Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD- STOP: 0x0000007E


  • Please log in to reply
5 replies to this topic

#1 trashcan7

trashcan7

  • Members
  • 402 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:16 AM

Posted 30 November 2008 - 06:33 PM

Hi
I have a Dell Inspiron 530S and recently, it has crashed a couple times showing the blue screen of death.

Under Technical Information, it says:


*** STOP: 0x0000007E (0xC0000005, 0x804F04FE, 0xBA4FBA68, 0xBA4FB764)

Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further assistance.


It occurs very randomly, sometimes when I'm looking through a webpage and once when I didn't even touch the computer. I had just turned the computer on, and an hour later, when I turned on the monitor, I saw the BSOD. The computer is relatively new, about a half-year old. I have reformatted it a couple months ago due to a different problem.
Can somebody suggest something? Yes, I did try to search this problem, but what has mostly come up is BSOD's with more information like a file name or a type of error, but mine does not say anything useful besides the above.

BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped, new avatar (a camel) :0)


  • Members
  • 16,690 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:16 AM

Posted 30 November 2008 - 06:50 PM

Follow the steps in this guide to post an analysis of your crash dump file: http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/
- John
**If you need a more detailed explanation, please ask for it. I have the Knack. **

#3 trashcan7

trashcan7
  • Topic Starter

  • Members
  • 402 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:16 AM

Posted 30 November 2008 - 07:45 PM

Thanks for the reply. Here's the result for the most recent minidump file:
________________________________



Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini113008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Nov 30 13:25:58.187 2008 (GMT-8)
System Uptime: 0 days 0:00:35.843
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image cmdguard.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for cmdguard.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdguard.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 804f04fe, ba4fba68, ba4fb764}

Probably caused by : cmdguard.sys ( cmdguard+e11d )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 804f04fe, The address that the exception occurred at
Arg3: ba4fba68, Exception Record Address
Arg4: ba4fb764, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!IoThreadToProcess+8
804f04fe 8b8020020000 mov eax,dword ptr [eax+220h]

EXCEPTION_RECORD: ba4fba68 -- (.exr 0xffffffffba4fba68)
ExceptionAddress: 804f04fe (nt!IoThreadToProcess+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000220
Attempt to read from address 00000220

CONTEXT: ba4fb764 -- (.cxr 0xffffffffba4fb764)
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=ba4fbc14 edi=ba4fbc6c
eip=804f04fe esp=ba4fbb30 ebp=ba4fbb30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!IoThreadToProcess+0x8:
804f04fe 8b8020020000 mov eax,dword ptr [eax+220h] ds:0023:00000220=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000220

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from a82f111d to 804f04fe

STACK_TEXT:
ba4fbb30 a82f111d 00000000 bae797a3 ba4fbc6c nt!IoThreadToProcess+0x8
WARNING: Stack unwind information not available. Following frames may be wrong.
ba4fbb68 a82e35e0 ba4fbc14 ba4fbb9c ba4fbcb8 cmdguard+0xe11d
ba4fbb78 b9d34b27 ba4fbc14 ba4fbb9c 00000000 cmdguard+0x5e0
ba4fbcb8 b9d34c33 8a6058c0 899f30bc ba4fbcd8 fltmgr!DrainCompletionNode+0xfd
ba4fbcf0 b9d3dfef 8a6058c0 8a6058c0 ba4fbd30 fltmgr!FltpDrainActiveCompletions+0xe1
ba4fbd00 b9d43a24 8a6058c0 80535780 89995868 fltmgr!FltpDrainPendingCallbacksForInstance+0xf
ba4fbd30 b9d4b09f 89995868 00000008 8a527920 fltmgr!FltpFreeInstance+0x74
ba4fbd50 b9d3d8f7 8a6058cc 00000008 8a527920 fltmgr!FltpFreeVolume+0x89
ba4fbd68 b9d4164e 89a1e020 00000008 8056485c fltmgr!FltpCleanupDeviceObject+0x61
ba4fbd7c 8053877d 8a527920 00000000 8a86d640 fltmgr!FltpFastIoDetachDeviceWorker+0x14
ba4fbdac 805cff70 8a527920 00000000 00000000 nt!ExpWorkerThread+0xef
ba4fbddc 805460ee 8053868e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
cmdguard+e11d
a82f111d ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: cmdguard+e11d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: cmdguard

IMAGE_NAME: cmdguard.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 491b1a43

STACK_COMMAND: .cxr 0xffffffffba4fb764 ; kb

FAILURE_BUCKET_ID: 0x7E_cmdguard+e11d

BUCKET_ID: 0x7E_cmdguard+e11d

Followup: MachineOwner
---------

#4 usasma

usasma

    Still visually handicapped, new avatar (a camel) :0)


  • Members
  • 16,690 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:16 AM

Posted 30 November 2008 - 09:09 PM

It appears that this was caused by your COMODO Firewall Pro Sandbox Driver

I'd suggest uninstalling it, then installing a freshly downloaded copy of it.
On the off-chance that it's caused by malware, I'd suggest trying one of the free online scans listed here: http://www.bleepingcomputer.com/blogs/usas...?showentry=1252
- John
**If you need a more detailed explanation, please ask for it. I have the Knack. **

#5 peterdiva

peterdiva

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Western Australia
  • Local time:05:16 PM

Posted 01 December 2008 - 01:24 AM

See the following thread for the same crash.

http://www.techspot.com/vb/showthread.php?...ht=cmdguard.sys

#6 trashcan7

trashcan7
  • Topic Starter

  • Members
  • 402 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:16 AM

Posted 01 December 2008 - 07:58 PM

Oh, thanks for the replies!
I uninstalled it and installed an older version of it, as advised in the link to the other forum. Hopefully there will be no more crashes, and hopefully all of the crashes I had were just caused by COMODO Firewall.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users