BSOD - "Probably caused by : Rt64win7.sys ( Rt64win7+1dd7e )"

[MidwestAtty]

BSOD - "Probably caused by : Rt64win7.sys ( Rt64win7+1dd7e )"

All,

I have been experiencing BSODs overnight, while logged off. I installed WINDBG, and got the following crash dump. Also, I downloaded all of the symbol files, and pointed WINDBG to the location, but I am getting symbol file errors, as shown.

After WINDBG noted that it was likely Rt64win7.sys causing the problem, I installed a new set of drivers from Realtek. No dice. Thanks for any help!

************* Symbol Path validation summary **************
Response Time (ms) Location
OK C:\symbols
Symbol search path is: C:\symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600
Machine Name:
Kernel base = 0xfffff800`03219000 PsLoadedModuleList = 0xfffff800`0345b730
Debug session time: Tue Mar 7 05:06:33.936 2017 (UTC - 5:00)
System Uptime: 0 days 19:25:23.447
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
Probably caused by : Rt64win7.sys ( Rt64win7+1dd7e )

 

[ICIT2LOL]

Hello and welcome MidwestAtty now can you please follow this
Now before we can help we do need to know what is in your machine so please do this System Info - See Your System Specs
or either enter the specs of your system in your forum profile the specs will appear when we click on that little box bottom left of the post screen it is for me the preferable option as it is easy. As you may appreciate it is very hard when you don’t know what one is working with for example a diesel or petrol engine.
*(pretyped to save time)

and then follow these please
Dump Files - Configure Windows to Create on BSOD
&
Blue Screen of Death (BSOD) Posting Instructions

Now from first look that error / dump is related to an Ethernet connection namely the Realtek device but until we have more info on the dumps and the machine it is hard to say for definite.

 

[MidwestAtty]

Okay - I think I've loaded the system specs correctly. In addition, I have attached the .ZIP file to this post.

 

[ICIT2LOL]

Ok that is something to work on now and this Bugcheck below is pointing to a hard ware issue

[COLOR="Red"]BugCheck 1E,[/COLOR] {0, 0, 0, 0}

Now I have to ask is this a new machine (or refurbished) , have you made any hard ware changes to it lately and what if you have before we start testing the components.

Now amongst the dump files in the event viewer stuff I found a reference to McAfee now are you using that security or was it a bundled in software with the machine?? If you are not using it then please remove it using the McAfee removal tool. If you are using McAfee then (as personally I find it a piece of rubbish) would disable it or better uninstall it and use something else. There are plenty of free AV's unless you ant to go for a paid for version of one.
https://service.mcafee.com/webcente...&showHeader=false&_adf.ctrl-state=vb68m7yq6_4

 

[MidwestAtty]

I absolutely agree re: McAfee and rubbish. I am removing it now using their tool. After reboot, I will also be using Ccleaner to vacuum the registry more deeply.

This is a "brand new" system - I got it within the last 30 days, directly from Dell. No hardware changes or upgrades, etc.

 

[ICIT2LOL]

Ok MidwestAtty now before you go much further have you installed much other software on the machine? and seeing this is a new machine that MuckAfee was probably bundled with the Dell stuff - something that I wish they would stop doing but won't because it is revenue raising for MuckAfee and also helps Dell keep the cost of their machines down through some sort of sponsorship deal.

Plus before doing much else to the machine I would also contact the seller and/or Dell because such an issue should not be present on a new machine.

 

[MidwestAtty]

ICIT2LOL,

First, I ran the McAfee removal tool, then Ccleaner, so it should be all gone.

I (or my firm) has added the following to my machine:

1. TABS3, Praticemaster - Legal billing suite - very stable, generally)
2. AdiIrc - seems decent, well-rated - AdiIRC - Free IRC Client
3. MS Office 2016 - complete
4. CCleaner
5. Norton Endpoint - I'm not a fan, as it's a hog.
6. Spotify

If I cannot get this resolved in a few days, I plan to contact Dell.

 

[ICIT2LOL]

Ok now from that list of added stuff I think maybe the Norton may be a cause issue and I am not a fan of it at all anyway, and why on earth would they put Spotify on the machines??

The AdiIrc I see from that link is some form of internet/chat software and is a free program which I think is most unusual for a company to use.
I work for a government department and it is something they would never allow as they not allow CCleaner but I suppose it is free enterprise eh?

Now by that I am really questioning if those softwares are interfering with the system as you might never know what may have been bundled with them.

If you ant to look in the registry for any McAfee entries it is very simple and I am assuming you know how to get there you just need to look in the HKEY's LOCAL_MACHINE 7 CURRENT_USER > Software and scroll down the listing to see if there are any McAfee entries. see pic for example

 

[MidwestAtty]

ICIT2LOL,

I have full admin rights on my machine, so the ADI and the Spotify are my installs. And yes, the Norton sucks, but that's the firm's choice, not mine.

When I get back in to work on Monday, I will check for any more McAfee.

Thank you!

 

[ICIT2LOL]

ICIT2LOL,

I have full admin rights on my machine, so the ADI and the Spotify are my installs. And yes, the Norton sucks, but that's the firm's choice, not mine.

When I get back in to work on Monday, I will check for any more McAfee.

Thank you!

Ok no worries then I thought maybe those softwares had some unwanted effects to the system.

The McAfee entries if nay juts right click on them and delete the whole thing and it is always a good idea to back the registry up before one does anything in there - I do after clean installs and changing stuff in there.
Registry - Backup and Restore

Now as you have admin rights this little ditty might be of use to you
Just a little something that will make your machine a little faster and more efficient is this Optimize Windows 7
It is my bible when installing an OS on my machines and also when I am fixing friends and family machines too.
Now if you go through it slowly you will find lots of tweaks and they are all really thoroughly done by the authour Brink a fellow who is in my mind brilliant and if you need to ask questions he is just the most obliging person around.
The other thing is that you may lose some of the "bling" such as transparency (you don't have to I find it unnecessary) and all the tweaks are reversible.
If you do get stuck just post back in that tutorial and you will get help. Another bonus using this tutorial is that it helps you find your way around your machine and Windows 7!
Just one tip I would say you start with is do this Registry - Backup and Restore do this and it will save you a lot of grief if you are ever doing things in the registry and even if you don't it is a good back up to have if your system ever gets corrupted.
(pretyped to save time)

 

[MidwestAtty]

Okay - came in this morning, and had the "Windows Recovered from a Crash" notification. I've attached another .ZIP file, in case the information is any better this time.

Also, in addition to the above programs, I also have:

1. Creative Cloud & the full Adobe Acrobat suite
2. Chrome
3. Phillips SpeechExec
4. RescueTime
5. WinDbg

It looks like the first crashed happened on 2/18 (computer was new to me on 2/2), so I am looking to see what was installed / changed on that date. So far, nothing. However, I am removing ADirc and Spotify to see if that makes any difference.

 

[ICIT2LOL]

Right now the zip opens with a blank window and is only 22kb so you may have to try again.

Those other programs out of them what does Phillips SpeechExec and RescueTime actually do?? If you have the software for them it might come down to uninstalling them.

The WinDbg do you use it look at the dumps?? if so then you might take a look at this Driver Reference Table (DRT) it is a listing of dump file references but having said that if you are interested at all in this BSOD stuff then see this
WinDBG - Install and Configure for BSOD Analysis

 

[MidwestAtty]

Okay - here's another attempt at the analysis.

 

[ICIT2LOL]

Ok came through ok and yes you have a real problem there my firend and I am sorry you have so many blue screens.

Now there is still the bugcheck 01E

KMODE_EXCEPTION_NOT_HANDLED [COLOR="Red"](1e)[/COLOR]
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

and the bugcheck ntoskrnl.exe is very common and can be just about anything as can the above - so we had better start checking the device in the machine out because it seems to me that the system is not loading drivers properly or at all.

The first thing that comes to mind is checking the memory and this will take a reasonably long time to do. So could you please follow this
Now to make absolutely we are on the same page the memtest linked here is the only*one we recommend and it MUST be run for at least 8 passes or you may as well not bother. It is rather lengthy and best left for a downtime for that machine - overnight is good. Having said that you can stop the test if errors show up while you are around and then it is a matter of tracking down the bad stick of RAM.* RAM - Test with Memtest86+
(This is pretyped to save time)

I have to reinforce the importance of running this test for those 8 passes though it is critical that you do unless as stated errors come up straight away or soon after the test has started.