Windows 7 is crashing...i don't know what to do anymore

[ANT]

hello everyone,

Windows 7 is crashing... i don't know what to do anymore. i've uninstall some applications update some drivers, fix some potential errors that could cause the crashes and nothing. i still have the w7 crash on startup, or when it come form the sleep more, or sometimes even when i close it.

what can be the problem and how can i fix it?

thanks

 

[zigzag3143]

hello everyone,

Windows 7 is crashing... i don't know what to do anymore. i've uninstall some applications update some drivers, fix some potential errors that could cause the crashes and nothing. i still have the w7 crash on startup, or when it come form the sleep more, or sometimes even when i close it.

what can be the problem and how can i fix it?

thanks

hi Ant

this bsod was caused by your atheros wifi driver. suggest you reinstall the driver.the driver date is from 2006 and a driver this old is bound to cause problems.


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\100809-19843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x8284c000 PsLoadedModuleList = 0x82994810
Debug session time: Thu Oct 8 02:00:34.640 2009 (GMT-4)
System Uptime: 0 days 0:00:25.406
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000B8, {8297f280, 855b2d48, 82972fd0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\athr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athr.sys
*** ERROR: Module load completed but symbols could not be loaded for athr.sys
Probably caused by : athr.sys ( athr+29ff8 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 8297f280, Original thread which is the cause of the failure
Arg2: 855b2d48, New thread
Arg3: 82972fd0, Stack address of the original thread
Arg4: 00000000

Debugging Details:
------------------


FAULTING_THREAD: 8297f280

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xB8

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 828b38c7 to 828b3966

STACK_TEXT:
82972a20 828b38c7 85977970 82975d20 85977998 nt!KiSwapContext+0x26
82972a54 828b7785 82975d20 00000000 00000001 nt!KiExitDispatcher+0x140
82972a8c 828886c0 fff0bdc0 ffffffff 00000000 nt!KiSetTimerEx+0x7a
82972aac 884366ad 85977970 fff0bdc0 ffffffff nt!KeSetTimerEx+0x1c
82972ad0 8f45dff8 85977960 fff0bdc0 ffffffff ndis!NdisSetTimerObject+0xa2
WARNING: Stack unwind information not available. Following frames may be wrong.
82972af4 8f4b49f7 85a54e08 00000064 85a54e08 athr+0x29ff8
82972b08 88436774 00000000 85a54e08 00000000 athr+0x809f7
82972b38 828b604d 85977998 00977960 a6916d6a ndis!ndisMTimerObjectDpc+0xbc
82972b7c 828b5ff1 82975d20 82972ca8 00000002 nt!KiProcessTimerDpcTable+0x50
82972c68 828b5eae 82975d20 82972ca8 00000000 nt!KiProcessExpiredTimerList+0x101
82972cdc 828b420e 0000065a 85566d48 8297f280 nt!KiTimerExpiration+0x25c
82972d20 828b4038 00000000 0000000e 00000000 nt!KiRetireDpcList+0xcb
82972d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38


STACK_COMMAND: .thread 0xffffffff8297f280 ; kb

FOLLOWUP_IP:
athr+29ff8
8f45dff8 ?? ???

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: athr+29ff8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: athr

IMAGE_NAME: athr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a553e00

FAILURE_BUCKET_ID: 0xB8_athr+29ff8

BUCKET_ID: 0xB8_athr+29ff8

Followup: MachineOwner
---------

 

[ANT]

thank you zigzag for the the reply and help.

the indicated driver was updated some time ago. 2 weeks or maybe more. now i have 08.07.2009 driver, version 8.0.0.171 for the microsoft page.

what do you suggest uninstall it and reinstall the driver ? or something else could cause the crash

 

[H2SO4]

thank you zigzag for the the reply and help.

the indicated driver was updated some time ago. 2 weeks or maybe more. now i have 08.07.2009 driver, version 8.0.0.171 for the microsoft page.

what do you suggest uninstall it and reinstall the driver ? or something else could cause the crash

Uninstalling/reinstalling drivers rarely accomplishes anything. Unfortunately, just because it's recent doesn't necessarily mean a driver is not buggy.

I'd suggest you upload more of the minidumps corresponding to these crashes. A pattern may become obvious when more of them are examined.

 

[chev65]

hello everyone,

Windows 7 is crashing... i don't know what to do anymore. i've uninstall some applications update some drivers, fix some potential errors that could cause the crashes and nothing. i still have the w7 crash on startup, or when it come form the sleep more, or sometimes even when i close it.

what can be the problem and how can i fix it?

thanks

Posting your system specs could be helpful here.

 

[ANT]

ok chev65, here are 2 more .dmp files because i deleted the rest and i saved only this ones. if i'll engage another crash i'll post the dmp files here.

ok chev65 i'll wait for your analysis. hope we'll find a solution for this.

Posting your system specs could be helpful here.

I have a Benq A52 laptop

• Processor: Intel Dual Core 1860 MHz.
• Memory: DDRII 2.0GB.
• HDD: 120GB (5400RPM - SATA).
• Optical Drive: 8x DVD-DUAL with Double Layer support.
• Graphics Card: ATI Radeon® Xpress 200M.
• Video Memory: Shared (max. to 128MB).
• Display: 15.4" WXGA (1280x800).
• Battery: 4-cell Lithium-Ion Battery, 29.6Whr (2000mAh).
• I/O Ports:
  • USB 2.0 x 3.
  • RJ-45 Ethernet port x 1.
  • RJ-11 Modem port x 1.
  • DC-in for power supply x 1.
  • Microphone-in x 1.
  • Headphone-out x 1.
  • VGA / D-Sub port x .
• Audio:
  • 2 x 1.0W Speakers.
  • 2 channel Sound System.
  • Sound Blaster Pro Compatible.
  • Noise Suppression & Echo Cancellation supported.
• Communication:
  • Modem: Built-in 56K/V.92.
  • LAN: Built-in 10/100/1000 Ethernet.
  • WLAN: Built-in 802.11b/g.
• Keyboard: 19mm key pitch/87 keys(US)/ 88 keys (UK).
• Dimension: 362x260x30.5(front)~35.5(rear) mm.
• Weight:
  • 2.3 kg without battery.
  • 2.5 kg with battery.

 

[zigzag3143]

Ant what build of win 7 are you running? (7100?)

ken

edit for add info

there a 4 drivers dated 2005 on the system. they cant be helping

 

[ANT]

Ant what build of win 7 are you running? (7100?)

ken

no, i have 7600.

 

[zigzag3143]

Ant

from microsoft?

 

[zigzag3143]

With 7600 from ms I cant see how these drivers from 2005 even work in win 7


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\100209-18234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x8283a000 PsLoadedModuleList = 0x82982810
Debug session time: Fri Oct 2 02:45:48.433 2009 (GMT-4)
System Uptime: 0 days 0:07:12.199
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 84886031, 8078af40, 0}

Probably caused by : ntkrpamp.exe ( nt!KiDispatchInterrupt+2c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 84886031, The address that the exception occurred at
Arg3: 8078af40, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
+2c
84886031 0000 add byte ptr [eax],al

TRAP_FRAME: 8078af40 -- (.trap 0xffffffff8078af40)
ErrCode = 00000002
eax=00000000 ebx=00000008 ecx=82965670 edx=0002625a esi=82963d20 edi=84886030
eip=84886031 esp=8078afb4 ebp=82963d20 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
84886031 0000 add byte ptr [eax],al ds:0023:00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 828a19dc to 84886031

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
8078aff4 828a19dc 00000030 00000000 00000000 0x84886031
8078aff8 00000000 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiDispatchInterrupt+2c
828a19dc 5c pop esp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiDispatchInterrupt+2c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007

FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchInterrupt+2c

BUCKET_ID: 0x8E_nt!KiDispatchInterrupt+2c

Followup: MachineOwner
---------

491e000 94925700 st330 Wed Oct 26 10:19:47 2005 (435F9083)
94926000 94929f00 lpwdm Wed Oct 26 10:19:46 2005 (435F9082)
9492a000 9492d180 stbus Wed Oct 26 10:19:47 2005 (435F9083)
9492e000 94937d80 steth Mon Oct 24 07:28:12 2005 (435CC54C)
9501f000 9505a000 mrxsmb10 Mon Jul 13 19:14:34 2009 (4A5BBFDA)
9505a000 95075000 mrxsmb20 Mon Jul 13 19:14:29 2009 (4A5BBFD5)
9508d000 9509b000 epfwwfp Thu May 14 09:12:05 2009 (4A0C18A5)
9509b000 95132000 peauth Mon Jul 13 20:35:44 2009 (4A5BD2E0)
95132000 9513c000 secdrv Wed Sep 13 09:18:32 2006 (45080528)

 

[ANT]

Ant

from microsoft?

yes, it's the RTM version.

 

[chev65]

Can't find anything conclusive on ntkrpamp.exe which is what the bug check says is the most likely cause.

From what I have read this could be your anti virus program causing this type of problem or possibly bad ram or an incompatable driver is being used.

 

[ANT]

491e000 94925700 st330 Wed Oct 26 10:19:47 2005 (435F9083)
94926000 94929f00 lpwdm Wed Oct 26 10:19:46 2005 (435F9082)
9492a000 9492d180 stbus Wed Oct 26 10:19:47 2005 (435F9083)
9492e000 94937d80 steth Mon Oct 24 07:28:12 2005 (435CC54C)

the first 2 drivers are certainly from my USB modem that i have to connect to the internet (probably the rest of the drivers that are dated 2005 are also used by the USB modem).

luckily in couple of days i'll change my IPS so i'll uninstall the USB modem. how i'll be sure that i've uninstalled all the drivers because in the device manager i only have 1 device listed the speedtouch 330. if i uninstall this will remove automatically the rest of the drivers?

Can't find anything conclusive on ntkrpamp.exe which is what the bug check says is the most likely cause.

From what I have read this could be your anti virus program causing this type of problem or possibly bad ram or an incompatable driver is being used.

the antivirus i use is nod32 smart security.i didn't have any problem with win xp ( my previous OS) so if it was the ram i should have problems in win xp too, and i didn't had. hope it's the driver problem.

 

[H2SO4]

Can't find anything conclusive on ntkrpamp.exe which is what the bug check says is the most likely cause.

From what I have read this could be your anti virus program causing this type of problem or possibly bad ram or an incompatable driver is being used.

ntkrpamp is otherwise known as "Windows".

 

[chev65]

Here is what else I came up with on that error.

0x50 - Probable Cause "ntkrpamp.exe" - Normally caused by Defective Memory (L2 Cache, RAM, Video RAM) or Incompatible Software including Anti-Virus software.

0x1A - Probable Cause "ntkrpamp.exe" - Very similar error to 0x50 - The Minidump indicates a process called "SBCSSvc.exe" which is associated with something called CounterSpy i think from a Google search.


True it's a Windows system file.

ntkrpamp.exe is a process associated with Microsoft Windows Operating System from Microsoft Corporation. This process is required for essential applications to work properly and ntkrpamp.exe should not be disabled.

Still the fact that this file is associated with a bugcheck indicates that it may be caused by the reasons I already listed.

 

[H2SO4]

ntkrpamp.exe is a process associated with Microsoft Windows Operating System from Microsoft Corporation. This process is required for essential applications to work properly and ntkrpamp.exe should not be disabled.

It's the kernel itself mate... NT KeRnel PAE Multi-Processor

"Disabling" it will indeed make it difficult for "essential applications to work properly"

On a more serious note, at least half of all BSODs occur in the ntoskrnl/ntkrnlmp/ntkrpamp module - it's the one which does the vast majority of the work. However, only in a vanishingly small percentage of cases is that module actually responsible for the crash. It simply gets fed bad data and it chokes.

 

[H2SO4]

@ANT: Please consider updating your drivers as Zigzag said. Your crashes are caused by something in the network stack, either the NIC driver or something that's latched itself into that path - antivirus, 3rd-party firewall... that sort of thing.

Here's a somewhat reconstructed version of the stack from the same minidump. Note the NDIS.sys reference... networking.

0: kd> kL = 8078ad8c 8078ad8c 0
ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
8078ad88 82949e00 0x0
8078adb0 828f7245 nt!WmipDoFindRegEntryByDevice+0x2b
8078adcc 88488495 nt!KiDispatchException+0x7f
8078ade0 884edbc1 ndis!ndisDereferenceDriver+0x1b
8078ae08 828a404d ndis!ndisMTimerDpcX+0xe4
8078ae4c 828a3ff1 nt!KiProcessTimerDpcTable+0x50
8078af38 8287dfca nt!KiProcessExpiredTimerList+0x101
00000000 00000000 nt!Kei386EoiHelper+0x192

 

[chev65]

ntkrpamp.exe is a process associated with Microsoft Windows Operating System from Microsoft Corporation. This process is required for essential applications to work properly and ntkrpamp.exe should not be disabled.

It's the kernel itself mate... NT KeRnel PAE Multi-Processor

"Disabling" it will indeed make it difficult for "essential applications to work properly"

On a more serious note, at least half of all BSODs occur in the ntoskrnl/ntkrnlmp/ntkrpamp module - it's the one which does the vast majority of the work. However, only in a vanishingly small percentage of cases is that module actually responsible for the crash. It simply gets fed bad data and it chokes.

Which is exactly why I said it was inconclusive. Dismantling my responce isn't helping with the problem mate.

I already mentioned twice that it appeared to be related to a driver or anti virus problem. Have a good one.

 

[H2SO4]

Which is exactly why I said it was inconclusive. Dismantling my responce isn't helping with the problem mate.

I already mentioned twice that it appeared to be related to a driver or anti virus problem. Have a good one.

Don't be upset please. I'm not "dismantling your response". I wanted to explain why research into ntkrpamp was unnecessary.

 

[ANT]

yes guys no need to fight now

your answers helped me a lot. hope the driver update or remove of the hardware itself will solve my problems.

thank you very much for the help.