Bugcheck system crashes - 0x0000001e and 0x0000007f


  1. Posts : 3
    Windows 7 Ultimate 64 bit
       #1

    Bugcheck system crashes - 0x0000001e and 0x0000007f


    A reliable Windows 7 Ultimate 64 system has started to crash and reboot. Three crashes in circa 40 days.

    It may be associated with update to ATI Graphics drivers or use of new software

    System Event Log which goes back to 2012 has the following 3 bugcheck events

    10/09/2013 14:31:17
    The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc000001d, 0xfffff880011b3541, 0x0000000000000001, 0xfffff880009e5d00). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 091013-51168-01.

    03/08/2013 05:39:16
    The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800030b1a2a, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080313-51527-01.

    01/08/2013 10:04:23
    The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f (0x0000000000000008, 0x0000000080050031, 0x00000000000006f8, 0xfffff8000310e3dd). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080113-41730-01.

    ---------------------------

    I tried to WinDbg to analyse but my knowledge of windows dumps analysis is minimal.

    Summary of WinDbg output from today's crash:

    Debugging Details:
    ------------------

    EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

    FAULTING_IP:
    fltmgr!FltpCacheCreateNames+341
    fffff880`011b3541 483bc3 cmp rax,rbx

    EXCEPTION_PARAMETER1: 0000000000000001
    EXCEPTION_PARAMETER2: fffff880009e5d00

    ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

    BUGCHECK_STR: 0x1E_c000001d
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    PROCESS_NAME: csrss.exe
    CURRENT_IRQL: 1
    LAST_CONTROL_TRANSFER: from fffff80003114748 to fffff800030c9b80

    FAILED_INSTRUCTION_ADDRESS:
    fltmgr!FltpCacheCreateNames+341
    fffff880`011b3541 483bc3 cmp rax,rbx

    STACK_TEXT:
    fffff880`0cddee48 fffff800`03114748 : 00000000`0000001e ffffffff`c000001d fffff880`011b3541 00000000`00000001 : nt!KeBugCheckEx
    fffff880`0cddee50 fffff800`030c9202 : fffff880`0cddf628 00000000`00000000 fffff880`0cddf6d0 fffffa80`05b56b10 : nt! ?? ::FNODOBFM::`string'+0x487ed
    fffff880`0cddf4f0 fffff800`030c735f : fffff880`0cddf6d0 fffffa80`20db5c01 fffffa80`211b3000 fffffa80`00000000 : nt!KiExceptionDispatch+0xc2
    fffff880`0cddf6d0 fffff880`011b3541 : fffffa80`045f5e58 fffffa80`05b56b10 00000000`6e664d46 00000000`00000000 : nt!KiInvalidOpcodeFault+0x11f
    fffff880`0cddf860 fffff880`011836b3 : fffffa80`05b56b10 fffffa80`1e080310 00000000`00000000 fffffa80`045f5e08 : fltmgr!FltpCacheCreateNames+0x341
    fffff880`0cddf8e0 fffff880`0119b2b9 : fffffa80`21085010 fffffa80`045f5800 fffffa80`21085000 fffffa80`0438b360 : fltmgr! ?? ::FNODOBFM::`string'+0x2b76
    fffff880`0cddf970 fffff800`033cad5c : 00000000`00000005 fffffa80`211987c8 fffffa80`1e080310 00000000`00000000 : fltmgr!FltpCreate+0x2a9
    fffff880`0cddfa20 fffff800`033c66d8 : fffffa80`045396d0 fffff800`00000000 fffffa80`21198610 fffffa80`00000001 : nt!IopParseDevice+0x14d3
    fffff880`0cddfb80 fffff800`033c78f6 : 00000000`00000000 fffffa80`21198610 fffffa80`05b57200 fffffa80`039e3360 : nt!ObpLookupObjectName+0x588
    fffff880`0cddfc70 fffff800`033c91fc : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`20c7a970 : nt!ObOpenObjectByName+0x306
    fffff880`0cddfd40 fffff800`033b3804 : fffff880`0cde0780 fffffa80`00100020 fffff880`0cde0168 fffff880`0cde0198 : nt!IopCreateFile+0x2bc
    fffff880`0cddfde0 fffff800`030c8e13 : fffff880`0cddff01 fffffa80`21085010 fffffa80`21222000 fffff800`031fa656 : nt!NtOpenFile+0x58
    fffff880`0cddfe70 fffff800`030c53d0 : fffff800`03375fec fffffa80`2116b5f0 00000000`00000101 000007ff`00000000 : nt!KiSystemServiceCopyEnd+0x13
    fffff880`0cde0078 fffff800`03375fec : fffffa80`2116b5f0 00000000`00000101 000007ff`00000000 fffff880`00000001 : nt!KiServiceLinkage
    fffff880`0cde0080 fffff800`030c8e13 : fffffa80`0396df30 fffff880`0cde0b01 00000000`746c6644 fffff880`0cde0bd8 : nt!NtCreateUserProcess+0x2eb
    fffff880`0cde0bb0 00000000`77181d8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`013eea28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181d8a

    Any help would be much appreciated

    I am including the Windbg output in the zipped SF_10-09-2013.zip attachment
    Last edited by sa2000; 17 Sep 2013 at 18:11. Reason: removed attachment as no one is analysing the dump info
      My Computer


  2. Posts : 1,436
    Windows 8.1 Pro x64
       #2

    Hello sa2000, welcome to SF!

    I'm surprised your computer even starts up with all of this:

    Code:
    Sidebar	%programfiles%\windows sidebar\sidebar.exe /autorun	NT AUTHORITY\LOCAL SERVICE	HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Sidebar	%programfiles%\windows sidebar\sidebar.exe /autorun	NT AUTHORITY\NETWORK SERVICE	HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    BBC iPlayer Desktop	bbc iplayer desktop.lnk	SA-Vista-1\sarmad	Startup
    Dropbox	dropbox.lnk	SA-Vista-1\sarmad	Startup
    mpnex31.exe - Shortcut	mpnex31.exe - shortcut.lnk	SA-Vista-1\sarmad	Startup
    Sidebar	c:\program files\windows sidebar\sidebar.exe /autorun	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    ehTray.exe	c:\windows\ehome\ehtray.exe	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    swg	"c:\program files (x86)\google\googletoolbarnotifier\googletoolbarnotifier.exe"	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Google Update	"c:\users\sarmad\appdata\local\google\update\googleupdate.exe" /c	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    SmileboxTray	"c:\users\sarmad\appdata\roaming\smilebox\smileboxtray.exe"	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    AdobeBridge		SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Skype	"c:\program files (x86)\skype\phone\skype.exe" /minimized /regrun	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Second Copy	"c:\program files (x86)\second copy 8\seccopy.exe" /initialwait=10	SA-Vista-1\sarmad	HKU\S-1-5-21-3752380366-2555111880-1006056450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Sidebar	%programfiles%\windows sidebar\sidebar.exe /autorun	SA-Vista-1\UpdatusUser	HKU\S-1-5-21-3752380366-2555111880-1006056450-1011\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    HPADVISOR		SA-Vista-1\UpdatusUser	HKU\S-1-5-21-3752380366-2555111880-1006056450-1011\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    HPADVISOR		SA-Vista-1\plex	HKU\S-1-5-21-3752380366-2555111880-1006056450-1014\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Plex Media Server	"c:\program files (x86)\plex\plex media server\plex media server.exe"	SA-Vista-1\plex	HKU\S-1-5-21-3752380366-2555111880-1006056450-1014\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    swg	"c:\program files (x86)\google\googletoolbarnotifier\googletoolbarnotifier.exe"	SA-Vista-1\plex	HKU\S-1-5-21-3752380366-2555111880-1006056450-1014\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Second Copy	"c:\program files (x86)\second copy 8\seccopy.exe"	SA-Vista-1\plex	HKU\S-1-5-21-3752380366-2555111880-1006056450-1014\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    AutoStart IR	c:\progra~2\wintv\ir.exe /quiet	Public	Common Startup
    WinTV Recording Status.	c:\progra~2\wintv\wintv7\wintvt~2.exe	Public	Common Startup
    LogMeIn GUI	"c:\program files (x86)\logmein\x64\logmeinsystray.exe"	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    AdobeAAMUpdater-1.0	"c:\program files (x86)\common files\adobe\oobe\pdapp\uwa\updaterstartuputility.exe"	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    CanonSolutionMenu	c:\program files (x86)\canon\solutionmenu\cnslmain.exe /logon	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Nvtmru	"c:\program files (x86)\nvidia corporation\nvidia update core\nvtmru.exe"	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Download CCleaner - PC Optimization and Cleaning - Free Download and disable the non important ones.

    Drivers 2008 and before are well known to cause problems. Please update to latest versions.

    Code:
    lmimirr.sys                 Tue Apr 10 17:32:45 2007 (461C108D)
    PxHlpa64.sys                Wed Mar 12 20:58:17 2008 (47D88A39)
    hotcore3.sys                Fri Jun 27 16:57:51 2008 (4865625F)
    LMIRfsDriver.sys            Mon Jul 14 11:26:56 2008 (487B7E50)
    
    http://www.carrona.org/drivers/driver.php?id=lmimirr.sys 
    http://www.carrona.org/drivers/driver.php?id=PxHlpa64.sys 
    http://www.carrona.org/drivers/driver.php?id=hotcore3.sys 
    http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys
    Where you running windows update when this crash happened?

    -Justin
      My Computer


  3. Posts : 3
    Windows 7 Ultimate 64 bit
    Thread Starter
       #3

    Thanks Justin.

    Whilst there is a lot of pre-loaded software, it is now used mainly for running Plex Media Server and streaming files to local devices - running in a different non admin account. I was not running Windows Update at the time. It was just running Plex Media Server and any periodic update checks it might have scheduled for the various apps on the system

    I will have a look at the drivers you identified and look into cccleaner. The AVG Internet Security 2013 software I have does have cleaning tool. Would you still recommend going for ccCleaner instead?

    EDIT: Also the SF Diagnostic Tool has a driver check tool built in - should I try that?
    Last edited by sa2000; 10 Sep 2013 at 11:28. Reason: added text
      My Computer


  4. Posts : 3
    Windows 7 Ultimate 64 bit
    Thread Starter
       #4

    I have looked at the 4 drivers
    Code:
    lmimirr.sys                 Tue Apr 10 17:32:45 2007 (461C108D)
    LMIRfsDriver.sys            Mon Jul 14 11:26:56 2008 (487B7E50)
    PxHlpa64.sys                Wed Mar 12 20:58:17 2008 (47D88A39)
    hotcore3.sys                Fri Jun 27 16:57:51 2008 (4865625F)
    
    Driver Reference Table - lmimirr.sys 
    http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys
    Driver Reference Table - PxHlpa64.sys 
    Driver Reference Table - hotcore3.sys
    The first two are part of the LogMeIn Free client software and I am on the latest version of the software.
    The PxHlpa64.sys appears to be Sonic CD/DVD driver and I have not been able to find the application that installed it.
    The hotcore3.sys is part of a Paragon Drive Backup / Partition Manager apps that I have. I will see if there is an update. But do they have impact if I am not actually making use of these drivers at time of crash?

    I have run AVG Internet Security 2013 Fix Perfomance tool and it fixed a number of what it detected as registry errors.
    I have also downloaded and run ccCleaner but I just did analyse as it it wanted to delete quite a lot of stuff that was not really errors. EG deleting the windows memory dump files ! I was not prepared to go through the options and untick what I did not want deleting

    Anyway - by posting on this forum I was hoping to get specific diagnosis from the kernel dump rather than general stuff which I could have done myself. I understand that it should be possible to establish which driver is causing the problem from analysis of the bug check dump/info = rather than guesswork on what it could be
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Đ Designer Media Ltd
All times are GMT -5. The time now is 21:04.
Find Us