Windows 7 Stop 0x0000007e

sjcf1 · 18 Sep 2010 at 20:47

Hi all.

My laptops recently been bluescreening, coming up with the error code 0x0000007E.

I've done some searching on the net, all I can find though is solutions relating to Nortan antivirus, which isn't installed. And a RAID issue from windows 2003. Since its got 1 hard drive, and doesn't use RAID. However, whenever I restart the PC, the laptop doesn't bluescreen. It only seems to be doing it on cold boot.

I'm running windows 7 dual booted with ubunutu 10.04 - though it was doing this before I installed ubuntu.

Spec of the laptop is a Lenovo N100
Intel Dual Core 1.66ghz T2300
2gb Ram
250gb Hard drive.

Has anyone got any ideas why its bluescreening?

Thanks in advance.

Pho · 18 Sep 2010 at 20:54

Do you have any files in c:\Windows\Minidump created around the times of the crashes? If so post them up here (or email them to me [see sig]) and I'll take a look.

(they're debug files which can be read with WinDbg)

sjcf1 · 18 Sep 2010 at 20:57

Thanks for the offer, I've emailed you with the minidump file.

Pho · 18 Sep 2010 at 21:41

PHP:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [091810-43025-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82a1b000 PsLoadedModuleList = 0x82b63810
Debug session time: Sat Sep 18 20:23:24.627 2010 (GMT+1)
System Uptime: 0 days 0:00:20.295
Loading Kernel Symbols
...............................................................
.........................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 82c3d4d5, 8ab23648, 8ab23220}

Probably caused by : ntkrpamp.exe ( nt!RtlEqualUnicodeString+2f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82c3d4d5, The address that the exception occurred at
Arg3: 8ab23648, Exception Record Address
Arg4: 8ab23220, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlEqualUnicodeString+2f
82c3d4d5 3b37            cmp     esi,dword ptr [edi]

EXCEPTION_RECORD:  8ab23648 -- (.exr 0xffffffff8ab23648)
ExceptionAddress: 82c3d4d5 (nt!RtlEqualUnicodeString+0x0000002f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000c5c8
Attempt to read from address 0000c5c8

CONTEXT:  8ab23220 -- (.cxr 0xffffffff8ab23220)
eax=0000000e ebx=8990face ecx=8990fac0 edx=00000004 esi=00790053 edi=0000c5c8
eip=82c3d4d5 esp=8ab23710 ebp=8ab2371c iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210206
nt!RtlEqualUnicodeString+0x2f:
82c3d4d5 3b37            cmp     esi,dword ptr [edi]  ds:0023:0000c5c8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  0000c5c8

READ_ADDRESS: GetPointerFromAddress: unable to read from 82b83718
Unable to read MiSystemVaType memory at 82b63160
 0000c5c8 

FOLLOWUP_IP: 
nt!RtlEqualUnicodeString+2f
82c3d4d5 3b37            cmp     esi,dword ptr [edi]

BUGCHECK_STR:  0x7E

LOCK_ADDRESS:  82b80f60 -- (!locks 82b80f60)

Resource @ nt!PiEngineLock (0x82b80f60)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0x82b80f60
	Thread Count  : 0
	Thread address: 0x00000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from 82c3d331 to 82c3d4d5

STACK_TEXT:  
8ab2371c 82c3d331 0000c5c8 8990face 00000201 nt!RtlEqualUnicodeString+0x2f
8ab23744 82c3d178 018624c0 8ab23790 00000201 nt!ObpLookupDirectoryUsingHash+0xa0
8ab23768 82c3c0e2 898624c0 8ab23790 00000201 nt!ObpLookupDirectoryEntry+0x80
8ab237cc 82c622d9 00000000 8ab23820 00000240 nt!ObpLookupObjectName+0x371
8ab2382c 82bc6419 8ab23858 84ac9438 00000000 nt!ObOpenObjectByName+0x165
8ab23878 82bc5e1e 8985a224 00000010 8ab23a38 nt!IopReferenceDriverObjectByName+0x46
8ab23918 82c0aea4 8985a238 00000001 8985a224 nt!PipCallDriverAddDeviceQueryRoutine+0x16a
8ab23950 82c130f8 00000001 8ab23a1c c0000034 nt!RtlpCallQueryRegistryRoutine+0x2cd
8ab239bc 82bc3120 40000000 80000054 8ab23a38 nt!RtlQueryRegistryValues+0x31d
8ab23a98 82bc288e 84ad5e78 8ab23cc8 00000000 nt!PipCallDriverAddDevice+0x383
8ab23c94 82ba6a42 84ac1370 85b0e388 8ab23cc8 nt!PipProcessDevNodeTree+0x15d
8ab23cd4 82a2ef9c 85b0e388 82b7ee80 84acbd48 nt!PiProcessStartSystemDevices+0x6d
8ab23d00 82a88f3b 00000000 00000000 84acbd48 nt!PnpDeviceActionWorker+0x241
8ab23d50 82c296d3 00000001 a3bf2177 00000000 nt!ExpWorkerThread+0x10d
8ab23d90 82adb0f9 82a88e2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!RtlEqualUnicodeString+2f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c3fac

STACK_COMMAND:  .cxr 0xffffffff8ab23220 ; kb

FAILURE_BUCKET_ID:  0x7E_nt!RtlEqualUnicodeString+2f

BUCKET_ID:  0x7E_nt!RtlEqualUnicodeString+2f

Followup: MachineOwner
---------

0: kd> !PCR
Cannot get PRCB address

Hmm, not entirely sure on this one. Run memtest86+ on your memory for at least one full pass (a couple of hours or so) to make sure there's no errors.

sjcf1 · 18 Sep 2010 at 21:45

I'll mem test.

Thanks for taking the time to look at the dumpfile.

sjcf1 · 19 Sep 2010 at 14:54

I tested the memory and its come up with no errors. Has anyone got any other ideas?

Destination · 20 Sep 2010 at 10:12

Have you tried a cold memtest, since it is unlikely but possible, that once everything gets to speed (and some heat) that an intermittant hardware fault is eliminated?

dk345 · 20 Sep 2010 at 10:18

I recently worked on a PC with the same error as that. Ran the diagnostics on the hard drive and it failed, that might not be your problem but it's worth a try?

brainchylde · 20 Sep 2010 at 10:28

Have you got all the up to date drivers? I had a problem with some W7 machines in work - the graphics driver was causing the machine to shut down completely. Very strange.

sjcf1 · 20 Sep 2010 at 19:00

Hikari Kisugi said:
Have you tried a cold memtest, since it is unlikely but possible, that once everything gets to speed (and some heat) that an intermittant hardware fault is eliminated?

Thanks, I'll try that. What is considered to be a cold boot? After a couple of hours.

dk345 said:
I recently worked on a PC with the same error as that. Ran the diagnostics on the hard drive and it failed, that might not be your problem but it's worth a try?

Never thought of checking the hard drive, will check it after the cold mem test

brainchylde said:
Have you got all the up to date drivers? I had a problem with some W7 machines in work - the graphics driver was causing the machine to shut down completely. Very strange.

Got all up to date drivers for it

MrMacca · 20 Sep 2010 at 22:42

Anything useful here? : http://www.carrona.org/bsodindx.html#0x0000007E