BSOD at shut down

mateo315 · 08 Dec 2010

the windows explorer search turned up only a google search of RaInfo.sys, and thats all. why would the dump registry think its still installed? the Rt64Win7.sys folder i had I redownloaded. I unzipped it and looked for an .exe file there was none. I tried to open the application file but this time it gave me a warning box. once I get a response from the Dritek people I will let you know what they say. I am going to attach a copy of everything I was talking about with the Rt64Win7.sys.

I extend my thanks to you for your service as well. I will be careful out there. I have a wife, a 4 year old daughter, and a 5 month old daughter to come home to. what was your MOS?

CarlTR6 · 09 Dec 2010

Did you do your search on C: hard drive. Open Windows Explore; in the left had pane, click on "Local disk (C:)". In the sear window at the upper right, type "RaInfo.sys" (without the quotes), and click the search icon. Make sure Windows explore is configured to show system files.

The warning message is about clicking on on a .dll file. Here is what you should have when you unzip the file:
Attachment 122154 Attachment 122155
Click on the .ini file.

mateo315 · 09 Dec 2010

I ran the search the way you described and still the only thing to come up was a google search. I still have not heard anything from the dritek people. I looked for a .ini file in the unzipped update and did not see one. all of these BSODs started after my wife installed a program called web watcher. its a key stroke recorder, it takes screen shots of the computer periodically, and an internet monitor. it's supposed to be stealth. do you think that program would have caused the problems I am having now? Also, I tried to restart my computer again and it gave me a BSOD again. here is the latest:
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF80002A9B7E7
BCP3: 0000000000000000
BCP4: 000007FFFFFA0000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\120910-32588-01.dmp
C:\Users\Victor\AppData\Local\Temp\WER-89482-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

CarlTR6 · 09 Dec 2010

mateo315 said:

I ran the search the way you described and still the only thing to come up was a google search. I still have not heard anything from the dritek people. I looked for a .ini file in the unzipped update and did not see one.

Those screen shots I posted above are from the file I downloaded from your post onto my desktop. I extracted the files to a folder and the second screen shot shows the .ini file. You have a 64 bit system so you need to look in the 64 folder.

all of these BSODs started after my wife installed a program called web watcher. its a key stroke recorder, it takes screen shots of the computer periodically, and an internet monitor. it's supposed to be stealth. do you think that program would have caused the problems I am having now? Also, I tried to restart my computer again and it gave me a BSOD again.

Ah, that may well be the problem. Third party security programs that work well with XP and even Vista, do not work well with Win 7. They cause conflicts, memory corruption and crashes. There are sound reasons for this; it is due to Win 7's own enhanced security coded into the OS. Uninstall WebWatcher and see if that improves the system.

These are the out of date drivers still on your system.

Apfiltr.sys Sun May 24 06:57:40 2009 - Alps pointing device . OEM - none at ã‚¢ãƒ«ãƒ—ã‚¹é›»æ°—

DKbFltr.sys Wed Mar 25 23:15:42 2009 - Dritek Keyboard Filter driver. Technical Support.

LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 - RemotelyAnywhere Mirror Miniport Driver or LogMeIn Mirror Miniport Driver. https://secure.logmein.com/US/home.aspx.

Rt64win7.sys Fri May 22 10:52:30 2009 - Realtek 8101E/8168/8169 NDIS 6.20 32-bit Driver. Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek.

The Dritek driver is a Vista driver and may work. The same with the Alps driver. Concentrate on the 2008 driver and updating Rt64Win7.sys.

I think you are searching for the LogMeIn Driver from the Start menu. Don't use the search in start. Go to Control Panel > Folder Options and click on the View tab. Select show hidden files, folders, and drives. Open Windows Explore and search all of your C: drive for this driver. You can also look in your Program Files folder for a logmein or remotelyanywhere folder. If you find it, look thoroughly through the folder and all subfolders for the file. I have never had LogMein installed; so I can't specifically tell you where that driver is; but it is definitely loading on your system from somewhere.

Code:

System Uptime: 3 days 22:52:18.922
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002a9b7e7, 0, 7fffffa0000}

Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002a9b7e7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`02a9b7e7 66390a          cmp     word ptr [rdx],cx

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000007fffffa0000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf30e0
 000007fffffa0000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  rundll32.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88002dc7438 -- (.exr 0xfffff88002dc7438)
ExceptionAddress: fffff80002a9b7e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000

TRAP_FRAME:  fffff88002dc74e0 -- (.trap 0xfffff88002dc74e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a9b7e7 rsp=fffff88002dc7678 rbp=fffff88002dc77b0
 r8=0000000000000000  r9=fffff88002dc76b8 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`02a9b7e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002af5a39 to fffff80002abb740

STACK_TEXT:  
fffff880`02dc6c68 fffff800`02af5a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02a9b7e7 00000000`00000000 : nt!KeBugCheckEx
fffff880`02dc6c70 fffff800`02abad82 : fffff880`02dc7438 fffff880`067ff8d0 fffff880`02dc74e0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`02dc7300 fffff800`02ab98fa : 00000000`00000000 fffff880`067ff8d0 fffffa80`044dc500 fffff800`02dd1d2e : nt!KiExceptionDispatch+0xc2
fffff880`02dc74e0 fffff800`02a9b7e7 : fffff800`02a9b872 00000000`00000010 00000000`00000082 fffff880`02dc76a8 : nt!KiPageFault+0x23a
fffff880`02dc7678 fffff800`02a9b872 : 00000000`00000010 00000000`00000082 fffff880`02dc76a8 fffffa80`015fbb60 : nt!RtlImageNtHeaderEx+0x3f
fffff880`02dc7680 fffffa80`024d2bc6 : fffff880`02dc77b0 00000000`00000000 fffffa80`024d7260 fffffa80`024db300 : nt!RtlImageNtHeader+0x1e
fffff880`02dc76b0 fffff880`02dc77b0 : 00000000`00000000 fffffa80`024d7260 fffffa80`024db300 00000000`00000000 : 0xfffffa80`024d2bc6
fffff880`02dc76b8 00000000`00000000 : fffffa80`024d7260 fffffa80`024db300 00000000`00000000 00000000`00000000 : 0xfffff880`02dc77b0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`02a9b7e7 66390a          cmp     word ptr [rdx],cx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!RtlImageNtHeaderEx+3f

BUCKET_ID:  X64_0x1E_nt!RtlImageNtHeaderEx+3f

Followup: MachineOwner
---------

1: kd> lmtsmn
start             end                 module name
fffff880`00ea2000 fffff880`00ef9000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0380d000 fffff880`03897000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04800000 fffff880`04816000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`03a26000 fffff880`03a3d000   amdk8    amdk8.sys    Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00e4d000 fffff880`00e58000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04b91000 fffff880`04bd2000   Apfiltr  Apfiltr.sys  Sun May 24 06:57:40 2009 (4A192824)
fffff880`00e1a000 fffff880`00e23000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e23000 fffff880`00e4d000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`04891000 fffff880`04ab5000   athrx    athrx.sys    Wed Mar 31 21:54:32 2010 (4BB3FCD8)
fffff880`03e66000 fffff880`043d6000   atikmdag atikmdag.sys Tue Jul 21 11:59:53 2009 (4A65E5F9)
fffff880`00f6a000 fffff880`00f76000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`0395b000 fffff880`03962000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03bde000 fffff880`03bef000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`026c8000 fffff880`026e6000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`007b0000 fffff960`007d7000   cdd      cdd.dll      Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`04cc4000 fffff880`04ce1000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`043d6000 fffff880`04400000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d3f000 fffff880`00dff000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`011c8000 fffff880`011f8000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ce1000 fffff880`00d3f000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`03a3d000 fffff880`03a41500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01109000 fffff880`0117c000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00f61000 fffff880`00f6a000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`04be1000 fffff880`04bf1000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`04d77000 fffff880`04d85000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03bc0000 fffff880`03bde000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03bb1000 fffff880`03bc0000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`013e7000 fffff880`013fd000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04b76000 fffff880`04b82000   DKbFltr  DKbFltr.sys  Wed Mar 25 23:15:42 2009 (49CAF35E)
fffff880`04c9c000 fffff880`04cbe000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`04d91000 fffff880`04d9a000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04d85000 fffff880`04d91000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04d9a000 fffff880`04dad000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`04d3d000 fffff880`04d49000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`03ca7000 fffff880`03d9b000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`03d9b000 fffff880`03de1000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`01097000 fffff880`010ab000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0104b000 fffff880`01097000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`013dd000 fffff880`013e7000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
fffff880`00e58000 fffff880`00e92000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`015a2000 fffff880`015ec000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`04bf3000 fffff880`04c00000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`02a02000 fffff800`02a4b000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`04b34000 fffff880`04b58000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04cef000 fffff880`04d08000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04d08000 fffff880`04d10080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04ce1000 fffff880`04cef000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`02600000 fffff880`026c8000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0149d000 fffff880`014a6000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`04b58000 fffff880`04b76000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04b82000 fffff880`04b91000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bc3000 fffff800`00bc6000   kdcom    kdcom.dll    Fri Oct 08 07:17:09 2010 (4CAEFDB5)
fffff880`03a4b000 fffff880`03a8e000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013b2000 fffff880`013cc000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`04cbe000 fffff880`04cc3200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04c21000 fffff880`04c36000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04de9000 fffff880`04dfc000   LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 (487B7E50)
fffff880`04dbb000 fffff880`04dde000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`03e00000 fffff880`03e3c880   mcdbus   mcdbus.sys   Tue Feb 24 05:34:07 2009 (49A3CD1F)
fffff880`00cc0000 fffff880`00ccd000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`04dad000 fffff880`04dbb000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04bd2000 fffff880`04be1000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04d13000 fffff880`04d20000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00e00000 fffff880`00e1a000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03925000 fffff880`03952000   MpFilter MpFilter.sys Sat Mar 20 01:58:08 2010 (4BA463F0)
fffff880`04e0c000 fffff880`04e1c000   MpNWMon  MpNWMon.sys  Sat Mar 20 01:58:00 2010 (4BA463E8)
fffff880`02765000 fffff880`0277d000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`0277d000 fffff880`027aa000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`027aa000 fffff880`027f8000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`04c36000 fffff880`04c59000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`039c0000 fffff880`039cb000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f02000 fffff880`00f0c000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`010ab000 fffff880`01109000   msrpc    msrpc.sys    unavailable (00000000)
fffff880`03ba6000 fffff880`03bb1000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`0148b000 fffff880`0149d000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014b0000 fffff880`015a2000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`0483a000 fffff880`04846000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0273a000 fffff880`0274d000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04846000 fffff880`04875000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03e3d000 fffff880`03e52000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`03b0b000 fffff880`03b1a000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03897000 fffff880`038dc000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`039cb000 fffff880`039dc000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03b9a000 fffff880`03ba6000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a4b000 fffff800`03027000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0120f000 fffff880`013b2000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`03952000 fffff880`0395b000   Null     Null.SYS     unavailable (00000000)
fffff880`026e7000 fffff880`0273a000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`038fb000 fffff880`03921000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00f4c000 fffff880`00f61000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f19000 fffff880`00f4c000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fe7000 fffff880`00fee000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00fee000 fffff880`00ffe000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013cc000 fffff880`013dd000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`036b5000 fffff880`0375b000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04c5f000 fffff880`04c9c000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00ccd000 fffff880`00ce1000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04816000 fffff880`0483a000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04875000 fffff880`04890000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03c39000 fffff880`03c5a000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`03c5a000 fffff880`03c74000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03b49000 fffff880`03b9a000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`039a5000 fffff880`039ae000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`039ae000 fffff880`039b7000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`039b7000 fffff880`039c0000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01000000 fffff880`0103a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`0274d000 fffff880`02765000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03c00000 fffff880`03c39000   Rt64win7 Rt64win7.sys Fri May 22 10:52:30 2009 (4A16BC2E)
fffff880`04612000 fffff880`047faf00   RTKVHD64 RTKVHD64.sys Tue Oct 06 06:51:17 2009 (4ACB2125)
fffff880`03c74000 fffff880`03ca3000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0375b000 fffff880`03766000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04e48000 fffff880`04eff000   Sftfslh  Sftfslh.sys  Fri Apr 23 15:20:30 2010 (4BD1F2FE)
fffff880`04eff000 fffff880`04f4c000   Sftplaylh Sftplaylh.sys Fri Apr 23 15:20:28 2010 (4BD1F2FC)
fffff880`04ff2000 fffff880`04ffd000   Sftredirlh Sftredirlh.sys Fri Apr 23 15:20:39 2010 (4BD1F307)
fffff880`04dde000 fffff880`04de9000   Sftvollh Sftvollh.sys Fri Apr 23 15:20:08 2010 (4BD1F2E8)
fffff880`015ec000 fffff880`015f4000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`03766000 fffff880`037fc000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`04f8b000 fffff880`04ff2000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`04f4c000 fffff880`04f79000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04bf1000 fffff880`04bf2480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01601000 fffff880`017fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`04f79000 fffff880`04f8b000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`03800000 fffff880`0380d000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`039dc000 fffff880`039fa000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03b35000 fffff880`03b49000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00420000 fffff960`0042a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`03a00000 fffff880`03a26000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`03de1000 fffff880`03df3000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04d20000 fffff880`04d3d000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04d11000 fffff880`04d12f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04b23000 fffff880`04b34000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`03a8e000 fffff880`03ae8000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`04ac2000 fffff880`04acd000   usbohci  usbohci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04acd000 fffff880`04b23000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04d49000 fffff880`04d76200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00f0c000 fffff880`00f19000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`03962000 fffff880`03970000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`03970000 fffff880`03995000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00f76000 fffff880`00f8b000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f8b000 fffff880`00fe7000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`0117c000 fffff880`011c8000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`04ab5000 fffff880`04ac2000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`03af5000 fffff880`03b0b000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`03b1a000 fffff880`03b35000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`03995000 fffff880`039a5000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00c00000 fffff880`00ca4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ca4000 fffff880`00cb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`038dc000 fffff880`038e5000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000c0000 fffff960`003cf000   win32k   win32k.sys   Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`03a42000 fffff880`03a4b000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00ef9000 fffff880`00f02000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04c00000 fffff880`04c21000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`04e20000 fffff880`04e22000   MSPQM.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e26000 fffff880`04e28000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e24000 fffff880`04e26000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e22000 fffff880`04e24000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e1c000 fffff880`04e1e000   MSPQM.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e1e000 fffff880`04e20000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`03600000 fffff880`03671000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e08000 fffff880`04e0a000   MSPQM.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e0a000 fffff880`04e0c000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e06000 fffff880`04e08000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e04000 fffff880`04e06000   MSPQM.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04ffd000 fffff880`04fff000   MSPQM.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e02000 fffff880`04e04000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04e00000 fffff880`04e02000   MSPCLOCK.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`03600000 fffff880`03671000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01200000 fffff880`0120e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`015f4000 fffff880`01600000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`014a6000 fffff880`014af000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`038e8000 fffff880`038fb000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`038fb000 fffff880`03925000   cdrom.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

mateo315 · 10 Dec 2010

CarlTR6 said:

Those screen shots I posted above are from the file I downloaded from your post onto my desktop. I extracted the files to a folder and the second screen shot shows the .ini file. You have a 64 bit system so you need to look in the 64 folder.

please forgive my ignorance. I am sure you are getting a little annoyed with me. for that I do apologize. I looked in the 64 bit folder, and I looked at your screen shot. I still did not see a .ini file extension. the only file extensions I see are .txt, .cat, .inf, .sys, .DLL, and a .dll

Ah, that may well be the problem. Third party security programs that work well with XP and even Vista, do not work well with Win 7. They cause conflicts, memory corruption and crashes. There are sound reasons for this; it is due to Win 7's own enhanced security coded into the OS. Uninstall WebWatcher and see if that improves the system.

Is there a program that you could recommend or something I might be able to do on my computer so the program will not conflict? With me going to Afghanistan tomorrow, my wife would feel more comfortable with that program (or one like it) installed (we are christians and would like to maintain accountability for me).

I think you are searching for the LogMeIn Driver from the Start menu. Don't use the search in start. Go to Control Panel > Folder Options and click on the View tab. Select show hidden files, folders, and drives. Open Windows Explore and search all of your C: drive for this driver. You can also look in your Program Files folder for a logmein or remotelyanywhere folder. If you find it, look thoroughly through the folder and all subfolders for the file. I have never had LogMein installed; so I can't specifically tell you where that driver is; but it is definitely loading on your system from somewhere.

I did all of these things you said. and still came up with nothing but the google search. I even searched in the program files and didn't see anything.

again, I am so sorry for being so annoying. and I really appreciate your patience.

CarlTR6 · 10 Dec 2010

You are not annoying at all. No problem. I think I see the problem. In Control Panel > Folder Options > View, make sure that Hide extensions for known file types is NOT checked. The file you are looking for is rt64win7 and it says Setup information in the column to the right. The .ini extension is hidden. Attaching the screen shots helped. Good job.

Maybe those LogMeIn drivers are gone. Using Windows Explorer, navigate to C:\Windows\System 32\Drivers and look down the list of files. They should be in alphabetical order. If you don't find them, don't worry about for now. I can't find them in your uploaded files either.
Just see if you can install the rt64win7 driver. That should help your system.

A program like WebWatcher is basically a root kit, albeit a good root kit and Windows 7 is designed to resist root kits. Here is what I recommend. MSE and Windows Firewall plus Malwarebytes (free) as an on demand scanner. Once a week, open Malwarebytes, update it and do a scan. To make Windows Firewall more user friendly and easy to configure, download and install Windows 7 Firewall Control : Sphinx Software.

How is the computer running now?

mateo315 · 11 Dec 2010

You are not annoying at all. No problem. I think I see the problem. In Control Panel > Folder Options > View, make sure that Hide extensions for known file types is NOT checked. The file you are looking for is rt64win7 and it says Setup information in the column to the right. The .ini extension is hidden. Attaching the screen shots helped. Good job.

I changed the settings in folder options. I went back to look for the one that said setup information. that file is a .inf. I tried to open it and it opened into the notepad. I tried to right click and click install that way, but the computer would not let me.

Maybe those LogMeIn drivers are gone. Using Windows Explorer, navigate to C:\Windows\System 32\Drivers and look down the list of files. They should be in alphabetical order. If you don't find them, don't worry about for now. I can't find them in your uploaded files either. Just see if you can install the rt64win7 driver. That should help your system.

i didnt find the files for logmein. and I am still having trouble installing the rt64win7

A program like WebWatcher is basically a root kit, albeit a good root kit and Windows 7 is designed to resist root kits. Here is what I recommend. MSE and Windows Firewall plus Malwarebytes (free) as an on demand scanner. Once a week, open Malwarebytes, update it and do a scan. To make Windows Firewall more user friendly and easy to configure, download and install Windows 7 Firewall Control : Sphinx Software.

I already have MSE installed in my computer. I tried to look for Windows Firewall plus Malwarebytes (free) so I can download it and couldnt find a site. I did download and install Windows 7 Firewall Control : Sphinx Software. but when I opened it, I had no clue what to do. there was a bunch of pop up message window about a couple of different programs I have. then I couldnt use the internet. google chrome wasnt working properly. I uninstalled the program then every thing worked. what do I need to do with that program. will doing this allow that webwatcher program work, or do I still need to uninstall it. if so, do you know of anything like it that would work in windows 7.

well I head out tomorrow morning and internet access will be limited for a while.

mateo315 · 13 Dec 2010

I am in germany. I am only here for half a day though. were you able to take a look at my last post?

CarlTR6 · 13 Dec 2010

I apologize; I was not on line a lot yesterday. I looked at your last three dumps from Dec 11th. All three indicate hardware/hardware related (direr) issues. None point to a specific cause. One is a critcal error code that I will discuss further down. It appears that the the LogMeIn drivers are gone. Good job with those.

Regarding rt64win7.sys. Make sure you have unzipped to a folder on your desktop. Open Device Manager and find the device with rt64win7.sys. Click on Update driver; select Browse my computer... and point it to the folder on your desktop.

[/quote]
Error code A, IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility.

Error code 124, WHEA_UNCORRECTABLE_ERROR. Usual causes: Hardware, Incompatibility, May be driver corruption.

Error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.[/quote]
The 124 error code is unique in that it gives little information and is the result of a critical failure. Read this article for more information: [2-Int] Stop 0x124 - what it means and what to try. You need to eliminate the driver issue to see if that is the cause.

Apfiltr.sys Sun May 24 06:57:40 2009 - Alps pointing device. OEM - none at ã‚¢ãƒ«ãƒ—ã‚¹é›»æ°—. Try to update this driver from your computer manufacture's website.

DKbFltr.sys Wed Mar 25 23:15:42 2009 - Dritek Keyboard Filter driver. Technical Support.

Rt64win7.sys Fri May 22 10:52:30 2009 - Realtek 8101E/8168/8169 Network Driver Interface Specification 6.20 64-bit Driver. Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek. This one you are working on.

When you get to where you can, test your RAM with Memtest 86 following the instructions in this tutorial: RAM - Test with Memtest86+. Run Memtest from a cold boot after your computer has been off for a while. Let run for at least 7 passes; this will take 6-8 hours. Post back with your results. If you see errors, you can stop the test.