BSOD error, BCCode: 1000007e, posted using instructions

[ladyinred]

This is my second time receiving a blue screen error in the last 2 weeks. I received the BSOD about a minute after uninstalling a statistical program (SPSS AMOS), when I was just using Firefox. This morning my system time was off by 20 minutes and I noticed it was about 2 minutes slow last night. I synced it with the server 1 hour ago and it has been working since, and the BIOS time is correct. This might be an unrelated issue, but I wanted to mention it. I also just noticed that after my computer restarted following the BSOD, my C drive running my OS is less full than it was this morning by about 6GB (it was very full with about 4GB left). The program I had just uninstalled prior to the BSOD was a large program, but not THAT large.

I am using a Dell Inspiron 1464 with Windows 7 Home Professional 64-bit. The computer and OS are about 2 years old. Dell installed a new fan, heatsink, and motherboard last week (in between the 2 BSODs) because my fan wasn't working correctly. I am monitoring the time issue in case a bad CMOS battery was installed.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF88001B08D6E
BCP3: FFFFF8800854E908
BCP4: FFFFF8800854E160
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

 

[ladyinred]

My dump files and system health files as instructed are attached. I am not sure why the system health file says I am not running an antivirus software. I use Avast Free and Ad-Aware Ad-watch Live for spyware.

 

[writhziden]

The .zip file did not include the crash reports but instead the Windows_NT6_BSOD_v3.03_jcgriff2_.exe file. Please provide us with the full reports so we may help you determine the cause of the crashes. Thanks you.

 

[ladyinred]

Oh man, I'm sorry... haha. Here are the correct files! Thanks!

 

[writhziden]

Security Software:

aawservice.exe	c:\program files (x86)\lavasoft\ad-aware\aawservice.exe	1440	8	200	1380	4/18/2012 8:54 AM	9.0.0.0	2.05 MB (2,152,152 bytes)	3/20/2012 1:41 PM
aawtray.exe	c:\program files (x86)\lavasoft\ad-aware\aawtray.exe	3116	8	200	1380	4/18/2012 8:54 AM	9.0.0.0	1.13 MB (1,187,072 bytes)	3/20/2012 1:41 PM
avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1352	8	200	1380	4/18/2012 8:54 AM	7.0.1426.0	43.72 KB (44,768 bytes)	3/28/2012 9:20 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	2320	8	200	1380	4/18/2012 8:55 AM	7.0.1426.0	4.05 MB (4,241,512 bytes)	3/28/2012 9:20 PM

Remove either ad-aware or avast! Having two security programs that accomplish the same tasks can cause conflicts and lead to crashes.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\ladyinred\BSOD041912\Windows_NT6_BSOD_jcgriff2\041812-83772-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`03467000 PsLoadedModuleList = 0xfffff800`036ab650
Debug session time: Wed Apr 18 07:52:04.237 2012 (UTC - 6:00)
System Uptime: 0 days 0:21:22.704
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88001b08d6e, fffff8800854e908, fffff8800854e160}

Probably caused by : volsnap.sys ( volsnap!VspCollectLazyOffsetsPass+1be )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88001b08d6e, The address that the exception occurred at
Arg3: fffff8800854e908, Exception Record Address
Arg4: fffff8800854e160, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
volsnap!VspCollectLazyOffsetsPass+1be
fffff880`01b08d6e 44892490        mov     dword ptr [rax+rdx*4],r12d

EXCEPTION_RECORD:  fffff8800854e908 -- (.exr 0xfffff8800854e908)
ExceptionAddress: fffff88001b08d6e (volsnap!VspCollectLazyOffsetsPass+0x00000000000001be)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  fffff8800854e160 -- (.cxr 0xfffff8800854e160)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000004
rdx=0000000000000000 rsi=0000000000000002 rdi=fffff8800854ec80
rip=fffff88001b08d6e rsp=fffff8800854eb40 rbp=0000000000000001
 r8=0000000000000008  r9=0000000000000008 r10=fffff8800854ec50
r11=0000000000000004 r12=0000000000008323 r13=fffffa80073446d8
r14=ffffffffffffffe0 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00210293
volsnap!VspCollectLazyOffsetsPass+0x1be:
fffff880`01b08d6e 44892490        mov     dword ptr [rax+rdx*4],r12d ds:002b:00000000`00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003715100
 0000000000000000 

FOLLOWUP_IP: 
volsnap!VspCollectLazyOffsetsPass+1be
fffff880`01b08d6e 44892490        mov     dword ptr [rax+rdx*4],r12d

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88001b2914c to fffff88001b08d6e

STACK_TEXT:  
fffff880`0854eb40 fffff880`01b2914c : 00000000`00000002 fffff880`0854ec40 fffff880`0854ec20 fffff880`0854ec60 : volsnap!VspCollectLazyOffsetsPass+0x1be
fffff880`0854ebd0 fffff880`01b2acde : fffffa80`0001fe40 fffffa80`04bbc190 fffff880`0854ed40 fffffa80`07344728 : volsnap!VspPopulateFreeBlocksBitmap+0x46c
fffff880`0854ecf0 fffff800`0377dfda : fffffa80`00000000 fffffa80`044d6b60 00000000`00000080 fffffa80`03b4d9e0 : volsnap!VspLazyPreCopyOnWriteWorker+0xce
fffff880`0854ed40 fffff800`034d49c6 : fffff880`03163180 fffffa80`044d6b60 fffffa80`03b61b60 00000000`bffff000 : nt!PspSystemThreadStartup+0x5a
fffff880`0854ed80 00000000`00000000 : fffff880`0854f000 fffff880`08549000 fffff880`0854e820 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  volsnap!VspCollectLazyOffsetsPass+1be

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce792c8

STACK_COMMAND:  .cxr 0xfffff8800854e160 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_volsnap!VspCollectLazyOffsetsPass+1be

BUCKET_ID:  X64_0x7E_volsnap!VspCollectLazyOffsetsPass+1be

Followup: MachineOwner
---------

The crashes are related to volume shadow copy, which is part of the Windows backup software. Your older crash from March 28th was the same.

If you are using third party backup software, this could be causing these crashes. I would suggest that you http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html and see how the system responds. Given how infrequently you are having crashes, this may take a bit of time to debug. I will remain subscribed to the thread as you progress with debugging steps.

NOTE: The above could be related to your security software conflict, as well. It is possible both security programs were trying to access the backup drivers at once and led to the crashes.

 

[ladyinred]

Thank you for your help. I will try the steps outlined to perform a clean startup. I have also disabled the live checking from Ad-aware Ad-watch Live. I confirmed that Avast Antivirus does look for spyware as well as viruses, so I shouldn't need Ad-aware to also be actively watching for spyware. It should be fine to keep Ad-aware installed and use it just to scan my system every few months, correct? I find that Ad-aware does a good job of finding spyware.

One of my concerns is that my C drive (containing just my OS and program files, not documents) went from 55GB used out of 59GB to 47GB out of 59GB after the crash. I know it was 55GB before because I noticed the high level, emptied my recycle bin (then had 55GB) and then tried to identify programs I didn't need that I could uninstall to free up my C drive. I then uninstalled one statistical program just right before the crash, but that software says it requires 125MB of free space to operate, so it certainly wasn't taking up 8GB. Should I be concerned about this reduction and does this seem related to issues with the volume shadow copy? I haven't been able to identify anything that is missing from the C drive.

 

[writhziden]

The volume shadow copy driver may have been in use creating a system restore point. Windows does this periodically (about once a week) or when updates are installed/programs are removed or added. Uninstalling a program may have started the system restore, and then the system crashed when the restore process was started. The space that is missing is likely due to a new restore point starting to replace an old one (the old one was probably around 8 GB in size, or multiple restore points totaling 8 GB were removed to make room for the new one).

Additionally, you may want to make sure your restore points are working properly. Manually create a restore point and see if it finishes.