BSOD on shutdown

bertie11 · 28 Jul 2010

A couple of days ago when I went to shut my system down it gave me a BSOD showing a Stop:7E. Now I sometimes get a :7F and I had a :50 as well but is mailnly :7E every time I try to shut down.

I have tried system restore but that always fails to finish and it can't tell me why. I tried all 3 restore dates that showed. Memory tests on the system repair disk found no fault and system repair itself couldn't find anything. This is Win 7 HP 32bit.

The system boots up OK and I also tried last known good config which made no difference so I am at a loss how to proceed now.

I did wonder if it started when I did a Mozy backup and then turned the external USB drive off without using the Safely remove hardware icon in the system tray. If it is that, how can I fix it?
With thanks for any help.

Wallonn7 · 28 Jul 2010

bertie11 said:

A couple of days ago when I went to shut my system down it gave me a BSOD showing a Stop:7E. Now I sometimes get a :7F and I had a :50 as well but is mailnly :7E every time I try to shut down.

I have tried system restore but that always fails to finish and it can't tell me why. I tried all 3 restore dates that showed. Memory tests on the system repair disk found no fault and system repair itself couldn't find anything. This is Win 7 HP 32bit.

The system boots up OK and I also tried last known good config which made no difference so I am at a loss how to proceed now.

I did wonder if it started when I did a Mozy backup and then turned the external USB drive off without using the Safely remove hardware icon in the system tray. If it is that, how can I fix it?
With thanks for any help.

Hi, buddy.
I suggest you take a look at the following topic before anything else.
https://www.sevenforums.com/crashes-d...tructions.html
This will help the BSOD Team solve your problem more quickly.
Thanks!

"PLEASE REP ANYONE WHO HELPS YOU"

bertie11 · 28 Jul 2010

A couple of days ago when I went to shut my system down it gave me a BSOD showing a Stop:7E. Now I sometimes get a :7F and I had a :50 as well but is mailnly :7E every time I try to shut down.

I have tried system restore but that always fails to finish and it can't tell me why. I tried all 3 restore dates that showed. Memory tests on the system repair disk found no fault and system repair itself couldn't find anything.

The system boots up OK and I also tried last known good config which made no difference so I am at a loss how to proceed now.

I did wonder if it started when I did a Mozy backup and then turned the external USB drive off without using the Safely remove hardware icon in the system tray. If it is that, how can I fix it?
With thanks for any help

This is Win 7 HP 32bit.
Original software was XP Pro but I formatted and installed a full retail Windows 7.
Hardware about 2 1/2 years old, I installed Win 7 about 6 months ago.

zigzag3143 · 28 Jul 2010

bertie11 said:

A couple of days ago when I went to shut my system down it gave me a BSOD showing a Stop:7E. Now I sometimes get a :7F and I had a :50 as well but is mailnly :7E every time I try to shut down.

I have tried system restore but that always fails to finish and it can't tell me why. I tried all 3 restore dates that showed. Memory tests on the system repair disk found no fault and system repair itself couldn't find anything.

The system boots up OK and I also tried last known good config which made no difference so I am at a loss how to proceed now.

I did wonder if it started when I did a Mozy backup and then turned the external USB drive off without using the Safely remove hardware icon in the system tray. If it is that, how can I fix it?
With thanks for any help

This is Win 7 HP 32bit.
Original software was XP Pro but I formatted and installed a full retail Windows 7.
Hardware about 2 1/2 years old, I installed Win 7 about 6 months ago.

These crashes were caused by a few things. First snapman.sys (part of the acronis app), and second some ancient drivers dating back to 2004.

I would remove acronis, and update the drivers.
How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

let us know if you need further assistance

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\072810-37112-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x83419000 PsLoadedModuleList = 0x83561810
Debug session time: Wed Jul 28 06:43:15.882 2010 (GMT-4)
System Uptime: 0 days 0:14:02.317
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image snapman.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {bad02509, 1, 8649ff97, 2}


Could not read faulting driver name
Probably caused by : snapman.sys ( snapman+14fe5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: bad02509, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 8649ff97, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 83581718
Unable to read MiSystemVaType memory at 83561160
 bad02509 

FAULTING_IP: 
+19
8649ff97 8694ff49860000  xchg    dl,byte ptr [edi+edi*8+8649h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 89a14fe5 to 8649ff97

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
8d3c2c98 89a14fe5 879545d8 879545d8 8649ec88 0x8649ff97
8d3c2d50 836276bb 8649c738 aa0df9df 00000000 snapman+0x14fe5
8d3c2d78 8382eba9 ffffffff 83452c74 a4769a67 nt!PspSystemThreadStartup+0x9e
8d3c2d90 834d90f9 89a1ece0 8649c738 00000000 hal!KfLowerIrql+0x61
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
snapman+14fe5
89a14fe5 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  snapman+14fe5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: snapman

IMAGE_NAME:  snapman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b700653

FAILURE_BUCKET_ID:  0x50_BADMEMREF_snapman+14fe5

BUCKET_ID:  0x50_BADMEMREF_snapman+14fe5

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: bad02509, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 8649ff97, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 83581718
Unable to read MiSystemVaType memory at 83561160
 bad02509 

FAULTING_IP: 
+19
8649ff97 8694ff49860000  xchg    dl,byte ptr [edi+edi*8+8649h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 89a14fe5 to 8649ff97

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
8d3c2c98 89a14fe5 879545d8 879545d8 8649ec88 0x8649ff97
8d3c2d50 836276bb 8649c738 aa0df9df 00000000 snapman+0x14fe5
8d3c2d78 8382eba9 ffffffff 83452c74 a4769a67 nt!PspSystemThreadStartup+0x9e
8d3c2d90 834d90f9 89a1ece0 8649c738 00000000 hal!KfLowerIrql+0x61
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
snapman+14fe5
89a14fe5 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  snapman+14fe5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: snapman

IMAGE_NAME:  snapman.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b700653

FAILURE_BUCKET_ID:  0x50_BADMEMREF_snapman+14fe5

BUCKET_ID:  0x50_BADMEMREF_snapman+14fe5

Followup: MachineOwner
---------

OLD DRIVERS DATING FROM AS FAR BACK AS 2004. DESPERATELY NEED UPDATING

Code:

ASACPI.sys        0x915c7000    0x915c8420    0x00001420    0x411c2d04    8/12/2004 22:52:52                        
Afc.sys        0x91b1c000    0x91b24000    0x00008000    0x421c29af    2/23/2005 02:58:55                        
cdrport.sys        0x904ad000    0x904ae200    0x00001200    0x4231489d    3/11/2005 03:28:29                        
cdrblock.sys        0x904af000    0x904b1880    0x00002880    0x42aea493    6/14/2005 05:34:11                        
hardlock.sys        0x9f01f000    0x9f0c6400    0x000a7400    0x42e7874d    7/27/2005 09:08:29                        
secdrv.SYS        0x9f18d000    0x9f197000    0x0000a000    0x45080528    9/13/2006 09:18:32                        
Pcouffin.sys        0x92600000    0x9260b900    0x0000b900    0x457584b9    12/5/2006 10:39:53                        
CM108.sys        0x8b432000    0x8b5bc000    0x0018a000    0x468360b0    6/28/2007 03:18:08                        
tifsfilt.sys        0x8b5d7000    0x8b5e0340    0x00009340    0x46d5687d    8/29/2007 08:37:17                        
ckldrv.sys        0x90ffa000    0x90ffec80    0x00004c80    0x47dea040    3/17/2008 12:45:52                        
BMLoad.sys        0x89c82000    0x89c87800    0x00005800    0x48ee6e7f    10/9/2008 16:50:07                        
SASDIFSV.SYS        0x90a21000    0x90a27000    0x00006000    0x49c7f748    3/23/2009 16:55:36                        
Ph3xIB32.sys        0x9140a000    0x9154a200    0x00140200    0x4a049a27    5/8/2009 16:46:31                        
spldr.sys        0x89bdd000    0x89be5000    0x00008000    0x4a084ebb    5/11/2009 12:13:47                        
nvlddmkm.sys        0x92626000    0x92f8b940    0x00965940    0x4a0c7fdb    5/14/2009 16:32:27                        
amdxata.sys        0x893f5000    0x893fe000    0x00009000    0x4a12f30f    5/19/2009 13:57:35

bertie11 · 29 Jul 2010

Thanks Ken, I will settle down and sort through your suggestions and post back.

bertie11 · 30 Jul 2010

Quick update. I removed Acronis and I could then closedown and restart Ok. Quite why that happened I've no idea. The system was showing signs of corrupted files as well, some programs wouldn't run and then my internet connection went so I restored another Acronis image from a month ago and I now have a working system, well, I'm now havivg trouble verifying Macrium and Acronis images!. I've run Spinrite and done a disk check of C: from My Computer, no faults. A bit frustrating not having a good image to rely on!

I haven't had time to look at the old files yet though, but I will.

Thanks.

Wallonn7 · 30 Jul 2010

bertie11 said:

Quick update. I removed Acronis and I could then closedown and restart Ok. Quite why that happened I've no idea. The system was showing signs of corrupted files as well, some programs wouldn't run and then my internet connection went so I restored another Acronis image from a month ago and I now have a working system, well, I'm now havivg trouble verifying Macrium and Acronis images!. I've run Spinrite and done a disk check of C: from My Computer, no faults. A bit frustrating not having a good image to rely on!

I haven't had time to look at the old files yet though, but I will.

Thanks.

I had the impression that you back up the system very sporadically. This impression is due to you having used a system image from a month ago. And a month is a long time when dealing with something that changes all the time, either by updates of OS itself, or by those linked with the rest. I regret the inconvenience this may cause and you're going through it ... Anyway, good to know that the reason that brought you here seem to have found the solution. If you have something else to add, please let us know!

"PLEASE REP ANYONE WHO HELPS YOU"

bertie11 · 30 Jul 2010

I normally take an image every week but the most recent image failed when it was restoring, it was corrupted for some reason and I had forgotten to take others earlier!
Not good ,lesson learnt!

Wallonn7 · 30 Jul 2010

bertie11 said:

I normally take an image every week but the most recent image failed when it was restoring, it was corrupted for some reason and I had forgotten to take others earlier!
Not good ,lesson learnt!

Do you use the option to check the backups after you create them?! If not, start doing. Do the same before restoring. This way, you prevent being caught by surprise again!

"PLEASE REP ANYONE WHO HELPS YOU"

bertie11 · 31 Jul 2010

In Acronis True Image2010 Backup, is there an option to verify after backup, only I can't see one.
I have now set verify before recovery which I hadn't done before. I really need to verify after backup, not before recovery.

Good point!