Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Bsod Help

  • Please log in to reply
1 reply to this topic

#1 zx225


  • Members
  • 1 posts
  • Local time:06:09 PM

Posted 05 September 2008 - 09:27 AM


I have a dump log, but I'm not sure what to look for. Can anyone make anything of this?
This is what shows up in event log:

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e
Error code 1000007e, parameter1 c0000005, parameter2 806e494f, parameter3 bad1bb38, parameter4 bad1b834

I did a dump, but i'm not sure what to look for.

* *
* Bugcheck Analysis *
* *

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 806e494f, bad1bb38, bad1b834}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFsdClose+a4 )

Followup: MachineOwner

1: kd> !analyze -v
* *
* Bugcheck Analysis *
* *

This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
Arg1: c0000005, The exception code that was not handled
Arg2: 806e494f, The address that the exception occurred at
Arg3: bad1bb38, Exception Record Address
Arg4: bad1b834, Context Record Address

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

806e494f f0ff09 lock dec dword ptr [ecx]

EXCEPTION_RECORD: bad1bb38 -- (.exr 0xffffffffbad1bb38)
Cannot read Exception record @ bad1bb38

CONTEXT: bad1b834 -- (.cxr 0xffffffffbad1b834)
Unable to read context, Win32 error 0n30





LAST_CONTROL_TRANSFER: from ba52d398 to 806e494f

bad1bbfc ba52d398 8830d5c8 89ddb450 bad1bcd0 hal!ExAcquireFastMutex+0xf
bad1bc7c 804eeeb1 89d7a020 879a9c50 89ddb968 Ntfs!NtfsFsdClose+0xa4
bad1bc8c ba5f4459 bad1bcb8 804eeeb1 8937bdd0 nt!IopfCallDriver+0x31
bad1bc94 804eeeb1 8937bdd0 879a9c50 879a9de0 sr!SrPassThrough+0x31
bad1bca4 ba609b2f 88663c18 879a9c50 00000000 nt!IopfCallDriver+0x31
bad1bcb8 ba609ffb bad1bcd0 879a9c60 89dda900 fltMgr!FltpPassThrough+0xf9
bad1bce8 804eeeb1 88651c68 879a9c50 879a9c50 fltMgr!FltpDispatch+0xf3
bad1bcf8 805827bc 8830d5b0 00000000 00000000 nt!IopfCallDriver+0x31
bad1bd30 805b9e2d 0030d5c8 00000000 8830d5b0 nt!IopDeleteFile+0x132
bad1bd4c 805257b8 8830d5c8 00000000 806e4aa8 nt!ObpRemoveObjectRoutine+0xdf
bad1bd64 80509a05 80560d80 8839be70 80560d98 nt!ObfDereferenceObject+0x4c
bad1bd8c 8050b229 e90b4c08 00000000 89e36da8 nt!MiSegmentDelete+0x105
bad1bdac 805ce794 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0xab
bad1bddc 805450ce 8050b17e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

ba52d398 8b45dc mov eax,dword ptr [ebp-24h]


SYMBOL_NAME: Ntfs!NtfsFsdClose+a4



IMAGE_NAME: Ntfs.sys


STACK_COMMAND: .cxr 0xffffffffbad1b834 ; kb

FAILURE_BUCKET_ID: 0x7E_Ntfs!NtfsFsdClose+a4

BUCKET_ID: 0x7E_Ntfs!NtfsFsdClose+a4

Followup: MachineOwner

1: kd> !analyze -v

BC AdBot (Login to Remove)


#2 usasma


    Still visually handicapped (avatar is memory developed by my Dad

  • BSOD Kernel Dump Expert
  • 25,091 posts
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:09 PM

Posted 05 September 2008 - 07:18 PM

Well, the error occurred in NTFS.SYS - the driver that runs the file system on the hard drive
Here's a link to a brief description of the error message: http://aumha.org/a/stop.php#0x7e
The first parameter (c0000005) indicates that the error occurred while accessing memory.
Interestingly, there appears to be an interjection of something from System Restore right around the time the error occurred (the sr!... stuff in the Stack Text) - but I'm still learning about this, so I don't know if it's significant or not.

So, those are the clues - now we've gotta work our way through them. I prefer to work from the lowest level to higher levels.
In this case, that'd involve a hard drive diagnostic (usually free from the manufacturer of your hard drive).
I'd also try a memory diagnostic (at least 3 passes) - here's a free one: http://www.memtest86.com/
Then I'd try running CHKDSK /R from the Command Prompt

Then I'd sit back and wait to see if it does it again. If not, then we're happy - if it does, then we'll run some more tests/fixes (Driver Verifier, SFC.EXE /SCANNOW, and maybe even a repair install).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users