random blue screens in windows 7
I get these random blue screens since i tried installing McAfee antivirus software. Currently in Programs and Features it does not show that McAfee is installed.
Today i ran a program called Who Crashed and got this report:
Crash Dump Analysis
Crash dump directory: C:\Windows\Minidump
Crash dumps are enabled on your computer.
On Fri 3/25/2011 15:52:26 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032511-20576-01.dmp
This was probably caused by the following module:
ntoskrnl.exe (nt+0x66580)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003C7D108, 0x0, 0xFFFFFFFFFFFFFFFF)
Error:
KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product:
Microsoft® Windows® Operating System
company:
Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
On Fri 3/25/2011 15:50:47 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032511-20623-01.dmp
This was probably caused by the following module:
ntoskrnl.exe (nt+0x66580)
Bugcheck code: 0xA (0x67060009, 0x2, 0x1, 0xFFFFF80003CE099B)
Error:
IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product:
Microsoft® Windows® Operating System
company:
Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
On Fri 3/25/2011 15:26:52 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032511-20950-01.dmp
This was probably caused by the following module:
ntoskrnl.exe (nt+0x66580)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003C76608, 0x0, 0xFFFFFFFFFFFFFFFF)
Error:
KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product:
Microsoft® Windows® Operating System
company:
Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
On Fri 3/25/2011 15:06:58 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032511-21465-01.dmp
This was probably caused by the following module:
ntoskrnl.exe (nt+0x66580)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80003CE0998, 0xFFFFF880088ACB60, 0x0)
Error:
SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product:
Microsoft® Windows® Operating System
company:
Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
On Fri 3/25/2011 15:05:33 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032511-19890-01.dmp
This was probably caused by the following module:
ntoskrnl.exe (nt+0x66580)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF80003CA0803)
Error:
IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product:
Microsoft® Windows® Operating System
company:
Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
Still i have no clue what is wrong with my HP laptop.
System Information (local)
computer name: ZAIN-PC
windows version: Windows 7 , 6.1, build: 7600
windows dir: C:\Windows
CPU: GenuineIntel Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz Intel586, level: 6
2 logical processors, active mask: 3
RAM: 4193214464 total
VM: 2147352576, free: 1944485888
Please help me.
March 25th, 2011 8:26pm
Bug Check Code 0xA: http://msdn.microsoft.com/fr-ca/library/ff560129(v=vs.85).aspx
Bug Check Code 0x3B: http://msdn.microsoft.com/en-us/library/ff558949(VS.85).aspx
Bug Check Code 0x1E: http://msdn.microsoft.com/en-us/library/ff557408(VS.85).aspx
Please use Microsoft Skydrive to upload dump files (%systemroot%\minidumps like c:\windows\minidumps). Once done, post a link here so that I download them and I analyze them.
If you want to debug dump files without my help, use Windbg and refer to this Microsoft article:
http://support.microsoft.com/kb/315263
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 25th, 2011 9:35pm
ok i uploaded the dump files on skydrive. THIS is the link for it
http://cid-c7ee7ea78c514a32.office.live.com/browse.aspx/.Public
March 26th, 2011 7:04pm
As I see, you have got multiple BSOD causes.
Please proceed like that:
Run memtest86+ and check that all is okay with your RAM. If it detects a faulty one, please replace it.
Update all possible drivers
After proceeding like that, make sure that all is okay. If not, post new dump files.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 26th, 2011 7:28pm
Thanx for your instructions. I ran the memtest86+ with my flash disk as the boot. There was nothing faulty. I was updating all the drivers but every single one was already up to date.
The blue screens haven't appeared yet. But they just come up when they feel like.
Kindly give more instructions if possible.
Thanx.
March 27th, 2011 6:04pm
If they appear again, post new dump files.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 27th, 2011 7:39pm
http://cid-c7ee7ea78c514a32.office.live.com/browse.aspx/.Public?uc=2
this link has the new dump files for today.
Thanx
March 28th, 2011 12:47am
*******************************************************************************
*
*
* Bugcheck Analysis *
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000090, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003c7e855, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003eb00e0
0000000000000090
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiCommitThreadWait+1d5
fffff800`03c7e855 488bbb90000000 mov rdi,qword ptr [rbx+90h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: taskhost.exe
TRAP_FRAME: fffff88009d942b0 -- (.trap 0xfffff88009d942b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000007fffffd0001 rbx=0000000000000000 rcx=fffff88009d94400
rdx=00000000000007ff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003c7e855 rsp=fffff88009d94440 rbp=0000000000000001
r8=fffffa8006ced0e8 r9=0000000000000000 r10=fffffffffffffffe
r11=0000000076f7bff4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!KiCommitThreadWait+0x1d5:
fffff800`03c7e855 488bbb90000000 mov rdi,qword ptr [rbx+90h] ds:00000000`00000090=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003c76ae9 to fffff80003c77580
STACK_TEXT:
fffff880`09d94168 fffff800`03c76ae9 : 00000000`0000000a 00000000`00000090 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09d94170 fffff800`03c75760 : 00000000`00000000 00000000`00000090 fffffa80`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`09d942b0 fffff800`03c7e855 : fffffa80`04eb85b0 fffffa80`04eb85b0 fffff800`04013210 fffff800`00000009 : nt!KiPageFault+0x260
fffff880`09d94440 fffff800`03c809af : fffff800`03df2e80 fffff800`03df2e80 00000000`0000006c fffffa80`04f7b230 : nt!KiCommitThreadWait+0x1d5
fffff880`09d944d0 fffff880`01c5f1c8 : 00000000`00000000 fffff8a0`00000000 00000000`00000000 fffffa80`05068a00 : nt!KeWaitForSingleObject+0x19f
fffff880`09d94570 fffff880`01c5e05d : fffffa80`04eb85b0 fffff8a0`02bea890 00000000`00000001 fffffa80`cd637052 : msrpc!LRPC_CASSOCIATION::OpenSecurityContext+0x118
fffff880`09d945e0 fffff880`01c5e37b : fffff8a0`0ebcb8c0 00000000`00000000 fffff8a0`0ebcb8c0 fffff8a0`02bea890 : msrpc!LRPC_BASE_BINDING_HANDLE::BaseBindingCopy+0x15d
fffff880`09d94720 fffff880`01c619d2 : fffff8a0`02bea890 fffff8a0`02bea890 00000000`00000001 00000000`00000058 : msrpc!LRPC_FAST_BINDING_HANDLE::BindingCopy+0x8b
fffff880`09d94750 fffff960`003054f3 : fffff8a0`0e485350 fffff900`c08ce4e0 fffffa80`00000028 00000000`000007ff : msrpc!RpcBindingCopy+0x42
fffff880`09d94780 fffff960`00082691 : fffff900`c08ce4e0 00000000`00000000 fffffa80`06ced060 00000000`00000000 : win32k!PlaySoundPostMessage+0x77
fffff880`09d947e0 fffff960`000dd141 : 00000000`00000030 fffffa80`04eb85b0 fffff880`09d94be0 fffffa80`06ced060 : win32k!PostPlaySoundMessage+0x25
fffff880`09d94810 fffff960`000d42db : fffff900`c08ce4e0 fffff880`09d94be0 00000000`ffffffff fffffa80`06ced060 : win32k!DestroyProcessInfo+0x125
fffff880`09d94840 fffff960`000d43d6 : fffffa80`066da400 fffff900`c08ce4e0 fffffa80`04eb0000 00000000`00000000 : win32k!xxxUserProcessCallout+0x15f
fffff880`09d94890 fffff800`03f5bdd5 : fffffa80`066da4f0 00000000`00000000 00000000`00000000 fffffa80`04eb85b0 : win32k!W32pProcessCallout+0x4e
fffff880`09d948c0 fffff800`03f35e1d : 00000000`00000000 fffff800`03f75601 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`09d94980 fffff800`03c526d3 : fffffa80`069d6a01 fffffa80`05e69010 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`09d949b0 fffff800`03c52b20 : 00000000`001654a0 fffff880`09d94a30 fffff800`03f35f2c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`09d94a30 fffff800`03c76877 : fffffa80`06fa8060 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`09d94b70 00000000`7735f9ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0225f198 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7735f9ea
STACK_COMMAND: kb
FOLLOWUP_IP:
msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118
fffff880`01c5f1c8 8b7710 mov esi,dword ptr [rdi+10h]
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: msrpc
IMAGE_NAME: msrpc.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc17c
FAILURE_BUCKET_ID: X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118
BUCKET_ID: X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118
Followup: MachineOwner
---------------------------------------------
As I see, your BSOD is caused by msrpc.sys. It belongs to Kernel Remote Procedure Call Provider.
For more information, refer to this article;
http://www.computerhope.com/cgi-bin/process.pl?p=msrpc.sys
For security reasons, I think it will be better to re-install your OS like mentioned in the article.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 28th, 2011 12:56am
I think thats because i was installing McAfee and a window popped saying that its not compatible with windows 7 and i accidently instead of canceling it pressed ok.
But now when i look in the Programs in control panel i dont see Mcafee installed. So, how do i uninstall it? or what should i do to stop these BSODs?
March 28th, 2011 1:22am
Like I said previously. I recommand the re-install of the OS.
For the McAfee, you can restore your system state using a restore point that dates before its install.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 28th, 2011 1:24am