WinDbg Analysis Of 0x50 BSOD (XPSP3) Shows NtKrnlPA.exe

Hi everyone,

I have been trying to resolve a BSOD problem on my XPSP3 for the past few days, and an informative thread on WinDbg on this forum has brought me here. I hope that the experts will be able to guide me in resolving this issue.

My problem is that the IE on my machine gives a BSOD within a few seconds of invocation. All other applications continue to work smoothly, including MSN Messenger and other browsers. Following the information provided in a tutorial on this forum, I used WinDbg which has pointed to NtKrnlPA.exe (stored in c:\windows\system32) as the possible culprit.

Searching for instances of this file in my machine, I came across one copy in the c:\windows\servicepackfiles\i386\sp3.cab folder. This file has size 2,018KB, dated 4/14/2008, 12:01 AM. This same file perhaps resides in the c:\windows\servicepackfiles\i386 folder. However, the copy in c:\windows\system32 has size 1,977KB, dated 2/6/2009, 4:02 PM. The copy in c:\windows\Driver Cache\i386 folder has size 2,018KB, dated 2/7/2009, 7:02 PM.

Will my problem be resolved by copying the instance of this file from servicepackfiles folders into c:\windows\system32? And then perhaps nudge the registry to somehow adjust to my act?

Or do I uninstall SP3 altogether and reinstall it again? Or any other?

I very much appreciate your guidance on this problem...

Thanks in advance...

 

Hello again,

In case it helps, here is the output given by WinDbg to the minidump created by my machine when crashing into BSOD:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini100109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: D:\Windows Diagnostics\DebugSymbols\ListOfSymbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Oct 1 09:37:19.364 2009 (GMT+5)
System Uptime: 0 days 0:07:13.060
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffb0, 0, 8054b51a, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys

Could not read faulting driver name
Probably caused by : ntkrnlpa.exe ( nt!CcTwilightLookasideList+1a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffb0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054b51a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: ffffffb0

FAULTING_IP:
nt!CcTwilightLookasideList+1a
8054b51a ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43

STACK_TEXT:
a92bb860 8052037a 00000050 ffffffb0 00000000 nt!KeSetTargetProcessorDpc+0xf
a92bb86c 00000000 a92bb8e0 00000000 ffffffb0 nt!MiRemoveWsle+0xa

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!CcTwilightLookasideList+1a
8054b51a ?? ???

SYMBOL_NAME: nt!CcTwilightLookasideList+1a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

FAILURE_BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a

BUCKET_ID: 0x50_nt!CcTwilightLookasideList+1a

Followup: MachineOwner
---------

Thanks...

 

Hi again,

I was wondering if anyone can help me on my problem? Would be most grateful!

In the meanwhile, I overwrote the file creating the problem with one from the sp3.cab. After rebooting the system, the system did not stabilize. I had to keep rebooting it. Finally, i restored it back to the earlier state through the safe mode. So may be something needs to be done to the registry as well?

I really look forward to getting this problem resolved from the guidance of the experts here. The system works perfectly fine with the other browsers. It is only when I run the IE (earlier 7, now 6), that I get the BSOD.

Thanks in advance...