Bsod w7 please help!!!

[Alex P]

You'll find in this post the problems I encounter.
Please help me because I can't use my computer.


Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1048

Additional information about the problem:
BCCode: 1a
BCP1: 0000000000005002
BCP2: FFFFF781C0000000
BCP3: 000000000000897B
BCP4: 0004897CFFFFFFFE
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\092010-23010-01.dmp
C:\Users\Alex\AppData\Local\Temp\WER-49140-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt



Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1048

Additional information about the problem:
BCCode: 24
BCP1: 00000000001904FB
BCP2: FFFFF880031858D8
BCP3: FFFFF88003185140
BCP4: FFFFF880014FB72F
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\092010-19671-01.dmp
C:\Users\Alex\AppData\Local\Temp\WER-39140-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt



On Mon 20.09.2010 08:38:28 your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1A (0x5002, 0xFFFFF781C0000000, 0x8EE3, 0x48EE1FFFFFFFE)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\092010-20872-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.



On Mon 20.09.2010 08:16:42 your computer crashed
This was likely caused by the following module: ntfs.sys
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF880031858D8, 0xFFFFF88003185140, 0xFFFFF880014FB72F)
Error: NTFS_FILE_SYSTEM
Dump file: C:\Windows\Minidump\092010-19671-01.dmp
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.



On Mon 20.09.2010 07:49:17 your computer crashed
This was likely caused by the following module: ataport.sys
Bugcheck code: 0x1A (0x5002, 0xFFFFF781C0000000, 0x897B, 0x4897CFFFFFFFE)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\092010-23010-01.dmp
file path: C:\Windows\system32\drivers\ataport.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: ATAPI Driver Extension
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.



On Sun 19.09.2010 10:20:46 your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1A (0x41790, 0xFFFFFA8000FA1BB0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\091910-22230-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

4 crash dumps have been found and analyzed. Note that it's not always possible to state with certainty whether a reported driver is really responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

 

[Alex P]

I have installed Windows 3 times. The problems appears only after the first shutdown.
I have tested the drive and Ram, and everything is ok.

 

[Tews]

Please follow these instructions for getting help with a BSOD...

Blue Screen of Death (BSOD) Posting Instructions

 

[Alex P]

w7 64 bit, I purchased the computer 1 a few days ago, so everything is new

 

[Alex P]

NT6

NT6_BSOD + Perform Archive

 

[Tews]

The dmp(s) point to ntkrpamp.exe or ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. Enable driver verifier using the following procedures ...

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Try removing any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff781c0000000, 897b, 4897cfffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f42 )

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff781c0000000, 8ee3, 48ee1fffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f42 )

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880031858d8, fffff88003185140, fffff880014fb72f}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+26f )

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000fa1bb0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

This driver should be updated if possible..

amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)

 

[Alex P]

Do what repeatedly ? I'm waiting to restart after doing the verifier thing, but please tell me what to do after again ?

 

[Tews]

Wait for your system to BSOD, then upload the .dmp files for further analysis...

 

[Alex P]

NEW BSOD, with the real problem , I hope

Here is the new dump files.
please tell me that u figured it out

Thank you very much

 

[Alex P]

Tews, please tell me if u need anything else...I can't wait to resolve this because I can't do my work

 

[richc46]

http://www.sevenforums.com/crashes-debugging/112508-random-bsods.html

Why so many posts?

This will just delay our being able to help.

 

[Tews]

Try removing any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000fa1bb0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880031858d8, fffff88003185140, fffff880014fb72f}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+26f )

Followup: MachineOwner

-----------------------------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5002, fffff781c0000000, 897b, 4897cfffffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f42 )

Followup: MachineOwner
---------

The following driver is out of date and should be updated..

fffff880`0514b000 fffff880`05187880   mcdbus   mcdbus.sys   Tue Feb 24 05:34:07 2009 (49A3CD1F) ... MagicISO ... [url=http://www.magiciso.com/]MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor[/url]

 

[Alex P]

doesn't work

I did all that u'd told me but doesnt work
new crushes:

 

[Alex P]

I had to restore

I had to use system restore because the system crushed every time I restarted before entering windows
u'll find attached the errors again

 

[Alex P]

Any new idea ? Anyone ?

please

 

[Tews]

These appear to be the same files as before... please empty your minidump folder, and upload the new files as they are generated...

 

[Alex P]

files

This should be it. As I restored, there are no more dump files.
I had to restore because it crashed every time i restarted before windows loaded, so ai couldn't use it

 

[Tews]

Your latest .dmp file shows Rtkvhd64.sys (Realtek High Definition Audio Function Driver) as the probable cause for this crash.. Download and install the latest driver available for your system at Realtek

....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {fffff9800e4a6d60, 0, fffff88006d617ea, 0}

Unable to load image \SystemRoot\system32\drivers\RTKVHD64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTKVHD64.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys

Could not read faulting driver name
Probably caused by : RTKVHD64.sys ( RTKVHD64+d97ea )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff9800e4a6d60, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff88006d617ea, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb90e0
 fffff9800e4a6d60 

FAULTING_IP: 
RTKVHD64+d97ea
fffff880`06d617ea 8b4630          mov     eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD5

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002b262b0 -- (.trap 0xfffff88002b262b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88002b264d8
rdx=fffff88002b26440 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88006d617ea rsp=fffff88002b26440 rbp=0000000000000002
 r8=0000000000000000  r9=fffff88006d617ea r10=0000000000000000
r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
RTKVHD64+0xd97ea:
fffff880`06d617ea 8b4630          mov     eax,dword ptr [rsi+30h] ds:8180:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d01f14 to fffff80002c81740

STACK_TEXT:  
fffff880`02b26148 fffff800`02d01f14 : 00000000`00000050 fffff980`0e4a6d60 00000000`00000000 fffff880`02b262b0 : nt!KeBugCheckEx
fffff880`02b26150 fffff800`02c7f82e : 00000000`00000000 fffff8a0`019e8116 fffffa80`053aa000 fffff800`02cb433f : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`02b262b0 fffff880`06d617ea : fffff880`02b264d8 00000000`00000000 fffff8a0`019e8116 fffffa80`068f4a90 : nt!KiPageFault+0x16e
fffff880`02b26440 fffff880`02b264d8 : 00000000`00000000 fffff8a0`019e8116 fffffa80`068f4a90 00000000`00000000 : RTKVHD64+0xd97ea
fffff880`02b26448 00000000`00000000 : fffff8a0`019e8116 fffffa80`068f4a90 00000000`00000000 fffff800`00000000 : 0xfffff880`02b264d8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RTKVHD64+d97ea
fffff880`06d617ea 8b4630          mov     eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  RTKVHD64+d97ea

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RTKVHD64

IMAGE_NAME:  RTKVHD64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c500000

FAILURE_BUCKET_ID:  X64_0xD5_VRF_RTKVHD64+d97ea

BUCKET_ID:  X64_0xD5_VRF_RTKVHD64+d97ea

Followup: MachineOwner
---------

 

[Alex P]

Sound Driver

I did that too
I've uninstalled everything, the sound driver, daemon tools, etc
and after installing the little program you've told me about: DuplexSecure - Downloads
it started crushing every time before loading windows, so I had to restore to a restored point located yesterday, and yesterday was the day i installed windows for the 3rd time so it doesn't crush anymore for now

Please..

 

[richc46]

Tews is currently busy, so I will offer my suggestions. The first is we have to take it slow, I know this is impportant to you, as 4 postings show, but we have others that are just as anxious.

That being said. You submitted a large number of minidumps, I examined several and they all show drivers as a potential problem. The reports give clues, not the answer.
Take the driver test and then post the results.
I would back up first, since there is a small possiblity that this test can cause problems and loss of personal documents.


Enable the Driver Verifier
www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html