Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )

25 Apr 2012   #1
Focist

Windows 7 Pro SP1
 
 
BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols;srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`02c4f000 PsLoadedModuleList = 0xfffff800`02e93650
Debug session time: Tue Apr 24 23:25:23.989 2012 (UTC - 4:00)
System Uptime: 0 days 0:09:45.674
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffffffc6, 1, fffff80002fb9045, 0}
Probably caused by : ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffc6, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002fb9045, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

WRITE_ADDRESS: ffffffffffffffc6
FAULTING_IP:
nt!NtSetInformationProcess+288
fffff800`02fb9045 410f45c5 cmovne eax,r13d
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: SearchFilterHo
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800970c740 -- (.trap 0xfffff8800970c740)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800ac97b30
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fb9045 rsp=fffff8800970c8d0 rbp=fffff8800970cca0
r8=fffffa80069a5bc0 r9=0000000000000001 r10=ffffffffffffffff
r11=00000000002ec4bc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!NtSetInformationProcess+0x288:
fffff800`02fb9045 410f45c5 cmovne eax,r13d
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c7825c to fffff80002ccbc80
STACK_TEXT:
fffff880`0970c5d8 fffff800`02c7825c : 00000000`00000050 ffffffff`ffffffc6 00000000`00000001 fffff880`0970c740 : nt!KeBugCheckEx
fffff880`0970c5e0 fffff800`02cc9dae : 00000000`00000001 ffffffff`ffffffc6 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x456cf
fffff880`0970c740 fffff800`02fb9045 : fa8008f2`c0c80400 fffff880`00000200 fffffa80`069a5bc0 0000000f`ffffff01 : nt!KiPageFault+0x16e
fffff880`0970c8d0 fffff800`02ccaf13 : 00000000`00000008 00000000`77622fd0 00000000`00000001 00000000`00000000 : nt!NtSetInformationProcess+0x288
fffff880`0970cc20 00000000`77bd14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001cebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bd14da

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtSetInformationProcess+288
fffff800`02fb9045 410f45c5 cmovne eax,r13d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!NtSetInformationProcess+288
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55
FAILURE_BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffc6, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002fb9045, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

WRITE_ADDRESS: ffffffffffffffc6
FAULTING_IP:
nt!NtSetInformationProcess+288
fffff800`02fb9045 410f45c5 cmovne eax,r13d
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: SearchFilterHo
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800970c740 -- (.trap 0xfffff8800970c740)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800ac97b30
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fb9045 rsp=fffff8800970c8d0 rbp=fffff8800970cca0
r8=fffffa80069a5bc0 r9=0000000000000001 r10=ffffffffffffffff
r11=00000000002ec4bc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!NtSetInformationProcess+0x288:
fffff800`02fb9045 410f45c5 cmovne eax,r13d
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c7825c to fffff80002ccbc80
STACK_TEXT:
fffff880`0970c5d8 fffff800`02c7825c : 00000000`00000050 ffffffff`ffffffc6 00000000`00000001 fffff880`0970c740 : nt!KeBugCheckEx
fffff880`0970c5e0 fffff800`02cc9dae : 00000000`00000001 ffffffff`ffffffc6 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x456cf
fffff880`0970c740 fffff800`02fb9045 : fa8008f2`c0c80400 fffff880`00000200 fffffa80`069a5bc0 0000000f`ffffff01 : nt!KiPageFault+0x16e
fffff880`0970c8d0 fffff800`02ccaf13 : 00000000`00000008 00000000`77622fd0 00000000`00000001 00000000`00000000 : nt!NtSetInformationProcess+0x288
fffff880`0970cc20 00000000`77bd14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001cebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bd14da

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtSetInformationProcess+288
fffff800`02fb9045 410f45c5 cmovne eax,r13d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!NtSetInformationProcess+288
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55
FAILURE_BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
fffff800`02c4f000 fffff800`03237000 nt (pdb symbols) c:\symcache\ntkrnlmp.pdb\76FCE21B949E486090FD485BE42AF54A2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Mon Mar 05 22:58:13 2012 (4F558B55)
CheckSum: 005553E5
ImageSize: 005E8000
File version: 6.1.7601.17790
Product version: 6.1.7601.17790
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17790
FileVersion: 6.1.7601.17790 (win7sp1_gdr.120305-1505)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

I have Windows 7 Pro Sp1
I just Installed it upgrading from windows Xp pro Sp3
Processor Core 2 Quad Q8200 @2.33 GHz 2.34 GHz
8.00 GB of ddr3 1333 just upgraded from 4.00 GB ddr2
Motherboard Asus P5QC Chipset Intel P45
My Computer crashes everytime I turn it on pretty much at start up after I have had it off for 30 to 45 minutes. After it crashes twince in a row it usually runs like a champ after that. I have only had windows 7 for a week and it pretty much just started happening a few days ok if you guys may assist me with this problem I will forever be so grateful thxs!


My System SpecsSystem Spec
25 Apr 2012   #2
zigzag3143

Win 8 Release candidate 8400
 
 



We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP


We could also use some system information, which you can get easily by running msinfo32.
To do that go to start>run>type msinfo32>enter

When it is finished running go to file>save>name it and upload to us here.


You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:
Quote:
* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:
Quote:
* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.
My System SpecsSystem Spec
25 Apr 2012   #3
Focist

Windows 7 Pro SP1
 
 

I might of fixed my problem by doing a windows repair its to early to tell right now I will let it runs its course for a few days if it crashes again I will upload the other information that is needed I already gave you my dmp file on my original post sir!
My System SpecsSystem Spec
25 Apr 2012   #4
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by Focist View Post
I might of fixed my problem by doing a windows repair its to early to tell right now I will let it runs its course for a few days if it crashes again I will upload the other information that is needed I already gave you my dmp file on my original post sir!
Good job and good luck
My System SpecsSystem Spec
Reply

 BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )




Thread Tools



Similar help and support threads for2: BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )
Thread Forum
Solved BSOD ntoskrnl.exe and ntkrnlmp.exe BSOD Help and Support
Solved BSOD cause by ntkrnlmp.exe BSOD Help and Support
Solved BSOD caused by ntkrnlmp.exe BSOD Help and Support
bsod ntkrnlmp.exe BSOD Help and Support
BSOD - ntkrnlmp.exe BSOD Help and Support
Persistent ntkrnlmp.exe BSOD Win 7 BSOD Help and Support
BSOD ntkrnlmp.exe ??? HELP! BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 07:22 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App