random blue screens in windows 7
I get these random blue screens since i tried installing McAfee antivirus software. Currently in Programs and Features it does not show that McAfee is installed. Today i ran a program called Who Crashed and got this report: Crash Dump Analysis Crash dump directory: C:\Windows\Minidump Crash dumps are enabled on your computer. On Fri 3/25/2011 15:52:26 GMT your computer crashed crash dump file: C:\Windows\Minidump\032511-20576-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x66580) Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003C7D108, 0x0, 0xFFFFFFFFFFFFFFFF) Error: KMODE_EXCEPTION_NOT_HANDLED file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. On Fri 3/25/2011 15:50:47 GMT your computer crashed crash dump file: C:\Windows\Minidump\032511-20623-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x66580) Bugcheck code: 0xA (0x67060009, 0x2, 0x1, 0xFFFFF80003CE099B) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. On Fri 3/25/2011 15:26:52 GMT your computer crashed crash dump file: C:\Windows\Minidump\032511-20950-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x66580) Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003C76608, 0x0, 0xFFFFFFFFFFFFFFFF) Error: KMODE_EXCEPTION_NOT_HANDLED file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. On Fri 3/25/2011 15:06:58 GMT your computer crashed crash dump file: C:\Windows\Minidump\032511-21465-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x66580) Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80003CE0998, 0xFFFFF880088ACB60, 0x0) Error: SYSTEM_SERVICE_EXCEPTION file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. On Fri 3/25/2011 15:05:33 GMT your computer crashed crash dump file: C:\Windows\Minidump\032511-19890-01.dmp This was probably caused by the following module: ntoskrnl.exe (nt+0x66580) Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF80003CA0803) Error: IRQL_NOT_LESS_OR_EQUAL file path: C:\Windows\system32\ntoskrnl.exe product: Microsoft® Windows® Operating System company: Microsoft Corporation description: NT Kernel & System Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. Still i have no clue what is wrong with my HP laptop. System Information (local) computer name: ZAIN-PC windows version: Windows 7 , 6.1, build: 7600 windows dir: C:\Windows CPU: GenuineIntel Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz Intel586, level: 6 2 logical processors, active mask: 3 RAM: 4193214464 total VM: 2147352576, free: 1944485888 Please help me.
March 25th, 2011 8:26pm

Bug Check Code 0xA: http://msdn.microsoft.com/fr-ca/library/ff560129(v=vs.85).aspx Bug Check Code 0x3B: http://msdn.microsoft.com/en-us/library/ff558949(VS.85).aspx Bug Check Code 0x1E: http://msdn.microsoft.com/en-us/library/ff557408(VS.85).aspx Please use Microsoft Skydrive to upload dump files (%systemroot%\minidumps like c:\windows\minidumps). Once done, post a link here so that I download them and I analyze them. If you want to debug dump files without my help, use Windbg and refer to this Microsoft article: http://support.microsoft.com/kb/315263 This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 25th, 2011 9:35pm

ok i uploaded the dump files on skydrive. THIS is the link for it http://cid-c7ee7ea78c514a32.office.live.com/browse.aspx/.Public
March 26th, 2011 7:04pm

As I see, you have got multiple BSOD causes. Please proceed like that: Run memtest86+ and check that all is okay with your RAM. If it detects a faulty one, please replace it. Update all possible drivers After proceeding like that, make sure that all is okay. If not, post new dump files. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 26th, 2011 7:28pm

Thanx for your instructions. I ran the memtest86+ with my flash disk as the boot. There was nothing faulty. I was updating all the drivers but every single one was already up to date. The blue screens haven't appeared yet. But they just come up when they feel like. Kindly give more instructions if possible. Thanx.
March 27th, 2011 6:04pm

If they appear again, post new dump files. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 27th, 2011 7:39pm

http://cid-c7ee7ea78c514a32.office.live.com/browse.aspx/.Public?uc=2 this link has the new dump files for today. Thanx
March 28th, 2011 12:47am

******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000090, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80003c7e855, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003eb00e0 0000000000000090 CURRENT_IRQL: 2 FAULTING_IP: nt!KiCommitThreadWait+1d5 fffff800`03c7e855 488bbb90000000 mov rdi,qword ptr [rbx+90h] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: taskhost.exe TRAP_FRAME: fffff88009d942b0 -- (.trap 0xfffff88009d942b0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=000007fffffd0001 rbx=0000000000000000 rcx=fffff88009d94400 rdx=00000000000007ff rsi=0000000000000000 rdi=0000000000000000 rip=fffff80003c7e855 rsp=fffff88009d94440 rbp=0000000000000001 r8=fffffa8006ced0e8 r9=0000000000000000 r10=fffffffffffffffe r11=0000000076f7bff4 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc nt!KiCommitThreadWait+0x1d5: fffff800`03c7e855 488bbb90000000 mov rdi,qword ptr [rbx+90h] ds:00000000`00000090=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003c76ae9 to fffff80003c77580 STACK_TEXT: fffff880`09d94168 fffff800`03c76ae9 : 00000000`0000000a 00000000`00000090 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`09d94170 fffff800`03c75760 : 00000000`00000000 00000000`00000090 fffffa80`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`09d942b0 fffff800`03c7e855 : fffffa80`04eb85b0 fffffa80`04eb85b0 fffff800`04013210 fffff800`00000009 : nt!KiPageFault+0x260 fffff880`09d94440 fffff800`03c809af : fffff800`03df2e80 fffff800`03df2e80 00000000`0000006c fffffa80`04f7b230 : nt!KiCommitThreadWait+0x1d5 fffff880`09d944d0 fffff880`01c5f1c8 : 00000000`00000000 fffff8a0`00000000 00000000`00000000 fffffa80`05068a00 : nt!KeWaitForSingleObject+0x19f fffff880`09d94570 fffff880`01c5e05d : fffffa80`04eb85b0 fffff8a0`02bea890 00000000`00000001 fffffa80`cd637052 : msrpc!LRPC_CASSOCIATION::OpenSecurityContext+0x118 fffff880`09d945e0 fffff880`01c5e37b : fffff8a0`0ebcb8c0 00000000`00000000 fffff8a0`0ebcb8c0 fffff8a0`02bea890 : msrpc!LRPC_BASE_BINDING_HANDLE::BaseBindingCopy+0x15d fffff880`09d94720 fffff880`01c619d2 : fffff8a0`02bea890 fffff8a0`02bea890 00000000`00000001 00000000`00000058 : msrpc!LRPC_FAST_BINDING_HANDLE::BindingCopy+0x8b fffff880`09d94750 fffff960`003054f3 : fffff8a0`0e485350 fffff900`c08ce4e0 fffffa80`00000028 00000000`000007ff : msrpc!RpcBindingCopy+0x42 fffff880`09d94780 fffff960`00082691 : fffff900`c08ce4e0 00000000`00000000 fffffa80`06ced060 00000000`00000000 : win32k!PlaySoundPostMessage+0x77 fffff880`09d947e0 fffff960`000dd141 : 00000000`00000030 fffffa80`04eb85b0 fffff880`09d94be0 fffffa80`06ced060 : win32k!PostPlaySoundMessage+0x25 fffff880`09d94810 fffff960`000d42db : fffff900`c08ce4e0 fffff880`09d94be0 00000000`ffffffff fffffa80`06ced060 : win32k!DestroyProcessInfo+0x125 fffff880`09d94840 fffff960`000d43d6 : fffffa80`066da400 fffff900`c08ce4e0 fffffa80`04eb0000 00000000`00000000 : win32k!xxxUserProcessCallout+0x15f fffff880`09d94890 fffff800`03f5bdd5 : fffffa80`066da4f0 00000000`00000000 00000000`00000000 fffffa80`04eb85b0 : win32k!W32pProcessCallout+0x4e fffff880`09d948c0 fffff800`03f35e1d : 00000000`00000000 fffff800`03f75601 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561 fffff880`09d94980 fffff800`03c526d3 : fffffa80`069d6a01 fffffa80`05e69010 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d fffff880`09d949b0 fffff800`03c52b20 : 00000000`001654a0 fffff880`09d94a30 fffff800`03f35f2c 00000000`00000001 : nt!KiDeliverApc+0x2eb fffff880`09d94a30 fffff800`03c76877 : fffffa80`06fa8060 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70 fffff880`09d94b70 00000000`7735f9ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c 00000000`0225f198 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7735f9ea STACK_COMMAND: kb FOLLOWUP_IP: msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118 fffff880`01c5f1c8 8b7710 mov esi,dword ptr [rdi+10h] SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118 FOLLOWUP_NAME: MachineOwner MODULE_NAME: msrpc IMAGE_NAME: msrpc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc17c FAILURE_BUCKET_ID: X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118 BUCKET_ID: X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+118 Followup: MachineOwner --------------------------------------------- As I see, your BSOD is caused by msrpc.sys. It belongs to Kernel Remote Procedure Call Provider. For more information, refer to this article; http://www.computerhope.com/cgi-bin/process.pl?p=msrpc.sys For security reasons, I think it will be better to re-install your OS like mentioned in the article. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 28th, 2011 12:56am

I think thats because i was installing McAfee and a window popped saying that its not compatible with windows 7 and i accidently instead of canceling it pressed ok. But now when i look in the Programs in control panel i dont see Mcafee installed. So, how do i uninstall it? or what should i do to stop these BSODs?
March 28th, 2011 1:22am

Like I said previously. I recommand the re-install of the OS. For the McAfee, you can restore your system state using a restore point that dates before its install. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Free Windows Admin Tool Kit Click here and download it now
March 28th, 2011 1:24am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics