BSOD 0x0000007e

cypherprops · 06 Nov 2012

Stop: 0x00000003B NPFS.sys

Arc · 07 Nov 2012

VMware USB monitor

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff98001554fb0, 2, 1, fffff80003199c48}

*** WARNING: Unable to verify timestamp for hcmon.sys
*** ERROR: Module load completed but symbols could not be loaded for hcmon.sys
Probably caused by : hcmon.sys ( hcmon+6295 )

Followup: MachineOwner
---------

Try to upgrade it.

Update Intel 82577LM Gigabit NIC from Intel Download Center

Code:

fffff880`08e66510  fffff880`0437141cUnable to load image \SystemRoot\system32\DRIVERS\e1k62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1k62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1k62x64.sys
 e1k62x64+0x2141c

Perform Disc check

Update your SSD's Firmware (skip, if it is not SSD)
Reseat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Disable DV now.

upload your MSINFO32.nfo file.

Click on the start button
Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
Give the time for processing, it will save a .nfo file on your desktop.
Zip it, and upload it following the instruction.

cypherprops · 07 Nov 2012

Msinfo32

cypherprops · 07 Nov 2012

Ok so first regarding "hcmon.sys" Vmware Usb monitor?

Its because of USB which i am using inside the Vmware? Whats the fix for this?

2nd - How to update Intel 82577LM Gigabit NIC driver?
I usually go to the intel website and select the Desktop board model number and It asks for Os and gives all the drivers.
and i use Lan connection driver.

What is the method to update Intel 82577LM Gigabit NIC driver?

3rd- whats SSD? And how can i detect if i have SSD?
How to update the drivers for SSD?

Reset the Sata and Power in BIOS?

4th - I can do the Disk check, that i have also done before.

5th- "Seatool for dos: SeaTools | Seagate download" <-- are these drivers for my Harddisk or the portable Seagate Back up plus HD which i bought recently?

Also how to get the right Seatool for dos: SeaTools | Seagate driver and Can i Burn the drivers in USB flash drive and then boot it from that and then do the scan??

Sorry im kind of novice in this solving BSOD's :S

Arc · 07 Nov 2012

1st: Try to update your vmware version.

2nd: A link is given there, try it.

3rd: Solid-state drive - Wikipedia, the free encyclopedia. If you have you, you should have known it.

4th: then go for it :)

5th:

Unplug, clean ard replug those two.

5th: those are not drivers, but tools to check the health of the discs. If those are newly purchased, better you take them to the vendor.

cypherprops · 08 Nov 2012

wel im back and i did everything u said

Did updated the firmware of the Hard disk
Did Long scan with Seagate tools on windows
Did Check dirk on all drives
And then formatted the drive which had win 7

I did a Fresh clean install of Windows 7
I installed the Intel drivers and Nvidia Driver from official website by using the Detection utility just in case if im using outdated drivers.

And I did the updates and Right at the Last update of Installing ".Net framework 4" got a BSOD grrrrrrr

I got the minidump but i went ahead and re downloaded the .net framework Update and it worked somehow everything was smooth.

So just to check i downloaded the Windows debugging tools to check whats in minidump. And Got something "nt" in Module Name

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\110912-31418-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02e66000 PsLoadedModuleList = 0xfffff800`030aa670
Debug session time: Fri Nov 9 02:04:09.063 2012 (UTC + 5:30)
System Uptime: 0 days 0:02:58.562
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003010617, fffff8800926c730, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003010617, Address of the instruction which caused the bugcheck
Arg3: fffff8800926c730, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ExAllocatePoolWithTag+537
fffff800`03010617 48895808 mov qword ptr [rax+8],rbx

CONTEXT: fffff8800926c730 -- (.cxr 0xfffff8800926c730)
rax=ffeff8a009c23830 rbx=fffffa8006bd5b90 rcx=fffff8a009c20830
rdx=0000000000000002 rsi=0000000000000041 rdi=0000000000000001
rip=fffff80003010617 rsp=fffff8800926d110 rbp=0000000000001000
r8=0000000000000001 r9=fffffa8006bd5b90 r10=fffffa8006bd5288
r11=0000000000000002 r12=fffffa8006bd5280 r13=0000000000000000
r14=fffffa80072a7b50 r15=000000006e664d46
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`03010617 48895808 mov qword ptr [rax+8],rbx ds:002b:ffeff8a0`09c23838=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80003010617

STACK_TEXT:
fffff880`0926d110 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537

FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+537
fffff800`03010617 48895808 mov qword ptr [rax+8],rbx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be

STACK_COMMAND: .cxr 0xfffff8800926c730 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+537

BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner
---------

So i googled about "nt" and "ntkrnlmp.exe" and on some forum someone said do a "SFC /SCANNOW" atleast 3 times having restarts in between each scan.

First scan stopped at 48% and i retarted and tried SFC /SCANNOW again and it got finished at 100%.

Now just to make sure i restarted and and did another scan and it got stuck at 18%

And then i restarted and did 1 last Scan and i got another BSOD

This time "Module Name" Pool corruption

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\110912-17690-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02e5e000 PsLoadedModuleList = 0xfffff800`030a2670
Debug session time: Fri Nov 9 06:13:40.013 2012 (UTC + 5:30)
System Uptime: 0 days 0:03:29.511
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800030099bc, fffff880031af848, fffff880031af0a0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030099bc, The address that the exception occurred at
Arg3: fffff880031af848, Exception Record Address
Arg4: fffff880031af0a0, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ExDeferredFreePool+100
fffff800`030099bc 4c8b02 mov r8,qword ptr [rdx]

EXCEPTION_RECORD: fffff880031af848 -- (.exr 0xfffff880031af848)
ExceptionAddress: fffff800030099bc (nt!ExDeferredFreePool+0x0000000000000100)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff880031af0a0 -- (.cxr 0xfffff880031af0a0)
rax=fffff8a008ac6340 rbx=0000000000000004 rcx=fffffa8006bd7a40
rdx=ffeff8a008aac740 rsi=0000000000000000 rdi=fffff8a0081d5ac0
rip=fffff800030099bc rsp=fffff880031afa80 rbp=0000000000000000
r8=ffeff8a008aac740 r9=fffff8a008ab4410 r10=0000000000000000
r11=0000000000000000 r12=fffffa8006bd7500 r13=0000000000000000
r14=0000000000000010 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`030099bc 4c8b02 mov r8,qword ptr [rdx] ds:002b:ffeff8a0`08aac740=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310c100
ffffffffffffffff

FOLLOWUP_IP:
nt!ExDeferredFreePool+100
fffff800`030099bc 4c8b02 mov r8,qword ptr [rdx]

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff800030091a1 to fffff800030099bc

STACK_TEXT:
fffff880`031afa80 fffff800`030091a1 : fffffa80`087e8801 fffff8a0`08809e30 fffffa80`06c60b50 fffff800`0304fe80 : nt!ExDeferredFreePool+0x100
fffff880`031afb10 fffff800`031be12c : fffff800`030da600 fffff800`0307a2d8 fffffa80`624e4d43 00000000`00000000 : nt!ExFreePoolWithTag+0x411
fffff880`031afbc0 fffff800`031be1c0 : fffff8a0`02d51130 00000000`2b1dd868 fffff8a0`00978010 ffffffff`ffffffff : nt!CmpDereferenceNameControlBlockWithLock+0xdc
fffff880`031afbf0 fffff800`0319e1ef : fffff8a0`02d51130 fffff800`031bc730 fffff800`624e4d43 fffff800`0307a2d8 : nt!CmpCleanUpKcbCacheWithLock+0x34
fffff880`031afc20 fffff800`031bc921 : fffff8a0`02d51130 00000000`0378361a fffff8a0`00978010 00000000`00000000 : nt!CmpDereferenceKeyControlBlockWithLock+0x13f
fffff880`031afc50 fffff800`02ee6641 : fffff800`0307a2d8 fffffa80`06c60b50 00000000`00000000 fffffa80`06c60b50 : nt!CmpDelayDerefKCBWorker+0x1f1
fffff880`031afcb0 fffff800`03173e5a : 00000000`00000000 fffffa80`06c60b50 00000000`00000080 fffffa80`06c44040 : nt!ExpWorkerThread+0x111
fffff880`031afd40 fffff800`02ecdd26 : fffff880`02fd5180 fffffa80`06c60b50 fffff880`02fdffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031afd80 00000000`00000000 : fffff880`031b0000 fffff880`031aa000 fffff880`031af8b0 00000000`00000000 : nt!KxStartSystemThread+0x16

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+100

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

STACK_COMMAND: .cxr 0xfffff880031af0a0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_nt!ExDeferredFreePool+100

BUCKET_ID: X64_0x7E_nt!ExDeferredFreePool+100

Followup: Pool_corruption
---------

Plz help

Arc · 09 Nov 2012

► Scan the system for possible virus infection.

After getting the results, update the display driver to latest. I am using 310.33 beta, it works fine.