# Solved: Windows 7 bccode 124



## Rompastompa (Jan 24, 2010)

My new PC is running Windows 7 Professional 64 Bit
8Gb Ram
AMD Phenom II X4 965 Black Edition 3.4Ghz

Periodically displays a blue screen and reboots itself. When it starts up I get the window error message
"Windows has recovered from an unexpected shutdown" The detials in this message are as follows

Problem Event Name: Bluescreen
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 2057

I tried using a program called Blue screen view to read the contents of the dump file created at the time of the crash:

Dump File: 012310-28984-01.dmp
Crash time: 23.01.2010 22.30:43
Bug Check String: 
Bug Check Code: 0x00000124
Parameter 1: 00000000'00000000
Parameter 2: fffffa80'07a748f8
Parameter 3: 00000000'00000000
Parameter 4: 00000000'00000000
Caused by driver: ntoskrnl.exe
Caused by address: ntoskrnl.exe+4a63cc
File description: NT Kernel & System
Product name: Microsoft Windows Operating System
Company: Microsoft Corp 
File version: 6.1.7600.16385(win7_rtm.090713-1255)
Processor: x64
Computer Name:
Full Path: C:\Windows\minidump\012310-28984-01.dmp
Processors count: 4
Major version: 15
Minor version: 7600

If there's any more information that you need then please let me know. Its a new PC, only week old. I can say that the problem occurs at a specific time or when I'm doing a specific task. Its occured in the morning when the pc is first turned on, and after the pc has been on for several hours.

Any help gratefully appreciated.


----------



## Rollin' Rog (Dec 9, 2000)

Is the system a store bought Win7 installation with all original components? Have you added or changed any hardware?

Are you using it for gaming? Are you overclocking anything?

This is the best overall coverage of the error >> http://www.faultwire.com/solutions-...rectable-hardware-error-0x00000124-*1289.html

In some cases however folks have reported their antivirus product to be implicated in the problem.

Although there is not much to be learned from the bugchecks for these faults (other than what other drivers and programs you might have running) -- I will take a look if you upload atleast one of the minidumps:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to *c:\windows\minidump *and copy the last few minidump files to that folder. *this assumes 'c' is your boot drive, if it is not, subsitute accordingly
3 > *close* the folder and right click on it and select *Send to* _Compressed (zipped) Folder_. 
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

If you do not see any minidumps, be sure you are not using any cache cleaner such as CCleaner. Also run *sysdm.cpl* and select Advanced > Startup and Recovery. Make sure "small memory dump" is the one chosen under "write debugging information" and the location should be *%systemroot%\minidump*

Since almost all bugchecks can be caused by faulty ram, I would recommend you perform memory tests.

On Vista and Win7 you can run *mdsched.exe* and on reboot to the scanner press F1 for Advanced options and run the extended tests.

Unfortunately a "pass" does not entirely rule out memory issues where mismatched ram and high stress conditions are encountered.


----------



## Rompastompa (Jan 24, 2010)

Thanks for the quick response. Here's the answers to your questions.
1) It is a new pc, however I'm reluctant to send it back. I bought it from Mesh computers in London. Their customer service is terrible. It too nearly 5 weeks and a threat to cancel just to get it delivered....

2) I'm not using it for gaming, but for a 3d CAD application. However software isn't loaded onto my system yet.

3) The only change I made in the Bios was to enable unleashing mode. I have the Asus M4A79XTD - Evo motherboard, however again the problem occured before I turned this on. But i've disabled it again now.

4) I've attached the last (and only) 2 mini dumps. I did run ccleaner earlier...

I'll run the mdsched that you said also in the meantime. 

Many Thanks


----------



## Rompastompa (Jan 24, 2010)

I'm also going to try the Fix it Utilities software to do a complete hardware check that was recommended in the link that you provided on the faultware site. I'll let you know what the results are when I get them.

Also one other thing that I notice from time to time on my new pc is that the screen seems to judder sometimes and just the screen went blue and instead of rebooting it came back on and now the cursor is very large. Similar to when windows boots into safe mode.

Not sure if this helps at all...


----------



## Rollin' Rog (Dec 9, 2000)

Probably too late now, but I don't think registry cleaners to be very helpful overall, and sometimes quite harmful.

The "trap frame" is quite spare, but there are some drivers that need looking into >>

0: kd> .trap (display trap frame)
*** WARNING: Unable to verify timestamp for mcupdate.dll
*** ERROR: Module load completed but symbols could not be loaded for mcupdate.dll
*** WARNING: Unable to verify timestamp for *spjm.sys*
*** ERROR: Module load completed but symbols could not be loaded for spjm.sys
*** WARNING: Unable to verify timestamp for amdxata.sys
*** ERROR: Module load completed but symbols could not be loaded for amdxata.sys
*** WARNING: Unable to verify timestamp for* mrfoldr.sys*
*** ERROR: Module load completed but symbols could not be loaded for mrfoldr.sys
*** WARNING: Unable to verify timestamp for dump_ataport.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_ataport.sys
*** WARNING: Unable to verify timestamp for spldr.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
Couldn't resolve error at 'display trap frame)'

--------------------------------------------------------------------------

1: kd> .trap (display trap frame)
*** WARNING: Unable to verify timestamp for mcupdate.dll
*** ERROR: Module load completed but symbols could not be loaded for mcupdate.dll
*** WARNING: Unable to verify timestamp for mrfoldr.sys
*** ERROR: Module load completed but symbols could not be loaded for mrfoldr.sys
*** WARNING: Unable to verify timestamp for amdxata.sys
*** ERROR: Module load completed but symbols could not be loaded for amdxata.sys
*** WARNING: Unable to verify timestamp for *spbu.sys*
*** ERROR: Module load completed but symbols could not be loaded for spbu.sys
*** WARNING: Unable to verify timestamp for dump_ataport.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_ataport.sys
*** WARNING: Unable to verify timestamp for spldr.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
Couldn't resolve error at 'display trap frame)'

-----------------------------------------------------------

Note the red bolded driver seems to be "polymorphic" -- which is often associated with either trojan rootkits or virtualization software such as Alcohol or DaemonTools.

I would uninstall anything related to virtualization.

Also any folder locking or encryption processes are suspect (not sure what "mrfolder" does.)

---------------------------------------------------------

You can open the Control Panel > Action Center > Maintenance > Reliability Monitor and trace the beginning of these BSODs to see what was installed prior.


----------



## Rompastompa (Jan 24, 2010)

Thanks for the response.
I'll look into the drivers you've identified.

I do have deamon tools lite installed, however I can live without it. mrfldr is a back up tool mirror folder. It mirros folders one drive to another in realtime. I'll uninstall it and see how I go.


----------



## Rollin' Rog (Dec 9, 2000)

Daemon Tools would be the most likely culprit given the polymorphic drivers there and ruling out any real hardware issue such as faulty ram, overheating, or the lack of proper chipset drivers (if you haven't updated those, you should).

Usually there is another driver pointing to Daemon Tools, but they may have changed the program to conceal that.


----------



## Rompastompa (Jan 24, 2010)

Hi,
Well as I said I removed daemon tools, removed mirror folder, updated the graphics card drivers (ATI castalyst suite), scaned for viruses (removed some malware although it was only located in a backup folder) and I've put my pc through its paces tonight and everything seems stable.

I've created a restore point just in case.

I was thinking of updating the chipset drivers and there are some drivers located on the Asus website but I don't know what version I currently have? how can I find out? is it in the bios?

Also I was looking through the driver error list that you sent back to me and I can account for all the drivers except mcupdate.dll, I cant really determine what it is. I only managed to find this - 

"mcupdate.dll is a module\r belonging to VirusScan Enterprise\r from Network Associates, Inc.\r "

I did find a definition of mcupdate.exe though, apparently it belongs to mcafee, however I have nevver installed mcafee on this pc.

This might be nothing but I always like to be sure of these things.

I'll just have to keep a close eye on this, because I have't installed any other virus software other than avast which I have always found to be stable and seems to be performing well on my new pc.

Thanks for all the help though
Matt


----------



## Rollin' Rog (Dec 9, 2000)

That dll is present in all Windows installations since XP, as far as I can tell -- it's included with the OS for one reason or another.

Does the Asus "Navigation Wizard" detect your chipset?

http://support.asus.com/download/download.aspx?SLanguage=en-us

In any case you should probably check the system vendor's site for the model for such updates if in doubt

This can also be a helpful hardware identifying tool >> http://www.hwinfo.com/


----------



## Rompastompa (Jan 24, 2010)

Yeah I figured it out in the end. I used CPU-Z a utility to tell me these details.

I did upgrade the chipset from the Asus website, however I'd already upgraded through ATI as well and since my motherboard is designed for an AMD processor with an ATI radeon card the updates were virtually the same.

In fact the Asus update installed the ATI catalyst suite again..

Either way the pc's up to date. Hopefully this is the last time I'll need to post....(Unitl the next crisis)...............

But thanks for your help, it was invaluable...
Cheers.
Matt


----------



## Rollin' Rog (Dec 9, 2000)

:up:

Feel free to mark the thread "Solved" when and if all seems well ... you're most welcome for any help continuing or otherwise.


----------



## Rompastompa (Jan 24, 2010)

Hi,
I spoke to soon. I new it was too good to last.
I turned on my pc this morning and the screen went blue again, however it didn;t reboot. The screen just came back on. There was a notification that the graphics card driver had stopped working but had recovered.

Shortly afterwards it did reboot following a blue screen

I looked in the relability history and it shows a video hardware error followed by a windows unexpected shutdown.

I'm also going to take this up with the people that I bought the pc from. But if you get a chance could you look at the dump file I attached and see if there is anything specific you can find out?

This was created just after the shutdown.

Thanks
Matt


----------



## Rompastompa (Jan 24, 2010)

These are the details of the errors in the order that they occured. (Forgot to add them earlier)

A problem with your video hardware caused Windows to stop working correctly.

*Problem signature*
Problem Event Name: LiveKernelEvent
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 2057

*Extra information about the problem*
BCCode: 117
BCP1: FFFFFA80075174E0
BCP2: FFFFF88004086C6C
BCP3: 0000000000000000
BCP4: 0000000000000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Bucket ID: X64_0x117_Tdr:2_IMAGE_atikmpag.sys
Server information: 35a6c513-0642-4032-84b6-bd786a984e58
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 2057

*Extra information about the problem*
BCCode: 124
BCP1: 0000000000000000
BCP2: FFFFFA800805F8F8
BCP3: 0000000000000000
BCP4: 0000000000000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Bucket ID: X64_0x124_AuthenticAMD_PROCESSOR_BUS_PRV
Server information: f2943c6f-a8d8-494a-8a8a-98b6d8f3c803


----------



## Rollin' Rog (Dec 9, 2000)

Only the "124" error was in your minidump -- which is the rather generic "hardware" error.

The other is a "timing issue" -- Vista and Win7 generate this error when the video processor is stuck in a loop or unable to respond in a timely manner. Sometimes overheating can cause this.

What is your display driver configuration? Are you using multiple cards? You might try reseating the card or trying a different available slot, if just one.

The "trap frame" of the '124' error still shows the mysterious polymorphic driver which I believe is associated with Alcohol or Daemon Tools, but may be a rootkit Trojan, along with "Mrfoldr.sys"

Did you reinstall these?



> MODULE_NAME: hardware
> 
> IMAGE_NAME: hardware
> 
> ...


I would also disable "MrFoldr" just to get it out of the picture during testing.


----------



## Rompastompa (Jan 24, 2010)

Hello, thanks for this response.
I have been onto my technical support from the pc manufacturer and they have had me checking and testing things all day. In the end they requested that I re install the operating system. Which I did, however I still get random re boots. Even with no third party software installed

I have had a bccode 117 which I believe is associated with graphics hardware errors?
My pc has recorded several stop error stating that there is an error with my graphics hardware and it has cause windows to stop. This has happened 5 or 6 times today.

The manufacturer is taking the pc back to check the graphics card and system. As you say there seems to be something definitely wrong with it.

Thanks for the help again though. I'll mark this issue completed because I think you've done as much as you could.

Everything in my opinion is pointing to some graphics issue which the manufacturer will look into.

Thanks
Matt


----------



## Rollin' Rog (Dec 9, 2000)

You're welcome and good luck -- yes that error is pretty specific to display hardware and if it persisted after a clean install there is really nothing else but to take advantage of warranty support on the hardware.


----------



## wtxcowboy (May 25, 2004)

Also I was looking through the driver error list that you sent back to me and I can account for all the drivers except mcupdate.dll, I cant really determine what it is. I only managed to find this -

"mcupdate.dll is a module\r belonging to VirusScan Enterprise\r from Network Associates, Inc.\r "

I did find a definition of mcupdate.exe though, apparently it belongs to mcafee, however I have nevver installed mcafee on this pc.

This might be nothing but I always like to be sure of these things.

I'll just have to keep a close eye on this, because I have't installed any other virus software other than avast which I have always found to be stable and seems to be performing well on my new pc.

Thanks for all the help though
Matt[/QUOTE]

know this is marked solved, but was reading your post about mcupdate.exe, it also is used by windows mediacenter if you have that on your pc. found that in my task mgr & after my reading around, discovered mediacenter was doing an auto update & that was the link to it. hope this helped 
******


----------

