 10/20/2013 8:40:56 PM GMT your computer crashed
crash dump file: C:\windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x76 (0x0, 0xFFFFFA8003F033D0, 0x2, 0x0)
Error: PROCESS_HAS_LOCKED_PAGES
Bug check description: This bug check indicates that a driver failed to release locked pages after an I/O operation, or that it attempted to unlock pages that were already unlocked.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
On Mon 8/12/2013 2:51:45 AM GMT your computer crashed
crash dump file: C:\windows\Minidump\081113-35895-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x6F880)
Bugcheck code: 0xA (0x40, 0x2, 0x1, 0xFFFFF80003076D19)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
On Fri 8/9/2013 6:36:01 AM GMT your computer crashed
crash dump file: C:\windows\Minidump\080813-49249-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x6F880)
Bugcheck code: 0xA (0x40, 0x2, 0x1, 0xFFFFF8000307DD19)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
Please let me know any other data I can provide that will help, I really need to fix this.
Sunday, October 20, 2013 9:22 PM
Answers
-
A bugcheck (BSOD) is a mechanism to protect your PC from damage.
To see the cause I have to take a look at the dumps with the Debugging Tools for Windows.
Please start the Windows Explorer and go to the folder C:\Windows\Minidump. Next, copy the dmp files to your desktop, zip all dmp into 1 zip file and upload the zip file to your public Skydrive [1] folder and post a link here.
If you can't see dmp files, make sure your Windows is configured correctly [2][3] to generate dumps.
If you want to analyze them your own, check those videos [4][5] and read this KB article [6].
André
[1] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
[2] http://support.microsoft.com/kb/254649
[3] http://blog.nirsoft.net/2010/07/27/how-to-configure-windows-to-create-minidump-files-on-bsod/
[4] http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-15-WinDbg-Bugchecks
[5] http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-16-WinDbg-Driver-Verifier, http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-17-WinDbg-Driver-Verifier-Part-2, http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-18-WinDbg-Driver-Verifier-Part-3
[6] http://support.microsoft.com/kb/315263
"A programmer is just a tool which converts caffeine into code"
- Edited by Andre.Ziegler Monday, October 21, 2013 5:33 AM
- Marked as answer by Cloud_TS Wednesday, November 6, 2013 3:38 PM
Monday, October 21, 2013 5:33 AM