BSOD ntkrpamp.exe

[jpattard]

I can't figure out what's wrong :/ but one strange thing is this:

Owning Process 83f36540 Image: <Unknown>
Attached Process 86b0e5c8 Image: System

Here is my Debugger output.


Loading Dump File [C:\Windows\Minidump\051810-20529-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83e03000 PsLoadedModuleList = 0x83f4b810
Debug session time: Tue May 18 20:18:49.766 2010 (UTC + 2:00)
System Uptime: 0 days 0:16:51.530
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
........
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: a857ad48, Original thread which is the cause of the failure
Arg2: 807c8800, New thread
Arg3: aa354fd0, Stack address of the original thread
Arg4: 00000000

Debugging Details:
------------------


FAULTING_THREAD: a857ad48

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xB8

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 83e6acfd to 83edfd10

STACK_TEXT:
807dfd08 83e6acfd 000000b8 a857ad48 807c8800 nt!KeBugCheckEx+0x1e
807dfd20 83e6b0ce 00000000 0000000e 00000000 nt!SwapContext_XRstorEnd+0x105
807dfd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xce


STACK_COMMAND: .thread 0xffffffffa857ad48 ; kb

FOLLOWUP_IP:
nt!SwapContext_XRstorEnd+105
83e6acfd c3 ret

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!SwapContext_XRstorEnd+105

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cacf

FAILURE_BUCKET_ID: 0xB8_nt!SwapContext_XRstorEnd+105

BUCKET_ID: 0xB8_nt!SwapContext_XRstorEnd+105

Followup: MachineOwner
---------

1: kd> !thread
GetPointerFromAddress: unable to read from 83f6b71c
THREAD 807c8800 Cid 0000.0000 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from 83f2b49c
Owning Process 83f36540 Image: <Unknown>
Attached Process 86b0e5c8 Image: System
ffdf0000: Unable to get shared data
Wait Start TickCount 64819
Context Switch Count 865988
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!KiIdleLoop (0x83e6b000)
Stack Init 807dffd0 Current 807dfd1c Base 807e0000 Limit 807dd000 Call 0
Priority 0 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
ChildEBP RetAddr Args to Child
807dfd08 83e6acfd 000000b8 a857ad48 807c8800 nt!KeBugCheckEx+0x1e
807dfd20 83e6b0ce 00000000 0000000e 00000000 nt!SwapContext_XRstorEnd+0x105 (FPO: [0,2,0])
807dfd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0xce (FPO: [0,0,0])

1: kd> .tlist
0n0 System Process
0n4 System
0n452 smss.exe
0n696 csrss.exe
0n756 wininit.exe
0n768 csrss.exe
0n776 avgchsvx.exe
0n792 avgrsx.exe
0n840 services.exe
0n876 avgcsrvx.exe
0n924 lsass.exe
0n932 lsm.exe
0n1224 winlogon.exe
0n1292 svchost.exe
0n1376 nvvsvc.exe
0n1412 svchost.exe
0n1524 svchost.exe
0n1556 svchost.exe
0n1584 svchost.exe
0n1728 svchost.exe
0n1852 rundll32.exe
0n1996 WUDFHost.exe
0n492 svchost.exe
0n692 spoolsv.exe
0n1664 svchost.exe
0n2112 SaibSVC.exe
0n2196 schedul2.exe
0n2264 AEstSrv.exe
0n2288 afcdpsrv.exe
0n2308 avgwdsvc.exe
0n2380 BlueSoleilCS.exe
0n2416 BsMobileCS.exe
0n2452 CinemaNowSvc.exe
0n2512 mysqld.exe
0n2556 hnm_svc.exe
0n2764 avgnsx.exe
0n3104 dwm.exe
0n3128 explorer.exe
0n3140 taskhost.exe
0n3376 OEM02Mon.exe
0n3384 Apoint.exe
0n3392 DellWMgr.exe
0n3408 rundll32.exe
0n3416 rundll32.exe
0n3548 sttray.exe
0n3568 ApMsgFwd.exe
0n3584 sprtcmd.exe
0n3592 avgtray.exe
0n3628 hidfind.exe
0n3640 ApntEx.exe
0n3676 conhost.exe
0n3756 CPMonitor.exe
0n3764 RoxioBurnLauncher.exe
0n3772 SSDMonitor.exe
0n3784 BtTray.exe
0n2408 GrooveMonitor.exe
0n2496 VxBlockServer.exe
0n1916 NokiaMServer.exe
0n2792 MMonitor.exe
0n1948 sidebar.exe
0n2956 DTLite.exe
0n3048 GoogleCrashHandler.exe
0n3252 svchost.exe
0n3264 sqlservr.exe
0n3432 xmarkssync.exe
0n3472 NokiaOviSuite.exe
0n3400 PCSuite.exe
0n3520 BTTray.exe
0n2960 quickset.exe
0n3984 StartManSvc.exe
0n4300 nokiaaserver.exe
0n4332 RegMech.exe
0n4672 DTShellHlp.exe
0n4808 windbg.exe
0n5148 sqlbrowser.exe
0n5176 sqlwriter.exe
0n5224 stacsv.exe
0n5272 svchost.exe
0n5300 winvnc.exe
0n5364 vmnat.exe
0n5488 httpd.exe
0n5516 dsl_fs_sync.exe
0n5564 vmware-authd.exe
0n5580 httpd.exe
0n5608 vmnetdhcp.exe
0n6444 WmiPrvSE.exe
0n6456 WmiPrvSE.exe
0n6596 ServiceLayer.exe
0n6676 BsHelpCS.exe
0n6736 SearchIndexer.exe
0n6828 svchost.exe
0n7028 winvnc.exe
0n7444 svchost.exe
0n5456 svchost.exe
0n9636 wmpnetwk.exe
0n9068 sprtsvc.exe
0n8032 WINWORD.EXE
0n9364 audiodg.exe
0n10228 svchost.exe
0n8728 NclUSBSrv.exe
0n7160 NclRSSrv.exe
0n3576 NclIVTBTSrv.exe
0n1648 msiexec.exe
0n1316 WUDFHost.exe
0n5264 chrome.exe
0n4960 chrome.exe
0n9188 chrome.exe
0n9180 chrome.exe
0n4664 chrome.exe
1: kd> lmvm nt
start end module name
83e03000 84213000 nt (pdb symbols) downstreamstore\ntkrpamp.pdb\A0D85B412D774C83B08EF4AE749A8B582\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: downstreamstore\ntkrnlpa.exe\4B88CACF410000\ntkrnlpa.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Sat Feb 27 08:33:35 2010 (4B88CACF)
CheckSum: 003C7867
ImageSize: 00410000
File version: 6.1.7600.16539
Product version: 6.1.7600.16539
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.1.7600.16539
FileVersion: 6.1.7600.16539 (win7_gdr.100226-1909)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

[Engg.]

The difference in the two readings of the temperature gets my attention. (They were carried out at the same time?) more often than not (always in my experience) means that the accurate chipset drivers are not installed, unless a computer brand (Dell, HP, Gateway, etc) cannot make use of "normal" drivers or full / complete BIOS. Temperatures within the 40's I would not expect to be dangerous. Enter the BIOS / boot configuration, temperature readings should be there (compared to fan speed and PC Wizard as soon as you reach the desktop) that will give you a guide which is (most?) Correct. Drivers would still be what you focus on.