BSOD

[CarlTR6]

Error code 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M. Usual caused by Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control.

Kernel base = 0xfffff800`02a53000 PsLoadedModuleList = 0xfffff800`02c90e50
Debug session time: Mon Aug 30 19:13:28.617 2010 (GMT-4)
System Uptime: 0 days 7:40:23.006
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002b45a86, fffff880033e78a8, fffff880033e7110}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+49705 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002b45a86, The address that the exception occurred at
Arg3: fffff880033e78a8, Exception Record Address
Arg4: fffff880033e7110, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt! ?? ::FNODOBFM::`string'+49705
fffff800`02b45a86 488b00          mov     rax,qword ptr [rax]

EXCEPTION_RECORD:  fffff880033e78a8 -- (.exr 0xfffff880033e78a8)
ExceptionAddress: fffff80002b45a86 (nt! ?? ::FNODOBFM::`string'+0x0000000000049705)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880033e7110 -- (.cxr 0xfffff880033e7110)
rax=6d3d6362b5379cf8 rbx=0000000000000000 rcx=6d3d6362b5379cf8
rdx=fffffa80079a7000 rsi=fffff880033e7ba0 rdi=fffffa800438ab48
rip=fffff80002b45a86 rsp=fffff880033e7ae0 rbp=0000000000000002
 r8=0000000000000001  r9=fffffa800438ab48 r10=0000000000000005
r11=0000000000000000 r12=0000000000000001 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt! ?? ::FNODOBFM::`string'+0x49705:
fffff800`02b45a86 488b00          mov     rax,qword ptr [rax] ds:002b:6d3d6362`b5379cf8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  LogonUI.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfb0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+49705
fffff800`02b45a86 488b00          mov     rax,qword ptr [rax]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002ad7ee2 to fffff80002b45a86

STACK_TEXT:  
fffff880`033e7ae0 fffff800`02ad7ee2 : 00000000`00006be7 00000000`00000000 fffffa80`00000000 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x49705
fffff880`033e7b80 fffff800`02ad8173 : 00000000`00000008 fffff880`033e7c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`033e7bd0 fffff800`02d67c06 : fffffa80`03b7c680 00000000`00000080 fffffa80`03b50990 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`033e7d40 fffff800`02aa1c26 : fffff880`009b1180 fffffa80`03b7c680 fffff880`009bc0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`033e7d80 00000000`00000000 : fffff880`033e8000 fffff880`033e2000 fffff880`033e7710 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+49705

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff880033e7110 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!_??_::FNODOBFM::_string_+49705

BUCKET_ID:  X64_0x7E_nt!_??_::FNODOBFM::_string_+49705

Followup: MachineOwner
---------

This one points to memory corruption.

Let's test your RAM

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Post back with the results.

 

[Jonathan_King]

Update your InterVideo drivers:

regi.sys     Tue Oct 31 04:22:11 2006

Enable driver verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

 

[sawwei]

This one points to memory corruption.

Carl...
I have tested my RAM for 7 passed and it did not show any errors.
You mentioned in the mail that many possibility can caused this particular BSOD, but the error pointed to memory corruption.
What do you think we should do next to check and configure the real problems?

Update your InterVideo drivers:

regi.sys     Tue Oct 31 04:22:11 2006

Enable driver verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Thanks for your advice Jonathan.
Do you think that one was the cause of my BSOD ?
Come to think of it, I don't recall I have install anything from Intervideo.
How can I delete that driver ?
I enabled the Driver Verifier, restarted, but then I stucked on the Windows 7 logo and my system was not responding.

 

[Jonathan_King]

Looking through your list of installed programs, I see Cyberlink YouCam. Please go into Programs and Features, and remove that. It probably came pre-installed on your computer.

Keep trying to boot with Verifier enabled. If it is a hardware issue, it will likely boot after a few tries. If it is a low-level driver causing the issue, it may not boot ever.

Your Intel networking drivers should be updated. Try these ones:  Intel® PRO/Wireless and WiFi Link Drivers-Only for Windows 7*

 

[sawwei]

Looking through your list of installed programs, I see Cyberlink YouCam. Please go into Programs and Features, and remove that. It probably came pre-installed on your computer.

Keep trying to boot with Verifier enabled. If it is a hardware issue, it will likely boot after a few tries. If it is a low-level driver causing the issue, it may not boot ever.

Your Intel networking drivers should be updated. Try these ones:  Intel® PRO/Wireless and WiFi Link Drivers-Only for Windows 7*

Hi Jonathan,
Is the Cyberlink YouCam related to the Intervideo Driver or that's the program that caused my BSOD?
How long should I try to boot with the Verifier enabled ?

 

[Jonathan_King]

Try booting perhaps 6 times with Verifier enabled.

We don't know if the Intervideo driver is causing the problem, but we're trying to eliminate possible causes. My best guess at what program is using that driver is YouCam.

 

[sawwei]

Try booting perhaps 6 times with Verifier enabled.

We don't know if the Intervideo driver is causing the problem, but we're trying to eliminate possible causes. My best guess at what program is using that driver is YouCam.

I have removed the Cyberlink YouCam program and updated my Intel Wifi driver.
I also boot the system with Verifier Enabled.
After two failed attempts to boot, the system managed to do it on the third.
So, what should I do now ?
Should I just Enabled the Verifier or turn it off?

 

[Jonathan_King]

Leave the computer running, with Verifier enabled, and wait for it to crash. When it does, boot back up (you may have to disable driver verifier), and follow the BSOD Posting Instructions again.

 

[sawwei]

Leave the computer running, with Verifier enabled, and wait for it to crash. When it does, boot back up (you may have to disable driver verifier), and follow the BSOD Posting Instructions again.

I'm just wondering how come the Intervideo Driver is still in my system when I ran the Verifier.

 

[CarlTR6]

Leave the computer running, with Verifier enabled, and wait for it to crash. When it does, boot back up (you may have to disable driver verifier), and follow the BSOD Posting Instructions again.

I'm just wondering how come the Intervideo Driver is still in my system when I ran the Verifier.

It is possible that it is another program using that driver. You can navigate to C:\Windows\System32\Drivers using Windows Exploere. Look down the list for that driver. Rename it from .sys to .bak. Reboot. This will break whatever program uses this driver; but the driver will no longer load.

 

[Jonathan_King]

Leave the computer running, with Verifier enabled, and wait for it to crash. When it does, boot back up (you may have to disable driver verifier), and follow the BSOD Posting Instructions again.

I'm just wondering how come the Intervideo Driver is still in my system when I ran the Verifier.

Driver Verifier doesn't disable any drivers when you enable it. It only stresses them for faults.

 

[sawwei]

I let my system run for the night, but I did not have any BSOD.
What should I do now ?

 

[CarlTR6]

Let it run for another day and use your system as you normally would.

 

[Jonathan_King]

Hi Jonathan,

I am just wondering how to delete the Intervideo driver from my system.
When I use my old notebook, I used to have the Intervideo WinDVD program for the DVD playback, but on my new system I did not install any Intervideo program, only the Corel WinDVD.
I am trying to run my system with the Verifier Enabled for another day since I did not get any BSOD last night.
Thank you.

Could be the driver was not removed. Might Any DVD be using it? Try removing that, and then rename C:\Windows\system32\drivers\regi.sys to regi.old.

 

[sawwei]

I did not install AnyDVD in my system.
I am running my system at home now.
What should I do if it did not show any errors until tonight?
Should I keep Enabling the Verifier or should I turn it off?
I am thinking of installing a new memory today, so do I have to Disable the Verifier before the installation?
Well, I gotta say that I'm a bit frustrated of the BSOD that I'm having lately.
For the last twice BSOD that occured, it was when I did not have any activities running on my system except for Bittorent.
This last BSOD even happen only one day after I did a System Recovery
I used to let my Bittorent run on my system every night and I have never experienced any BSOD.
The previous BSODs I had happened when I did various activities, once when I was watching a movie file with WMP, the other one when I was browsing through my files in windows explorer.

 

[Jonathan_King]

Use your computer normally, with Verifier enabled, for about 12 more hours from now. If no BSODs until then, go ahead and disable verifier.

 

[sawwei]

Use your computer normally, with Verifier enabled, for about 12 more hours from now. If no BSODs until then, go ahead and disable verifier.

I have just upgraded my RAM to 8Gb, and did a System Recovery.
After that, I enabled the Verifier, changed the regi.sys to regi.old and restarted my system.
I tried 6 times, but this time I failed to boot into the Windows this time, so I disable the Verifier.
I did enable the Verifier and ran the system for at least 24 hours without any BSOD's
What should I do next ?

 

[Jonathan_King]

I think you may disable driver verifier, and hope the BSODs don't return!

 

[sawwei]

I think you may disable driver verifier, and hope the BSODs don't return!

Ok, I'll report back in a few days.
Thank you Jonathan.

 

[sawwei]

I've been using my system for almost a week without any problems until tonight.
My monitor suddenly shut off, but the system was still on.
I waited a while but nothing happened, so I restarted manually.
The weird thing is that I did not get any BSOD notifications, and this is the first time something like this ever happened to me.
Btw, I have just upgraded my BIOS 2 days ago.