BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )


  1. Focist
    Posts : 2
    Windows 7 Pro SP1
       New #1

    BSOD ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available
    Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols;srv*
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
    Machine Name:
    Kernel base = 0xfffff800`02c4f000 PsLoadedModuleList = 0xfffff800`02e93650
    Debug session time: Tue Apr 24 23:25:23.989 2012 (UTC - 4:00)
    System Uptime: 0 days 0:09:45.674
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........................................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
    Loading unloaded module list
    ...............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 50, {ffffffffffffffc6, 1, fffff80002fb9045, 0}
    Probably caused by : ntkrnlmp.exe ( nt!NtSetInformationProcess+288 )
    Followup: MachineOwner
    ---------
    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: ffffffffffffffc6, memory referenced.
    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
    Arg3: fffff80002fb9045, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------

    WRITE_ADDRESS: ffffffffffffffc6
    FAULTING_IP:
    nt!NtSetInformationProcess+288
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    MM_INTERNAL_CODE: 0
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    BUGCHECK_STR: 0x50
    PROCESS_NAME: SearchFilterHo
    CURRENT_IRQL: 0
    TRAP_FRAME: fffff8800970c740 -- (.trap 0xfffff8800970c740)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800ac97b30
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002fb9045 rsp=fffff8800970c8d0 rbp=fffff8800970cca0
    r8=fffffa80069a5bc0 r9=0000000000000001 r10=ffffffffffffffff
    r11=00000000002ec4bc r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!NtSetInformationProcess+0x288:
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    Resetting default scope
    LAST_CONTROL_TRANSFER: from fffff80002c7825c to fffff80002ccbc80
    STACK_TEXT:
    fffff880`0970c5d8 fffff800`02c7825c : 00000000`00000050 ffffffff`ffffffc6 00000000`00000001 fffff880`0970c740 : nt!KeBugCheckEx
    fffff880`0970c5e0 fffff800`02cc9dae : 00000000`00000001 ffffffff`ffffffc6 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x456cf
    fffff880`0970c740 fffff800`02fb9045 : fa8008f2`c0c80400 fffff880`00000200 fffffa80`069a5bc0 0000000f`ffffff01 : nt!KiPageFault+0x16e
    fffff880`0970c8d0 fffff800`02ccaf13 : 00000000`00000008 00000000`77622fd0 00000000`00000001 00000000`00000000 : nt!NtSetInformationProcess+0x288
    fffff880`0970cc20 00000000`77bd14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`001cebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bd14da

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!NtSetInformationProcess+288
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    SYMBOL_STACK_INDEX: 3
    SYMBOL_NAME: nt!NtSetInformationProcess+288
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55
    FAILURE_BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
    BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
    Followup: MachineOwner
    ---------
    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: ffffffffffffffc6, memory referenced.
    Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
    Arg3: fffff80002fb9045, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------

    WRITE_ADDRESS: ffffffffffffffc6
    FAULTING_IP:
    nt!NtSetInformationProcess+288
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    MM_INTERNAL_CODE: 0
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    BUGCHECK_STR: 0x50
    PROCESS_NAME: SearchFilterHo
    CURRENT_IRQL: 0
    TRAP_FRAME: fffff8800970c740 -- (.trap 0xfffff8800970c740)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800ac97b30
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002fb9045 rsp=fffff8800970c8d0 rbp=fffff8800970cca0
    r8=fffffa80069a5bc0 r9=0000000000000001 r10=ffffffffffffffff
    r11=00000000002ec4bc r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!NtSetInformationProcess+0x288:
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    Resetting default scope
    LAST_CONTROL_TRANSFER: from fffff80002c7825c to fffff80002ccbc80
    STACK_TEXT:
    fffff880`0970c5d8 fffff800`02c7825c : 00000000`00000050 ffffffff`ffffffc6 00000000`00000001 fffff880`0970c740 : nt!KeBugCheckEx
    fffff880`0970c5e0 fffff800`02cc9dae : 00000000`00000001 ffffffff`ffffffc6 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x456cf
    fffff880`0970c740 fffff800`02fb9045 : fa8008f2`c0c80400 fffff880`00000200 fffffa80`069a5bc0 0000000f`ffffff01 : nt!KiPageFault+0x16e
    fffff880`0970c8d0 fffff800`02ccaf13 : 00000000`00000008 00000000`77622fd0 00000000`00000001 00000000`00000000 : nt!NtSetInformationProcess+0x288
    fffff880`0970cc20 00000000`77bd14da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`001cebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bd14da

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!NtSetInformationProcess+288
    fffff800`02fb9045 410f45c5 cmovne eax,r13d
    SYMBOL_STACK_INDEX: 3
    SYMBOL_NAME: nt!NtSetInformationProcess+288
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55
    FAILURE_BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
    BUCKET_ID: X64_0x50_nt!NtSetInformationProcess+288
    Followup: MachineOwner
    ---------
    0: kd> lmvm nt
    start end module name
    fffff800`02c4f000 fffff800`03237000 nt (pdb symbols) c:\symcache\ntkrnlmp.pdb\76FCE21B949E486090FD485BE42AF54A2\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp: Mon Mar 05 22:58:13 2012 (4F558B55)
    CheckSum: 005553E5
    ImageSize: 005E8000
    File version: 6.1.7601.17790
    Product version: 6.1.7601.17790
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0409.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft® Windows® Operating System
    InternalName: ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion: 6.1.7601.17790
    FileVersion: 6.1.7601.17790 (win7sp1_gdr.120305-1505)
    FileDescription: NT Kernel & System
    LegalCopyright: © Microsoft Corporation. All rights reserved.

    I have Windows 7 Pro Sp1
    I just Installed it upgrading from windows Xp pro Sp3
    Processor Core 2 Quad Q8200 @2.33 GHz 2.34 GHz
    8.00 GB of ddr3 1333 just upgraded from 4.00 GB ddr2
    Motherboard Asus P5QC Chipset Intel P45
    My Computer crashes everytime I turn it on pretty much at start up after I have had it off for 30 to 45 minutes. After it crashes twince in a row it usually runs like a champ after that. I have only had windows 7 for a week and it pretty much just started happening a few days ok if you guys may assist me with this problem I will forever be so grateful thxs!
    Last edited by Focist; 25 Apr 2012 at 10:48. Reason: Forgot information
      My Computer
    Quote Quote

  3. zigzag3143
    Posts : 28,845
    Win 8 Release candidate 8400
       New #2



    We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

    If you are overclocking STOP


    We could also use some system information, which you can get easily by running msinfo32.
    To do that go to start>run>type msinfo32>enter

    When it is finished running go to file>save>name it and upload to us here.


    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

    The procedure:
    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
    *If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

    To ensure minidumps are enabled:
    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.
      My Computer
    Quote Quote

  4. Focist
    Posts : 2
    Windows 7 Pro SP1
    Thread Starter
       New #3

    I might of fixed my problem by doing a windows repair its to early to tell right now I will let it runs its course for a few days if it crashes again I will upload the other information that is needed I already gave you my dmp file on my original post sir!
      My Computer
    Quote Quote

  6. zigzag3143
    Posts : 28,845
    Win 8 Release candidate 8400
       New #4

    Focist said:
    I might of fixed my problem by doing a windows repair its to early to tell right now I will let it runs its course for a few days if it crashes again I will upload the other information that is needed I already gave you my dmp file on my original post sir!
    Good job and good luck
      My Computer
    Quote Quote

 

  Related Discussions
BSOD on ntkrnlmp.exe
in BSOD Help and Support

Hello, I have a laptop where I get this BSOD on the ntkrnlmp.exe. I cannot find what is wrong. Can someone help me troubleshoot this please? Thanks in advance!
BSOD (7f) ntkrnlmp.exe
in BSOD Help and Support

Hi, I've had 3 BSODS in the past 2 weeks, 2 of which were in the last 3 days whilst playing a video game. I ran Memtest after the second BSOD which returned no errors - I have an inkling it's my processor. Any assistance is greatly appreciated. I've attatched DM Log.
BSOD cause by ntkrnlmp.exe
in BSOD Help and Support

I keep getting periodic BSODs. All the hardware is brand new, except the hard drives. I've updated all drivers, and I've run Memtest86, which found no errors. I've also done complete disk checks on all hard drives. If someone could help me out here, I would really appreciate it. Thanks in advance!...
bsod ntkrnlmp.exe
in BSOD Help and Support

bsod when exit games windows 7 home premium x64 OEM DualCore Intel Core i3 330M, 2133 MHz (16 x 133) TOSHIBA Satellite L650 4GB ATI Mobility Radeon HD 5650 (1024 MB) Age of system and OS 7 days(new laptop) BugCheck 3B, {c0000005, fffff80002c8477e, fffff88008768e40, 0} Probably caused by...
BSOD - ntkrnlmp.exe
in BSOD Help and Support

Thank you all in advance... So a little background. I built this computer a month or two ago. Everything was fine, games like Supreme Commander were running great, but I wanted to change up my partitions and hard drives (go figure). I moved both of my drives off the 6Mb/s SATA connections...
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 03:15.
Find Us