Sign in with
Sign up | Sign in
Your question

BSOD, ntkrnlmp.exe

Last response: in Windows 7
Share
February 9, 2013 8:56:01 PM

Specs:
CPU: AMD Phenom II 955 Black, stock
Mobo: Gigabyte 970A-D3
GPU: Gigabyte Windforce 6870
RAM: 8GB
Windows 7 Ultimate

Got a BSOD, had one like this a while ago but the .dump file was corrupt. But this one isn't, so here's the Bugcheck analysis:

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffffa800ab84060
Arg4: 0000000000000000

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

BUGCHECK_STR: 0xc4_91

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800034ae625

STACK_TEXT:
fffff880`0df4b398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlInitializeExtendedContext+0x5


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlInitializeExtendedContext+5
fffff800`034ae625 4889742410 mov qword ptr [rsp+10h],rsi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlInitializeExtendedContext+5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be

FAILURE_BUCKET_ID: X64_0xc4_91_nt!RtlInitializeExtendedContext+5

BUCKET_ID: X64_0xc4_91_nt!RtlInitializeExtendedContext+5

Followup: MachineOwner
---------

Currently verifying all system files by doing the command sfc /VERIFYONLY in CMD. As suggested on this french fourm: http://www.presence-pc.com/forum/ppc/Logiciels/ecran-bl...

Will update if a problem is found from the verification.

More about : bsod ntkrnlmp exe

February 9, 2013 8:58:27 PM

Looks bad, "Windows Resource Protection found integrity violations. Details are included in the CBS.Log windir\Logs\CBS\CBS.log.

Going to continue following the instructions on here:
http://www.vista-xp.fr/forum/topic346.html

Unless anyone suggests otherwise.
m
0
l
February 9, 2013 9:06:53 PM

Alright, looks like doing the command sfc /scannow Fixed the files, all now is required is a restart. Will post again if the issue isn't resolved. But if it worked, that's how to fix it.
m
0
l
!