Antivirus Software:
Code:
avastsvc.exe c:\program files\avast software\avast\avastsvc.exe 1648 8 200 1380 9-3-2012 18:27 6.0.1289.0 43,72 KB (44.768 bytes) 9-11-2011 20:24
avastui.exe c:\program files\avast software\avast\avastui.exe 2376 8 200 1380 9-3-2012 18:27 6.0.1289.0 3,55 MB (3.722.416 bytes) 9-11-2011 20:24
Possible out of date drivers:
Code:
mcdbus 97193000 971af800 Tue Feb 24 03:42:13 2009 (49a3cf05) 0001e53c mcdbus.sys
HCW85BDA 9182d000 91981800 Mon May 11 01:23:35 2009 (4a07d277) 0015bef8 HCW85BDA.sys
mcdbus.sys
HCW85BDA.sys
Code:
-
Loading Dump File [D:\Kingston\BSODDmpFiles\ragnaroks\Windows_NT6_BSOD_jcgriff2\030912-26582-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82c15000 PsLoadedModuleList = 0x82d5e4d0
Debug session time: Fri Mar 9 11:26:48.112 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:15.188
Loading Kernel Symbols
............................................Unable to add module at ffffffff
Loading User Symbols
Missing image name, possible paged-out or corrupt data.
Loading unloaded module list
..Missing image name, possible paged-out or corrupt data.
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck FC, {10229, 6c23e867, 807e5c08, 0}
Probably caused by : Unknown_Module_89888786 ( Unknown_Module_89888786>+7d50e50 )
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\ragnaroks\Windows_NT6_BSOD_jcgriff2\030712-28844-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0x82c50000 PsLoadedModuleList = 0x82d994f0
Debug session time: Wed Mar 7 10:40:38.110 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:20.186
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 87a50008, Address of the IRP
Arg2: 00000eae
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
IRP_ADDRESS: 87a50008
FOLLOWUP_IP:
CLASSPNP!ClassCompleteRequest+11
8b785498 5d pop ebp
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x44
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 8b785498 to 82cc8c9d
STACK_TEXT:
82d77af0 8b785498 82d77b24 8b785abd 87a4a030 nt!IopfCompleteRequest+0x4b0
82d77af8 8b785abd 87a4a030 87a50008 00000001 CLASSPNP!ClassCompleteRequest+0x11
82d77b24 82cc8913 00000000 882184c8 002185d0 CLASSPNP!TransferPktComplete+0x2e4
82d77b68 8b30c3af 8821867c 862fe170 86300d3c nt!IopfCompleteRequest+0x128
WARNING: Stack unwind information not available. Following frames may be wrong.
82d77b80 8b2ee4ac 882184c8 8821867c 8821867c iaStor+0x233af
82d77b98 8b2eefe5 862fe170 8821867c 82c88fc0 iaStor+0x54ac
82d77bb8 8b2ef040 012fe170 82d77be8 862fe170 iaStor+0x5fe5
82d77bcc 8b2ef6b6 862fe170 82d77be8 82d7c600 iaStor+0x6040
82d77c68 8b30bcc5 862fe170 00000000 82d77cd4 iaStor+0x66b6
82d77c78 82cc81b5 862f7728 862f7000 00000000 iaStor+0x22cc5
82d77cd4 82cc8018 82d7ad20 82d84380 00000000 nt!KiExecuteAllDpcs+0xf9
82d77d20 82cc7e38 00000000 0000000e 00000000 nt!KiRetireDpcList+0xd5
82d77d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38
STACK_COMMAND: kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: CLASSPNP!ClassCompleteRequest+11
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CLASSPNP
IMAGE_NAME: CLASSPNP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf18
FAILURE_BUCKET_ID: 0x44_CLASSPNP!ClassCompleteRequest+11
BUCKET_ID: 0x44_CLASSPNP!ClassCompleteRequest+11
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\ragnaroks\Windows_NT6_BSOD_jcgriff2\030312-29811-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0x82c52000 PsLoadedModuleList = 0x82d9b4f0
Debug session time: Sat Mar 3 04:43:40.670 2012 (UTC - 6:00)
System Uptime: 0 days 0:07:54.746
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.....
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000003, the pool freelist is corrupt.
Arg2: 82d88c50, the pool entry being checked.
Arg3: 82d88c50, the read back flink freelist value (should be the same as 2).
Arg4: 82d88c00, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: DkService.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 82cf9bb6 to 82d7268c
STACK_TEXT:
978efc1c 82cf9bb6 00000008 00000413 20206f49 nt!ExAllocatePoolWithTag+0x682
978efc40 82e7fb4e 8ad1d528 00000413 20206f49 nt!ExAllocatePoolWithQuotaTag+0x57
978efcd0 82ea8772 885f4020 85b22008 00000000 nt!IopXxxControlFile+0x5f5
978efd04 82c901fa 000004f8 00000000 00000000 nt!NtFsControlFile+0x2a
978efd04 777c70b4 000004f8 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
04a5fd9c 00000000 00000000 00000000 00000000 0x777c70b4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+682
82d7268c cc int 3
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExAllocatePoolWithTag+682
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02a389
FAILURE_BUCKET_ID: 0x19_3_nt!ExAllocatePoolWithTag+682
BUCKET_ID: 0x19_3_nt!ExAllocatePoolWithTag+682
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\ragnaroks\Windows_NT6_BSOD_jcgriff2\022412-27627-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0x82c0a000 PsLoadedModuleList = 0x82d534f0
Debug session time: Fri Feb 24 09:44:30.440 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:19.515
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
Unable to load image \SystemRoot\system32\drivers\HCW85BDA.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for HCW85BDA.sys
*** ERROR: Module load completed but symbols could not be loaded for HCW85BDA.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 9684e23b, 8d58b5a0, 8d58b180}
Probably caused by : hardware ( HCW85BDA+2c23b )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9684e23b, The address that the exception occurred at
Arg3: 8d58b5a0, Exception Record Address
Arg4: 8d58b180, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
HCW85BDA+2c23b
9684e23b 84968b4dec8b test byte ptr [esi-7413B275h],dl
EXCEPTION_RECORD: 8d58b5a0 -- (.exr 0xffffffff8d58b5a0)
ExceptionAddress: 9684e23b (HCW85BDA+0x0002c23b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 142a0b03
Attempt to read from address 142a0b03
CONTEXT: 8d58b180 -- (.cxr 0xffffffff8d58b180)
eax=8841a257 ebx=883dbde4 ecx=88531000 edx=00000000 esi=883dbd78 edi=883d1808
eip=9684e23b esp=8d58b668 ebp=8d58b684 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
HCW85BDA+0x2c23b:
9684e23b 84968b4dec8b test byte ptr [esi-7413B275h],dl ds:0023:142a0b03=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 142a0b03
READ_ADDRESS: GetPointerFromAddress: unable to read from 82d73848
Unable to read MiSystemVaType memory at 82d52e40
142a0b03
FOLLOWUP_IP:
HCW85BDA+2c23b
9684e23b 84968b4dec8b test byte ptr [esi-7413B275h],dl
BUGCHECK_STR: 0x7E
MISALIGNED_IP:
HCW85BDA+2c23b
9684e23b 84968b4dec8b test byte ptr [esi-7413B275h],dl
LOCK_ADDRESS: 82d70c00 -- (!locks 82d70c00)
Resource @ nt!PiEngineLock (0x82d70c00) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0x82d70c00
Thread Count : 0
Thread address: 0x00000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from 9684e611 to 9684e23b
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8d58b684 9684e611 000000c9 015c2800 00000002 HCW85BDA+0x2c23b
8d58b6b8 9687d9b7 00000010 000000c9 8d58b6fc HCW85BDA+0x2c611
8d58b6d4 968991c7 00000010 8d58b6fc 000000c9 HCW85BDA+0x5b9b7
8d58b7d4 9689953e 8858b818 8858b7c8 00000000 HCW85BDA+0x771c7
8d58b7ec 96898901 8858b7c8 884c9848 00000000 HCW85BDA+0x7753e
8d58b800 9688160a 884c9848 884c9848 00000011 HCW85BDA+0x76901
8d58b814 9688183d 00000000 884c9848 00000013 HCW85BDA+0x5f60a
8d58b828 9687b178 00000000 ffffffff 884c90b0 HCW85BDA+0x5f83d
8d58b850 96879d72 00000000 ffffffff 8858f1a0 HCW85BDA+0x59178
8d58b868 96869ec5 8858f4b8 880b9218 884c8a88 HCW85BDA+0x57d72
8d58b880 96832672 884268c0 855c28e0 00000000 HCW85BDA+0x47ec5
8d58b934 96830ac4 8ea248f8 8d58b96c 969970d4 HCW85BDA+0x10672
8d58b940 969970d4 883dbde4 88430700 8ea248f8 HCW85BDA+0xeac4
8d58b96c 96991540 88430700 884307b8 883d1750 ks!CKsDevice::PnpStart+0x72
8d58b988 82c4158e 883d1750 88430700 8d58ba10 ks!CKsDevice::DispatchPnp+0x2d2
8d58b9a0 82dc8700 00000000 85ebd560 88229818 nt!IofCallDriver+0x63
8d58b9bc 82c1c28b 8d58b9ec 82c1f06f 88229818 nt!PnpAsynchronousCall+0x92
8d58ba20 82dbf569 82c1f06f 88229818 85ebe880 nt!PnpStartDevice+0xe1
8d58ba7c 82dbf432 88229818 0000003e 00000000 nt!PnpStartDeviceNode+0x12c
8d58ba98 82dc6e45 00000000 00000001 00000000 nt!PipProcessStartPhase1+0x62
8d58bc94 82d92e14 855e6a08 8560c410 8d58bcc8 nt!PipProcessDevNodeTree+0x188
8d58bcd4 82c1ecfd 8560c410 82d6eb20 855c28e0 nt!PiProcessStartSystemDevices+0x6d
8d58bd00 82c87a6b 00000000 00000000 855c28e0 nt!PnpDeviceActionWorker+0x241
8d58bd50 82e12fda 00000001 a650d12c 00000000 nt!ExpWorkerThread+0x10d
8d58bd90 82cbb1d9 82c8795e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: HCW85BDA+2c23b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xffffffff8d58b180 ; kb
FAILURE_BUCKET_ID: IP_MISALIGNED_HCW85BDA.sys
BUCKET_ID: IP_MISALIGNED_HCW85BDA.sys
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\ragnaroks\Windows_NT6_BSOD_jcgriff2\022212-28688-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0x82c47000 PsLoadedModuleList = 0x82d904f0
Debug session time: Wed Feb 22 10:53:25.753 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:46.454
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
....
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 85613480, Object type of the object whose reference count is being lowered
Arg2: 8adf90c8, Object whose reference count is being lowered
Arg3: 00000001, Reserved
Arg4: 00000001, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82cbfd02 to 82d25eb4
STACK_TEXT:
ae06dc68 82cbfd02 00000018 85613480 8adf90c8 nt!KeBugCheckEx+0x1e
ae06dc8c 82cbfcb0 8adf90c8 82eaa13a 85270f64 nt!ObfDereferenceObjectWithTag+0x4b
ae06dc94 82eaa13a 85270f64 00000a74 01c2d9bc nt!ObfDereferenceObject+0xd
ae06dd08 82c851fa 8559b5a8 00000000 00000000 nt!NtReadFile+0x403
ae06dd08 76ed70b4 8559b5a8 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01c2d9f4 00000000 00000000 00000000 00000000 0x76ed70b4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObfDereferenceObjectWithTag+4b
82cbfd02 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+4b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02a389
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b
BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b
Followup: MachineOwner
---------
- This .dmp file was corrupted which could mean hard disk errors or Windows file corruptions have occurred. The bugcheck itself occurs due to Memory problems... Drivers...
- Possible cause is Drivers...
- Caused by Diskeeper...
- Caused by your Hauppauge Computer Works driver.
- Possible causes are Memory problems... Drivers...
Thanks to Dave76 for help understanding possible causes.
We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.
If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.
- If you are overclocking any hardware, please stop.
- Remove the program diskeeper, it may be the root of most of your crashes. Third party defrag utilities often cause conflicts in Windows 7. Windows 7 has a good command line defrag utility. If you want help running it, don't hesitate to ask.
- Update your Hauppauge device drivers.
- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
- Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
If you swap any memory components, follow these steps for ESD safety:
- Shut down and turn off your computer.
- Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
- Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
- Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a.
Backup your system and user files
b.
Create a system restore point
c. If you do not have a Windows 7 DVD,
Create a system repair disc
d. Run
Driver Verifier
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using
System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.