I have been getting the blue screen and memory dump. I ran the debugger and
it showed that the probable cause was ntkrpamp.exe. When I found that on my
machine it looks like it might be a sp2 file. The only two things that I
have installed recently are a trial of Microsoft expressions web and harry
potter and the order of the phoenix game. Of course, regular updates have
been automatically installed. I will include what I got when I debugged. I
would really appreciate any help Here is what I got when I ran the debugger:
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\websymbols\Mini071207-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Jul 12 16:33:46.687 2007 (GMT-5)
System Uptime: 0 days 9:43:32.405
Loading Kernel Symbols
.................................................. .................................................. .................................................. ..................................................
Loading User Symbols
Loading unloaded module list
.................
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 1c, 1, 804faee4}

Probably caused by : ntkrpamp.exe ( nt!KeWaitForSingleObject+186 )

Followup: MachineOwner
---------

1: kd> !analyze -v
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 804faee4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeWaitForSingleObject+186
804faee4 8939 mov dword ptr [ecx],edi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 806e496b to 804faee4

STACK_TEXT:
f793dcd4 806e496b 00000000 00000000 00000000 nt!KeWaitForSingleObject+0x186
f793dcf4 804ed874 8578ef58 855f1e84 8578ef50 hal!ExAcquireFastMutex+0x2b
f793dd08 f72cf808 e5bfaeb8 855f1c28 e5bfaeb8
nt!FsRtlRemovePerStreamContext+0x1e
f793dd34 f72d0d56 855f1c28 86b3c1a8 8526a818
fltmgr!FltpDeleteAllStreamListCtrls+0x62
f793dd50 f72c35f7 855f1cac 00000008 86b3c1a8 fltmgr!FltpFreeVolume+0xa4
f793dd68 f72c734e 8526a818 00000008 8056375c
fltmgr!FltpCleanupDeviceObject+0x61
f793dd7c 805379bd 86b3c1a8 00000000 871c1b30
fltmgr!FltpFastIoDetachDeviceWorker+0x14
f793ddac 805ce84c 86b3c1a8 00000000 00000000 nt!ExpWorkerThread+0xef
f793dddc 8054532e 805378ce 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeWaitForSingleObject+186
804faee4 8939 mov dword ptr [ecx],edi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeWaitForSingleObject+186

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

Have you tried a system restore?

Restore to what? Do you mean to restore to a previous registry? I'm not
sure what day to do?

"Richard Hein" wrote:

> Have you tried a system restore?
>

"Kirsten" <Kirsten@discussions.microsoft.com> wrote in message
news:E38E544A-0B48-4283-930A-28DE954E017B@microsoft.com...
> Restore to what? Do you mean to restore to a previous registry? I'm not
> sure what day to do?
>
No, he means use the system restore facility which restores the operating
system to a previous state.

You get to system restore (on my Dell laptop anyway) via Help & Support.

To do this, open Help & Support from the Start Menu.
Under "Pick a Task" you will see an item called
"undo changes to your system with System Restore"

Click on System Restore and follow the instructions on the screen.

Jim
> "Richard Hein" wrote:
>

>> Have you tried a system restore?
>>