Help! BSOD due to ntkrnlpa.exe

[blueumbrella]

BSOD happened on my laptop several times since recently. Windows was usually in a "locked" mode, then it just automatically restarted. I've opened the minidump files (see attachment) using WinDBG. They all point to ntkrnlpa.exe, but that can't be deleted or uninstalled. Please help me on what to do next. Thanks

 

[usasma]

ntkrnlpa.exe is the kernel (core) of the operating system. You can't do anything with it for several reasons - and that's a good thing. It is not to blame - despite the indications from the debugger. If it was to blame you'd be having many more problems other than the occasional BSOD.

So, we have to look elsewhere for the reason....

First, The Windows Debugging Tools aren't able to access symbols for your operating system files (in particular NTOSKRNL.EXE / NTKRNLMP.EXE / NTKRNLPA.EXE / NTKRPAMP.EXE) from the Microsoft Symbol Server - so that makes debugging them difficult if not impossible.

Please do the following:
- activate/validate the Windows installation at Genuine Microsoft Software
- run sfc.exe /scannow to replace any problem files
- open a support incident with Microsoft to see if they can fix the missing symbols issue ( Windows 7 Solution Center )
- If that doesn't fix it, then wipe the hard drive and reinstall Windows
- don't use "leaked"/torrent builds

Since we don't have the assistance of the memory dump symbols, we'll have to try other things to repair this:

please remove or update these older drivers that were loaded at the time of the crash. Don't use Windows Update or the Update drivers function of Device Manager.
Please use the following instructions to locate the most currently available drivers to replace the one's that you uninstall OR remove:

How To Find Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: http://www.carrona.org/drvrdown.html

Here's the older drivers. Please pay particular attention to any dated 2007 or earlier:

• Alidevice.SYS Sun Jul 13 04:10:10 2008 - alipay kernel module - alidevice - alipay.com - http://www.carrona.org/dvrref.html#Alidevice.SYS
• HSX_CNXT.sys Fri Dec 22 14:48:52 2006 - SoftK56 Modem Driver by Conexant Systems - http://www.carrona.org/dvrref.html#HSX_CNXT.sys
• HSX_DPV.sys Fri Dec 22 14:50:21 2006 - SoftK56 Modem Driver by Conexant Systems - http://www.carrona.org/dvrref.html#HSX_DPV.sys
• HSXHWAZL.sys Fri Dec 22 14:49:02 2006 - SoftK56 Modem Driver by Conexant Systems - http://www.carrona.org/dvrref.html#HSXHWAZL.sys
• mdmxsdk.sys Mon Jun 19 17:26:59 2006 - Diagnostic Interface x86 Driver by Conexant - http://www.carrona.org/dvrref.html#mdmxsdk.sys
• psadd.sys Mon Feb 19 13:56:45 2007 - Lenovo Parties Service Access Device Driver - http://www.carrona.org/dvrref.html#psadd.sys
• PxHelp20.sys Wed Jun 20 18:26:00 2007 - Sonic CD/DVD driver (used by many different CD/DVD programs) - http://www.carrona.org/dvrref.html#PxHelp20.sys
• rimmptsk.sys Wed Nov 16 21:28:31 2005 - Ricoh Memory Card Reader driver - http://www.carrona.org/dvrref.html#rimmptsk.sys
• RimSerial.sys Mon Nov 24 12:02:13 2008 - RIM Virtual Driver (probably associated with a Blackberry) - http://www.carrona.org/dvrref.html#RimSerial.sys
• rimsptsk.sys Thu Dec 22 03:02:21 2005 - Ricoh Memory Card Reader driver - http://www.carrona.org/dvrref.html#rimsptsk.sys
• rixdptsk.sys Tue Nov 14 20:35:19 2006 - Ricoh Memory Card Reader driver - http://www.carrona.org/dvrref.html#rixdptsk.sys
• smiif32.sys Mon May 12 05:01:06 2008 - SMI Driver for Lenovo system - http://www.carrona.org/dvrref.html#smiif32.sys
• sncduvc.SYS Mon Dec 29 04:13:29 2008 - HP/Suyin Webcam driver - http://www.carrona.org/dvrref.html#sncduvc.SYS
• tdrpman.sys Mon Nov 12 08:35:28 2007 - Acronis Try&Decide and Restore Points Volume Filter Driver - http://www.carrona.org/dvrref.html#tdrpman.sys
• tifsfilt.sys Wed Aug 29 08:37:17 2007 - Acronis True Image FS Filter by Acronis - http://www.carrona.org/dvrref.html#tifsfilt.sys
• timntr.sys Wed Aug 29 08:13:12 2007 - Acronis True Image Backup Archive Explorer - http://www.carrona.org/dvrref.html#timntr.sys
• Tppwr32v.sys Thu Jun 12 22:27:57 2008 - ThinkPad Pwr Mgmt Port Driver - http://www.carrona.org/dvrref.html#Tppwr32v.sys

If this doesn't stop the BSOD's, then please use Driver Verifier according to these directions:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Summary of the BSOD's:

*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Sun Mar 14 12:16:33.008 2010 (GMT-4)
System Uptime: 2 days 3:26:04.053
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Thu Mar 11 04:27:55.752 2010 (GMT-4)
System Uptime: 0 days 1:42:45.796
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Mon Mar  8 13:39:18.368 2010 (GMT-4)
System Uptime: 0 days 1:33:09.660
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Mon Mar  1 13:45:28.869 2010 (GMT-4)
System Uptime: 0 days 0:32:26.914
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50

 

[blueumbrella]

usasma, thank you so much for your prompt reply. Following your instructions, I've validated my windows and gone through the scan but haven't yet figured out how to open a support incident in Microsoft's forum. Also, I tried to find some newer drivers, especially for the oldest "SoftK56 Modem" and the "Ricoh Memory Card Reader". However, the links provided at carrona.org couldn't lead to useful resources. I'll keep searching and report what I can find later.

 

[usasma]

The links for the SOFTK56 modem are from the manufacturer of your system (HP, Toshiba, etc) as are the links for the Ricoh Media Card Reader.

The "older" drivers are just a shot in the dark. This is because older drivers are more likely to have compatibility issues - so we suggest updating them on the chance that they will fix the problems. If the system manufacturer doesn't have a later version - then there's not much point in replacing them.

The Microsoft support incident isn't required - but the link to contact them is in the upper right corner of that page. The reason for this is that the debugger won't give us any decent information because of the problem with the symbols (and I know that my links to the symbol server are good due to other memory dumps that I've analyzed).

The issue with Microsoft is that the symbols are needed to analyze problems. If the Microsoft Symbol Server doesn't have the proper symbols for all legitimate/legal versions of the operating system files - then the symbol server isn't of much use to us.

All in all, those are pretty common drivers and they don't normally cause issues - so I wouldn't worry about them.

The one's that I'm concerned about are:
- psadd.sys
- smiif32.sys
- the 2 Acronis drivers
- Tppwr32v.sys

 

[blueumbrella]

Thanks for the short list. It reminds me that I did update the ThinkPad Power Management drive weeks ago, which might have changed the Tppwr32v.sys. Now I have rolled it back to the previous version. Let's see if that's the solution.

The Acronis drivers are for a backup software which I installed right after Windows 7, and it hasn't been changed ever since. I'll uninstall this next if necessary.

 

[usasma]

Acronis operates on a very low level inside the OS - so I'd suggest uninstalling it just to be sure.

 

[blueumbrella]

It happed again, just last night in the middle of nowhere. Attached is the minidump file. I'm now uninstalling the Acronis software

 

[usasma]

Let's wait and see if that fixes things....

 

[blueumbrella]

Happened again. I think I'm giving up

 

[usasma]

"Patience is a virtue" - this may take a while to fix. If it's too frustrating for you, then I'd suggest backing up your stuff, wiping the hard drive clean, and then installing a fresh copy of Windows.

Then check the device drivers in Device Manager - and update Windows. Then see if that fixes things. This will tell you if it's a software problem (it'll be fixed) or a hardware problem (it'll still have problems).

If you want to continue working on it (we'll figure it out eventually), please post the most recent memory dump files so we can have a look at them here.

 

[blueumbrella]

Ok, let see what the hell is wrong here... Yesterday alone there were 2 dumps, again coming out of nowhere.

I always install updates as soon as they're available (my ThinkPad updates are installed using its official "System Update" software). Now I start thinking if the latest versions are good or bad to the system. If they cause BSOD, in the future should I not update them as long as the system runs ok?

 

[blueumbrella]

one more, just 1 minute ago...

 

[usasma]

Have you started using Driver Verifier as I requested in my original post? The last 3 BSOD's don't mention that Driver Verifier is running

Additionally, since the symbols aren't working correctly, the BSOD doesn't give us any further information.

Please compare this list of older drivers with the original list. These drivers need to be either removed or updated. Anything dated 2007 and earlier probably doesn't know about Win7 - so it's compatibility is in question.

Alidevice.SYS Sun Jul 13 04:10:10 2008
HSX_CNXT.sys Fri Dec 22 14:48:52 2006
HSX_DPV.sys  Fri Dec 22 14:50:21 2006
HSXHWAZL.sys Fri Dec 22 14:49:02 2006
mdmxsdk.sys  Mon Jun 19 17:26:59 2006
psadd.sys    Mon Feb 19 13:56:45 2007
PxHelp20.sys Wed Jun 20 18:26:00 2007
rimmptsk.sys Wed Nov 16 21:28:31 2005
rimsptsk.sys Thu Dec 22 03:02:21 2005
rixdptsk.sys Tue Nov 14 20:35:19 2006
smiif32.sys  Mon May 12 05:01:06 2008
sncduvc.SYS  Mon Dec 29 04:13:29 2008
tifsfilt.sys Wed Aug 29 08:37:17 2007
timntr.sys   Wed Aug 29 08:13:12 2007
Tppwr32v.sys Thu Jun 12 22:27:57 2008
Uim_IM.sys   Sat Dec 13 06:02:30 2008
UimBus.sys   Sat Dec 13 06:02:24 2008
UimFIO.SYS   Sat Dec 13 06:02:25 2008
WinVd32.sys  Wed Dec 31 11:26:00 2008
xaudio.sys   Tue Nov 28 19:44:50 2006

Summary of BSOD:

*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Tue Mar 23 14:41:27.371 2010 (GMT-4)
System Uptime: 0 days 3:23:23.415
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Mon Mar 22 19:11:53.033 2010 (GMT-4)
System Uptime: 0 days 6:43:06.077
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Debug session time: Mon Mar 22 12:27:55.561 2010 (GMT-4)
System Uptime: 0 days 0:15:43.605
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
BUGCHECK_STR:  0x50

 

[blueumbrella]

I just tried the Driver Verifier once. Windows failed to restart immediately after. BSOD (different from previous memory dump) appeared with one line pointing to "UIM_IM.sys Address 86BC2A97 base at 86BC1000 DateStamp 49439646". I manually shut it down. Then it started into the Startup Repair program and suggested me go back to the last restore point. I yes it and it restarted successfully, I find no extra minidump file in the windows\Minidump directory.

I then googled "UIM_IM.sys" and found it's a driver from Paragon. I did install a Paragon Backup software long ago and already uninstalled it. Can I now just delete that file in windows\system32\drivers, or how can I remove it?

 

[usasma]

Uninstall the Paragon program.
Then go and check to make sure that the UIM_IM.sys driver is gone from C:\Windows\System32\drivers

 

[blueumbrella]

It has been uninstalled long ago. UIM_IM.sys is still there.

 

[usasma]

I'm a firm believer in using uninstall utilities rather than ripping things out by the roots.
But, at times, there is justification for manually removing things.

I'd suggest renaming it to something like UIM_IM.BAK
Also rename these other 2 Paragon drivers:
UimBus.sys Sat Dec 13 06:02:24 2008
UimFIO.SYS Sat Dec 13 06:02:25 2008

Then, use this free utility to locate the entry that's still loading any of the Paragon stuff: Autoruns for Windows

 

[blueumbrella]

UIM_IM.sys and the other two have been renamed. I've run the verifier several times more, here is what I got:

SPBBCDrv.sys caused a failure to start. It's associated with Symantec, which says it would be false alarm (see here). So I just excluded it from the verifier's checklist.

Restarted again and another driver WinFl32.sys caused a failure. It's generated by a software called "Folder Lock", which I uninstalled last month. So I just renamed it.

Now the system starts successfully. Let's see...

BTW, Autoruns is such a neat handy tool for debugging. Thanks!

 

[usasma]

STOP using Driver Verifier for now.
If you get another BSOD - then use Driver Verifier.
Include ALL 3rd party drivers (including Symantec/Norton) when using Driver Verifier.

Symantec/Norton can cause false positives - BUT - they can also be your problem.
The test to rule out Norton (after using Driver Verifier) is as follows:

Anti-Virus Removal:
Please do the following:
- download a free antivirus for testing purposes: Free AntiVirus
- uninstall the Norton from your system (you can reinstall it, if so desired, when we're done troubleshooting)
- remove any remnants of Norton using this free tool: Download and run the Norton Removal Tool
- IMMEDIATELY install and update the free antivirus
- check to see if this fixes the BSOD's

 

[blueumbrella]

Thanks for the instructions. I've stopped the verifier.

Actually since I completely removed the ThinkPad Power Manager and its driver, I haven't experienced another BSOD. Let's see if that's the real cause...