Win7 Ultimate Retail, BSOD

Hi all,

I received my copy of Win7 Ultimate on Wednesday after Amazon brought forward the delivery date owing to a postal strike that is currently underway in the UK. I proceeded with a clean install (x64 version), installed all my apps and was surprised to see, on my third day of using the OS, a BSOD. I was only running ITunes (my first song was playing in iTunes on this installation) and Outlook. I don't think anything else notable was running. I also have Norton 360 as my file scanner.

Below are my hardware details and underneath that you will find a WinDbg output. Have submitted the crash info to Microsoft via the 'Action' Centre, no fixes yet as obviously it is early days.

Not expecting a solution but grateful for any comments you might have.

Thanks all,
Martin

OS Name Microsoft Windows 7 Ultimate
Version 6.1.7600 Build 7600
OS Manufacturer Microsoft Corporation
System Manufacturer Dell Inc
System Model Dimension E521
System Type x64-based PC
Processor AMD Athlon(tm) 64 X2 Dual Core Processor 5600+, 2800 Mhz, 2 Core(s), 2 Logical Processor(s)
BIOS Version/Date Dell Inc 1.1.11, 02/08/2007
SMBIOS Version 2.4
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume3
Locale United Kingdom
Hardware Abstraction Layer Version = "6.1.7600.16385"
Installed Physical Memory (RAM) 4.00 GB
Total Physical Memory 4.00 GB
Available Physical Memory 1.83 GB
Total Virtual Memory 8.00 GB
Available Virtual Memory 5.55 GB
Page File Space 4.00 GB
Page File C:\pagefile.sys
--
!analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002b9853b, The address that the exception occurred at
Arg3: fffff88003124898, Exception Record Address
Arg4: fffff880031240f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!IopDeleteFile+24b
fffff800`02b9853b 488b09 mov rcx,qword ptr [rcx]

EXCEPTION_RECORD: fffff88003124898 -- (.exr 0xfffff88003124898)
ExceptionAddress: fffff80002b9853b (nt!IopDeleteFile+0x000000000000024b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000001300000000
Attempt to read from address 0000001300000000

CONTEXT: fffff880031240f0 -- (.cxr 0xfffff880031240f0)
rax=fffff8a00f57ddf0 rbx=fffffa800a0b3070 rcx=0000001300000000
rdx=fffff8a00f57ddf1 rsi=fffffa80039db080 rdi=fffffa8004502030
rip=fffff80002b9853b rsp=fffff88003124ad0 rbp=0000000000000001
r8=fffff8a00f57ddf0 r9=0000000000000110 r10=fffff800029ff900
r11=fffff8a010bfcca0 r12=fffffa80044f5d10 r13=fffff8a010c70600
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!IopDeleteFile+0x24b:
fffff800`02b9853b 488b09 mov rcx,qword ptr [rcx] ds:002b:00000013`00000000=????????????????
Resetting default scope

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000001300000000

READ_ADDRESS: 0000001300000000

FOLLOWUP_IP:
nt!IopDeleteFile+24b
fffff800`02b9853b 488b09 mov rcx,qword ptr [rcx]

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff8000288a0b4 to fffff80002b9853b

STACK_TEXT:
fffff880`03124ad0 fffff800`0288a0b4 : 00000000`00000000 00000000`00000000 fffffa80`039db080 00000000`00000000 : nt!IopDeleteFile+0x24b
fffff880`03124b60 fffff800`02b72f39 : 00000000`00000000 00000000`0008c081 fffffa80`0a0b3210 fffffa80`0008c081 : nt!ObfDereferenceObject+0xd4
fffff880`03124bc0 fffff800`029aaf6b : fffffa80`0a0b3218 00000000`00000001 00000000`00000000 0f4f072f`00000631 : nt!MiSegmentDelete+0xa1
fffff880`03124c00 fffff800`029ab5dd : 00000000`00000000 00000000`00000080 fffffa80`039cd040 0fc71f0f`00000012 : nt!MiProcessDereferenceList+0x23b
fffff880`03124cc0 fffff800`02b28166 : f2f0f0fc`b4f0f036 8f0c0f29`0e0f2f1f 70d8f4f2`6050f0f4 8f1b050f`0f0d0f0f : nt!MiDereferenceSegmentThread+0x10d
fffff880`03124d40 fffff800`02863486 : fffff800`029fde80 fffffa80`039e4510 fffff800`02a0bc40 0e6d2e0e`0f0f2d8f : nt!PspSystemThreadStartup+0x5a
fffff880`03124d80 00000000`00000000 : fffff880`03125000 fffff880`0311f000 fffff880`03124550 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!IopDeleteFile+24b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

STACK_COMMAND: .cxr 0xfffff880031240f0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_nt!IopDeleteFile+24b

BUCKET_ID: X64_0x7E_nt!IopDeleteFile+24b

Followup: MachineOwner
---------

usasma said:

Further info on the STOP 0x7e error: BSOD Index

As it states in the above link, possible causes are:

Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

Please check your disk space and let us know how much free space is available.
Please run the Windows 7 Upgrade Advisor to see if there's any incompatibilities noted - and please post the results of the report here (as the results aren't always easy to interpret). (The download is free here: Download details: Windows 7 Upgrade Advisor

I'd like to include one more "possible cause" for a 0x7E - absolutely frickin' anything at all :)

For the majority of common bugcheck types, those "possible cause" write-ups in the debugger docs are just an attempt to over-simplify that which cannot be simplified.

MartinLondonUK said:

Hi all,

Not expecting a solution but grateful for any comments you might have.

OH YE OF LITTLE FAITH ! ! :0

`

MartinLondonUK said:

Hi all,

I was only running ITunes (my first song was playing in iTunes on this installation) and Outlook. I don't think anything else notable was running. I also have Norton 360 as my file scanner...

It's nice to see you all gathered here for the party. . . so here are my thoughts on this -

Code:

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.
FAILURE_BUCKET_ID: X64_0x7E_nt!IopDeleteFile+24b

My guesstimate is that N360 is up to old tricks. The 0xc0000005 exception = memory access violation. Combine this with the IopDeleteFile instruction and I see a file deletion (or rename) being interfered with. I suggest the removal of N360 using the Norton Removal Tool.

Instructions --> Tech Support Forum - View Single Post - [SOLVED] Vista will not allow updates to programs

IMHO, 3rd party firewalls tend to interefere with Windows 7 (& Vista) system services by blocking local NETBIOS ports. I would recommend that you use the WIndows Firewall only along with your choice of anti-virus and see how things go.

Lastly, I was curious as to what you are running that is using > 2GB RAM ?

Code:

    Total Physical Memory 4.00 GB
    Avail Physical Memory 1.83 GB

Regards. . .

jcgriff2

.

Hi all again,

Whoa, quite a few responses! Ok, first off:-

How do your drivers look in 'Devices'? You may need to update one or more.

Thanks, Jacee. I went into Device Manager and went through the list from top to bottom. I updated the generic bluetooth adaptor for my Belkin USB, only to find it was unsigned. In the end, I updated it. I also updated my ATI Radeon drivers for my monitor as per the recommendation in the BSOD Index link from usasma:-

Please check your disk space and let us know how much free space is available.
Please run the Windows 7 Upgrade Advisor to see if there's any incompatibilities noted - and please post the results of the report here (as the results aren't always easy to interpret). (The download is free here: http://www.microsoft.com/downloads/d...1-2497c146af15

Usasma, my disk space is plentyful with 126GB from 222GB free on this drive. I have another drive free at the moment that I use for backup, which is the same capacity. Should not think disk space is a problem.

I have run and attached the Upgrade Advisors report for your persual. I also went to the Dell site on the Advisors suggestion, but it provided much the same information that you were offering.

Following on from above, I also went through the following list on the BSOD Index page:-

If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
Try changing video adapters.
Check with your hardware vendor for any BIOS updates.
Disable BIOS memory options such as caching or shadowing.

I can confirm that no BIOS updates are available, I suspect because this machine originally came out for the launch of Vista and that is when I got it. I also went into the BIOS and there were no means to configure memory options that I could see, certainly not caching or shadowing. I suspect it might well be a driver, as stated here in the WinDBG report...

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

...in which case the action taken above might remedy this. Only time will tell on that.

H2S04, I agree on that - I understand the ntkrnlmp.exe is the Windows Kernal? I.E. the most important file out of the whole B****Y lot! I read somewhere else that when something crashes, the Kernal can get the blame for it even though it is not at fault. So yes, these crash dumps can sometimes be too broad for their own good...

My guesstimate is that N360 is up to old tricks. The 0xc0000005 exception = memory access violation. Combine this with the IopDeleteFile instruction and I see a file deletion (or rename) being interfered with. I suggest the removal of N360 using the Norton Removal Tool.

Instructions --> Tech Support Forum - View Single Post - [SOLVED] Vista will not allow updates to programs

IMHO, 3rd party firewalls tend to interefere with Windows 7 (& Vista) system services by blocking local NETBIOS ports. I would recommend that you use the WIndows Firewall only along with your choice of anti-virus and see how things go.

You could be right jcgriff2, Norton 360 has been a tinker in the past and I have had to reinstall it a few times. I had a few blue screens a year back in Vista (not had any since) and they were torn between Norton and Firefox. Both were implicated in the debug anyway. I will hold out for the moment on Norton in case the action on the drivers has made any difference - one step at a time. That goes for memory too and all the static issues, I have not needed to look inside the box ever since I brought the machine. So handling memory or any other tinkling will be last resort. I choose Norton because at the time of getting Vista, I read about the different packages and how many viruses they could suck up. Norton was in the top three and One care was rock bottom with just 90%. Maybe it is time to review that choice, but what would be the package to go with these days?

Lastly, I was curious as to what you are running that is using > 2GB RAM ?

Just lots of things running together! I have attached a screen dump for your perusal. Everything looks normal anyway!

Right, that is me done. I am off to have a calorie busting session on the bike. Laters.

Thanks all for your comments and help. :)
Martin

Sorry ppl forgot to put the attachments on correctly.

MartinLondonUK said:

H2S04, I agree on that - I understand the ntkrnlmp.exe is the Windows Kernal? I.E. the most important file out of the whole B****Y lot! I read somewhere else that when something crashes, the Kernal can get the blame for it even though it is not at fault. So yes, these crash dumps can sometimes be too broad for their own good...

Yes, that's the kernel. Since it oversees and coordinates just about every transaction down there in the guts of the OS, bad data sourced from elsewhere frequently has a way of showing up as a crash "in the kernel". The actual number of times when the kernel itself is at fault is vanishingly small.

For what it's worth, I agree with JCGriff's notion - remove the AV as a test of its complicity.

Hi again,

Well tonight there was another alarming development. After engaging in other activities and then coming back to the computer, Windows 7 was reporting that it was not a genuine copy(!). That was surprising, considering that it was brought completely legit from Amazon.co.uk and that I actually saw Win successfully authenticate itself yesterday (it pauses for a few days from authenticating unless you specifically ask it too). Re-entering the key as instructed, though correct, did not work either. In the end I rebooted and while it initially said it was potentially counterfeit, after a while it reverted to Genuine. The Certificate, labeling and the disc holograms all seem in order, so maybe it was just a quirk. If I see it again I will be on the phone to Microsoft and Amazon like a shot! I have also taken a screen shot of the authenticated page with product key for future reference. Grr, should not have to do this!

Usasma, I have looked at the svchost line with Process Explorer. Having identified the PID as 956, I quickly located the services that it was tied to. In Process Explorer I was able to note that the command line for it :-

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

You can also see an attachment showing all the threads and the services related to it. Unfortunately I did not know exactly what I was meant to be doing in terms of identifying where the memory is going, just CPU usage (and most of the CPU figures flash there for just a few seconds)...

I gave the notion about Norton some serious thought, now that you are advocating to remove it. I should add that this is the version for Win7, 3.5.2.11, not 3.0 which is the general version for Vista et al. Considering that drivers might also be a factor and that there was a line mentioning vista driver faults in WinDbg, the updates I did in my earlier message might have fixed it. I say might, as that is the million dollar question, and of course I don't know when I will get my next BSOD - days, weeks, months, years, maybe? What I will certainly do is consider having Norton on for 7 days, and then 7 days off, with FreeAVG as the backup. I know that would put things on hold in terms of updating to here for a few days, but if there is any news I will be sure to post. :) At least I can monitor things over a short period. As I installed last Wednesday I will switch over this Wednesday and if I need to look for a new anti-virus with good coverage, I will. Simple.

I will definitely be back here to report, hopefully success.

Catch you around and thanks again for the help so far. Much appreciated.
Martin